chore(deps): patch Dependabot security alerts without breaking build#6983
Open
prkhrkat wants to merge 1 commit into
Open
chore(deps): patch Dependabot security alerts without breaking build#6983prkhrkat wants to merge 1 commit into
prkhrkat wants to merge 1 commit into
Conversation
Resolve 26 of 30 open Dependabot alerts by bumping to patched versions and re-vendoring. All updates verified with make build (binary compiles, wire codegen unchanged). Updated: - golang.org/x/crypto 0.46.0 -> 0.52.0 (7 alerts, incl. critical) - github.com/go-git/go-git/v5 5.13.2 -> 5.19.1 (7 alerts) - oras.land/oras-go/v2 2.6.0 -> 2.6.1 (3 alerts) - github.com/go-git/go-billy/v5 5.6.2 -> 5.9.0 - golang.org/x/net 0.48.0 -> 0.55.0 - github.com/aws/aws-sdk-go-v2/service/s3 1.79.4 -> 1.97.3 - github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream 1.6.10 -> 1.7.8 - github.com/cloudflare/circl 1.6.1 -> 1.6.3 - k8s.io/kubernetes 1.33.4 -> 1.33.6 (aligned all k8s.io/* staging to 0.33.6) Intentionally skipped (would break build or no upstream fix): - helm.sh/helm/v3: fix (3.20.2) force-upgrades k8s stack to 0.35.x, incompatible with pinned argo-cd v2.14.20 / k8s 1.33 - github.com/argoproj/argo-cd/v2: no patched version available - github.com/go-pg/pg: no patched version available Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
prkhrkat
requested review from
prakarsh-dt,
vikramdevtron and
vivek-devtron
as code owners
|
Some linked issues are invalid. Please update the issue links:\nIssue # in is not found or invalid (HTTP }404).\n |
|
Some linked issues are invalid. Please update the issue links:\nIssue # in is not found or invalid (HTTP }404).\n |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Patches Dependabot security alerts by bumping vulnerable dependencies to their fixed versions and re-vendoring. Resolves 26 of 30 open alerts. Every change was verified against
make build— the binary compiles andwirecodegen is unchanged.Updated dependencies (build passes)
golang.org/x/cryptogithub.com/go-git/go-git/v5oras.land/oras-go/v2github.com/go-git/go-billy/v5golang.org/x/netgithub.com/aws/aws-sdk-go-v2/service/s3github.com/aws/aws-sdk-go-v2/aws/protocol/eventstreamgithub.com/cloudflare/circlk8s.io/kubernetes(+ allk8s.io/*staging)Intentionally NOT updated
helm.sh/helm/v3(medium): the only fix (3.20.2) force-upgrades the entire k8s stack to v0.35.x, which is incompatible with the pinnedargo-cd/v2 v2.14.20andk8s.io/kubernetes 1.33— it breaks the build. No backported patch exists on the 3.18/3.19 line. Needs a coordinated argo-cd + k8s upgrade.github.com/argoproj/argo-cd/v2(high) — no patched version published upstream.github.com/go-pg/pg(medium) — no patched version published upstream.Verification
make build→ succeeds, produces thedevtronbinary;wireregeneratedwire_gen.goidentically (no diff).go build ./...→ only the pre-existing brokenmocks/mock_pipelinepackages fail, identical to the baseline before these changes and not part of themakebinary.go.mod,go.sum, andvendor/.🤖 Generated with Claude Code
Summary by Bito