diff --git a/.changelog/23172.txt b/.changelog/23172.txt new file mode 100644 index 000000000..e2864673d --- /dev/null +++ b/.changelog/23172.txt @@ -0,0 +1,3 @@ +```release-note:security +build: Updated Go to 1.22.4 to address Go stdlib vulnerabilities CVE-2024-24789 and CVE-2024-24790 +``` diff --git a/.go-version b/.go-version index 6245beecd..2a0ba77cc 100644 --- a/.go-version +++ b/.go-version @@ -1 +1 @@ -1.22.1 +1.22.4 diff --git a/contributing/README.md b/contributing/README.md index 4235abd15..47d23928f 100644 --- a/contributing/README.md +++ b/contributing/README.md @@ -30,7 +30,7 @@ A development environment is supplied via Vagrant to make getting started easier Developing without Vagrant --- -1. Install [Go 1.22.1+](https://golang.org/) *(Note: `gcc-go` is not supported)* +1. Install [Go 1.22.4+](https://golang.org/) *(Note: `gcc-go` is not supported)* 1. Clone this repo ```sh $ git clone https://github.com/hashicorp/nomad.git diff --git a/go.mod b/go.mod index aff124392..7f40dc3d9 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/hashicorp/nomad -go 1.21 +go 1.22 // Pinned dependencies are noted in github.com/hashicorp/nomad/issues/11826. replace ( diff --git a/scripts/linux-priv-go.sh b/scripts/linux-priv-go.sh index e7ab52594..fa627ccfc 100755 --- a/scripts/linux-priv-go.sh +++ b/scripts/linux-priv-go.sh @@ -21,7 +21,7 @@ case $(arch) in esac function install_go() { - local go_version="1.22.1" + local go_version="1.22.4" local download="https://storage.googleapis.com/golang/go${go_version}.linux-${ARCH}.tar.gz" if go version 2>&1 | grep -q "${go_version}"; then diff --git a/scripts/release/mac-remote-build b/scripts/release/mac-remote-build index 8ac321ee5..01251a809 100755 --- a/scripts/release/mac-remote-build +++ b/scripts/release/mac-remote-build @@ -56,7 +56,7 @@ REPO_PATH="${TMP_WORKSPACE}/gopath/src/github.com/hashicorp/nomad" mkdir -p "${TMP_WORKSPACE}/tmp" install_go() { - local go_version="1.22.1" + local go_version="1.22.4" local download= download="https://storage.googleapis.com/golang/go${go_version}.darwin-amd64.tar.gz"