Skip to content

cyclonedx-gomod fails with go 1.23.6

Describe the bug

Image cyclonedx/cyclonedx-gomod:latest is not using an updated version of go

So it fails for any lock file needing this version.

$ cyclonedx-gomod "${go_mode:0:3}" -json -output reports/go-sbom.cyclonedx.json $GO_SBOM_OPTS
4:08PM ERR error="failed to load package: command `/usr/local/go/bin/go list -json -e ./.` failed: exit status 1"
go: go.mod requires go >= 1.23.5 (running go 1.23.4; GOTOOLCHAIN=local)

Solution proposals

  • Ask maintainer for an update
  • Using go official image and go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest instead of projects image
Edited by Clement Bois