Conversation
Address End-of-Life (EoL) components and security vulnerabilities identified in CI-21697 for plugins/buildx Docker images. ## Go Version Upgrade - Upgrade Go from 1.23.0 to 1.25.0 (go1.23.x EOL: 2025-08-12) - Upgrade toolchain from go1.24.2 to go1.25.8 (go1.24.x EOL: 2026-02-11) ## Docker Base Image Upgrade - Upgrade docker:28.1.1-dind to docker:29.3.1-dind - Resolves EoL zfs 2.2.7-r0 (EOL: 2025-12-18) - Resolves approaching EoL openssl 3.3.3-r0 (EOL: 2026-04-09) - Resolves containerd/v2 security advisories (GHSA-cxfp-7pvr-95ff, GHSA-m6hq-p25p-ffr2, GHSA-pwhc-rpq9-4c8w) - Resolves containernetworking/plugins advisories (GHSA-jv3w-x3r3-g6rm) ## Buildx Plugin Upgrade - Upgrade buildx from v0.23.0 to v0.32.1 ## Go Dependencies Updated - github.com/aws/aws-sdk-go: v1.26.7 -> v1.55.8 - github.com/coreos/go-semver: v0.3.0 -> v0.3.1 - github.com/cpuguy83/go-md2man/v2: v2.0.2 -> v2.0.7 - github.com/inhies/go-bytesize: updated to latest - github.com/jmespath/go-jmespath: v0.0.0 -> v0.4.0 - github.com/joho/godotenv: v1.3.0 -> v1.5.1 - github.com/sirupsen/logrus: v1.9.0 -> v1.9.4 - github.com/stretchr/testify: v1.7.0 -> v1.10.0 - github.com/urfave/cli: v1.22.2 -> v1.22.17 - golang.org/x/sys: v0.30.0 -> v0.42.0 - gopkg.in/yaml.v2: v2.2.8 -> v2.4.0 - gopkg.in/yaml.v3: updated to v3.0.1 Fixes: CI-21697
abhay084
changed the title
There was a problem hiding this comment.
Pull request overview
Updates the drone-buildx plugin’s build environment to address EoL components and security advisories by upgrading the Go toolchain, Docker-in-Docker base images, Buildx, and several Go dependencies.
Changes:
- Bump Go language/toolchain versions and refresh Go module dependencies (
go.mod,go.sum). - Upgrade Docker-in-Docker base images used for plugin images to
docker:29.3.1-dind. - Upgrade embedded Buildx binary download to
v0.32.1for both amd64 and arm64 images.
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| go.mod | Updates Go version/toolchain and bumps direct + indirect module dependencies. |
| go.sum | Updates dependency checksums to match the upgraded module graph. |
| docker/docker/Dockerfile.linux.amd64 | Updates dind base image and Buildx download URL for amd64. |
| docker/docker/Dockerfile.linux.arm64 | Updates dind base image and Buildx download URL for arm64. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+26
to
+28
| go 1.25.0 | ||
|
|
||
| toolchain go1.24.2 | ||
| toolchain go1.25.8 |
There was a problem hiding this comment.
CI configs in this repo still pin golang:1.23 / golang:1.23.0 (see .drone.yml and .harness/harness.yaml). With go 1.25.0 + toolchain go1.25.8, those jobs will either fail if toolchain downloads are disallowed, or incur an implicit toolchain download. Consider updating the CI images to Go 1.25.x (or explicitly configuring GOTOOLCHAIN behavior) to keep builds deterministic and avoid CI breakages/timeouts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Address End-of-Life (EoL) components and security vulnerabilities identified in CI-21697 for plugins/buildx Docker images.
Go Version Upgrade
Docker Base Image Upgrade
Buildx Plugin Upgrade
Go Dependencies Updated
Fixes: CI-21697