mirror of
https://github.com/krkn-chaos/krkn.git
synced 2026-09-08 09:47:17 +00:00
7c94a307d0
* adding member request information Signed-off-by: Paige Patton <prubenda@redhat.com> Assisted By: Claude Code: fixes krkn source dependencies cves Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> introduced grype scan on github images Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> golang downgrade Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> golang dependency pinning Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> golang dependency pinning Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> setuptools downgrade Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> go-ntlmssp downgrade Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> security scan in summary Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> setuptools downgrade Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> upgrade to fedora 45 Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> golang dependencies Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> removed pinned dependencies Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> pinned dependency for oc latest Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> golang stdlib stable version Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> upgrading oc release Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> upgrading yq Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> yq build in pipeline Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> pinned transitive dependencies Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> removed not working Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> buildkit unpinned Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> other pinned dependencies Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> other pinned Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> other pinned Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> go work vendor Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> other pinned Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> pin buildkit and distribution Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> reinstated distribution Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> nit Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> SECURITY.md Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> feat: add Grype security scanning badge and comprehensive security policy - Add security badge job to docker-image workflow - Generates detailed badge showing C:X H:Y M:Z vulnerability counts - Runs on every push to main branch - Publishes badge to krkn-lib-docs repository - Uses Grype to scan container image for CVEs - Dynamic color based on severity (green/yellow/orange/red) - Add security badge to README.md - Displays current vulnerability baseline - Placed after coverage badge for visibility - Enhance SECURITY.md with CNCF-ready security policy - Document proactive security approach with Grype CI/CD integration - Define security baseline: 0 Critical, 7 High, 3 Medium, 0 Low (12 total) - Detail accepted risks with mitigation strategies - Document all 12 known CVEs in transitive dependencies - Explain why each CVE cannot be fixed (dependency constraints) - Establish quarterly review process for accepted risks - Add SLA commitments for vulnerability remediation Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> fix: remove moby/buildkit v0.28.1 pin that breaks oc build The moby/buildkit v0.28.1 upgrade has breaking API changes (undefined: archive.Compression) that are incompatible with docker/docker v28.5.2 vendored in oc. This CVE is documented as accepted risk in SECURITY.md. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> DCO krkn-lib update krkn-lib update * increased krkn-lib version Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> --------- Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> Co-authored-by: Paige Patton <prubenda@redhat.com>
44 lines
1.6 KiB
Plaintext
44 lines
1.6 KiB
Plaintext
aliyun-python-sdk-core==2.13.36
|
|
aliyun-python-sdk-ecs==4.24.25
|
|
arcaflow-plugin-sdk==0.14.3
|
|
boto3>=1.34.0 # Updated to support urllib3 2.x
|
|
azure-identity==1.16.1
|
|
azure-keyvault==4.2.0
|
|
azure-mgmt-compute==30.5.0
|
|
azure-mgmt-network==27.0.0
|
|
coverage==7.6.12
|
|
datetime==5.4
|
|
docker>=7.0.0 # Upgraded to support requests>=2.32; Unix socket support now native
|
|
gitpython==3.1.50
|
|
google-auth==2.37.0
|
|
google-cloud-compute==1.22.0
|
|
ibm-cloud-sdk-core>=3.24.4 # Requires requests>=2.32.4
|
|
ibm_vpc==0.26.3 # Requires ibm_cloud_sdk_core
|
|
jinja2==3.1.6
|
|
jaraco-context>=6.1.0 # Fixes GHSA-58pv-8j8x-9vj2
|
|
cbor2<5.7.0 # Pinned by arcaflow-plugin-sdk
|
|
lxml==6.1.0
|
|
kubernetes>=35.0.0
|
|
krkn-lib==6.1.0
|
|
numpy==1.26.4
|
|
pandas==2.2.0
|
|
openshift-client==1.0.21
|
|
paramiko>=3.5.1 # Fixes GHSA-r374-rxx8-8654
|
|
pyVmomi==8.0.2.0.1
|
|
pyfiglet==1.0.2
|
|
pytest==9.0.3
|
|
python-ipmi==0.5.4
|
|
python-openstackclient==6.5.0
|
|
requests>=2.32.4 # Fixes GHSA-9hjg-9r4m-mvj7, GHSA-9wx4-h78v-vm56, GHSA-gc5v-m9x4-r6x2
|
|
# requests-unixsocket removed - docker 7.0+ handles Unix sockets natively
|
|
urllib3>=2.7.0 # Fixes GHSA-qccp-gfcp-xxvc, GHSA-38jv-5279-wg99, GHSA-gm62-xv2j-4w53, GHSA-2xpw-w6gg-jr37
|
|
service_identity==24.1.0
|
|
PyYAML==6.0.1
|
|
setuptools==81.0.0 # Has pkg_resources (required by VMware SDK) + newer vendored jaraco-context
|
|
wheel>=0.46.2 # Fixes GHSA-8rrh-rw8j-w5fx
|
|
colorlog==6.10.1
|
|
|
|
git+https://github.com/vmware/vsphere-automation-sdk-python.git@v8.0.0.0
|
|
cryptography>=46.0.7 # pinned to avoid multiple CVEs (subgroup attack, buffer overflow, DNS constraints)
|
|
protobuf>=4.25.8 # not directly required, pinned by Snyk to avoid a vulnerability
|