values.yaml is generated by serialising CreateDefaultConfig, and that literal
sets the Auth fields explicitly instead of leaving them to the struct tags.
The tag said kubeshark-admin while the literal said kubeshark-viewer, so the
chart's committed default only held until the next generate-helm-values, which
would have rewritten every ungated install from admin to read-only and 403ed
deployments that never configured authorization.
Regenerating now reproduces the committed values.yaml byte for byte, which is
what says the two sources agree rather than merely happening to look alike.
The test compares the literal against the tag instead of asserting a role name,
so it keeps holding if the default is deliberately changed and only fails when
the two drift apart.
Also documents that scripting.enabled closes the scripting API rather than only
hiding the UI, now that it is the switch demo mode used to be.
* deps: bump indirect deps to clear critical/high Dependabot alerts
Bumps the vulnerable indirect dependencies flagged as critical or high
severity in Dependabot:
- golang.org/x/crypto v0.39.0 -> v0.54.0 (7 critical + 2 high: SSH agent
constraint/key-constraint bypass, @revoked auth bypass, FIDO/U2F presence
check bypass, VerifiedPublicKeyCallback permission skip, infinite loop on
large channel writes, client-induced server deadlock, RSA/DSA DoS, byte
arithmetic underflow panic)
- google.golang.org/grpc v1.68.1 -> v1.83.0 (critical: authz bypass via
missing leading slash in :path; high: xDS RBAC and HTTP/2 issues)
- github.com/containerd/containerd v1.7.27 -> v1.7.34 (high: LABEL ->
restart-monitor binary:// host-root RCE, runAsNonRoot evasion, local
privesc via wide CRI directory permissions)
- oras.land/oras-go/v2 v2.6.0 -> v2.6.2 (high: CVE-2026-50163 hardlink
extract-dir escape, credential forwarding via unvalidated Location header)
- github.com/moby/spdystream v0.5.0 -> v0.5.1 (high: DoS on CRI)
Transitively pulls up x/net, x/sync, x/sys, x/term, x/text, x/time,
x/oauth2, protobuf, filepath-securejoin, selinux and go-logr via go mod tidy.
The go directive moves 1.24.0 -> 1.25.0 (required by the upgraded modules);
the explicit toolchain pin is dropped. CI resolves Go from go.mod, so no
workflow changes are needed.
go build ./... and go test ./... pass.
* ci: move golangci-lint to v2, fix resulting lint issues
golangci-lint-action@v3 pins `latest` to v1.64.8, which is built with
go1.24 and refuses to run now that go.mod targets 1.25.0:
can't load config: the Go language version (go1.24) used to build
golangci-lint is lower than the targeted Go version (1.25.0)
Move the job to golangci-lint-action@v7 + v2.8.0 and add a .golangci.yml
mirroring the hub repo's v2 config: govet, staticcheck, ineffassign and
unused, plus gofmt/goimports as formatters.
Fixes for the issues that surfaced:
- ST1005: lowercase error strings, drop trailing '!' in connect/hub.go
- SA4011: kubernetes/watch.go had a `break` inside a `select` default
that broke the select rather than the loop, i.e. a no-op; removed
- QF1008: drop the embedded ChartPathOptions selector in helm.go
- QF1003: tagged switch on r.URL.Path in mcp_test.go
- QF1004: strings.Replace(..., -1) -> strings.ReplaceAll
- gofmt -s and goimports with a local prefix across the tree
errcheck is not in the enabled set, matching hub.
* cmd: clarify --time parse error in pcap dump
The error neither named the offending flag/value nor separated the
wrapped error from the message. Reported by Copilot on #1952.
---------
Co-authored-by: Alon Girmonsky <1990761+alongir@users.noreply.github.com>
* Remove `logger` module
* Remove `shared` module
* Move `cli` folder contents into project root
* Fix linter
* Change the module name from `github.com/kubeshark/kubeshark/cli` to `github.com/kubeshark/kubeshark`
* Set the default `Makefile` rule to `build`
* Add `lint` rule
* Fix the linter errors
Volodymyr Stoiko
M. Mert Yildiran