From 65eed1ba331834fff4945183cb89d7c6915424c7 Mon Sep 17 00:00:00 2001 From: Nadia Mayor Date: Tue, 31 Mar 2026 12:16:05 -0500 Subject: [PATCH 01/10] Updated to fix some vulnerabilities --- docker/Dockerfile.proxy | 3 ++- docker/Dockerfile.synchronizer | 3 ++- go.mod | 4 ++-- go.sum | 2 ++ 4 files changed, 8 insertions(+), 4 deletions(-) diff --git a/docker/Dockerfile.proxy b/docker/Dockerfile.proxy index d886f368..9d0bcd62 100644 --- a/docker/Dockerfile.proxy +++ b/docker/Dockerfile.proxy @@ -1,5 +1,5 @@ # Build stage -FROM golang:1.24.13-bookworm AS builder +FROM golang:1.25.8-bookworm AS builder ARG EXTRA_BUILD_ARGS ARG FIPS_MODE @@ -20,6 +20,7 @@ RUN bash -c 'if [[ "${FIPS_MODE}" = "enabled" ]]; \ FROM debian:13.3 AS runner RUN apt update -y +RUN apt upgrade -y RUN apt install -y bash ca-certificates RUN groupadd -g 1000 split-proxy RUN useradd -r -u 1000 -g split-proxy -s /usr/sbin/nologin split-proxy diff --git a/docker/Dockerfile.synchronizer b/docker/Dockerfile.synchronizer index 3e5879a3..dc2cfc5a 100644 --- a/docker/Dockerfile.synchronizer +++ b/docker/Dockerfile.synchronizer @@ -1,5 +1,5 @@ # Build stage -FROM golang:1.24.13-bookworm AS builder +FROM golang:1.25.8-bookworm AS builder ARG EXTRA_BUILD_ARGS ARG FIPS_MODE @@ -21,6 +21,7 @@ RUN bash -c 'if [[ "${FIPS_MODE}" = "enabled" ]]; \ FROM debian:13.3 AS runner RUN apt update -y +RUN apt upgrade -y RUN apt install -y bash ca-certificates RUN groupadd -g 1000 split-synchronizer RUN useradd -r -u 1000 -g split-synchronizer -s /usr/sbin/nologin split-synchronizer diff --git a/go.mod b/go.mod index 9f428238..03c050ea 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/splitio/split-synchronizer/v5 -go 1.24.13 +go 1.25.0 require ( github.com/gin-contrib/cors v1.6.0 @@ -46,7 +46,7 @@ require ( github.com/ugorji/go/codec v1.3.0 // indirect golang.org/x/arch v0.24.0 // indirect golang.org/x/crypto v0.48.0 // indirect - golang.org/x/net v0.50.0 // indirect + golang.org/x/net v0.51.0 // indirect golang.org/x/sync v0.19.0 // indirect golang.org/x/sys v0.41.0 // indirect golang.org/x/text v0.34.0 // indirect diff --git a/go.sum b/go.sum index aec7dddf..59570840 100644 --- a/go.sum +++ b/go.sum @@ -105,6 +105,8 @@ golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo= golang.org/x/net v0.50.0 h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60= golang.org/x/net v0.50.0/go.mod h1:UgoSli3F/pBgdJBHCTc+tp3gmrU4XswgGRgtnwWTfyM= +golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo= +golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y= golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4= golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= golang.org/x/sys v0.0.0-20200923182605-d9f96fdee20d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= From e38d12def37ab8c41f6dcee68574196a4997efc8 Mon Sep 17 00:00:00 2001 From: Nadia Mayor Date: Tue, 31 Mar 2026 13:57:00 -0500 Subject: [PATCH 02/10] Updated go version --- docker/Dockerfile.proxy | 2 +- docker/Dockerfile.synchronizer | 2 +- go.mod | 2 +- go.sum | 2 -- 4 files changed, 3 insertions(+), 5 deletions(-) diff --git a/docker/Dockerfile.proxy b/docker/Dockerfile.proxy index 9d0bcd62..2426a1da 100644 --- a/docker/Dockerfile.proxy +++ b/docker/Dockerfile.proxy @@ -1,5 +1,5 @@ # Build stage -FROM golang:1.25.8-bookworm AS builder +FROM golang:1.26.1-bookworm AS builder ARG EXTRA_BUILD_ARGS ARG FIPS_MODE diff --git a/docker/Dockerfile.synchronizer b/docker/Dockerfile.synchronizer index dc2cfc5a..4a0dbfbf 100644 --- a/docker/Dockerfile.synchronizer +++ b/docker/Dockerfile.synchronizer @@ -1,5 +1,5 @@ # Build stage -FROM golang:1.25.8-bookworm