Merge pull request #280 from splitio/SDKS-8515-vulnerabilities

Upgrade Debian to 12.6

CHANGES.txt

@@ -1,3 +1,9 @@
+5.8.1 (Jul 12, 2024)
+- Fixed vulnerabilities:
+   - Updated debian image to 12.6
+   - Updated gin-contrib/cors to 1.6.0 
+   - Updated golang image to 1.22.5
+
 5.8.0 (May 14, 2024)
  - Added support for targeting rules based on semantic versions (https://semver.org/).
  - Added special impression label "targeting rule type unsupported by sdk" when the matcher type is not supported by the SDK, which returns 'control' treatment.
@@ -8,7 +14,7 @@
    - Updated gin/gonic to 1.10
  - Updated go-split-commons to v6
 
-5.7.0 (TBD)
+5.7.0 (Feb 22, 2024)
  - Add support for FIPS-compliant binaries & docker images
 
 5.6.1 (Jan 29, 2024)

docker/Dockerfile.proxy

@@ -1,5 +1,5 @@
 # Build stage
-FROM golang:1.21.10-bookworm AS builder
+FROM golang:1.22.5-bookworm AS builder
 
 ARG EXTRA_BUILD_ARGS
 ARG FIPS_MODE
@@ -17,7 +17,7 @@ RUN bash -c 'if [[ "${FIPS_MODE}" = "enabled" ]]; \
     fi'
 
 # Runner stage
-FROM debian:12.5 AS runner
+FROM debian:12.6 AS runner
 
 RUN apt update -y
 RUN apt install -y bash ca-certificates

docker/Dockerfile.synchronizer

@@ -1,5 +1,5 @@
 # Build stage
-FROM golang:1.21.10-bookworm AS builder
+FROM golang:1.22.5-bookworm AS builder
 
 ARG EXTRA_BUILD_ARGS
 ARG FIPS_MODE
@@ -17,7 +17,7 @@ RUN bash -c 'if [[ "${FIPS_MODE}" = "enabled" ]]; \
     fi'
 
 # Runner stage
-FROM debian:12.5 AS runner
+FROM debian:12.6 AS runner
 
 RUN apt update -y
 RUN apt install -y bash ca-certificates

go.mod

@@ -1,9 +1,9 @@
 module github.com/splitio/split-synchronizer/v5
 
-go 1.21
+go 1.22
 
 require (
-	github.com/gin-contrib/cors v1.4.0
+	github.com/gin-contrib/cors v1.6.0
 	github.com/gin-contrib/gzip v0.0.6
 	github.com/gin-gonic/gin v1.10.0
 	github.com/google/uuid v1.3.0

go.sum

@@ -24,8 +24,8 @@ github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/r
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
 github.com/gabriel-vasile/mimetype v1.4.3 h1:in2uUcidCuFcDKtdcBxlR0rJ1+fsokWf+uqxgUFjbI0=
 github.com/gabriel-vasile/mimetype v1.4.3/go.mod h1:d8uq/6HKRL6CGdk+aubisF/M5GcPfT7nKyLpA0lbSSk=
-github.com/gin-contrib/cors v1.4.0 h1:oJ6gwtUl3lqV0WEIwM/LxPF1QZ5qe2lGWdY2+bz7y0g=
-github.com/gin-contrib/cors v1.4.0/go.mod h1:bs9pNM0x/UsmHPBWT2xZz9ROh8xYjYkiURUfmBoMlcs=
+github.com/gin-contrib/cors v1.6.0 h1:0Z7D/bVhE6ja07lI8CTjTonp6SB07o8bNuFyRbsBUQg=
+github.com/gin-contrib/cors v1.6.0/go.mod h1:cI+h6iOAyxKRtUtC6iF/Si1KSFvGm/gK+kshxlCi8ro=
 github.com/gin-contrib/gzip v0.0.6 h1:NjcunTcGAj5CO1gn4N8jHOSIeRFHIbn51z6K+xaN4d4=
 github.com/gin-contrib/gzip v0.0.6/go.mod h1:QOJlmV2xmayAjkNS2Y8NQsMneuRShOU/kjovCXNuzzk=
 github.com/gin-contrib/sse v0.1.0 h1:Y/yl/+YNO8GZSjAhjMsSuLt29uWRFHdHYUb5lYOV9qE=

splitio/version.go

@@ -2,4 +2,4 @@
 package splitio
 
 // Version is the version of this Agent
-const Version = "5.8.0"
+const Version = "5.8.1"

windows/Makefile

@@ -7,7 +7,7 @@ BUILD_FOLDER := $(CURRENT_PATH)/build
 
 
 GO := $(BIN_FOLDER)/go
-ASSET ?= go1.21.linux-amd64.tar.gz 
+ASSET ?= go1.22.linux-amd64.tar.gz 
 SOURCES := $(shell find $(PARENT_PATH) -path $(dirname $(pwd))/windows -prune -o -name "*.go" -print) \
 		   $(PARENT_PATH)/go.mod \
 		   $(PARENT_PATH)/go.sum