Update to go1.22.3 due to CVE

[MisterMX]

What happened?

go1.22.3 fixes two critical security issues regarding the DNS resolution and code compilation on Darwin. See golang/go#67119 and golang/go#66754.

CVE: GHSA-5fq7-4mxc-535h

Google Group Announcement: https://groups.google.com/g/golang-announce/c/wkkO4P9stm0

How can we reproduce it?

n.a.

What environment did it happen in?

All Crossplane versions running go < 1.21.10 and go < 1.22.3.

[negz]

I don't think there's much to do here.

#5684 already bumped this in master.

https://github.com/crossplane/crossplane/blob/release-1.14/go.mod#L3 - Appears unaffected.
https://github.com/crossplane/crossplane/blob/release-1.15/go.mod#L5 - Appears unaffected.

We'll need to make sure 1.16 gets released (crossplane/release#9) with a patched version of Go. I expect Renovate will bump the release-1.16 branch.

[jbw976]

Trying to make sure this gets taken care of before v1.16 goes out today.

@phisco I haven't seen a PR for this go1.22.3 update from Renovate on the release-1.16 branch and that branch isn't even listed in the dependency dashboard. Is that because release-1.16 isn't listed in the baseBranches in https://github.com/crossplane/crossplane/blob/master/.github/renovate.json5#L15?

If that's the case, we should probably update the release steps to add the release branch to baseBranches right after creating it for code freeze, instead of waiting for the full release, so Renovate can keep it up to date right away starting with code freeze. What do you think?

[phisco]

Yes, that's because we forgot to update the branch list:

crossplane/.github/renovate.json5

Line 15 in 0d0473e

"baseBranches": ["master","release-1.13","release-1.14","release-1.15"],

I was sure we had a step for it.

[phisco]

We do, but it's misplaced: https://github.com/crossplane/release/blob/e6d04f89834b298c68b9fbda8b240fc372a03da0/.github/ISSUE_TEMPLATE/release.md?plain=1#L63

It should be in the code freeze section.

[jbw976]

I'll do the following:

• open a PR in crossplane/crossplane to add the release-1.16 release branch to baseBranches now
  • build: add release-1.16 to Renovate baseBranches #5694
• see if renovate takes care of this golang dependency in that branch, if it doesn't then just open a PR manually
  • had to open a PR manually: chore(deps): update golang version to v1.22.3 (release-1.16) #5695
• update my PR Update release steps from v1.16 lessons release#12 to split that step into 2 parts:
  • code freeze: add new release branch to baseBranches
  • release day: remove old no longer supported branch