Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump go1.21 and update dependencies #149

Closed
wants to merge 3 commits into from

Conversation

jkhelil
Copy link
Contributor

@jkhelil jkhelil commented Oct 17, 2023

Changes

  • Bump go to 1.21
  • Bump sigs.k8s.io/controller-runtime to 0.14.6
  • Bump k8s.io/api to 0.27.4
  • Update OWNERS

Submitter Checklist

  • Includes tests if functionality changed/was added
  • Includes docs if changes are user-facing
  • Set a kind label on this PR
  • Release notes block has been filled in, or marked NONE

See the contributor guide
for details on coding conventions, github and prow interactions, and the code review process.

Release Notes

NONE

@jkhelil
Copy link
Contributor Author

jkhelil commented Oct 17, 2023

@shipwright-io/operator-approvers PTAL

Copy link
Member

@adambkaplan adambkaplan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See comment about k8s/client-go. In addition. please provide a descriptive title which indicates this fixes a CVE.

k8s.io/api v0.27.4
k8s.io/apiextensions-apiserver v0.27.4
k8s.io/apimachinery v0.27.4
k8s.io/client-go v1.5.2
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please ensure client-go is aligned with the other k8s versions. This will break things otherwise.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes there is a replcaement directive for client-go
k8s.io/client-go => k8s.io/client-go v0.26.8
the k8s.io/client-go v1.5.2 is forced by go mod algorithm
I can see the same thing for the tekton operator go mod https://github.com/tektoncd/operator/blob/main/go.mod#L33

Also, it is worth adding that i tested it locally and it is working correctly

@jkhelil jkhelil changed the title Bump go1.21 Bump go1.21 and update golang.org/x dependencies to mitigate CVE-2023-39325 Oct 17, 2023
@jkhelil
Copy link
Contributor Author

jkhelil commented Oct 18, 2023

@shipwright-io/operator-reviewers
/assign @adambkaplan

@jkhelil
Copy link
Contributor Author

jkhelil commented Oct 18, 2023

/assign @coreydaley

@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 22, 2023
@openshift-merge-robot openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 23, 2023
@jkhelil jkhelil changed the title Bump go1.21 and update golang.org/x dependencies to mitigate CVE-2023-39325 Bump go1.21 and update dependencies Oct 23, 2023
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Oct 23, 2023

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from adambkaplan. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Archived in project
Development

Successfully merging this pull request may close these issues.

4 participants