[internal] fix CVE (#137)

duckhawk · web-flow · commit b7792e708893 · 2025-11-07T16:59:29.000+03:00
Signed-off-by: v.oleynikov &lt;vasily.oleynikov@flant.com&gt;
diff --git a/.github/workflows/build_dev.yml b/.github/workflows/build_dev.yml
@@ -10,7 +10,7 @@ env:
   GOPROXY: ${{ secrets.GOPROXY }}
   SOURCE_REPO: ${{ secrets.SOURCE_REPO }}
   SOURCE_REPO_SSH_KEY: ${{ secrets.SOURCE_REPO_SSH_KEY }}
-  BASE_IMAGES_VERSION: "v0.5.39"
+  BASE_IMAGES_VERSION: "v0.5.40"
 
 on:
   #pull_request:
diff --git a/.github/workflows/build_prod.yml b/.github/workflows/build_prod.yml
@@ -11,7 +11,7 @@ env:
   GOPROXY: ${{ secrets.GOPROXY }}
   SOURCE_REPO: ${{ secrets.SOURCE_REPO }}
   SOURCE_REPO_SSH_KEY: ${{ secrets.SOURCE_REPO_SSH_KEY }}
-  BASE_IMAGES_VERSION: "v0.5.39"
+  BASE_IMAGES_VERSION: "v0.5.40"
 
 on:
   push:
diff --git a/CHANGELOG/v0.3.13.ru.yml b/CHANGELOG/v0.3.13.ru.yml
@@ -1,2 +1,4 @@
 Изменения:
   - Обновлена версия базовых образов
+  - Фиксы CVE
+  - Обновлена версия golang до 1.24.10
diff --git a/CHANGELOG/v0.3.13.yml b/CHANGELOG/v0.3.13.yml
@@ -1,2 +1,4 @@
 Changes:
   - Updated base images versions
+  - CVE fixes
+  - Updated golang version to 1.24.10
diff --git a/api/go.mod b/api/go.mod
@@ -1,6 +1,6 @@
 module github.com/deckhouse/csi-nfs/api
 
-go 1.24.9
+go 1.24.10
 
 require k8s.io/apimachinery v0.32.0
 
diff --git a/hooks/go/go.mod b/hooks/go/go.mod
@@ -1,6 +1,6 @@
 module github.com/deckhouse/csi-nfs/hooks/go
 
-go 1.24.9
+go 1.24.10
 
 require (
 	github.com/deckhouse/csi-nfs/api v0.0.0-20250314071217-91b1f5b52e17
diff --git a/images/controller/go.mod b/images/controller/go.mod
@@ -1,6 +1,6 @@
 module github.com/deckhouse/csi-nfs/images/controller
 
-go 1.24.9
+go 1.24.10
 
 require (
 	github.com/deckhouse/csi-nfs/api v0.0.0-20250213115525-4785a9da80db
diff --git a/images/csi-nfs-scheduler-extender/go.mod b/images/csi-nfs-scheduler-extender/go.mod
@@ -1,6 +1,6 @@
 module github.com/deckhouse/csi-nfs/images/csi-nfs-scheduler-extender
 
-go 1.24.9
+go 1.24.10
 
 require (
 	github.com/deckhouse/csi-nfs/api v0.0.0-20250213115525-4785a9da80db
diff --git a/images/csi-nfs/patches/005-Fix-CVE.patch b/images/csi-nfs/patches/005-Fix-CVE.patch
diff --git a/images/csi-nfs/patches/006-Updated-golang-version.patch b/images/csi-nfs/patches/006-Updated-golang-version.patch
@@ -0,0 +1,25 @@
+From c915618a5aea9b89c301310c8f57380be39ed5a0 Mon Sep 17 00:00:00 2001
+From: "v.oleynikov" <vasily.oleynikov@flant.com>
+Date: Fri, 7 Nov 2025 16:25:02 +0300
+Subject: [PATCH] Updated golang version
+
+Signed-off-by: v.oleynikov <vasily.oleynikov@flant.com>
+---
+ go.mod | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/go.mod b/go.mod
+index 4132646e..1f07cd23 100644
+--- a/go.mod
++++ b/go.mod
+@@ -1,6 +1,6 @@
+ module github.com/kubernetes-csi/csi-driver-nfs
+ 
+-go 1.24.8
++go 1.24.10
+ 
+ require (
+ 	github.com/container-storage-interface/spec v1.11.0
+-- 
+2.43.0
+
diff --git a/images/csi-nfs/patches/README.md b/images/csi-nfs/patches/README.md
@@ -16,6 +16,14 @@ Add mountPermissions to snapshot. Fix mountPermissions.
 
 Fix CVE
 
+## 005-Fix-CVE.patch
+
+Fix CVE
+
+## 006-Updated-golang-version.patch
+
+Update golang version
+
 ## How to apply
 
 ```bash
diff --git a/images/csi-nfs/werf.inc.yaml b/images/csi-nfs/werf.inc.yaml
@@ -107,8 +107,8 @@ secrets:
 
 shell:
   setup:
+    - apk add --no-cache git
     - cd /src/csi-driver-nfs/cmd/nfsplugin
-    - GOPROXY=$(cat /run/secrets/GOPROXY) go mod tidy
     - GOPROXY=$(cat /run/secrets/GOPROXY) go mod download
     - export GOOS=linux GOARCH=amd64 CGO_ENABLED=0
     - |
diff --git a/images/tlshd/go.mod b/images/tlshd/go.mod
@@ -1,6 +1,6 @@
 module github.com/deckhouse/csi-nfs/images/tlshd
 
-go 1.24.9
+go 1.24.10
 
 require github.com/spf13/cobra v1.8.1
 
diff --git a/images/wait-rpcbind/go.mod b/images/wait-rpcbind/go.mod
@@ -1,3 +1,3 @@
 module github.com/deckhouse/csi-nfs/images/wait-rpcbind
 
-go 1.24.9
+go 1.24.10
diff --git a/images/webhooks/go.mod b/images/webhooks/go.mod
@@ -1,6 +1,6 @@
 module github.com/deckhouse/csi-nfs/images/webhooks
 
-go 1.24.9
+go 1.24.10
 
 require (
 	github.com/deckhouse/csi-nfs/api v0.0.0-20250213115525-4785a9da80db
diff --git a/images/wrap-mount/go.mod b/images/wrap-mount/go.mod
@@ -1,3 +1,3 @@
 module github.com/deckhouse/csi-nfs/images/wrap-mount
 
-go 1.24.9
+go 1.24.10
diff --git a/lib/go/common/go.mod b/lib/go/common/go.mod
@@ -1,4 +1,4 @@
-go 1.24.9
+go 1.24.10
 
 require github.com/deckhouse/csi-nfs/api v0.0.0-20250116103144-d23aedd591a3
 
