CVE-2024-24790: bump go to 1.22.6

[sdx-jkataja]

Fixes vulnerability CVE-2024-24790 by updating Go to 1.22.6

Fixes #913

[sysadmind]

This needs to be changed in .promu.yml as well although there it should just be 1.22.
See here: https://github.com/prometheus/prometheus/blob/main/.promu.yml

[sdx-jkataja]

Commit fe96c8f

[sysadmind]

I think with a version this new, the toolchain declaration is required.

[sdx-jkataja]

Please advise on what's needed for the toolchain declaration

[sdx-jkataja]

Do you mean the following declaration?

go 1.22.6

toolchain go1.22.6

Running go mod tidy removes the toolchain line, so I assume it won't be required.

[sysadmind]

I think it depends on your local go version. After a second thought, we don't need to change this file at all. This is only a minimum go version and we don't need any new language features so we can leave this as 1.20

[sdx-jkataja]

I'm go newbie so I had to check, and it appears you're correct. I have go 1.22.5 and when I built the code in master branch and then scan with Syft, it reports that the image contains go standard library 1.22.5.

Should I remove the change in go.mod and rely on CI files to use the updated go version?

[sysadmind]

Correct, you don't need the change in go.mod and in that case you also don't need the go.sum changes.

[sdx-jkataja]

Done, I removed that commit

[mohhai1]

@sysadmind , kindly, when do we expect w release/tag with the fix?

[sysadmind]

https://github.com/prometheus-community/elasticsearch_exporter/releases/tag/v1.8.0