Critical security vulnerability in go 1.21.10

[kirach]

Hi there,

We're using the latest version of secrets-init (0.5.2) in our docker containers to fetch secrets from google cloud (we also store our docker containers in gcp). And google cloud security scanner started to report critical security vulnerabilitiy in our docker images which turned out to be related to the version of go used in the latest secrets-init which is 1.21.10.

Here is the link to the security vulnerability,

The issue should be fixed in go 1.21.11. Based on what I see in the Dockerfile no code changes are needed, it should be enough to rebuild the docker image and it should switch to the latest version of go.

Thank you for you work and let me know if I can provide any additional information.

[alexei-led]

switched to go 1.22