Skip to content

Conversation

@macabu
Copy link
Contributor

@macabu macabu commented Oct 14, 2025

From the Go team:

This release addresses breakage caused by a security patch included in Go 1.25.2
and 1.24.8, which enforced overly restrictive validation on the parsing of X.509
certificates. We've removed those restrictions while maintaining the security
fix that the initial release addressed.

@github-actions
Copy link
Contributor

😢 zizmor failed with exit code 14.

Expand for full output
error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> ./.github/workflows/storybook-a11y.yml:42:7
   |
 2 | / on:
 3 | |   pull_request:
 4 | |   push:
 5 | |     branches:
 6 | |       - main
 7 | |       - release-*.*.*
   | |_____________________- generally used when publishing artifacts generated at runtime
...
42 |       - uses: actions/setup-node@v4
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
   |
   = note: audit confidence → Low

303 findings (76 ignored, 226 suppressed): 0 informational, 0 low, 0 medium, 1 high

@macabu macabu marked this pull request as ready for review October 14, 2025 10:17
@macabu macabu requested review from a team, fcjack, matryer and svennergr as code owners October 14, 2025 10:17
@macabu macabu requested review from andresmgot, charandas, radiohead, toddtreece and xnyo and removed request for a team October 14, 2025 10:17
@macabu macabu requested review from CollinFingar, IevaVasiljeva, Sergej-Vlasov, forsethc, joshhunt, juanicabanas, oscarkilhed and samsch and removed request for a team October 14, 2025 10:17
@macabu macabu enabled auto-merge (squash) October 14, 2025 10:21
@macabu macabu merged commit e6db6c9 into release-12.2.1 Oct 14, 2025
155 of 158 checks passed
@macabu macabu deleted the go-update-1.25.3-release-12.2.1 branch October 14, 2025 10:23
@grafana-delivery-bot
Copy link
Contributor

🚀 Your submission is now being built and packaged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants