Skip to content

Pin k8s.io/kuberenetes + dependency bumps #706

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Pin k8s.io/kuberenetes + dependency bumps #706

wants to merge 2 commits into from
+268,760 −42,151

Conversation

dereknola
Copy link
Contributor

@dereknola dereknola commented Jun 9, 2025 •
edited
Loading

#704 is in a broken state and I lack permissions to fix it. Opening this PR instead.

Changes

  • Pin k8s.io/kubernetes to match the rest of the k8s dependencies
  • Keep go 1.23.0 the above issue was causing go to be bumped when it should not be.

Validation

make works locally

@dependabot
Bump the non-k8s group with 13 updates
5cc8331 
Bumps the non-k8s group with 13 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/coredns/coredns](https://github.com/coredns/coredns) | `1.11.3` | `1.12.2` |
| [github.com/miekg/dns](https://github.com/miekg/dns) | `1.1.63` | `1.1.66` |
| [github.com/onsi/gomega](https://github.com/onsi/gomega) | `1.36.1` | `1.36.2` |
| [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.19.1` | `1.22.0` |
| [github.com/vishvananda/netlink](https://github.com/vishvananda/netlink) | `1.1.0` | `1.3.1` |
| [go.etcd.io/etcd/api/v3](https://github.com/etcd-io/etcd) | `3.5.18` | `3.6.0` |
| [go.etcd.io/etcd/client/pkg/v3](https://github.com/etcd-io/etcd) | `3.5.18` | `3.6.0` |
| [go.etcd.io/etcd/client/v2](https://github.com/etcd-io/etcd) | `2.305.18` | `2.305.21` |
| [go.etcd.io/etcd/client/v3](https://github.com/etcd-io/etcd) | `3.5.18` | `3.6.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.38.0` | `0.40.0` |
| [k8s.io/klog/v2](https://github.com/kubernetes/klog) | `2.120.1` | `2.130.1` |
| [k8s.io/kubernetes](https://github.com/kubernetes/kubernetes) | `1.30.12` | `1.33.1` |
| [k8s.io/utils](https://github.com/kubernetes/utils) | `0.0.0-20230726121419-3b25d923346b` | `0.0.0-20241104100929-3ea5e8cea738` |


Updates `github.com/coredns/coredns` from 1.11.3 to 1.12.2
- [Release notes](https://github.com/coredns/coredns/releases)
- [Changelog](https://github.com/coredns/coredns/blob/master/Makefile.release)
- [Commits](coredns/coredns@v1.11.3...v1.12.2)

Updates `github.com/miekg/dns` from 1.1.63 to 1.1.66
- [Changelog](https://github.com/miekg/dns/blob/master/Makefile.release)
- [Commits](miekg/dns@v1.1.63...v1.1.66)

Updates `github.com/onsi/gomega` from 1.36.1 to 1.36.2
- [Release notes](https://github.com/onsi/gomega/releases)
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md)
- [Commits](onsi/gomega@v1.36.1...v1.36.2)

Updates `github.com/prometheus/client_golang` from 1.19.1 to 1.22.0
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.19.1...v1.22.0)

Updates `github.com/vishvananda/netlink` from 1.1.0 to 1.3.1
- [Release notes](https://github.com/vishvananda/netlink/releases)
- [Commits](vishvananda/netlink@v1.1.0...v1.3.1)

Updates `go.etcd.io/etcd/api/v3` from 3.5.18 to 3.6.0
- [Release notes](https://github.com/etcd-io/etcd/releases)
- [Commits](etcd-io/etcd@v3.5.18...v3.6.0)

Updates `go.etcd.io/etcd/client/pkg/v3` from 3.5.18 to 3.6.0
- [Release notes](https://github.com/etcd-io/etcd/releases)
- [Commits](etcd-io/etcd@v3.5.18...v3.6.0)

Updates `go.etcd.io/etcd/client/v2` from 2.305.18 to 2.305.21
- [Release notes](https://github.com/etcd-io/etcd/releases)
- [Commits](etcd-io/etcd@client/v2.305.18...client/v2.305.21)

Updates `go.etcd.io/etcd/client/v3` from 3.5.18 to 3.6.0
- [Release notes](https://github.com/etcd-io/etcd/releases)
- [Commits](etcd-io/etcd@v3.5.18...v3.6.0)

