From cfcb05523c3d0ce29234cf8866a50149eadbb56c Mon Sep 17 00:00:00 2001 From: Jacob Shirley Date: Fri, 21 Aug 2026 17:45:59 +0000 Subject: [PATCH] Bump Go to 1.24.13 The 1.24.0 SDK that release binaries are built with carries fixed stdlib CVEs, most notably CVE-2025-68121 (crypto/tls, CVSS 10.0), which vulnerability scanners flag on every machine with a bazelisk release binary installed. 1.24.13 is the current patch release of the same minor line. --- MODULE.bazel | 2 +- go.mod | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/MODULE.bazel b/MODULE.bazel index 373e9624..78da9817 100644 --- a/MODULE.bazel +++ b/MODULE.bazel @@ -17,7 +17,7 @@ bazel_dep(name = "aspect_bazel_lib", version = "2.22.0", repo_name=None) bazel_dep(name = "rules_nodejs", version = "6.6.2", repo_name=None) go_sdk = use_extension("@io_bazel_rules_go//go:extensions.bzl", "go_sdk") -go_sdk.download(version = "1.24.0") +go_sdk.download(version = "1.24.13") go_deps = use_extension("@bazel_gazelle//:extensions.bzl", "go_deps") go_deps.from_file(go_mod = "//:go.mod") diff --git a/go.mod b/go.mod index e309a93d..3fd70e90 100644 --- a/go.mod +++ b/go.mod @@ -2,7 +2,7 @@ module github.com/bazelbuild/bazelisk go 1.24.0 -toolchain go1.24.2 +toolchain go1.24.13 require ( github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d