* deps: bump indirect deps to clear critical/high Dependabot alerts
Bumps the vulnerable indirect dependencies flagged as critical or high
severity in Dependabot:
- golang.org/x/crypto v0.39.0 -> v0.54.0 (7 critical + 2 high: SSH agent
constraint/key-constraint bypass, @revoked auth bypass, FIDO/U2F presence
check bypass, VerifiedPublicKeyCallback permission skip, infinite loop on
large channel writes, client-induced server deadlock, RSA/DSA DoS, byte
arithmetic underflow panic)
- google.golang.org/grpc v1.68.1 -> v1.83.0 (critical: authz bypass via
missing leading slash in :path; high: xDS RBAC and HTTP/2 issues)
- github.com/containerd/containerd v1.7.27 -> v1.7.34 (high: LABEL ->
restart-monitor binary:// host-root RCE, runAsNonRoot evasion, local
privesc via wide CRI directory permissions)
- oras.land/oras-go/v2 v2.6.0 -> v2.6.2 (high: CVE-2026-50163 hardlink
extract-dir escape, credential forwarding via unvalidated Location header)
- github.com/moby/spdystream v0.5.0 -> v0.5.1 (high: DoS on CRI)
Transitively pulls up x/net, x/sync, x/sys, x/term, x/text, x/time,
x/oauth2, protobuf, filepath-securejoin, selinux and go-logr via go mod tidy.
The go directive moves 1.24.0 -> 1.25.0 (required by the upgraded modules);
the explicit toolchain pin is dropped. CI resolves Go from go.mod, so no
workflow changes are needed.
go build ./... and go test ./... pass.
* ci: move golangci-lint to v2, fix resulting lint issues
golangci-lint-action@v3 pins `latest` to v1.64.8, which is built with
go1.24 and refuses to run now that go.mod targets 1.25.0:
can't load config: the Go language version (go1.24) used to build
golangci-lint is lower than the targeted Go version (1.25.0)
Move the job to golangci-lint-action@v7 + v2.8.0 and add a .golangci.yml
mirroring the hub repo's v2 config: govet, staticcheck, ineffassign and
unused, plus gofmt/goimports as formatters.
Fixes for the issues that surfaced:
- ST1005: lowercase error strings, drop trailing '!' in connect/hub.go
- SA4011: kubernetes/watch.go had a `break` inside a `select` default
that broke the select rather than the loop, i.e. a no-op; removed
- QF1008: drop the embedded ChartPathOptions selector in helm.go
- QF1003: tagged switch on r.URL.Path in mcp_test.go
- QF1004: strings.Replace(..., -1) -> strings.ReplaceAll
- gofmt -s and goimports with a local prefix across the tree
errcheck is not in the enabled set, matching hub.
* cmd: clarify --time parse error in pcap dump
The error neither named the offending flag/value nor separated the
wrapped error from the message. Reported by Copilot on #1952.
---------
Co-authored-by: Alon Girmonsky <1990761+alongir@users.noreply.github.com>
mcp-publisher login github uses the device flow (interactive OAuth) which
requires a human to visit a URL - this can never work in CI. Switch to
github-oidc which uses the OIDC token provided by GitHub Actions.
* Add MCP Registry support with MCPB package format
- Update release workflow to create .mcpb artifacts for MCP Registry
- Update server.json to use MCPB registry type with GitHub namespace
- Use io.github.kubeshark/mcp namespace for GitHub authentication
- Add SHA256 placeholders (to be updated after first release)
* Add automated MCP Registry publishing to release workflow
- Add workflow_dispatch trigger with dry_run option for testing
- Add mcp-publish job that runs after release completes
- Generate server.json dynamically with correct version and SHA256 hashes
- Install and run mcp-publisher automatically
- Update static server.json to reference file with placeholders
- Add MCP Registry section to README
The release workflow now automatically publishes to the MCP Registry
when a new version is tagged. No manual steps required.
* Refactor: Extract MCP publishing to separate workflow
- Create mcp-publish.yml that triggers on release:published
- Simplify release.yml to focus on building and releasing
- MCP workflow has its own workflow_dispatch for testing
- Cleaner separation of concerns
* Address PR review feedback
- Update actions/checkout to v4
- Add OIDC permissions for MCP Registry authentication
- Change trigger from release:published to workflow_call
- Release workflow now calls mcp-publish after artifacts are uploaded
- Keep workflow_dispatch for manual testing
* Add mcp-publisher login step before publish
* feat: add goreleaser config for creating automatically homebrew formula
* Fix the formatting of YAML and add a newline at the end of file
* Fix the formatting of YAML, add a newline at the end of file and change the commit author
Co-authored-by: M. Mert Yildiran <me@mertyildiran.com>
* Remove `logger` module
* