Repository: apecloud/kubeblocks

Issue:
[Vulnerability] fix critical and critial Vulnerability reported by daily scan.
- https://github.com/apecloud/apecloud-cd/actions/runs/19053202977/job/54417873454

<img width="470" height="131" alt="Image" src="https://github.com/user-attachments/assets/121f1566-6292-4e07-a59a-302406e17b91" />


```
Total: 6 (HIGH: 6, CRITICAL: 0)

┌─────────┬────────────────┬──────────┬────────┬───────────────────┬────────────────┬──────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version  │                            Title                             │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼────────────────┼──────────────────────────────────────────────────────────────┤
│ stdlib  │ CVE-2025-47912 │ HIGH     │ fixed  │ v1.23.12          │ 1.24.8, 1.25.2 │ The Parse function permits values other than IPv6 addresses  │
│         │                │          │        │                   │                │ to be incl...                                                │
│         │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2025-47912                   │
│         ├────────────────┤          │        │                   │                ├──────────────────────────────────────────────────────────────┤
│         │ CVE-2025-58183 │          │        │                   │                │ tar.Reader does not set a maximum size on the number of      │
│         │                │          │        │                   │                │ sparse...                                                    │
│         │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2025-58183                   │
│         ├────────────────┤          │        │                   │                ├──────────────────────────────────────────────────────────────┤
│         │ CVE-2025-58186 │          │        │                   │                │ Despite HTTP headers having a default limit of 1MB, the      │
│         │                │          │        │                   │                │ number of...                                                 │
│         │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2025-58186                   │
│         ├────────────────┤          │        │                   ├────────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2025-58187 │          │        │                   │ 1.24.9, 1.25.3 │ Due to the design of the name constraint checking algorithm, │
│         │                │          │        │                   │                │ the proce...                                                 │
│         │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2025-58187                   │
│         ├────────────────┤          │        │                   ├────────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2025-58188 │          │        │                   │ 1.24.8, 1.25.2 │ Validating certificate chains which contain DSA public keys  │
│         │                │          │        │                   │                │ can cause ......                                             │
│         │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2025-58188                   │
│         ├────────────────┤          │        │                   │                ├──────────────────────────────────────────────────────────────┤
│         │ CVE-2025-61724 │          │        │                   │                │ The Reader.ReadResponse function constructs a response       │
│         │                │          │        │                   │                │ string through ...                                           │
│         │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2025-61724                   │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴────────────────┴──────────────────────────────────────────────────────────────┘
```

Hints from issue comments:

Solution patch:
diff --git a/.github/workflows/cicd-pull-request.yml b/.github/workflows/cicd-pull-request.yml
index 9a162a384..06ee9c157 100644
--- a/.github/workflows/cicd-pull-request.yml
+++ b/.github/workflows/cicd-pull-request.yml
@@ -10,7 +10,7 @@ on:
 env:
   GITHUB_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
   BASE_BRANCH: origin/main
-  GO_VERSION: "1.23"
+  GO_VERSION: "1.24"
 
 jobs:
   trigger-mode:
@@ -136,7 +136,7 @@ jobs:
     with:
       MAKE_OPS_PRE: "generate"
       IMG: "apecloud/kubeblocks"
-      GO_VERSION: "1.23"
+      GO_VERSION: "1.24"
       BUILDX_PLATFORMS: "linux/amd64"
       DOCKERFILE_PATH: "./docker/Dockerfile"
       BUILDX_ARGS: |
@@ -152,7 +152,7 @@ jobs:
     with:
       MAKE_OPS_PRE: "module generate test-go-generate"
       IMG: "apecloud/kubeblocks-tools"
-      GO_VERSION: "1.23"
+      GO_VERSION: "1.24"
       BUILDX_PLATFORMS: "linux/amd64"
       DOCKERFILE_PATH: "./docker/Dockerfile-tools"
     secrets: inherit
@@ -179,7 +179,7 @@ jobs:
       CHART_DIR: "deploy/helm"
       APECD_REF: "v0.1.43"
       MAKE_OPS_POST: "install"
-      GO_VERSION: "1.23"
+      GO_VERSION: "1.24"
     secrets: inherit
 
   pr-check:
diff --git a/.github/workflows/cicd-push.yml b/.github/workflows/cicd-push.yml
index 452f53387..f501054fc 100644
--- a/.github/workflows/cicd-push.yml
+++ b/.github/workflows/cicd-push.yml
@@ -10,7 +10,7 @@ on:
 env:
   GITHUB_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
   BASE_BRANCH: origin/main
-  GO_VERSION: "1.23"
+  GO_VERSION: "1.24"
 
 jobs:
   trigger-mode:
@@ -161,7 +161,7 @@ jobs:
     with:
       MAKE_OPS_PRE: "generate"
       IMG: "apecloud/kubeblocks"
-      GO_VERSION: "1.23"
+      GO_VERSION: "1.24"
       BUILDX_PLATFORMS: "linux/amd64"
       DOCKERFILE_PATH: "./docker/Dockerfile"
       BUILDX_ARGS: |
@@ -177,7 +177,7 @@ jobs:
     with:
       MAKE_OPS_PRE: "module generate test-go-generate"
       IMG: "apecloud/kubeblocks-tools"
-      GO_VERSION: "1.23"
+      GO_VERSION: "1.24"
       BUILDX_PLATFORMS: "linux/amd64"
       DOCKERFILE_PATH: "./docker/Dockerfile-tools"
     secrets: inherit
@@ -203,7 +203,7 @@ jobs:
       CHART_DIR: "deploy/helm"
       APECD_REF: "v0.1.43"
       MAKE_OPS_POST: "install"
-      GO_VERSION: "1.23"
+      GO_VERSION: "1.24"
     secrets: inherit
 
   deploy-kubeblocks-io:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 66336a1b4..c593ee6ce 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -8,7 +8,7 @@ on:
 
 env:
   BASE_BRANCH: origin/main
-  GO_VERSION: "1.23"
+  GO_VERSION: "1.24"
 
 jobs:
   trigger-mode:
diff --git a/.github/workflows/release-helm-chart.yml b/.github/workflows/release-helm-chart.yml
index 708de643c..c21fddf80 100644
--- a/.github/workflows/release-helm-chart.yml
+++ b/.github/workflows/release-helm-chart.yml
@@ -44,7 +44,7 @@ jobs:
       CHART_DIR: "deploy/helm"
       APECD_REF: "v0.1.96"
       MAKE_OPS_POST: "install"
-      GO_VERSION: "1.23"
+      GO_VERSION: "1.24"
     secrets: inherit
 
   release-addons-chart:
@@ -75,7 +75,7 @@ jobs:
       MAKE_OPS_PRE: "helm-package VERSION=${{ needs.release-version.outputs.release-version-bump }}"
       IMG: "apecloud/kubeblocks-charts"
       VERSION: "${{ needs.release-version.outputs.release-version }}"
-      GO_VERSION: "1.23"
+      GO_VERSION: "1.24"
       APECD_REF: "v0.1.86"
       DOCKERFILE_PATH: "./docker/Dockerfile-charts"
     secrets: inherit
diff --git a/.github/workflows/release-image.yml b/.github/workflows/release-image.yml
index 818f5faa5..b88b9efcc 100644
--- a/.github/workflows/release-image.yml
+++ b/.github/workflows/release-image.yml
@@ -71,7 +71,7 @@ jobs:
       MAKE_OPS_PRE: "generate"
       IMG: "apecloud/kubeblocks"
       VERSION: "${{ needs.release-version.outputs.release-version }}"
-      GO_VERSION: "1.23"
+      GO_VERSION: "1.24"
       APECD_REF: "v0.1.24"
       DOCKERFILE_PATH: "./docker/Dockerfile"
       BUILDX_ARGS: |
@@ -88,7 +88,7 @@ jobs:
       MAKE_OPS_PRE: "module generate test-go-generate"
       IMG: "apecloud/kubeblocks-tools"
       VERSION: "${{ needs.release-version.outputs.release-version }}"
-      GO_VERSION: "1.23"
+      GO_VERSION: "1.24"
       APECD_REF: "v0.1.24"
       DOCKERFILE_PATH: "./docker/Dockerfile-tools"
     secrets: inherit
@@ -112,7 +112,7 @@ jobs:
       MAKE_OPS_PRE: "helm-package VERSION=${{ needs.release-version.outputs.release-version-bump }}"
       IMG: "apecloud/kubeblocks-charts"
       VERSION: "${{ needs.release-version.outputs.release-version }}"
-      GO_VERSION: "1.23"
+      GO_VERSION: "1.24"
       APECD_REF: "v0.1.24"
       DOCKERFILE_PATH: "./docker/Dockerfile-charts"
     secrets: inherit
@@ -137,7 +137,7 @@ jobs:
       MAKE_OPS_PRE: "generate"
       IMG: "apecloud/kubeblocks"
       VERSION: "${{ needs.release-version.outputs.release-version }}-certified"
-      GO_VERSION: "1.23"
+      GO_VERSION: "1.24"
       APECD_REF: "v0.1.64"
       DOCKERFILE_PATH: "./docker/Dockerfile-redhat"
       BUILDX_ARGS: |
diff --git a/.github/workflows/release-version.yml b/.github/workflows/release-version.yml
index 484fd8982..76edb94d9 100644
--- a/.github/workflows/release-version.yml
+++ b/.github/workflows/release-version.yml
@@ -12,7 +12,7 @@ run-name: ref_name:${{ github.ref_name }} release_version:${{ inputs.release_ver
 
 env:
   GITHUB_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
-  GO_VERSION: "1.23"
+  GO_VERSION: "1.24"
 
 jobs:
   release-message:
diff --git a/Makefile b/Makefile
index 23495040b..0ae852857 100644
--- a/Makefile
+++ b/Makefile
@@ -172,7 +172,7 @@ mod-vendor: module ## Run go mod vendor against go modules.
 
 .PHONY: module
 module: ## Run go mod tidy->verify against go modules.
-	$(GO) mod tidy -compat=1.23
+	$(GO) mod tidy -compat=1.24
 	$(GO) mod verify
 
 TEST_PACKAGES ?= ./pkg/... ./apis/... ./controllers/... ./cmd/...
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 51e3233d3..a42bdeb1a 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -1,7 +1,7 @@
 # Build the manager binary
 ARG DIST_IMG=gcr.io/distroless/static:nonroot
 
-ARG GO_VERSION=1.23.12-alpine
+ARG GO_VERSION=1.24.9-alpine
 
 FROM --platform=${BUILDPLATFORM} golang:${GO_VERSION} AS builder
 
diff --git a/docker/Dockerfile-dataprotection b/docker/Dockerfile-dataprotection
index 07bbda490..aa5adcef1 100644
--- a/docker/Dockerfile-dataprotection
+++ b/docker/Dockerfile-dataprotection
@@ -1,7 +1,7 @@
 # Build the dataprotection binary
 ARG DIST_IMG=gcr.io/distroless/static:nonroot
 
-ARG GO_VERSION=1.23.12-alpine
+ARG GO_VERSION=1.24.9-alpine
 
 FROM --platform=${BUILDPLATFORM} golang:${GO_VERSION} AS builder
 
diff --git a/docker/Dockerfile-dev b/docker/Dockerfile-dev
index ddceb481e..f297c5045 100644
--- a/docker/Dockerfile-dev
+++ b/docker/Dockerfile-dev
@@ -1,7 +1,7 @@
 # Based on https://github.com/microsoft/vscode-dev-containers/tree/v0.245.2/containers/go/.devcontainer/base.Dockerfile
 
 # [Choice] Go version: 1, 1.19, 1.18, etc
-ARG GOVERSION=1.23
+ARG GOVERSION=1.24
 FROM golang:${GOVERSION}-bullseye
 
 # Copy library scripts to execute
diff --git a/docker/Dockerfile-redhat b/docker/Dockerfile-redhat
index 20ea57372..3fe8e5bdf 100644
--- a/docker/Dockerfile-redhat
+++ b/docker/Dockerfile-redhat
@@ -1,7 +1,7 @@
 # Build the manager binary
 ARG DIST_IMG=registry.access.redhat.com/ubi9:9.6
 
-ARG GO_VERSION=1.23.10-alpine
+ARG GO_VERSION=1.24.9-alpine
 
 FROM --platform=${BUILDPLATFORM} golang:${GO_VERSION} AS builder
 
diff --git a/docker/Dockerfile-tools b/docker/Dockerfile-tools
index efcfc7668..698063842 100644
--- a/docker/Dockerfile-tools
+++ b/docker/Dockerfile-tools
@@ -11,7 +11,7 @@
 #TARGETARCH - Architecture from --platform, e.g. arm64
 #TARGETVARIANT - used to set target ARM variant, e.g. v7
 
-ARG GO_VERSION=1.23-alpine
+ARG GO_VERSION=1.24.9-alpine
 
 FROM --platform=${BUILDPLATFORM} golang:${GO_VERSION} AS builder
 ARG TARGETOS
diff --git a/go.mod b/go.mod
index a4fe27fab..5dac8ff64 100644
--- a/go.mod
+++ b/go.mod
@@ -1,8 +1,6 @@
 module github.com/apecloud/kubeblocks
 
-go 1.23.1
-
-toolchain go1.23.12
+go 1.24
 
 require (
 	cuelang.org/go v0.8.0
diff --git a/pkg/configuration/openapi/cue_gen_openapi.go b/pkg/configuration/openapi/cue_gen_openapi.go
index 6ab8fc53e..7cea9f196 100644
--- a/pkg/configuration/openapi/cue_gen_openapi.go
+++ b/pkg/configuration/openapi/cue_gen_openapi.go
@@ -56,7 +56,7 @@ func GenerateOpenAPISchema(cueTpl string, schemaType string) (*apiextv1.JSONSche
 	if schemaType != "" {
 		rootValue = rt.Underlying().LookupPath(cue.MakePath(cue.Def(schemaType)))
 		if rootValue.Err() != nil {
-			return nil, core.MakeError(errors.Details(rootValue.Err(), nil))
+			return nil, core.MakeError("%s", errors.Details(rootValue.Err(), nil))
 		}
 	} else {
 		defs, err := rt.Underlying().Fields(cue.Definitions(true))
diff --git a/pkg/configuration/openapi/runtime.go b/pkg/configuration/openapi/runtime.go
index 2953b299e..8979578ae 100644
--- a/pkg/configuration/openapi/runtime.go
+++ b/pkg/configuration/openapi/runtime.go
@@ -43,14 +43,14 @@ func NewRuntime(cueString string) (*Runtime, error) {
 	insts := load.Instances([]string{"-"}, cueOption)
 	for _, ins := range insts {
 		if err := ins.Err; err != nil {
-			return nil, core.MakeError(errors.Details(err, nil))
+			return nil, core.MakeError("%s", errors.Details(err, nil))
 		}
 	}
 
 	inst := insts[0]
 	rt := cuecontext.New().BuildInstance(inst)
 	if err := rt.Validate(cue.All()); err != nil {
-		return nil, core.MakeError(errors.Details(err, nil))
+		return nil, core.MakeError("%s", errors.Details(err, nil))
 	}
 
 	return &Runtime{
diff --git a/pkg/controller/plan/restore.go b/pkg/controller/plan/restore.go
index 2fdf03437..9baea2bae 100644
--- a/pkg/controller/plan/restore.go
+++ b/pkg/controller/plan/restore.go
@@ -465,7 +465,7 @@ func (r *RestoreManager) createRestoreAndWait(compObj *appsv1.Component, restore
 		}
 	}
 	if errType != "" {
-		return intctrlutil.NewErrorf(errType, strings.Join(msgs, ";"))
+		return intctrlutil.NewErrorf(errType, "%s", strings.Join(msgs, ";"))
 	}
 	return nil
 }
diff --git a/pkg/controllerutil/errors.go b/pkg/controllerutil/errors.go
index 45a12c988..40ae7caf4 100644
--- a/pkg/controllerutil/errors.go
+++ b/pkg/controllerutil/errors.go
@@ -111,5 +111,5 @@ func IsNotFound(err error) bool {
 
 // NewFatalError returns a new Error with ErrorTypeFatal
 func NewFatalError(message string) *Error {
-	return NewErrorf(ErrorTypeFatal, message)
+	return NewErrorf(ErrorTypeFatal, "%s", message)
 }
diff --git a/pkg/dataprotection/action/action_stateful.go b/pkg/dataprotection/action/action_stateful.go
index eea09bd88..323b6b087 100644
--- a/pkg/dataprotection/action/action_stateful.go
+++ b/pkg/dataprotection/action/action_stateful.go
@@ -65,7 +65,7 @@ func (s *StatefulSetAction) Type() dpv1alpha1.ActionType {
 func (s *StatefulSetAction) Execute(ctx ActionContext) (actionStatus *dpv1alpha1.ActionStatus, err error) {
 	defer func() {
 		if err != nil {
-			err = intctrlutil.NewErrorf(intctrlutil.ErrorTypeRequeue, err.Error())
+			err = intctrlutil.NewErrorf(intctrlutil.ErrorTypeRequeue, "%s", err.Error())
 		}
 	}()
 	sts := &appsv1.StatefulSet{}
diff --git a/pkg/kbagent/service/action_utils.go b/pkg/kbagent/service/action_utils.go
index dcac94c9a..71e5c6204 100644
--- a/pkg/kbagent/service/action_utils.go
+++ b/pkg/kbagent/service/action_utils.go
@@ -115,10 +115,10 @@ func blockingCallAction(ctx context.Context, action *kbaproto.Action, parameters
 			if stderrMsg := result.stderr.String(); len(stderrMsg) > 0 {
 				errMsg += fmt.Sprintf(", stderr: %s", stderrMsg)
 			}
-			return nil, errors.Wrapf(kbaproto.ErrFailed, errMsg)
+			return nil, errors.Wrapf(kbaproto.ErrFailed, "%s", errMsg)
 		}
 		if errMsg := result.stderr.String(); len(errMsg) > 0 {
-			return nil, errors.Wrapf(err, errMsg)
+			return nil, errors.Wrapf(err, "%s", errMsg)
 		}
 		return nil, err
 	}
diff --git a/pkg/operations/custom.go b/pkg/operations/custom.go
index 06052b84c..002a94cd6 100644
--- a/pkg/operations/custom.go
+++ b/pkg/operations/custom.go
@@ -192,7 +192,7 @@ func (c CustomOpsHandler) checkExpression(reqCtx intctrlutil.RequestCtx,
 			if needWaitPreConditionDeadline(opsRes.OpsRequest) {
 				return intctrlutil.NewRequeueError(time.Second, rule.Message)
 			}
-			return fmt.Errorf(rule.Message)
+			return fmt.Errorf("%s", rule.Message)
 		}
 	}
 	return nil



Test patch:
diff --git a/pkg/operations/custom_test.go b/pkg/operations/custom_test.go
index 29cfe6ad0..01aa1d96e 100644
--- a/pkg/operations/custom_test.go
+++ b/pkg/operations/custom_test.go
@@ -371,7 +371,7 @@ var _ = Describe("CustomOps", func() {
 				GetObject()
 
 			// create a pod which belongs to the sharding component
-			pod := testapps.MockInstanceSetPod(&testCtx, nil, cluster.Name, shardingShotCompName, fmt.Sprintf(shardingCompName+"-0"), "")
+			pod := testapps.MockInstanceSetPod(&testCtx, nil, cluster.Name, shardingShotCompName, shardingCompName+"-0", "")
 			Expect(testapps.ChangeObj(&testCtx, pod, func(obj *corev1.Pod) {
 				pod.Labels[constant.KBAppShardingNameLabelKey] = defaultCompName
 			})).Should(Succeed())