flavorpack 2026-01-13
Go version upgrade and CI security maintenance
7 files · 21+ · 34-

Upgrade Go to 1.24.9 for Security Fixes

harden internal
  • Upgraded Go version from 1.21 to 1.24.9 across all CI workflows to address six security vulnerabilities (GO-2025-4014, GO-2025-4011, GO-2025-4009, GO-2025-4007, GO-2025-3956, GO-2025-3750) harden internal
  • Updated go.mod in src/flavor-go/ to require Go 1.24.9 decouple internal
    1 file
    • go.mod
  • Affected workflows: 01-helper-prep.yml, 05-code-quality.yml, 06-security-scan.yml, 07-dependency-audit.yml, 08-license-compliance.yml, compatibility-check.yml harden internal
    6 files
    • 01-helper-prep.yml
    • 05-code-quality.yml
    • 06-security-scan.yml
    • 07-dependency-audit.yml
    • 08-license-compliance.yml
    • compatibility-check.yml

Centralize Go Version via Repository Variable

baseline internal
  • Replaced hardcoded Go version strings with ${{ vars.GO_VERSION }} repository variable across all 6 workflow files baseline internal
    6 files
    • 01-helper-prep.yml
    • 05-code-quality.yml
    • 06-security-scan.yml
    • 07-dependency-audit.yml
    • 08-license-compliance.yml
    • compatibility-check.yml
  • Ensures Go version is defined once and consistent across the entire CI pipeline baseline internal
    6 files
    • 01-helper-prep.yml
    • 05-code-quality.yml
    • 06-security-scan.yml
    • 07-dependency-audit.yml
    • 08-license-compliance.yml
    • compatibility-check.yml

Switch Semgrep to Official GitHub Action

harden internal
6 files changed
  • 01-helper-prep.yml Updated CI workflow
  • 05-code-quality.yml Updated CI workflow
  • 06-security-scan.yml Updated CI workflow
  • 07-dependency-audit.yml Updated CI workflow
  • 08-license-compliance.yml Updated CI workflow
  • compatibility-check.yml Updated CI workflow
  • Replaced pip-installed Semgrep with semgrep/semgrep-action@v1 in 06-security-scan.yml harden internal
    1 file
    • 06-security-scan.yml
  • Semgrep requires a pre-built semgrep-core binary that cannot be built from source via pip baseline internal
    1 file
    • 06-security-scan.yml
  • Removed semgrep and pyt from pip install list baseline internal
    1 file
    • 06-security-scan.yml
  • Split SARIF generation into a separate step using the Semgrep action with generateSarif: true decouple internal
    1 file
    • 06-security-scan.yml

Auto-commit Go Module Update

baseline internal
1 file changed
  • go.mod Updated Go binary
  • Updated src/flavor-go/go.mod Go version directive from 1.24.0 to 1.24.9 baseline internal
    1 file
    • go.mod
← 2026-01-11 flavorpack changelog → 2026-02-26 flavorpack →