Updating gosu in order to patch critical vulns in Go 1.18.2

[aaronmaxlevy]

Gosu version 1.17 uses Go version 1.18.2 which has some critical severity vulnerabilities in it (e.g. CVE-2025-22871). This will significantly reduce the vulnerability count in the official Redis Docker images for 6.x and 7.x .

[jit-ci]

Hi, I’m Jit, a friendly security platform designed to help developers build secure applications from day zero with an MVS (Minimal viable security) mindset.

In case there are security findings, they will be communicated to you as a comment inside the PR.

Hope you’ll enjoy using Jit.

Questions? Comments? Want to learn more? Get in touch with us.

[Copilot]

Pull Request Overview

This PR upgrades gosu from version 1.17 to 1.19 to address critical Go vulnerabilities (e.g., CVE-2025-22871) present in Go 1.18.2 which was used in gosu 1.17. This security update reduces the vulnerability count in official Redis Docker images for versions 6.x and 7.x.

• Updated gosu version from 1.17 to 1.19 across all Redis versions
• Updated download URLs for all supported architectures to reference the new gosu 1.19 release
• Updated SHA256 checksums for all architecture-specific binaries

Reviewed Changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
versions.json	Updated gosu version and SHA256 hashes for all Redis versions (6.2, 7.0, 7.2, 7.4, 7.4-rc) and all architectures
7.4/debian/Dockerfile	Updated GOSU_VERSION environment variable and architecture-specific URLs/hashes
7.4/alpine/Dockerfile	Updated GOSU_VERSION environment variable and architecture-specific URLs/hashes
7.4-rc/debian/Dockerfile	Updated GOSU_VERSION environment variable and architecture-specific URLs/hashes
7.4-rc/alpine/Dockerfile	Updated GOSU_VERSION environment variable and architecture-specific URLs/hashes
7.2/debian/Dockerfile	Updated GOSU_VERSION environment variable and architecture-specific URLs/hashes
7.2/alpine/Dockerfile	Updated GOSU_VERSION environment variable and architecture-specific URLs/hashes
7.0/debian/Dockerfile	Updated GOSU_VERSION environment variable and architecture-specific URLs/hashes
7.0/alpine/Dockerfile	Updated GOSU_VERSION environment variable and architecture-specific URLs/hashes
6.2/debian/Dockerfile	Updated GOSU_VERSION environment variable and architecture-specific URLs/hashes
6.2/alpine/Dockerfile	Updated GOSU_VERSION environment variable and architecture-specific URLs/hashes

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[kalinstaykov]

Gosu is being upgraded as part of our release automation so we cannot accept this change at this stage.

If you think there are active releases that have the vulnerability let me know and I'll have a look at them.

[aaronmaxlevy]

@kalinstaykov All of the latest Redis 6.x and 7.x images have this vulnerability since they are still using an old version of Gosu.

[tianon]

CVE-2025-22871 is an HTTP vulnerability - gosu is definitely not vulnerable to it.

[aaronmaxlevy]

@tianon @kalinstaykov I don't dispute that, however the reality is that the presence of a vulnerable binary in a container image such as this creates a lot of noise for security teams — and dev teams as well that inevitably have to justify why the detection of CVE-2025-22871 in the official Redis container images is effectively a "false positive".

Both myself and I'm sure countless other individuals are having to spend time marking detections as false positives — why not just upgrade gosu to avoid that headache?

[kalinstaykov]

@tianon @kalinstaykov I don't dispute that, however the reality is that the presence of a vulnerable binary in a container image such as this creates a lot of noise for security teams — and dev teams as well that inevitably have to justify why the detection of CVE-2025-22871 in the official Redis container images is effectively a "false positive".

Both myself and I'm sure countless other individuals are having to spend time marking detections as false positives — why not just upgrade gosu to avoid that headache?

We don't use gosu in any of the 8.x. We will remove it from 7.x release in the next version.

[Peter-Sh]

@aaronmaxlevy gosu is replaced by setpriv in 6.2.22, 7.2.14 and 7.4.9