Updates `golang.org/x/net` from 0.38.0 to 0.40.0
- [Commits](golang/net@v0.38.0...v0.40.0)

Updates `k8s.io/klog/v2` from 2.120.1 to 2.130.1
- [Release notes](https://github.com/kubernetes/klog/releases)
- [Changelog](https://github.com/kubernetes/klog/blob/main/RELEASE.md)
- [Commits](kubernetes/klog@v2.120.1...v2.130.1)

Updates `k8s.io/kubernetes` from 1.30.12 to 1.33.1
- [Release notes](https://github.com/kubernetes/kubernetes/releases)
- [Commits](kubernetes/kubernetes@v1.30.12...v1.33.1)

Updates `k8s.io/utils` from 0.0.0-20230726121419-3b25d923346b to 0.0.0-20241104100929-3ea5e8cea738
- [Commits](https://github.com/kubernetes/utils/commits)

---
updated-dependencies:
- dependency-name: github.com/coredns/coredns
  dependency-version: 1.12.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: non-k8s
- dependency-name: github.com/miekg/dns
  dependency-version: 1.1.66
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: non-k8s
- dependency-name: github.com/onsi/gomega
  dependency-version: 1.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: non-k8s
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: non-k8s
- dependency-name: github.com/vishvananda/netlink
  dependency-version: 1.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: non-k8s
- dependency-name: go.etcd.io/etcd/api/v3
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: non-k8s
- dependency-name: go.etcd.io/etcd/client/pkg/v3
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: non-k8s
- dependency-name: go.etcd.io/etcd/client/v2
  dependency-version: 2.305.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: non-k8s
- dependency-name: go.etcd.io/etcd/client/v3
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: non-k8s
- dependency-name: golang.org/x/net
  dependency-version: 0.40.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: non-k8s
- dependency-name: k8s.io/klog/v2
  dependency-version: 2.130.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: non-k8s
- dependency-name: k8s.io/kubernetes
  dependency-version: 1.33.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: non-k8s
- dependency-name: k8s.io/utils
  dependency-version: 0.0.0-20241104100929-3ea5e8cea738
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: non-k8s
...

Signed-off-by: dependabot[bot] <support@github.com>
@k8s-ci-robot k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jun 9, 2025
@k8s-ci-robot
Copy link
Contributor

Hi @dereknola. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dereknola
Once this PR has been reviewed and has the lgtm label, please assign damiansawicki for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Jun 9, 2025
@dereknola
Pin k8s.io/kubernetes as well to v1.30.12
7c6f4a8 
Signed-off-by: Derek Nola <derek.nola@suse.com>
dereknola
dereknola commented Jun 9, 2025
View reviewed changes
go.mod
k8s.io/kubernetes v1.30.12
k8s.io/utils v0.0.0-20230726121419-3b25d923346b
k8s.io/klog/v2 v2.130.1
k8s.io/kubernetes v1.33.1
Copy link
Contributor Author

@dereknola dereknola Jun 9, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not actually a bump, as most of these are pinned via replacement calls below.

jamie-albert added a commit to jamie-albert/advisories that referenced this pull request Jun 10, 2025
@jamie-albert
kubernetes-dns-node-cache: add pending-upstream-fix for GHSA-cvx7-x8p…
34ca87f 
…j-x2gw

CoreDNS v1.11.3 vulnerability in github.com/coredns/coredns. Upstream fix in progress at kubernetes/dns#706. Marking as pending-upstream-fix while waiting for PR to be merged and new release.
@jamie-albert jamie-albert mentioned this pull request Jun 10, 2025
Merged
github-merge-queue bot pushed a commit to wolfi-dev/advisories that referenced this pull request Jun 10, 2025
@jamie-albert
kubernetes-dns-node-cache: add pending-upstream-fix for GHSA-cvx7-x8p…
64244aa 
…j-x2gw (#19083)

CoreDNS v1.11.3 vulnerability in github.com/coredns/coredns. Upstream fix in progress at kubernetes/dns#706. Marking as pending-upstream-fix while waiting for PR to be merged and new release.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@DamianSawicki DamianSawicki Awaiting requested review from DamianSawicki

@MrHohn MrHohn Awaiting requested review from MrHohn

At least 1 approving review is required to merge this pull request.

Assignees
No one assigned
Labels
cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@dereknola @k8s-ci-robot