CODEWITHSUNDEEP
gosecuritypackagedependenciesvendoring
the_endian
the_endian

Reputation: 2527

How do I update golang standard library in my go application?

I have an application that was built with go 1.16.4, which uses (imports) the archive/zip component of the Go std lib. I took a look at the golang Release Notes and see that a security vulnerability has been fixed in archive/zip in golang 1.16.5. How do I ensure that my application is no longer vulnerable? Must I upgrade my version of go itself, and then rebuild with that new version of go? Or could I vendor the newer version of the fixed component then rebuild? Must the files in the build machine's $GOROOT be updated?

Upvotes: 1

Views: 3255

Answers (1)

rustyx
rustyx

Reputation: 85481

Must I upgrade my version of go itself, and then rebuild with that new version of go?

Yes...

  1. Upgrade Go.
  2. Rebuild.

Or could I vendor the newer version of the fixed component then rebuild?

No, you can't vendor the Go standard library.

Must the files in the build machine's $GOROOT be updated?

GOROOT is the root folder of the Go SDK installation. It is updated when you upgrade Go on the machine (or container) that invokes go build/go install.

Upvotes: 1

Related Questions