misc: patch Dependabot security alerts across all modules - #395
Merged
Conversation
Safe security patches applied to every module's go.mod and re-vendored. 9 of 10 modules build clean (go build ./...); common-lib/securestore/ rollback has only a PRE-EXISTING failure (sql.BuildTLSConfig, from the postgres-SSL work vs its pinned common-lib) that is unrelated to these bumps and is not part of `make build`. Per-module updates: - all modules: golang.org/x/crypto -> v0.52.0 (critical), x/net -> v0.55.0 - chart-sync: + oras-go/v2 2.6.1, containerd 1.7.33 (replace target bumped), helm/v3 3.20.1 -> 3.20.2 (already on k8s 0.35, clean patch) - ci-runner: + otlptracehttp 1.43.0, aws-sdk s3 1.97.3, eventstream 1.7.8 - common-lib: + oras-go/v2 2.6.1, aws-sdk s3 1.97.3, eventstream 1.7.8 - git-sensor: + go-git/v5 5.19.1, go-billy/v5 5.9.0 - kubelink: + oras-go/v2 2.6.1, containerd 1.7.33 - kubewatch: + oras-go/v2 2.6.1, go-git/v5 5.19.1, go-billy/v5 5.9.0, pgx/v5 5.9.2, otlpmetrichttp 1.43.0, argo-workflows/v3 3.7.11 -> 3.7.14 - common-lib/securestore/rollback: x/crypto -> v0.52.0 Deliberately NOT included (deferred to a separate branch or no fix): - helm/v3 3.20.2 for common-lib & kubelink: forces k8s 0.33 -> 0.35 (major), handled on a separate branch for regression testing - github.com/argoproj/argo-cd/v2 (kubewatch): no patched version - github.com/quay/claircore (image-scanner): no patched version - github.com/docker/docker (common-lib, ci-runner): no patched version Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
prkhrkat
requested review from
prakarsh-dt,
vikramdevtron and
vivek-devtron
as code owners
July 16, 2026 08:55
|
Some linked issues are invalid. Please update the issue links:\nIssue # in is not found or invalid (HTTP }404).\n |
kubewatch's image build failed with:
go: go.mod requires go >= 1.25.7 (running go 1.25.5; GOTOOLCHAIN=local)
The Dependabot patch (d3b4df8) wrote `go 1.25.7` into kubewatch/go.mod,
but golang:1.25-alpine3.21 does NOT track the latest 1.25 patch. Docker
Hub stopped publishing 1.25.x-alpine3.21 variants - that tag was last
pushed 2025-12-02 and is pinned to Go 1.25.5; no 1.25.7-alpine3.21
exists. golang:1.25-alpine is still maintained and currently resolves to
1.25.12.
authenticator and common-lib/securestore/rollback were separately broken:
builder on Go 1.24 with go.mod already at 1.25.0.
All three move to golang:1.25-alpine. Side effect: the builder base goes
alpine 3.21 -> 3.22. Safe for the two stages that keep an alpine:3.21.2
runtime - both alpine versions ship musl 1.2.5 (r11 vs r12), and
kubewatch/rollback build with CGO_ENABLED=0 anyway.
Still on the frozen tag and due to break the same way once their go
directive passes 1.25.5: ci-runner (x2), image-scanner, lens, git-sensor.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Some linked issues are invalid. Please update the issue links:\nIssue # in is not found or invalid (HTTP }404).\n |
…62507d0fd31f across all services
|
Some linked issues are invalid. Please update the issue links:\nIssue # in is not found or invalid (HTTP }404).\n |
|
Some linked issues are invalid. Please update the issue links:\nIssue # in is not found or invalid (HTTP }404).\n |
Dependabot bumped github.com/cyphar/filepath-securejoin v0.4.1 -> v0.6.1. v0.6.0 removed the deprecated top-level MkdirAll wrapper (moved to pathrs-lite), but vendored argo-cd/v2 v2.14.20 still calls securejoin.MkdirAll in util/io/files/secure_mkdir_linux.go: vendor/github.com/argoproj/argo-cd/v2/util/io/files/secure_mkdir_linux.go:16:20: undefined: securejoin.MkdirAll The failure is linux-only (the file is //go:build linux), so it only shows up in the GOOS=linux Makefile build, not in a local darwin go build. A replace for this already existed but was version-qualified (v0.4.1 => v0.3.6), so it stopped firing once MVS selected v0.6.1. Made it unversioned so a future require bump cannot silently bypass it again. v0.3.6 is required specifically: argo-cd passes int(mode), and v0.4.0 changed the arg to os.FileMode. v0.4.1 and v0.5.2 both fail to compile. govulncheck reports no advisory against filepath-securejoin at v0.3.6. Only kubewatch is affected; git-sensor and kubelink do not vendor argo-cd's util/io/files. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Some linked issues are invalid. Please update the issue links:\nIssue # in is not found or invalid (HTTP }404).\n |
vivek-devtron
approved these changes
Aug 3, 2026
prkhrkat
changed the title
github-actions
Bot
added
PR:Ready-to-Review
and removed
PR:Issue-verification-failed
labels
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Patches Dependabot security alerts across all 10 modules of the monorepo by bumping vulnerable dependencies to their fixed versions and re-vendoring each module. Safe/stable bumps only — the helm→k8s-0.35 major upgrade is deferred to a separate branch.
Verification:
go build ./...(vendor mode) passes for 9 of 10 modules. The only failure iscommon-lib/securestore/rollbackonsql.BuildTLSConfig— a pre-existing error (itsreplace-pinned common-lib predates that function from the postgres-SSL work), unrelated to these bumps and not part ofmake build. Its diff here is crypto-only.Per-module changes
golang.org/x/crypto→ 0.52.0 (fixes the critical/high cluster),x/net→ 0.55.0oras-go/v22.6.1,containerd1.7.33 (replace target bumped),helm/v33.20.1 → 3.20.2 (already on k8s 0.35 — clean patch)otlptracehttp1.43.0,aws-sdk s31.97.3,eventstream1.7.8oras-go/v22.6.1,aws-sdk s31.97.3,eventstream1.7.8go-git/v55.19.1,go-billy/v55.9.0 (no API breakage)oras-go/v22.6.1,containerd1.7.33oras-go/v22.6.1,go-git/v55.19.1,go-billy/v55.9.0,pgx/v55.9.2,otlpmetrichttp1.43.0,argo-workflows/v33.7.11 → 3.7.14x/crypto→ 0.52.0k8s stayed on 0.33.x for every module except chart-sync (already 0.35). No argo-cd or k8s major moves here.
Deferred / no-fix
argoproj/argo-cd/v2(kubewatch),quay/claircore(image-scanner),docker/docker(common-lib, ci-runner).🤖 Generated with Claude Code