Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bump k8s.io/kubernetes and google.golang.org/grpc to fix vulnerabilities #607

Merged
merged 2 commits into from
Oct 31, 2023
Merged

Bump k8s.io/kubernetes and google.golang.org/grpc to fix vulnerabilities #607

merged 2 commits into from
Oct 31, 2023

Conversation

DamianSawicki
Copy link
Collaborator

@DamianSawicki DamianSawicki commented Oct 30, 2023 •
edited
Loading

Bumping k8s.io/kubernetes from 1.24.10 to the latest version of 1.26, namely 1.26.10. Reasons:

Bumping google.golang.org/grpc from v1.49.0 to v1.56.3. Reason:

@k8s-ci-robot k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Oct 30, 2023
@DamianSawicki DamianSawicki changed the title Bump k8s.io/kubernetes to fix vulnerabilities Bump k8s.io/kubernetes and google.golang.org/grpc to fix vulnerabilities Oct 30, 2023
@DamianSawicki
Bump k8s.io/kubernetes to fix vulnerabilities
bbb51c5 
Bumping to the latest version of 1.26, namely 1.26.10 because of
the following vulnerabilities:
 * CVE-2023-2728 was fixed in 1.24.15.
 * CVE-2023-2431 was fixed in 1.24.14.
 * CVE-2023-2727 was fixed in 1.24.15.
 * CVE-2021-25743 was fixed in 1.26.0-alpha.3 only.
@DamianSawicki
Bump google.golang.org/grpc to fix vulnerability
bd76a2a 
Bumping google.golang.org/grpc from v1.49.0 to v1.56.3
to fix GHSA-m425-mq94-257g.
@DamianSawicki
Copy link
Collaborator Author

/assign wewark

@k8s-ci-robot
Copy link
Contributor

@DamianSawicki: GitHub didn't allow me to assign the following users: wewark.

Note that only kubernetes members with read permissions, repo collaborators and people who have commented on this issue/PR can be assigned. Additionally, issues/PRs can only have 10 assignees at the same time.
For more information please see the contributor guide

In response to this:

/assign wewark

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@wewark
Copy link
Contributor

wewark commented Oct 31, 2023

LGTM, please run the tests in the README to ensure that jumping from 1.24 to 1.26 does not break anything.

@DamianSawicki
Copy link
Collaborator Author

LGTM, please run the tests in the README to ensure that jumping from 1.24 to 1.26 does not break anything.

Done.

$ make images-clean
...
$ make build
...
$ make containers
...
$ make test
...
All dependencies for usr/sbin/dnsmasq are present
...
Running tests:
?       k8s.io/dns/cmd/dnsmasq-nanny    [no test files]
?       k8s.io/dns/cmd/e2e      [no test files]
?       k8s.io/dns/cmd/kube-dns [no test files]
?       k8s.io/dns/cmd/kube-dns/app     [no test files]
?       k8s.io/dns/cmd/kube-dns/app/options     [no test files]
?       k8s.io/dns/cmd/node-cache       [no test files]
?       k8s.io/dns/cmd/sidecar-e2e      [no test files]
?       k8s.io/dns/pkg/e2e      [no test files]
?       k8s.io/dns/pkg/e2e/dns  [no test files]
?       k8s.io/dns/pkg/e2e/dnsmasq      [no test files]
?       k8s.io/dns/pkg/netif    [no test files]
?       k8s.io/dns/pkg/test     [no test files]
?       k8s.io/dns/pkg/util     [no test files]
?       k8s.io/dns/pkg/version  [no test files]
ok      k8s.io/dns/cmd/node-cache/app   60.096s
ok      k8s.io/dns/cmd/sidecar  0.071s
ok      k8s.io/dns/pkg/dns      0.093s
ok      k8s.io/dns/pkg/dns/config       1.076s
ok      k8s.io/dns/pkg/dns/federation   0.055s
ok      k8s.io/dns/pkg/dns/treecache    0.055s
ok      k8s.io/dns/pkg/dns/util 0.055s
ok      k8s.io/dns/pkg/dnsmasq  2.444s
ok      k8s.io/dns/pkg/sidecar  2.076s

Checking gofmt: PASS

Checking go vet: PASS

@k8s-ci-robot
Copy link
Contributor

@DamianSawicki: GitHub didn't allow me to assign the following users: jingyuanliang.

Note that only kubernetes members with read permissions, repo collaborators and people who have commented on this issue/PR can be assigned. Additionally, issues/PRs can only have 10 assignees at the same time.
For more information please see the contributor guide

In response to this:

/assign jingyuanliang

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@k8s-ci-robot
Copy link
Contributor

@DamianSawicki: GitHub didn't allow me to request PR reviews from the following users: jingyuanliang.

Note that only kubernetes members and repo collaborators can review this PR, and authors cannot review their own PRs.

In response to this:

/cc jingyuanliang

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@DamianSawicki
Copy link
Collaborator Author

CC @jingyuanliang

/assign kl52752

@kl52752
Copy link
Collaborator

kl52752 commented Oct 31, 2023

/lgtm
/approve

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Oct 31, 2023
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: DamianSawicki, kl52752

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 31, 2023
@k8s-ci-robot k8s-ci-robot merged commit 8f97b00 into kubernetes:master Oct 31, 2023
3 checks passed
@DamianSawicki DamianSawicki mentioned this pull request Oct 31, 2023
Closed
@ty-dc ty-dc mentioned this pull request Nov 6, 2023
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@bowei bowei Awaiting requested review from bowei

@MrHohn MrHohn Awaiting requested review from MrHohn

Assignees

@kl52752 kl52752

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@DamianSawicki @k8s-ci-robot @wewark @kl52752