chore(deps): patch Dependabot security alerts across all modules#395
Open
prkhrkat wants to merge 2 commits into
Open
chore(deps): patch Dependabot security alerts across all modules#395prkhrkat wants to merge 2 commits into
prkhrkat wants to merge 2 commits into
Conversation
Safe security patches applied to every module's go.mod and re-vendored. 9 of 10 modules build clean (go build ./...); common-lib/securestore/ rollback has only a PRE-EXISTING failure (sql.BuildTLSConfig, from the postgres-SSL work vs its pinned common-lib) that is unrelated to these bumps and is not part of `make build`. Per-module updates: - all modules: golang.org/x/crypto -> v0.52.0 (critical), x/net -> v0.55.0 - chart-sync: + oras-go/v2 2.6.1, containerd 1.7.33 (replace target bumped), helm/v3 3.20.1 -> 3.20.2 (already on k8s 0.35, clean patch) - ci-runner: + otlptracehttp 1.43.0, aws-sdk s3 1.97.3, eventstream 1.7.8 - common-lib: + oras-go/v2 2.6.1, aws-sdk s3 1.97.3, eventstream 1.7.8 - git-sensor: + go-git/v5 5.19.1, go-billy/v5 5.9.0 - kubelink: + oras-go/v2 2.6.1, containerd 1.7.33 - kubewatch: + oras-go/v2 2.6.1, go-git/v5 5.19.1, go-billy/v5 5.9.0, pgx/v5 5.9.2, otlpmetrichttp 1.43.0, argo-workflows/v3 3.7.11 -> 3.7.14 - common-lib/securestore/rollback: x/crypto -> v0.52.0 Deliberately NOT included (deferred to a separate branch or no fix): - helm/v3 3.20.2 for common-lib & kubelink: forces k8s 0.33 -> 0.35 (major), handled on a separate branch for regression testing - github.com/argoproj/argo-cd/v2 (kubewatch): no patched version - github.com/quay/claircore (image-scanner): no patched version - github.com/docker/docker (common-lib, ci-runner): no patched version Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
prkhrkat
requested review from
prakarsh-dt,
vikramdevtron and
vivek-devtron
as code owners
July 16, 2026 08:55
|
Some linked issues are invalid. Please update the issue links:\nIssue # in is not found or invalid (HTTP }404).\n |
kubewatch's image build failed with:
go: go.mod requires go >= 1.25.7 (running go 1.25.5; GOTOOLCHAIN=local)
The Dependabot patch (d3b4df8) wrote `go 1.25.7` into kubewatch/go.mod,
but golang:1.25-alpine3.21 does NOT track the latest 1.25 patch. Docker
Hub stopped publishing 1.25.x-alpine3.21 variants - that tag was last
pushed 2025-12-02 and is pinned to Go 1.25.5; no 1.25.7-alpine3.21
exists. golang:1.25-alpine is still maintained and currently resolves to
1.25.12.
authenticator and common-lib/securestore/rollback were separately broken:
builder on Go 1.24 with go.mod already at 1.25.0.
All three move to golang:1.25-alpine. Side effect: the builder base goes
alpine 3.21 -> 3.22. Safe for the two stages that keep an alpine:3.21.2
runtime - both alpine versions ship musl 1.2.5 (r11 vs r12), and
kubewatch/rollback build with CGO_ENABLED=0 anyway.
Still on the frozen tag and due to break the same way once their go
directive passes 1.25.5: ci-runner (x2), image-scanner, lens, git-sensor.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Some linked issues are invalid. Please update the issue links:\nIssue # in is not found or invalid (HTTP }404).\n |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Patches Dependabot security alerts across all 10 modules of the monorepo by bumping vulnerable dependencies to their fixed versions and re-vendoring each module. Safe/stable bumps only — the helm→k8s-0.35 major upgrade is deferred to a separate branch.
Verification:
go build ./...(vendor mode) passes for 9 of 10 modules. The only failure iscommon-lib/securestore/rollbackonsql.BuildTLSConfig— a pre-existing error (itsreplace-pinned common-lib predates that function from the postgres-SSL work), unrelated to these bumps and not part ofmake build. Its diff here is crypto-only.Per-module changes
golang.org/x/crypto→ 0.52.0 (fixes the critical/high cluster),x/net→ 0.55.0oras-go/v22.6.1,containerd1.7.33 (replace target bumped),helm/v33.20.1 → 3.20.2 (already on k8s 0.35 — clean patch)otlptracehttp1.43.0,aws-sdk s31.97.3,eventstream1.7.8oras-go/v22.6.1,aws-sdk s31.97.3,eventstream1.7.8go-git/v55.19.1,go-billy/v55.9.0 (no API breakage)oras-go/v22.6.1,containerd1.7.33oras-go/v22.6.1,go-git/v55.19.1,go-billy/v55.9.0,pgx/v55.9.2,otlpmetrichttp1.43.0,argo-workflows/v33.7.11 → 3.7.14x/crypto→ 0.52.0k8s stayed on 0.33.x for every module except chart-sync (already 0.35). No argo-cd or k8s major moves here.
Deferred / no-fix
argoproj/argo-cd/v2(kubewatch),quay/claircore(image-scanner),docker/docker(common-lib, ci-runner).🤖 Generated with Claude Code