-
Notifications
You must be signed in to change notification settings - Fork 10
chore(deps): update kubernetes packages to v0.34.1 #1419
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Conversation
ℹ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
489033a to
2e2cddd
Compare
2e2cddd to
625266d
Compare
625266d to
7de2ab5
Compare
7de2ab5 to
baefa31
Compare
baefa31 to
609bb82
Compare
609bb82 to
f5a2a4e
Compare
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
|
| github.com/onsi/ginkgo/v2 v2.23.4 | ||
| github.com/onsi/gomega v1.37.0 | ||
| github.com/zeebo/xxh3 v1.0.2 | ||
| golang.org/x/exp v0.0.0-20251017212417-90e834f514db |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
⚠️ Aqua detected vulnerability in your code
Vulnerability ID: CVE-2025-27144
Check Name: go-jose: Go JOSE's Parsing Vulnerable to Denial of Service
Severity: MEDIUM
Fixed Version: 4.0.5
Reachable Path(s) Found: No
Description: Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of . characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of . characters.
[This comment was created by Aqua Pipeline]
Read more at https://avd.aquasec.com/nvd/cve-2025-27144
0a4db42 to
b0fa8af
Compare
b0fa8af to
fffa13f
Compare



This PR contains the following updates:
v0.33.4->v0.34.1v0.33.4->v0.34.1v0.33.4->v0.34.1Release Notes
kubernetes/api (k8s.io/api)
v0.34.1Compare Source
v0.34.0Compare Source
v0.33.5Compare Source
kubernetes/apimachinery (k8s.io/apimachinery)
v0.34.1Compare Source
v0.34.0Compare Source
v0.33.5Compare Source
kubernetes/client-go (k8s.io/client-go)
v0.34.1Compare Source
v0.34.0Compare Source
v0.33.5Compare Source
Configuration
📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.