Go stdlib vulnerabilities requiring Go version bump (go 1.17 modules)

Go stdlib vulnerabilities in go 1.17 modules

Affected modules:

• test/backward_compatibility/releasedVersion/go.mod (go 1.17)
• test/backward_compatibility/currentCodeVersion/go.mod (go 1.17)

Count: ~50 CVEs related to stdlib@1.17.99

These modules are pinned to Go 1.17, which has a large number of known stdlib vulnerabilities spanning from 2022 through 2026. These are resolved by bumping the go directive.

Most Critical CVEs

Full list includes vulnerabilities in

• crypto/tls, crypto/x509, crypto/ecdsa, crypto/elliptic
• net/http, net/netip, net/textproto
• encoding/gob, encoding/xml
• os, os/exec
• path/filepath, archive/tar, archive/zip
• go/parser, go/build/constraint
• html/template, regexp/syntax
• math/big, internal/cgi

Spans GO-2022-* through GO-2026-* advisories.

Fix

Update the go directive in both backward compatibility test modules from go 1.17 to at least go 1.22+, then run go mod tidy.

Note: Since these are backward compatibility test modules, bumping the Go version may defeat their purpose of testing against older Go versions. This needs careful consideration of the testing strategy.

Note: The protobuf dependency bump is tracked separately in #247.

Read test/backward_compatibility/releasedVersion/go.mod and test/backward_compatibility/currentCodeVersion/go.mod, then inspect how these modules support backward-compatibility testing. Run go mod tidy after evaluating the proposed Go directive bump. Done means the stdlib vulnerabilities are addressed without undermining the purpose of the older-version test modules.