Skip to content

refactor(logic): scope testcontainers helpers to the test build - #1739

Merged
ericyan merged 1 commit into
github:masterfrom
davidham:bump-deps-and-go-to-address-high-cves
Jul 29, 2026
Merged

refactor(logic): scope testcontainers helpers to the test build#1739
ericyan merged 1 commit into
github:masterfrom
davidham:bump-deps-and-go-to-address-high-cves

Conversation

@davidham

@davidham davidham commented Jul 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Related issue: #1738

[Update 7/29/2026] Rebased onto current master and reduced to the single commit you asked for, @ericyan. The toolchain and dependency bumps are dropped.

Description

go/logic/test_utils.go has no _test.go suffix, so it is part of the ordinary build of package logic. It imports testcontainers-go, and package logic is imported by go/cmd/gh-ost, so testcontainers and its transitive dependencies are compiled into the released binary and recorded in its build info.

This PR renames the file to test_utils_test.go, so it stays available to the tests in the same package while being excluded from the ordinary build. Every identifier it declares is referenced only from applier_test.go, streamer_test.go and migrator_test.go, so it is a pure rename -- zero line changes. The rebase preserves your port.Num() change from #1741; the file content is byte-identical to master.

Measured effect

linux/amd64, CGO_ENABLED=0, built with go1.25.12:

master this PR
modules in build info 63 22
binary size 18.64 MB 16.99 MB
Trivy HIGH/CRITICAL 0 0

To be explicit about the framing, since it has changed since I opened this: this PR fixes no current CVE. After #1741 and #1742, master already scans clean, and so does this branch. The value here is what you identified -- testcontainers-go does not belong in the shipped binary. It drops 41 modules and ~1.65 MB, and it means a future advisory anywhere in the container-testing tree will not surface in scans of a binary that never calls into that code. The 3 docker/docker CVEs in v1.1.10 were a symptom of this; the upgrade cleared them, the rename removes the mechanism.

Verification

  • script/cibuild -- clean: gofmt, build, and full unit suite including the testcontainers-backed go/logic tests (61.4% coverage) against testcontainers v0.43.0
  • golangci-lint run --config=.golangci.yml -- 0 issues

In case this PR introduced Go code changes:

  • contributed code is using same conventions as original code
  • script/cibuild returns with no formatting errors, build errors or unit test errors.

@davidham
davidham force-pushed the bump-deps-and-go-to-address-high-cves branch from dee512f to a64cf03 Compare July 28, 2026 22:30
@davidham
davidham marked this pull request as ready for review July 28, 2026 22:34
Copilot AI review requested due to automatic review settings July 28, 2026 22:34
Copilot AI reviewed Jul 28, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the release toolchain and dependencies to eliminate reported HIGH CVEs while excluding test-only container dependencies from production binaries.

Changes:

  • Upgrades Go to 1.26.5 across build configurations.
  • Updates x/crypto and required x/sys, x/term, and x/text dependencies.
  • Renames container helpers to _test.go, removing testcontainers from release builds.

Reviewed changes

Copilot reviewed 4 out of 119 changed files in this pull request and generated no comments.

Show a summary per file
File Description
Dockerfile.packaging Uses Go 1.26.5 for packaging.
Dockerfile.test Uses Go 1.26.5 for tests.
go.mod Updates Go and dependency versions.
go.sum Refreshes dependency checksums.
script/ensure-go-installed Updates preferred Go release and checksums.
go/logic/test_utils_test.go Limits container helpers to test builds.
vendor/modules.txt Refreshes vendored module metadata.
vendor/golang.org/x/crypto/ssh/certs.go Vendors updated SSH certificate handling.
vendor/golang.org/x/crypto/ssh/channel.go Vendors updated SSH channel handling.
vendor/golang.org/x/crypto/ssh/cipher.go Vendors SSH cipher fixes.
vendor/golang.org/x/crypto/ssh/client_auth.go Vendors SSH authentication fixes.
vendor/golang.org/x/crypto/ssh/keys.go Vendors SSH key validation fixes.
vendor/golang.org/x/crypto/ssh/mux.go Vendors SSH multiplexing fixes.
vendor/golang.org/x/crypto/ssh/server.go Vendors SSH server security fixes.
vendor/golang.org/x/sys/cpu/asm_darwin_arm64_gc.s Adds vendored Darwin ARM64 support.
vendor/golang.org/x/sys/cpu/cpu.go Updates vendored CPU feature definitions.
vendor/golang.org/x/sys/cpu/cpu_arm64.go Updates ARM64 feature detection.
vendor/golang.org/x/sys/cpu/cpu_arm64.s Updates ARM64 assembly helpers.
vendor/golang.org/x/sys/cpu/cpu_darwin_arm64.go Adds Darwin ARM64 detection.
vendor/golang.org/x/sys/cpu/cpu_darwin_arm64_other.go Adds alternate Darwin ARM64 support.
vendor/golang.org/x/sys/cpu/cpu_gc_arm64.go Updates ARM64 compiler declarations.
vendor/golang.org/x/sys/cpu/cpu_gccgo_arm64.go Updates gccgo ARM64 helpers.
vendor/golang.org/x/sys/cpu/cpu_linux_riscv64.go Adds RISC-V feature detection.
vendor/golang.org/x/sys/cpu/cpu_loong64.go Expands Loong64 feature detection.
vendor/golang.org/x/sys/cpu/cpu_netbsd_arm64.go Updates NetBSD ARM64 parsing.
vendor/golang.org/x/sys/cpu/cpu_openbsd_arm64.go Updates OpenBSD ARM64 parsing.
vendor/golang.org/x/sys/cpu/cpu_other_arm64.go Updates fallback ARM64 initialization.
vendor/golang.org/x/sys/cpu/cpu_riscv64.go Adds RISC-V Zbc support.
vendor/golang.org/x/sys/cpu/cpu_windows.go Adds Windows CPU feature bindings.
vendor/golang.org/x/sys/cpu/cpu_windows_arm64.go Adds Windows ARM64 detection.
vendor/golang.org/x/sys/cpu/cpu_x86.go Updates x86 feature detection.
vendor/golang.org/x/sys/cpu/syscall_darwin_arm64_gc.go Adds Darwin ARM64 syscall support.
vendor/golang.org/x/sys/cpu/zcpu_windows.go Adds generated Windows CPU bindings.
vendor/golang.org/x/sys/plan9/syscall_plan9.go Updates vendored Plan 9 signal alias.
vendor/golang.org/x/sys/unix/affinity_linux.go Adds dynamic Linux CPU sets.
vendor/golang.org/x/sys/unix/ioctl_signed.go Adds signed ioctl string support.
vendor/golang.org/x/sys/unix/ioctl_unsigned.go Adds unsigned ioctl string support.
vendor/golang.org/x/sys/unix/mkall.sh Updates vendored generation script.
vendor/golang.org/x/sys/unix/mkerrors.sh Updates error generation inputs.
vendor/golang.org/x/sys/unix/readv_unix.go Centralizes vectored I/O helpers.
vendor/golang.org/x/sys/unix/syscall_darwin.go Uses shared vectored I/O helpers.
vendor/golang.org/x/sys/unix/syscall_linux.go Updates Linux syscall wrappers.
vendor/golang.org/x/sys/unix/syscall_linux_arm.go Handles nil ARM timestamps.
vendor/golang.org/x/sys/unix/syscall_linux_arm64.go Handles nil ARM64 timestamps.
vendor/golang.org/x/sys/unix/syscall_linux_loong64.go Handles nil Loong64 timestamps.
vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go Handles nil RISC-V timestamps.
vendor/golang.org/x/sys/unix/syscall_openbsd.go Adds OpenBSD vectored I/O bindings.
vendor/golang.org/x/sys/unix/syscall_solaris.go Uses shared ioctl string support.
vendor/golang.org/x/sys/unix/syscall_unix.go Updates receive-message error handling.
vendor/golang.org/x/sys/unix/zerrors_linux.go Refreshes Linux constants.
vendor/golang.org/x/sys/unix/zerrors_linux_386.go Refreshes Linux 386 errors.
vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go Refreshes Linux AMD64 errors.
vendor/golang.org/x/sys/unix/zerrors_linux_arm.go Refreshes Linux ARM errors.
vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go Refreshes Linux ARM64 errors.
vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go Refreshes Linux Loong64 errors.
vendor/golang.org/x/sys/unix/zerrors_linux_mips.go Refreshes Linux MIPS errors.
vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go Refreshes Linux MIPS64 errors.
vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go Refreshes Linux MIPS64LE errors.
vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go Refreshes Linux MIPSLE errors.
vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go Refreshes Linux PPC errors.
vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go Refreshes Linux PPC64 errors.
vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go Refreshes Linux PPC64LE errors.
vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go Refreshes Linux RISC-V errors.
vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go Refreshes Linux S390x errors.
vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go Refreshes Linux SPARC64 errors.
vendor/golang.org/x/sys/unix/zsyscall_linux.go Refreshes generated Linux syscalls.
vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.go Adds OpenBSD 386 vectored I/O.
vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.s Adds OpenBSD 386 trampolines.
vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.go Adds OpenBSD AMD64 vectored I/O.
vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.s Adds OpenBSD AMD64 trampolines.
vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.go Adds OpenBSD ARM vectored I/O.
vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.s Adds OpenBSD ARM trampolines.
vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.go Adds OpenBSD ARM64 vectored I/O.
vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.s Adds OpenBSD ARM64 trampolines.
vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.go Adds OpenBSD MIPS64 vectored I/O.
vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.s Adds OpenBSD MIPS64 trampolines.
vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.go Adds OpenBSD PPC64 vectored I/O.
vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.s Adds OpenBSD PPC64 trampolines.
vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.go Adds OpenBSD RISC-V vectored I/O.
vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.s Adds OpenBSD RISC-V trampolines.
vendor/golang.org/x/sys/unix/zsysnum_linux_386.go Refreshes Linux 386 syscall numbers.
vendor/golang.org/x/sys/unix/zsysnum_linux_amd64.go Refreshes Linux AMD64 syscall numbers.
vendor/golang.org/x/sys/unix/zsysnum_linux_arm.go Refreshes Linux ARM syscall numbers.
vendor/golang.org/x/sys/unix/zsysnum_linux_arm64.go Refreshes Linux ARM64 syscall numbers.
vendor/golang.org/x/sys/unix/zsysnum_linux_loong64.go Refreshes Loong64 syscall numbers.
vendor/golang.org/x/sys/unix/zsysnum_linux_mips.go Refreshes Linux MIPS syscall numbers.
vendor/golang.org/x/sys/unix/zsysnum_linux_mips64.go Refreshes MIPS64 syscall numbers.
vendor/golang.org/x/sys/unix/zsysnum_linux_mips64le.go Refreshes MIPS64LE syscall numbers.
vendor/golang.org/x/sys/unix/zsysnum_linux_mipsle.go Refreshes MIPSLE syscall numbers.
vendor/golang.org/x/sys/unix/zsysnum_linux_ppc.go Refreshes Linux PPC syscall numbers.
vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64.go Refreshes PPC64 syscall numbers.
vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64le.go Refreshes PPC64LE syscall numbers.
vendor/golang.org/x/sys/unix/zsysnum_linux_riscv64.go Refreshes RISC-V syscall numbers.
vendor/golang.org/x/sys/unix/zsysnum_linux_s390x.go Refreshes S390x syscall numbers.
vendor/golang.org/x/sys/unix/zsysnum_linux_sparc64.go Refreshes SPARC64 syscall numbers.
vendor/golang.org/x/sys/unix/ztypes_linux.go Refreshes shared Linux types.
vendor/golang.org/x/sys/unix/ztypes_linux_386.go Updates Linux 386 task statistics.
vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go Updates Linux AMD64 task statistics.
vendor/golang.org/x/sys/unix/ztypes_linux_arm.go Updates Linux ARM task statistics.
vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go Updates Linux ARM64 task statistics.
vendor/golang.org/x/sys/unix/ztypes_linux_loong64.go Updates Loong64 task statistics.
vendor/golang.org/x/sys/unix/ztypes_linux_mips.go Updates Linux MIPS task statistics.
vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go Updates MIPS64 task statistics.
vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go Updates MIPS64LE task statistics.
vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go Updates MIPSLE task statistics.
vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go Updates Linux PPC task statistics.
vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go Updates PPC64 task statistics.
vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go Updates PPC64LE task statistics.
vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go Updates RISC-V task statistics.
vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go Updates S390x task statistics.
vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go Updates SPARC64 task statistics.
vendor/golang.org/x/sys/unix/ztypes_netbsd_arm.go Corrects NetBSD ARM type layout.
vendor/golang.org/x/sys/windows/aliases.go Updates Windows signal aliasing.
vendor/golang.org/x/sys/windows/dll_windows.go Uses the current Windows syscall API.
vendor/golang.org/x/sys/windows/security_windows.go Handles absent security descriptors.
vendor/golang.org/x/sys/windows/syscall_windows.go Updates Windows syscall declarations.
vendor/golang.org/x/sys/windows/types_windows.go Adds Windows networking and CPU types.
vendor/golang.org/x/sys/windows/zsyscall_windows.go Refreshes generated Windows syscalls.
vendor/golang.org/x/term/terminal.go Vendors terminal editing improvements.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@ericyan

