Skip to content

Commit edba35e

Browse files
freeznetfreeznet
authored
fix CVEs and bump go to 1.24.11 (#825)
* bump go to 1.24.11 * fix cves * upgrade actions/setup-go@v5 * fix ci
1 parent 3e8ee06 commit edba35e

File tree

15 files changed

+190
-104
lines changed

15 files changed

+190
-104
lines changed

‎.github/workflows/bundle-release.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -49,10 +49,10 @@ jobs:
4949
username: ${{ secrets.DOCKER_USER }}
5050
password: ${{ secrets.DOCKER_PASSWORD }}
5151

52-
- name: Set up GO 1.24.10
53-
uses: actions/setup-go@v1
52+
- name: Set up GO 1.24.11
53+
uses: actions/setup-go@v5
5454
with:
55-
go-version: 1.24.10
55+
go-version: 1.24.11
5656
id: go
5757

5858
- name: InstallKubebuilder
@@ -180,10 +180,10 @@ jobs:
180180
username: ${{ secrets.DOCKER_USER }}
181181
password: ${{ secrets.DOCKER_PASSWORD }}
182182

183-
- name: Set up GO 1.24.10
184-
uses: actions/setup-go@v1
183+
- name: Set up GO 1.24.11
184+
uses: actions/setup-go@v5
185185
with:
186-
go-version: 1.24.10
186+
go-version: 1.24.11
187187
id: go
188188

189189
- name: InstallKubebuilder

‎.github/workflows/olm-verify.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,10 +34,10 @@ jobs:
3434
- name: checkout
3535
uses: actions/checkout@v2
3636

37-
- name: Set up GO 1.24.10
38-
uses: actions/setup-go@v1
37+
- name: Set up GO 1.24.11
38+
uses: actions/setup-go@v5
3939
with:
40-
go-version: 1.24.10
40+
go-version: 1.24.11
4141
id: go
4242

4343
- name: InstallKubebuilder

‎.github/workflows/project.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
strategy:
1919
fail-fast: false
2020
matrix:
21-
go-version: [1.22.12, 1.24.10]
21+
go-version: [1.22.12, 1.24.11]
2222
steps:
2323
- name: Free Disk Space (Ubuntu)
2424
uses: jlumbroso/[email protected]
@@ -36,7 +36,7 @@ jobs:
3636
swap-storage: true
3737

3838
- name: Set up Go
39-
uses: actions/setup-go@v1
39+
uses: actions/setup-go@v5
4040
with:
4141
go-version: ${{ matrix.go-version }}
4242
id: go

‎.github/workflows/release.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,10 +37,10 @@ jobs:
3737
username: ${{ secrets.DOCKER_USER }}
3838
password: ${{ secrets.DOCKER_PASSWORD }}
3939

40-
- name: Set up GO 1.24.10
41-
uses: actions/setup-go@v1
40+
- name: Set up GO 1.24.11
41+
uses: actions/setup-go@v5
4242
with:
43-
go-version: 1.24.10
43+
go-version: 1.24.11
4444
id: go
4545

4646
- name: InstallKubebuilder

‎.github/workflows/test-helm-charts.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -83,11 +83,11 @@ jobs:
8383
run: hack/kind-cluster-build.sh --name chart-testing -c 1 -v 10 --k8sVersion v1.23.17
8484
if: steps.list-changed.outputs.changed == 'true'
8585

86-
- name: Set up GO 1.24.10
86+
- name: Set up GO 1.24.11
8787
if: steps.list-changed.outputs.changed == 'true'
88-
uses: actions/setup-go@v1
88+
uses: actions/setup-go@v5
8989
with:
90-
go-version: 1.24.10
90+
go-version: 1.24.11
9191
id: go
9292

9393
- name: setup kubebuilder 3.6.0

‎.github/workflows/trivy.yml‎

Lines changed: 26 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,17 +27,40 @@ jobs:
2727
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db
2828
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db
2929
steps:
30+
- name: Free Disk Space (Ubuntu)
31+
uses: jlumbroso/[email protected]
32+
with:
33+
# this might remove tools that are actually needed,
34+
# if set to "true" but frees about 6 GB
35+
tool-cache: false
36+
# all of these default to true, but feel free to set to
37+
# "false" if necessary for your workflow
38+
android: true
39+
dotnet: true
40+
haskell: true
41+
large-packages: true
42+
docker-images: true
43+
swap-storage: true
44+
45+
# the runner machine has a disk /dev/sdb1 which mounted to /mnt, and it has more free disk than /dev/sda1.
46+
# we can use it to save docker's data to avoid bookie error due to lack of disk.
47+
- name: change docker data dir
48+
run: |
49+
sudo service docker stop
50+
echo '{ "exec-opts": ["native.cgroupdriver=cgroupfs"], "cgroup-parent": "/actions_job", "data-root": "/mnt/docker" }' | sudo tee /etc/docker/daemon.json
51+
sudo service docker start
52+
3053
- name: Checkout
3154
uses: actions/checkout@v3
3255
with:
3356
fetch-depth: 0
3457
repository: ${{github.event.pull_request.head.repo.full_name}}
3558
ref: ${{ github.event.pull_request.head.sha }}
3659

