KKeller033756 (Community Member) asked a question.

Does SAST scanning support GoLang 1.25.x?

The documentation indicates 1.25 or earlier so not sure if that means 1.25.x or earlier or if that means 1.25.0 or earlier.

 

My company has a pipeline for building GoLang services. We are currently on version 1.24.9 and looking to upgrade to version 1.25.4. The existing pipelines run just fine and the SAST scanning is working and reporting known/expected issues. However when we upgrade to 1.25.4(no other changes) then the SAST scans stop working.

 

The following is what we see when it fails. But with the older version of Go it finds the artifact to scan.

```

[17 Nov 2025 17:54:12,0144] PIPELINE-SCAN DEBUG: Response: 200: {"_links": {"root": {"href": "/"}, "self": {"href": "/scans/8d5d3a38-1605-49be-b106-7b553b9f3db4"}, "help": {"href": "https://docs.veracode.com/"}, "create": {"href": "/scans"}, "details": {"href": "/scans/8d5d3a38-1605-49be-b106-7b553b9f3db4"}}, "scan_id": "8d5d3a38-1605-49be-b106-7b553b9f3db4", "scan_status": "FAILURE", "api_version": 1, "app_id": null, "project_name": "pam-ssh-proxy", "project_uri": "https://gitlab-ci-token:[MASKED]@gitlab.com/saviynt/pam-ssh-proxy.git", "project_ref": "feature-PAM-18215-golangfips", "commit_hash": null, "dev_stage": "DEVELOPMENT", "binary_name": "source_code.zip", "binary_size": 4719829, "binary_hash": "49f9d627fd5d10151d5fb64765c487eaf14634e50c8a7d40090b467f1d1a5ff9", "binary_segments_expected": 2, "binary_segments_uploaded": 2, "scan_timeout": 60, "scan_duration": null, "results_size": null, "message": "No files found for scanning", "created": "2025-11-17T17:53:45.248317", "changed": "2025-11-17T17:54:10.163338", "modules": [], "selected_modules": [], "display_modules": [], "display_selected_modules": [], "engine_version": "20251020194313"}: OK

[17 Nov 2025 17:54:12,0144] PIPELINE-SCAN ERROR: The scan failed to complete: there are no results to analyze.

```

 

Again, no other changes outside of changing the go.mod files to reference 1.25.4 instead of 1.24.9.

 

The pipeline is downloading the scanner:

```

# 4. Download and run Veracode

- curl -o /opt/pipeline-scan.zip https://downloads.veracode.com/securityscan/pipeline-scan-LATEST.zip

- unzip /opt/pipeline-scan.zip -d /opt

```

 

Any advice?


Topics (4)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.