AS builder +FROM golang:1.26.1-bookworm AS builder ARG EXTRA_BUILD_ARGS ARG FIPS_MODE diff --git a/go.mod b/go.mod index 03c050ea..1bed79e3 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/splitio/split-synchronizer/v5 -go 1.25.0 +go 1.26.1 require ( github.com/gin-contrib/cors v1.6.0 diff --git a/go.sum b/go.sum index 59570840..09a28810 100644 --- a/go.sum +++ b/go.sum @@ -103,8 +103,6 @@ golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts= golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos= golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM8rJBtfilJ2qTU199MI= golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo= -golang.org/x/net v0.50.0 h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60= -golang.org/x/net v0.50.0/go.mod h1:UgoSli3F/pBgdJBHCTc+tp3gmrU4XswgGRgtnwWTfyM= golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo= golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y= golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4= From b23c4c7a6efe7e27ca0cbfbcf30ccaca3ea7cbd1 Mon Sep 17 00:00:00 2001 From: Nadia Mayor Date: Tue, 31 Mar 2026 14:01:46 -0500 Subject: [PATCH 03/10] Updated version --- splitio/version.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/splitio/version.go b/splitio/version.go index 9f2447df..87109695 100644 --- a/splitio/version.go +++ b/splitio/version.go @@ -2,4 +2,4 @@ package splitio // Version is the version of this Agent -const Version = "5.12.1" +const Version = "5.12.2-rc" From 3b14ddb3b0e5b5cf1ede2d8834132f9d8141dad0 Mon Sep 17 00:00:00 2001 From: Nadia Mayor Date: Tue, 31 Mar 2026 14:32:18 -0500 Subject: [PATCH 04/10] Updated make file --- Makefile | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index d2c2dcdf..c1df70cd 100644 --- a/Makefile +++ b/Makefile @@ -238,8 +238,10 @@ $(addprefix $(BUILD_FIPS)/,$(windows_execs)): $(BUILD_FIPS)/split_%: $(sources) cp $(BUILD_FIPS_WIN_TMP)/$(shell basename $@) $(BUILD_FIPS) else $(addprefix $(BUILD_FIPS)/,$(windows_execs)): $(BUILD_FIPS)/split_%: $(sources) go.sum - mkdir -p $(BUILD_FIPS) # we're on linux, we can build natively - $(MAKE) -f Makefile -C ./windows setup_ms_go binaries + mkdir -p $(BUILD_FIPS) + GOOS=windows GOARCH=$(ARCH) GOEXPERIMENT=boringcrypto CGO_ENABLED=0 $(GO) build $(ENFORCE_FIPS) \ + -o $(BUILD_FIPS_WIN_TMP)/$(shell basename $@) \ + cmd/$(call cmdfolder_from_bin,$@)/main.go cp $(BUILD_FIPS_WIN_TMP)/$(shell basename $@) $(BUILD_FIPS) endif # @} From a1cd4940f654ccf9bb3fcbc96593276976db8d52 Mon Sep 17 00:00:00 2001 From: Nadia Mayor Date: Tue, 31 Mar 2026 14:53:08 -0500 Subject: [PATCH 05/10] Updated make file --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index c1df70cd..60a81fff 100644 --- a/Makefile +++ b/Makefile @@ -74,7 +74,7 @@ test: $(sources) go.sum ### Run unit tests and generate coverage output test_coverage: $(sources) go.sum - $(GO) test -v -cover -coverprofile=coverage.out $(ARGS) ./... + GOTOOLCHAIN=auto $(GO) test -v -cover -coverprofile=coverage.out $(ARGS) ./... ## display unit test coverage derived from last test run (use `make test display-coverage` for up-to-date results) display-coverage: coverage.out From 670d55f08ffa4864f281e7e153feae596ac2c04e Mon Sep 17 00:00:00 2001 From: Nadia Mayor Date: Tue, 31 Mar 2026 14:58:08 -0500 Subject: [PATCH 06/10] Updated --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 60a81fff..c1df70cd 100644 --- a/Makefile +++ b/Makefile @@ -74,7 +74,7 @@ test: $(sources) go.sum ### Run unit tests and generate coverage output test_coverage: $(sources) go.sum - GOTOOLCHAIN=auto $(GO) test -v -cover -coverprofile=coverage.out $(ARGS) ./... + $(GO) test -v -cover -coverprofile=coverage.out $(ARGS) ./... ## display unit test coverage derived from last test run (use `make test display-coverage` for up-to-date results) display-coverage: coverage.out From 3e722d0555e9427e39a42ca3a375814f1938d2e5 Mon Sep 17 00:00:00 2001 From: Nadia Mayor Date: Tue, 31 Mar 2026 15:23:19 -0500 Subject: [PATCH 07/10] Updated go version --- .github/workflows/s3.yml | 2 +- .github/workflows/test.yml | 2 +- Makefile | 6 ++---- 3 files changed, 4 insertions(+), 6 deletions(-) diff --git a/.github/workflows/s3.yml b/.github/workflows/s3.yml index 1856b925..0d14b51f 100644 --- a/.github/workflows/s3.yml +++ b/.github/workflows/s3.yml @@ -25,7 +25,7 @@ jobs: - name: Setup Go uses: actions/setup-go@v5 with: - go-version: '1.24.6' + go-version: '1.26.1' - name: Create build folder run: mkdir -p build diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index e170c88b..21f1b4ae 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -29,7 +29,7 @@ jobs: - name: Setup Go uses: actions/setup-go@v5 with: - go-version: '1.24.6' + go-version: '1.26.1' - name: Get version run: echo "VERSION=$(awk '/^const Version/{gsub(/"/, "", $4); print $4}' splitio/version.go)" >> $GITHUB_ENV diff --git a/Makefile b/Makefile index c1df70cd..d2c2dcdf 100644 --- a/Makefile +++ b/Makefile @@ -238,10 +238,8 @@ $(addprefix $(BUILD_FIPS)/,$(windows_execs)): $(BUILD_FIPS)/split_%: $(sources) cp $(BUILD_FIPS_WIN_TMP)/$(shell basename $@) $(BUILD_FIPS) else $(addprefix $(BUILD_FIPS)/,$(windows_execs)): $(BUILD_FIPS)/split_%: $(sources) go.sum - mkdir -p $(BUILD_FIPS) - GOOS=windows GOARCH=$(ARCH) GOEXPERIMENT=boringcrypto CGO_ENABLED=0 $(GO) build $(ENFORCE_FIPS) \ - -o $(BUILD_FIPS_WIN_TMP)/$(shell basename $@) \ - cmd/$(call cmdfolder_from_bin,$@)/main.go + mkdir -p $(BUILD_FIPS) # we're on linux, we can build natively + $(MAKE) -f Makefile -C ./windows setup_ms_go binaries cp $(BUILD_FIPS_WIN_TMP)/$(shell basename $@) $(BUILD_FIPS) endif # @} From ae718f08b1c79a2599a569e03c53a30df2640657 Mon Sep 17 00:00:00 2001 From: Nadia Mayor Date: Tue, 31 Mar 2026 15:26:32 -0500 Subject: [PATCH 08/10] Updated make file --- windows/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/Makefile b/windows/Makefile index 06ba6f38..0747aa2e 100644 --- a/windows/Makefile +++ b/windows/Makefile @@ -7,7 +7,7 @@ BUILD_FOLDER := $(CURRENT_PATH)/build GO := $(BIN_FOLDER)/go -ASSET ?= go1.24.linux-amd64.tar.gz +ASSET ?= go1.26.linux-amd64.tar.gz SOURCES := $(shell find $(PARENT_PATH) -path $(dirname $(pwd))/windows -prune -o -name "*.go" -print) \ $(PARENT_PATH)/go.mod \ $(PARENT_PATH)/go.sum From 4e8592e64db08b6cb3cd52eb0e5d121fe316c675 Mon Sep 17 00:00:00 2001 From: Nadia Mayor Date: Wed, 1 Apr 2026 14:11:58 -0500 Subject: [PATCH 09/10] Updated go mod --- go.mod | 12 ++++++------ go.sum | 22 ++++++++++++---------- splitio/version.go | 2 +- 3 files changed, 19 insertions(+), 17 deletions(-) diff --git a/go.mod b/go.mod index 1bed79e3..c0d537e9 100644 --- a/go.mod +++ b/go.mod @@ -44,12 +44,12 @@ require ( github.com/stretchr/objx v0.5.2 // indirect github.com/twitchyliquid64/golang-asm v0.15.1 // indirect github.com/ugorji/go/codec v1.3.0 // indirect - golang.org/x/arch v0.24.0 // indirect - golang.org/x/crypto v0.48.0 // indirect - golang.org/x/net v0.51.0 // indirect - golang.org/x/sync v0.19.0 // indirect - golang.org/x/sys v0.41.0 // indirect - golang.org/x/text v0.34.0 // indirect + golang.org/x/arch v0.25.0 // indirect + golang.org/x/crypto v0.49.0 // indirect + golang.org/x/net v0.52.0 // indirect + golang.org/x/sync v0.20.0 // indirect + golang.org/x/sys v0.42.0 // indirect + golang.org/x/text v0.35.0 // indirect google.golang.org/protobuf v1.36.8 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect ) diff --git a/go.sum b/go.sum index 09a28810..8bef6719 100644 --- a/go.sum +++ b/go.sum @@ -97,22 +97,24 @@ github.com/ugorji/go/codec v1.3.0 h1:Qd2W2sQawAfG8XSvzwhBeoGq71zXOC/Q1E9y/wUcsUA github.com/ugorji/go/codec v1.3.0/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4= go.etcd.io/bbolt v1.3.6 h1:/ecaJf0sk1l4l6V4awd65v2C3ILy7MSj+s/x1ADCIMU= go.etcd.io/bbolt v1.3.6/go.mod h1:qXsaaIqmgQH0T+OPdb99Bf+PKfBBQVAdyD6TY9G8XM4= -golang.org/x/arch v0.24.0 h1:qlJ3M9upxvFfwRM51tTg3Yl+8CP9vCC1E7vlFpgv99Y= -golang.org/x/arch v0.24.0/go.mod h1:dNHoOeKiyja7GTvF9NJS1l3Z2yntpQNzgrjh1cU103A= -golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts= -golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos= +golang.org/x/arch v0.25.0 h1:qnk6Ksugpi5Bz32947rkUgDt9/s5qvqDPl/gBKdMJLE= +golang.org/x/arch v0.25.0/go.mod h1:0X+GdSIP+kL5wPmpK7sdkEVTt2XoYP0cSjQSbZBwOi8= +golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4= +golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA= golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM8rJBtfilJ2qTU199MI= golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo= golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo= golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y= -golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4= -golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= +golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0= +golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw= +golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4= +golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.0.0-20200923182605-d9f96fdee20d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k= -golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= -golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk= -golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA= +golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo= +golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8= +golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA= google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc= google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= diff --git a/splitio/version.go b/splitio/version.go index 87109695..d1533d4c 100644 --- a/splitio/version.go +++ b/splitio/version.go @@ -2,4 +2,4 @@ package splitio // Version is the version of this Agent -const Version = "5.12.2-rc" +const Version = "5.12.2-rc1" From 737e918e93eb18641fecdec845555eae43bd8a31 Mon Sep 17 00:00:00 2001 From: Nadia Mayor Date: Wed, 1 Apr 2026 15:08:11 -0500 Subject: [PATCH 10/10] Updated vesrion and changelogs --- CHANGES.txt | 9 +++++++++ splitio/version.go | 2 +- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/CHANGES.txt b/CHANGES.txt index 52e1f269..59ce3287 100644 --- a/CHANGES.txt +++ b/CHANGES.txt @@ -1,3 +1,12 @@ +5.12.2 (Apr 1, 2026) +- Updated golang image to 1.26.1 +- Updated golang.org/x/arch to v0.25.0 +- Updated golang.org/x/crypto to v0.49.0 +- Updated golang.org/x/net to 0.52.0 +- Updated golang.org/x/sync to 0.20.0 +- Updated golang.org/x/sys to 0.42.0 +- Updated golang.org/x/text to 0.35.0 + 5.12.1 (Feb 19, 2026) - Updated docker images and dependencies for vulnerability fixes. diff --git a/splitio/version.go b/splitio/version.go index d1533d4c..65621a53 100644 --- a/splitio/version.go +++ b/splitio/version.go @@ -2,4 +2,4 @@ package splitio // Version is the version of this Agent -const Version = "5.12.2-rc1" +const Version = "5.12.2"