37-
- name: Set up GO 1.24.10
38-
uses: actions/setup-go@v1
60+
- name: Set up GO 1.24.11
61+
uses: actions/setup-go@v5
3962
with:
40-
go-version: 1.24.10
63+
go-version: 1.24.11
4164
id: go
4265

4366
- name: InstallKubebuilder

‎.github/workflows/trivy_scheduled_master.yml‎

Lines changed: 25 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -38,17 +38,39 @@ jobs:
3838
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db
3939
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db
4040
steps:
41+
- name: Free Disk Space (Ubuntu)
42+
uses: jlumbroso/[email protected]
43+
with:
44+
# this might remove tools that are actually needed,
45+
# if set to "true" but frees about 6 GB
46+
tool-cache: false
47+
# all of these default to true, but feel free to set to
48+
# "false" if necessary for your workflow
49+
android: true
50+
dotnet: true
51+
haskell: true
52+
large-packages: true
53+
docker-images: true
54+
swap-storage: true
55+
56+
# the runner machine has a disk /dev/sdb1 which mounted to /mnt, and it has more free disk than /dev/sda1.
57+
# we can use it to save docker's data to avoid bookie error due to lack of disk.
58+
- name: change docker data dir
59+
run: |
60+
sudo service docker stop
61+
echo '{ "exec-opts": ["native.cgroupdriver=cgroupfs"], "cgroup-parent": "/actions_job", "data-root": "/mnt/docker" }' | sudo tee /etc/docker/daemon.json
62+
sudo service docker start
4163
- name: Checkout
4264
uses: actions/checkout@v3
4365
with:
4466
fetch-depth: 0
4567
repository: ${{github.event.pull_request.head.repo.full_name}}
4668
ref: ${{ github.event.pull_request.head.sha }}
4769

48-
- name: Set up GO 1.24.10
49-
uses: actions/setup-go@v1
70+
- name: Set up GO 1.24.11
71+
uses: actions/setup-go@v5
5072
with:
51-
go-version: 1.24.10
73+
go-version: 1.24.11
5274
id: go
5375

5476
- name: InstallKubebuilder

‎Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# Build the manager binary
2-
FROM golang:1.24.10-trixie as builder
2+
FROM golang:1.24.11-trixie as builder
33

44
WORKDIR /workspace/api
55
COPY api/ .

‎api/go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/streamnative/function-mesh/api
22

3-
go 1.24.10
3+
go 1.24.11
44

55
require (
66
k8s.io/api v0.30.9

‎go.mod‎

Lines changed: 34 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,23 @@
11
module github.com/streamnative/function-mesh
22

3-
go 1.24.10
3+
go 1.24.11
44

55
require (
6-
github.com/apache/pulsar-client-go v0.9.1-0.20230816081803-fbee610ddcbf
6+
github.com/apache/pulsar-client-go v0.17.0
77
github.com/go-logr/logr v1.4.2
88
github.com/golang/protobuf v1.5.4
99
github.com/onsi/ginkgo v1.16.5
1010
github.com/onsi/gomega v1.35.1
1111
github.com/prometheus/client_golang v1.20.5
1212
github.com/streamnative/function-mesh/api v0.0.0
13-
github.com/streamnative/pulsarctl v0.4.3-0.20240321142126-f3939fb0ed38
13+
github.com/streamnative/pulsarctl v0.6.0
1414
github.com/stretchr/testify v1.10.0
15-
google.golang.org/protobuf v1.36.5
15+
google.golang.org/protobuf v1.36.6
1616
gotest.tools v2.2.0+incompatible
17-
k8s.io/api v0.30.9
18-
k8s.io/apimachinery v0.30.9
17+
k8s.io/api v0.32.3
18+
k8s.io/apimachinery v0.32.3
1919
k8s.io/autoscaler/vertical-pod-autoscaler v0.11.0
20-
k8s.io/client-go v0.30.9
20+
k8s.io/client-go v0.32.3
2121
sigs.k8s.io/controller-runtime v0.18.6
2222
sigs.k8s.io/yaml v1.4.0
2323
)
@@ -32,7 +32,7 @@ require (
3232
github.com/cespare/xxhash/v2 v2.3.0 // indirect
3333
github.com/danieljoos/wincred v1.1.2 // indirect
3434
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
35-
github.com/dvsekhvalnov/jose2go v1.6.0 // indirect
35+
github.com/dvsekhvalnov/jose2go v1.7.0 // indirect
3636
github.com/emicklei/go-restful/v3 v3.11.0 // indirect
3737
github.com/evanphx/json-patch/v5 v5.9.0 // indirect
3838
github.com/fatih/color v1.7.0 // indirect
@@ -46,8 +46,8 @@ require (
4646
github.com/go-openapi/swag v0.23.0 // indirect
4747
github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2 // indirect
4848
github.com/gogo/protobuf v1.3.2 // indirect
49-
github.com/golang-jwt/jwt v3.2.1+incompatible // indirect
50-
github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
49+
github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
50+
github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
5151
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
5252
github.com/google/cel-go v0.17.8 // indirect
5353
github.com/google/gnostic-models v0.6.9 // indirect
@@ -61,7 +61,7 @@ require (
6161
github.com/inconshreveable/mousetrap v1.1.0 // indirect
6262
github.com/josharian/intern v1.0.0 // indirect
6363
github.com/json-iterator/go v1.1.12 // indirect
64-
github.com/klauspost/compress v1.17.9 // indirect
64+
github.com/klauspost/compress v1.18.0 // indirect
6565
github.com/kris-nova/logger v0.0.0-20181127235838-fd0d87064b06 // indirect
6666
github.com/kris-nova/lolgopher v0.0.0-20180921204813-313b3abb0d9b // indirect
6767
github.com/magiconair/properties v1.8.7 // indirect
@@ -83,28 +83,29 @@ require (
8383
github.com/spf13/cobra v1.8.1 // indirect
8484
github.com/spf13/pflag v1.0.5 // indirect
8585
github.com/stoewer/go-strcase v1.2.0 // indirect
86-
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0 // indirect
87-
go.opentelemetry.io/otel v1.28.0 // indirect
86+
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
87+
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 // indirect
88+
go.opentelemetry.io/otel v1.35.0 // indirect
8889
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0 // indirect
8990
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0 // indirect
90-
go.opentelemetry.io/otel/metric v1.28.0 // indirect
91-
go.opentelemetry.io/otel/sdk v1.28.0 // indirect
92-
go.opentelemetry.io/otel/trace v1.28.0 // indirect
91+
go.opentelemetry.io/otel/metric v1.35.0 // indirect
92+
go.opentelemetry.io/otel/sdk v1.35.0 // indirect
93+
go.opentelemetry.io/otel/trace v1.35.0 // indirect
9394
go.opentelemetry.io/proto/otlp v1.3.1 // indirect
9495
go.uber.org/multierr v1.11.0 // indirect
9596
go.uber.org/zap v1.27.0 // indirect
9697
golang.org/x/exp v0.0.0-20220722155223-a9213eeb770e // indirect
97-
golang.org/x/net v0.38.0 // indirect
98-
golang.org/x/oauth2 v0.27.0 // indirect
99-
golang.org/x/sync v0.12.0 // indirect
100-
golang.org/x/sys v0.31.0 // indirect
101-
golang.org/x/term v0.30.0 // indirect
102-
golang.org/x/text v0.23.0 // indirect
103-
golang.org/x/time v0.9.0 // indirect
98+
golang.org/x/net v0.39.0 // indirect
99+
golang.org/x/oauth2 v0.29.0 // indirect
100+
golang.org/x/sync v0.13.0 // indirect
101+
golang.org/x/sys v0.32.0 // indirect
102+
golang.org/x/term v0.31.0 // indirect
103+
golang.org/x/text v0.24.0 // indirect
104+
golang.org/x/time v0.10.0 // indirect
104105
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
105-
google.golang.org/genproto/googleapis/api v0.0.0-20240826202546-f6391c0de4c7 // indirect
106-
google.golang.org/genproto/googleapis/rpc v0.0.0-20240826202546-f6391c0de4c7 // indirect
107-
google.golang.org/grpc v1.65.0 // indirect
106+
google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422 // indirect
107+
google.golang.org/genproto/googleapis/rpc v0.0.0-20250115164207-1a7da9e5054f // indirect
108+
google.golang.org/grpc v1.71.1 // indirect
108109
gopkg.in/inf.v0 v0.9.1 // indirect
109110
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
110111
gopkg.in/yaml.v2 v2.4.0 // indirect
@@ -114,11 +115,17 @@ require (
114115
k8s.io/component-base v0.30.9 // indirect
115116
k8s.io/klog/v2 v2.130.1 // indirect
116117
k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
117-
k8s.io/utils v0.0.0-20241210054802-24370beab758 // indirect
118+
k8s.io/utils v0.0.0-20250321185631-1f6e0b77f77e // indirect
118119
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.29.0 // indirect
119120
sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
120121
sigs.k8s.io/randfill v1.0.0 // indirect
121122
sigs.k8s.io/structured-merge-diff/v4 v4.6.0 // indirect
122123
)
123124

125+
replace k8s.io/api => k8s.io/api v0.30.9
126+
127+
replace k8s.io/apimachinery => k8s.io/apimachinery v0.30.9
128+
129+
replace k8s.io/client-go => k8s.io/client-go v0.30.9
130+
124131
replace github.com/streamnative/function-mesh/api => ./api

0 commit comments

Comments
 (0)