Upgrade go stdlib to resolve CVEs

[bbemis]

Hi,

I am using a trivy scan to detect vulnerabilities in my project and we recently discovered a handful of vulnerabilities in the temporal-server image version 1.25.1. Looking at them they all seem to be related to the go stdlib version

would it be possible to upgrade out of these in the next server version?

[tihomir]

Thanks for reporting. Will report to our security team. For these types of finds always feel free to also create github issue: Issues · temporalio/temporal · GitHub

[Yichao_Yang]

Yes. We will upgrade golang version to latest 1.23 in our next minor release, 1.26.0, which is planned to go out in Dec. 2024.