Release: 2.12.1

[zroubalik]

This issue template is used to track the rollout of a new KEDA version.

For the full release process, we recommend reading this document.

Required items

• CVE-2023-39325 (High) detected in golang.org/x/net-v0.15.0 #5122
• KEDA operator works slowly (or doesn't work) when some ScaledObject reconciliation produces timeouts #5083
• Azure Pipelines: Space in pool name causes HTTP 400 errors #5107
• OpenTelemetry-Go Contrib vulnerable to denial of service in otelhttp due to unbound cardinality metrics #5089
• OTEL collector error logging is wrong #5094
• Fix code scanning alert - otelgrpc DoS vulnerability due to unbound cardinality metrics  #5208

Timeline

We aim to release this release in the week of November 27 2024.

Progress

• Prepare changelog
• Welcome message supported versions are up-to-date
• Add the new version to GitHub Bug report template
• Create KEDA release
• Publish new documentation version
• Setup continuous container scanning with Snyk
• Prepare & ship Helm chart
• Prepare next release
• Provide update in Slack
• Tweet about new release

[djsly]

@zroubalik , do you know if this PR #5200 will be part of 2.12.1 ?

looks like the golang.org/x/net will be fixed in 2.12.1, github.com/go-jose/go-jose/v3 is merged in main and I also see grace was bumped 1 month ago the fix is in main , is 2.12.1 based of main ?

the latest privy reports shows

┌───────────────────────────────┬─────────────────────┬──────────┬────────┬───────────────────┬────────────────────────┬──────────────────────────────────────────────────────────────┐
│            Library            │    Vulnerability    │ Severity │ Status │ Installed Version │     Fixed Version      │                            Title                             │
├───────────────────────────────┼─────────────────────┼──────────┼────────┼───────────────────┼────────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/go-jose/go-jose/v3 │ GHSA-2c7c-3mj9-8fqh │ MEDIUM   │ fixed  │ v3.0.0            │ 3.0.1                  │ Decryption of malicious PBES2 JWE objects can consume        │
│                               │                     │          │        │                   │                        │ unbounded system resources                                   │
│                               │                     │          │        │                   │                        │ https://github.com/advisories/GHSA-2c7c-3mj9-8fqh            │
├───────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼────────────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/net              │ CVE-2023-39325      │ HIGH     │        │ v0.15.0           │ 0.17.0                 │ golang: net/http, x/net/http2: rapid stream resets can cause │
│                               │                     │          │        │                   │                        │ excessive work (CVE-2023-44487)                              │
│                               │                     │          │        │                   │                        │ https://avd.aquasec.com/nvd/cve-2023-39325                   │
│                               ├─────────────────────┼──────────┤        │                   │                        ├──────────────────────────────────────────────────────────────┤
│                               │ CVE-2023-44487      │ MEDIUM   │        │                   │                        │ HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable   │
│                               │                     │          │        │                   │                        │ to a DDoS attack...                                          │
│                               │                     │          │        │                   │                        │ https://avd.aquasec.com/nvd/cve-2023-44487                   │
├───────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼────────────────────────┼──────────────────────────────────────────────────────────────┤
│ google.golang.org/grpc        │ GHSA-m425-mq94-257g │ HIGH     │        │ v1.58.2           │ 1.56.3, 1.57.1, 1.58.3 │ gRPC-Go HTTP/2 Rapid Reset vulnerability                     │
│                               │                     │          │        │                   │                        │ https://github.com/advisories/GHSA-m425-mq94-257g            │
│                               ├─────────────────────┼──────────┤        │                   ├────────────────────────┼──────────────────────────────────────────────────────────────┤
│                               │ CVE-2023-44487      │ MEDIUM   │        │                   │ 1.58.3, 1.57.1, 1.56.3 │ HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable   │
│                               │                     │          │        │                   │                        │ to a DDoS attack...                                          │
│                               │                     │          │        │                   │                        │ https://avd.aquasec.com/nvd/cve-2023-44487                   │
└───────────────────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴────────────────────────┴──────────────────────────────────────────────────────────────┘

[zroubalik]

google.golang.org/grpc

@djsly hi, this is the release go.mod https://github.com/kedacore/keda/blob/v2.12.1/go.mod

It seems like go-jose hasn't been bumped, this particular issue wasn't on my radar. Sorry for that.

[zroubalik]

Release done

[djsly]

@zroubalik for my personal knowledge, on which branch are the 1.12 releases based on ? should the go-jose version bumped by cherry picked somewhere ?
are you guys planning on releasing 1.12.3 with this fix before the January 1.13 release ?

[JorTurFer]

@zroubalik for my personal knowledge, on which branch are the 1.12 releases based on ?

The release is based on this code: https://github.com/kedacore/keda/tree/v2.12.1

are you guys planning on releasing 1.12.3 with this fix before the January 1.13 release ?

I don't think so as there isn't any critical issue for the moment IIRC

should the go-jose version bumped by cherry picked somewhere ?

As we don't plan to cut any other release before next release in January, the bump will be already there