Dependency & toolchain bump: close all reachable CVEs#3
Merged
Conversation
govulncheck traced three reachable vulnerabilities in x/net v0.10.0 through the live API serving path (HTTP/2 Rapid Reset GO-2023-2102, CONTINUATION flood GO-2024-2687, GO-2025-3595), and Go 1.22 is past end-of-support. - go.mod: go 1.25.0 with toolchain go1.25.12 pinned (1.25.4 still had 17 reachable stdlib CVEs; the pin clears them all - govulncheck now reports zero reachable vulnerabilities). - gin v1.9.1 -> v1.12.0, x/net v0.10.0 -> v0.57.0, x/crypto -> v0.54.0, protobuf -> v1.36.11, sonic -> v1.15.2, go-sqlite3 -> v1.14.48. No application code changes required; full test suite passes unchanged. - Dockerfile: build stage golang:1.25-bookworm; runtime stage switched from nvidia/cuda:12.4.1-runtime-ubuntu22.04 to debian:bookworm-slim (205MB vs multi-GB). GPU monitoring only shells out to nvidia-smi, which the NVIDIA Container Toolkit injects at run time for any base image; NVIDIA_VISIBLE_DEVICES=all and NVIDIA_DRIVER_CAPABILITIES=utility are now set explicitly in the image, preserving the implicit defaults the CUDA base provided (the Unraid template depends on them). Task: dex z9m8meke - Tier 3: Dependency & toolchain bump Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EQmqj1Hj8DL3GGAcBDNm8v
This was referenced Jul 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Stacked on #2 (which stacks on #1) — merge in order.
toolchain go1.25.12pinned.govulnchecknow reports zero reachable vulnerabilities — closing the three reachablex/netv0.10.0 HTTP/2 CVEs traced through the live API port (Rapid Reset, CONTINUATION flood) plus 17 reachable stdlib CVEs present at 1.25.4.x/netv0.57.0,x/cryptov0.54.0, protobuf, sonic, go-sqlite3). Zero application-code changes needed; the full Tier 1/2 test suite passes unchanged and served as the compatibility net.nvidia/cuda:12.4.1-runtimetodebian:bookworm-slim;nvidia-smiis injected at run time by the NVIDIA Container Toolkit regardless of base image (verified against NVIDIA docs and by the reviewer's live container run).NVIDIA_VISIBLE_DEVICES/NVIDIA_DRIVER_CAPABILITIESare now set explicitly, preserving the implicit CUDA-image defaults the Unraid template relies on.Review & verification
go vet+go test -race -count=1 ./...clean; localdocker buildsucceeded; demo smoke test (status + dashboard 200s, clean SIGINT with single restore line).golang:1.25.12-bookwormexactly (folded into Tier 4).nvidia-smiinjection is verified from docs + container runs here, but the definitive proof is your Unraid host with--runtime=nvidia— check GPU temps appear in the dashboard after upgrading.Task: dex z9m8meke — Tier 3: Dependency & toolchain bump
🤖 Generated with Claude Code