vcluster icon indicating copy to clipboard operation
vcluster copied to clipboard

chore(deps): Update dependencies

Open reneleonhardt opened this issue 6 months ago • 4 comments

What issue type does this pull request address? (keep at least one, remove the others) /kind bugfix /kind documentation

What does this pull request do? Which issues does it resolve? (use resolves #<issue_number> if possible)

🐞 Bug Fixes

  • v0.19 references in docs

🔒 Security Fixes

  • Require go 1.22.7 in go.mod (http security fixes)
  • Fix several vulnerabilities in docs
  • Fix a low vulnerability in grpc 1.64.0
Library Vulnerability Severity
@babel/traverse CVE-2023-45133 CRITICAL
async CVE-2021-43138 HIGH
axios CVE-2023-45857 MEDIUM
browserslist CVE-2021-23364
express CVE-2024-29041
follow-redirects CVE-2024-28849
got CVE-2022-33987
json5 CVE-2022-46175 HIGH
minimatch CVE-2022-3517
normalize-url CVE-2021-33502
webpack CVE-2024-43788 MEDIUM
webpack-dev-middleware CVE-2024-29180 HIGH

📦👷📝🧑‍💻 Chores

  • Update Go dependencies
  • Update k8s versions (0.30.2 to 0.30.4, 0.29.6 to 0.29.8, 0.28.11 to 0.28.13, 0.27.15 to 0.27.16)
  • Update etcd versions to 3.5.15-0 for k8s 0.30.4 (security fix), 3.5.12-0 for older k8s versions
  • Added missing CoreDNS versions copied from k8s (or would bug fixes be allowed?)
  • Update Dockerfiles (go 1.23, helm 3.15)
  • Update docs dependencies
  • Update GitHub Actions (kind, helm, syft, cosign, nodejs)
  • Update devcontainer dependencies
  • Let Dependabot update weekly, include docs and devcontainer
  • Use semver in Dockerfiles to rebuild when source or target images have been updated

Please provide a short message that should be published in the vcluster release notes chore(deps): Update dependencies

What else do we need to know?

  • I didn't squash all commits yet, maybe it's easier to follow my update path that way, you can squash them of course 😅
  • I didn't know if you would allow to update go to 1.23, so I only build images with it. If this is accepted I can update go.mod and CI afterwards.
  • My general intention was to prepare the code base for adding k8s 1.31 as soon as k3s and k0s are available 🚀

reneleonhardt avatar Aug 24 '24 12:08 reneleonhardt