Backport of security: Upgrade go version to 1.22.12 into release/1.20…

….x (#22133)

* backport of commit 21adeb4

* backport of commit caa60da

* backport of commit 285c44e

---------

Co-authored-by: Abhishek <[email protected]>

.changelog/22132.txt

@@ -0,0 +1,4 @@
+```release-note:security
+Upgrade Go to use v1.22.12 and bump Go X-Repositories to latest. This addresses CVE
+[CVE-2025-22866](https://nvd.nist.gov/vuln/detail/CVE-2025-22866)
+```

.go-version

@@ -1 +1 @@
-1.22.11
+1.22.12

agent/consul/state/txn.go

@@ -28,7 +28,7 @@ func (s *Store) txnKVS(tx WriteTxn, idx uint64, op *structs.TxnKVOp) (structs.Tx
 	var entry *structs.DirEntry
 	var err error
 
-	// enumcover: api.KVOp
+	// enumcover:api.KVOp
 	switch op.Verb {
 	case api.KVSet:
 		entry = &op.DirEnt
@@ -137,7 +137,7 @@ func (s *Store) txnKVS(tx WriteTxn, idx uint64, op *structs.TxnKVOp) (structs.Tx
 func txnSession(tx WriteTxn, idx uint64, op *structs.TxnSessionOp) error {
 	var err error
 
-	// enumcover: api.SessionOp
+	// enumcover:api.SessionOp
 	switch op.Verb {
 	case api.SessionDelete:
 		err = sessionDeleteWithSession(tx, &op.Session, idx)

agent/consul/txn_endpoint.go

@@ -268,7 +268,7 @@ func (t *Txn) Read(args *structs.TxnReadRequest, reply *structs.TxnReadResponse)
 // nodeVerbValidate checks for a known operation type. For certain operations,
 // it also indicated if further "preApply" checks are required.
 func nodeVerbValidate(op api.NodeOp) (bool, error) {
-	// enumcover: api.NodeOp
+	// enumcover:api.NodeOp
 	switch op {
 	// Skip the pre-apply checks if this is a GET.
 	case api.NodeGet:
@@ -283,7 +283,7 @@ func nodeVerbValidate(op api.NodeOp) (bool, error) {
 // serviceVerbValidate checks for a known operation type. For certain operations,
 // it also indicated if further "preApply" checks are required.
 func serviceVerbValidate(op api.ServiceOp) (bool, error) {
-	// enumcover: api.ServiceOp
+	// enumcover:api.ServiceOp
 	switch op {
 	// Skip the pre-apply checks if this is a GET.
 	case api.ServiceGet:
@@ -298,7 +298,7 @@ func serviceVerbValidate(op api.ServiceOp) (bool, error) {
 // checkVerbValidate checks for a known operation type. For certain operations,
 // it also indicated if further "preApply" checks are required.
 func checkVerbValidate(op api.CheckOp) (bool, error) {
-	// enumcover: api.CheckOp
+	// enumcover:api.CheckOp
 	switch op {
 	// Skip the pre-apply checks if this is a GET.
 	case api.CheckGet:
@@ -312,7 +312,7 @@ func checkVerbValidate(op api.CheckOp) (bool, error) {
 
 // intentionVerbValidate checks for a known operation type.
 func intentionVerbValidate(op structs.IntentionOp) error {
-	// enumcover: structs.IntentionOp
+	// enumcover:structs.IntentionOp
 	switch op {
 	case structs.IntentionOpCreate, structs.IntentionOpDelete, structs.IntentionOpUpdate, structs.IntentionOpDeleteAll, structs.IntentionOpUpsert:
 		return nil
@@ -323,7 +323,7 @@ func intentionVerbValidate(op structs.IntentionOp) error {
 
 // sessionVerbValidate checks for a known operation type.
 func sessionVerbValidate(op api.SessionOp) error {
-	// enumcover: api.SessionOp
+	// enumcover:api.SessionOp
 	switch op {
 	case api.SessionDelete:
 		return nil

api/go.mod

@@ -1,6 +1,6 @@
 module github.com/hashicorp/consul/api
 
-go 1.22.11
+go 1.22.12
 
 replace github.com/hashicorp/consul/sdk => ../sdk
 

envoyextensions/go.mod

@@ -1,6 +1,6 @@
 module github.com/hashicorp/consul/envoyextensions
 
-go 1.22.11
+go 1.22.12
 
 replace (
 	github.com/hashicorp/consul/api => ../api

go.mod

@@ -1,6 +1,6 @@
 module github.com/hashicorp/consul
 
-go 1.22.11
+go 1.22.12
 
 replace (
 	github.com/hashicorp/consul/api => ./api

internal/tools/proto-gen-rpc-glue/e2e/consul/go.mod

@@ -1,5 +1,5 @@
 module github.com/hashicorp/consul
 
-go 1.22.11
+go 1.22.12
 
 require google.golang.org/protobuf v1.28.1

internal/tools/proto-gen-rpc-glue/e2e/go.mod

@@ -1,6 +1,6 @@
 module github.com/hashicorp/consul/internal/tools/proto-gen-rpc-glue/e2e
 
-go 1.22.11
+go 1.22.12
 
 replace github.com/hashicorp/consul => ./consul
 

internal/tools/proto-gen-rpc-glue/go.mod

@@ -1,6 +1,6 @@
 module github.com/hashicorp/consul/internal/tools/proto-gen-rpc-glue
 
-go 1.22.11
+go 1.22.12
 
 require github.com/stretchr/testify v1.8.4
 

internal/tools/protoc-gen-consul-rate-limit/go.mod

@@ -1,6 +1,6 @@
 module github.com/hashicorp/consul/internal/tools/protoc-gen-consul-rate-limit
 
-go 1.22.11
+go 1.22.12
 
 replace github.com/hashicorp/consul/proto-public => ../../../proto-public
 

proto-public/go.mod

@@ -1,6 +1,6 @@
 module github.com/hashicorp/consul/proto-public
 
-go 1.22.11
+go 1.22.12
 
 require (
 	google.golang.org/grpc v1.56.3

sdk/go.mod

@@ -1,6 +1,6 @@
 module github.com/hashicorp/consul/sdk
 
-go 1.22.11
+go 1.22.12
 
 require (
 	github.com/hashicorp/go-cleanhttp v0.5.2

test-integ/go.mod

@@ -1,6 +1,6 @@
 module github.com/hashicorp/consul/test-integ
 
-go 1.22.11
+go 1.22.12
 
 require (
 	github.com/google/go-cmp v0.6.0

test/integration/connect/envoy/test-sds-server/go.mod

@@ -1,6 +1,6 @@
 module test-sds-server
 
-go 1.22.11
+go 1.22.12
 
 require (
 	github.com/envoyproxy/go-control-plane v0.12.0

test/integration/consul-container/go.mod

@@ -1,6 +1,6 @@
 module github.com/hashicorp/consul/test/integration/consul-container
 
-go 1.22.11
+go 1.22.12
 
 require (
 	fortio.org/fortio v1.54.0

testing/deployer/go.mod

@@ -1,6 +1,6 @@
 module github.com/hashicorp/consul/testing/deployer
 
-go 1.22.11
+go 1.22.12
 
 require (
 	github.com/avast/retry-go v3.0.0+incompatible

troubleshoot/go.mod

@@ -1,6 +1,6 @@
 module github.com/hashicorp/consul/troubleshoot
 
-go 1.22.11
+go 1.22.12
 
 replace (
 	github.com/hashicorp/consul/api => ../api