ericyan commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

Hi @davidham, thanks for your contribution.

I think the third commit is the one that brings unique value here. Would you cherry-pick that commit for this PR? I'd prefer to address the toolchain and dependencies updates separately.

@ericyan
ericyan self-requested a review July 29, 2026 09:05
@davidham
refactor(logic): scope testcontainers helpers to the test build
014cdc8 
go/logic/test_utils.go has no _test.go suffix, so it is part of the
ordinary build of package logic. It imports testcontainers-go, and
package logic is imported by go/cmd/gh-ost, so testcontainers and its
transitive dependencies are compiled into the released gh-ost binary
and recorded in its build info.

Container-testing infrastructure has no role at runtime. Shipping it
enlarges the binary and widens the dependency surface that scanners
report against, which is how the vendored Docker client came to
account for 3 HIGH CVEs in the v1.1.10 binary (github#1738). Upgrading
testcontainers in github#1741 cleared those particular findings, but the
structural issue remains: a future advisory anywhere in the
container-testing tree would again surface in scans of a binary that
never calls into it.

Rename the file to test_utils_test.go so it stays available to the
tests in the same package while being excluded from the ordinary
build. Every identifier it declares is referenced only from
applier_test.go, streamer_test.go and migrator_test.go, so this is a
pure rename with no content change.

Effect on the linux/amd64 binary, built with go1.25.12:
  - modules recorded in build info: 63 -> 22
  - binary size: 18.64 MB -> 16.99 MB
  - Trivy HIGH/CRITICAL: 0 -> 0, unchanged; master is already clean
@davidham
davidham force-pushed the bump-deps-and-go-to-address-high-cves branch from a64cf03 to 014cdc8 Compare July 29, 2026 14:58
@davidham davidham changed the title fix(security): clear 20 HIGH CVEs from the release binary refactor(logic): scope testcontainers helpers to the test build Jul 29, 2026
@davidham

davidham commented Jul 29, 2026

Copy link
Copy Markdown
Contributor Author

Hi @ericyan, thanks for your reply and the dependency updates. I rebased onto master and kept only the rename commit. Have a great day!

@ericyan
ericyan requested a review from Copilot July 29, 2026 16:06
Copilot AI reviewed Jul 29, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request.

@ericyan

ericyan commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

Thank you for your contribution ❤️

@ericyan
ericyan merged commit c32063f into github:master Jul 29, 2026
14 checks passed
@davidham
davidham deleted the bump-deps-and-go-to-address-high-cves branch July 29, 2026 16:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments
@ericyan ericyan ericyan approved these changes
@timvaillancourt timvaillancourt Awaiting requested review from timvaillancourt timvaillancourt is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@davidham @ericyan