feat(deps): bump helm to 3.20.2 (k8s 0.35) for common-lib & kubelink#396
Draft
prkhrkat wants to merge 2 commits into
Draft
feat(deps): bump helm to 3.20.2 (k8s 0.35) for common-lib & kubelink#396prkhrkat wants to merge 2 commits into
prkhrkat wants to merge 2 commits into
Conversation
Major dependency bump, stacked on the safe-patches branch. Completes the remaining helm CVE fix (Dependabot #221 common-lib, #220 kubelink) that requires k8s >= 0.35.1. - helm.sh/helm/v3 3.18.6 -> 3.20.2 (common-lib, kubelink) - k8s.io/* 0.33.3 -> 0.35.1 (pulled transitively by helm 3.20.2) Unlike the devtron repo, neither module imports argo-cd or gitops-engine, so the k8s 0.35 gogo-protobuf removal caused no breakage — both modules build clean (go build ./..., exit 0) with no code changes. chart-sync was already on this stack. Requires regression testing of the helm/k8s integration (chart install/ upgrade, resource rendering) before release, hence a separate branch/PR from the safe security patches. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
kubewatch's image build failed with:
go: go.mod requires go >= 1.25.7 (running go 1.25.5; GOTOOLCHAIN=local)
The Dependabot patch (d3b4df8) wrote `go 1.25.7` into kubewatch/go.mod,
but golang:1.25-alpine3.21 does NOT track the latest 1.25 patch. Docker
Hub stopped publishing 1.25.x-alpine3.21 variants - that tag was last
pushed 2025-12-02 and is pinned to Go 1.25.5; no 1.25.7-alpine3.21
exists. golang:1.25-alpine is still maintained and currently resolves to
1.25.12.
authenticator and common-lib/securestore/rollback were separately broken:
builder on Go 1.24 with go.mod already at 1.25.0.
All three move to golang:1.25-alpine. Side effect: the builder base goes
alpine 3.21 -> 3.22. Safe for the two stages that keep an alpine:3.21.2
runtime - both alpine versions ship musl 1.2.5 (r11 vs r12), and
kubewatch/rollback build with CGO_ENABLED=0 anyway.
Still on the frozen tag and due to break the same way once their go
directive passes 1.25.5: ci-runner (x2), image-scanner, lens, git-sensor.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps helm/v3 3.18.6 → 3.20.2 for common-lib and kubelink, completing the last helm CVE fix (Dependabot #221, #220, medium). helm 3.20.2 hard-requires k8s ≥ 0.35.1, so this pulls the k8s stack 0.33.3 → 0.35.1.
Why this is separate from the safe-patches PR
k8s 0.35 completed the gogo-protobuf removal — the same change that forced the argo-cd v3 migration in the
devtronrepo. Here it's far simpler: neither common-lib nor kubelink imports argo-cd or gitops-engine, so nothing depends on the removed protobuf surface. Both modules build clean with no code changes. (chart-sync was already on helm 3.20.1 + k8s 0.35 and is handled in #395.)Changes
Verification
go build ./...(vendor mode) → exit 0 for both modules, no code edits required.Testing needed before merge
Regression-test the helm/k8s integration (chart install/upgrade, manifest rendering, resource tree) — this is a helm minor + k8s minor bump on the deployment-critical modules.
🤖 Generated with Claude Code