build(deps): bump k8s.io/kubectl from 0.35.3 to 0.36.3 - #596
build(deps): bump k8s.io/kubectl from 0.35.3 to 0.36.3#596dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [k8s.io/kubectl](https://github.com/kubernetes/kubectl) from 0.35.3 to 0.36.3. - [Commits](kubernetes/kubectl@v0.35.3...v0.36.3) --- updated-dependencies: - dependency-name: k8s.io/kubectl dependency-version: 0.36.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
kind/chore
📝 WalkthroughWalkthroughUpdated Kubernetes dependencies from v0.35.3 to v0.36.3, refreshed related indirect dependencies, updated protobuf, and removed two indirect dependencies from ChangesDependency updates
Estimated code review effort: 1 (Trivial) | ~5 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 177: Update the oras.land/oras-go/v2 dependency in go.mod from v2.6.0 to
v2.6.1 or later, refresh the corresponding module checksums if needed, and rerun
the vulnerability scanner to verify the resolved dependency is no longer
flagged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: a21eb3e8-ed28-43bf-a2f9-f888c9676767
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
| k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect | ||
| k8s.io/streaming v0.36.3 // indirect | ||
| k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 // indirect | ||
| oras.land/oras-go/v2 v2.6.0 // indirect |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
module='oras.land/oras-go/v2'
go mod why -m "$module"
go list -deps ./... | grep -F "$module" || true
go list -m -u -json "$module"Repository: meshery/meshsync
Length of output: 7214
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
python3 - <<'PY'
import json, urllib.request
payload = json.dumps({
"package": {"name": "oras.land/oras-go/v2", "ecosystem": "Go"},
"version": "2.6.0",
}).encode()
req = urllib.request.Request(
"https://api.osv.dev/v1/query",
data=payload,
headers={"Content-Type": "application/json"},
)
with urllib.request.urlopen(req) as response:
data = json.load(response)
for vuln in data.get("vulns", []):
print(json.dumps({
"id": vuln.get("id"),
"summary": vuln.get("summary"),
"severity": vuln.get("severity"),
"affected": vuln.get("affected"),
}, indent=2))
print("\nRelevant module constraints:")
for line_no, line in enumerate(open("go.mod"), 1):
if any(term in line for term in ("k8s.io/", "helm.sh/helm", "oras.land/oras-go")):
print(f"{line_no}: {line.rstrip()}")
PYRepository: meshery/meshsync
Length of output: 2441
🌐 Web query:
oras.land/oras-go/v2 v2.6.0 OSV vulnerabilities archive path traversal registry credential token forwarding patched version
💡 Result:
The library oras.land/oras-go/v2 version 2.6.0 and earlier are affected by multiple security vulnerabilities [1][2][3]. All these issues are addressed in version 2.6.1, which is the recommended patched version [2][4][5]. Summary of vulnerabilities: Credential and Token Forwarding * Registry Credential Forwarding (CVE-2026-50151): The library failed to validate the Location header during monolithic blob uploads, allowing a malicious registry to redirect the request to a cross-host endpoint while reusing the original Authorization header, leading to credential exfiltration [4][6][7]. A related, residual vulnerability allowed for credential forwarding on manifest redirects [3]. * Bearer Token Realm Validation (GHSA-xf85-363p-868w): The library followed unvalidated Bearer realm URLs, enabling server-side request forgery (SSRF) to internal network endpoints (e.g., IMDS) and permitting TLS downgrade attacks by accepting plaintext http schemes from https-secured registries [1][8]. Path Traversal * Symlink Traversal (CVE-2026-50162): The file store write operation used a lexical check for working directory confinement that did not account for symlink traversal. This allowed an attacker to write files outside the intended working directory [2][9][10]. * Hardlink CWD Resolution (CVE-2026-50163 / GHSA-fxhp-mv3v-67qp): Tar extraction logic incorrectly resolved relative hardlink targets against the process current working directory (CWD) rather than the extraction directory, enabling an attacker to create hardlinks to files outside the intended extract tree [11][12][5]. Version 2.6.1 includes the necessary fixes for these path traversal and credential handling flaws [2][4][5].
Citations:
- 1: https://osv.dev/vulnerability/GHSA-xf85-363p-868w
- 2: https://osv.dev/vulnerability/CVE-2026-50162
- 3: GHSA-vh4v-2xq2-g5cg
- 4: https://nvd.nist.gov/vuln/detail/cve-2026-50151
- 5: fix: prevent hardlink path traversal via process CWD (GHSA-fxhp-mv3v-67qp) oras-project/oras-go#1232
- 6: GHSA-jxpm-75mh-9fp7
- 7: GHSA-jxpm-75mh-9fp7
- 8: GHSA-xf85-363p-868w
- 9: GHSA-8xwf-rjm4-xvhv
- 10: https://nvd.nist.gov/vuln/detail/CVE-2026-50162
- 11: GHSA-fxhp-mv3v-67qp
- 12: https://osv.dev/vulnerability/GHSA-fxhp-mv3v-67qp
Upgrade oras.land/oras-go/v2
v2.6.0 is reachable through helm.sh/helm/v3/pkg/registry and has multiple high-severity vulnerabilities. Upgrade to v2.6.1 or later, then rerun the vulnerability scanner.
🧰 Tools
🪛 OSV Scanner (2.4.0)
[HIGH] 177-177: oras.land/oras-go/v2 2.6.0: Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go
(GO-2026-5879)
[HIGH] 177-177: oras.land/oras-go/v2 2.6.0: Hardlink path traversal during tar extraction in oras.land/oras-go
(GO-2026-5880)
[HIGH] 177-177: oras.land/oras-go/v2 2.6.0: Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go
(GO-2026-5882)
[HIGH] 177-177: oras.land/oras-go/v2 2.6.0: ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go
(GO-2026-5884)
[HIGH] 177-177: oras.land/oras-go/v2 2.6.0: Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go
(GO-2026-5885)
[HIGH] 177-177: oras.land/oras-go/v2 2.6.0: oras-go has file store write outside workingDir via symlink traversal
[HIGH] 177-177: oras.land/oras-go/v2 2.6.0: oras-go tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution
[HIGH] 177-177: oras.land/oras-go/v2 2.6.0: oras-go blob upload vulnerable to credential forwarding via unvalidated Location header
[HIGH] 177-177: oras.land/oras-go/v2 2.6.0: ORAS Go forwards registry credentials across registry redirects
[HIGH] 177-177: oras.land/oras-go/v2 2.6.0: oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 177, Update the oras.land/oras-go/v2 dependency in go.mod
from v2.6.0 to v2.6.1 or later, refresh the corresponding module checksums if
needed, and rerun the vulnerability scanner to verify the resolved dependency is
no longer flagged.
Source: Linters/SAST tools
Bumps k8s.io/kubectl from 0.35.3 to 0.36.3.
Commits
73fdc7aUpdate dependencies to v0.36.3 tag58802aeMerge pull request #140296 from jpbetz/cherry-pick-smd-306-revertfde8e27Bump sigs.k8s.io/structured-merge-diff/v6 to v6.3.32a397b1Merge pull request #138500soltysh/automated-cherry-pick-of-#1384998598401Escape path inside the container50e8956Merge remote-tracking branch 'origin/master' into release-1.363f435caMerge pull request #138346 from dashpole/update_otel_prop36707c8Merge remote-tracking branch 'origin/master' into release-1.365e5dfaaUpdate github.com/moby/spdystream from v0.5.0 to v0.5.1777119fupdate go.opentelemetry.io/otel to v1.41.0Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit