Skip to content

Upgrade Terratag Go version to 1.24.9 and bump dependencies#227

Merged
chpl merged 3 commits intomasterfrom
eng-772-upgrade-terratag-cause-it-has-vulnerabilities
Nov 30, 2025
Merged

Upgrade Terratag Go version to 1.24.9 and bump dependencies#227
chpl merged 3 commits intomasterfrom
eng-772-upgrade-terratag-cause-it-has-vulnerabilities

Conversation

@liranfarage89
Copy link
Copy Markdown
Contributor

@liranfarage89 liranfarage89 commented Nov 30, 2025

ENG-772: Upgrade Terratag Go and dependencies to address vulnerabilities

Summary

  • Updated Terratag’s Go target version from 1.24.4 to 1.24.9 to align with patched Go stdlib ranges referenced in the JFrog report.
  • Bumped Go module dependencies to the latest versions within their existing major versions (including viper, go-cty, hcl/v2, testify, gomega, and various golang.org/x/* modules).
  • When Terratag is built with Go 1.24.9+ (or 1.25.3+), the github.com/golang/go CVEs reported under /opt/terratag should be addressed. Other CVEs in the report are for base image components (pip, curl, gnupg, busybox, jq, etc.) and will be handled in the hub/base image.

Commands run to implement this PR

# (Manual edit) Update Go version in go.mod
 go 1.24.4 -> go 1.24.9

# Bump direct deps within same major and update transitive deps
go get \
  github.com/bmatcuk/doublestar@v1 \
  github.com/hashicorp/go-hclog@v1 \
  github.com/hashicorp/hcl/v2@v2 \
  github.com/hashicorp/logutils@v1 \
  github.com/onsi/gomega@v1 \
  github.com/otiai10/copy@v1 \
  github.com/spf13/viper@v1 \
  github.com/stretchr/testify@v1 \
  github.com/thoas/go-funk@v0 \
  github.com/zclconf/go-cty@v1 \
  go.uber.org/multierr@v1

# Upgrade all deps within their current major and tidy
go get -u ./...
go mod tidy
```bash

@liranfarage89 liranfarage89 changed the title ENG-772: Upgrade Terratag Go version to 1.24.9 ENG-772: Upgrade Terratag Go version to 1.24.9 and bump dependencies Nov 30, 2025
@liranfarage89 liranfarage89 requested a review from a team November 30, 2025 15:08
@liranfarage89 liranfarage89 self-assigned this Nov 30, 2025
@chpl chpl merged commit e3299ae into master Nov 30, 2025
8 checks passed
@chpl chpl deleted the eng-772-upgrade-terratag-cause-it-has-vulnerabilities branch November 30, 2025 15:16
@yaronya yaronya changed the title ENG-772: Upgrade Terratag Go version to 1.24.9 and bump dependencies Upgrade Terratag Go version to 1.24.9 and bump dependencies Nov 30, 2025
@liranfarage89 liranfarage89 restored the eng-772-upgrade-terratag-cause-it-has-vulnerabilities branch November 30, 2025 15:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants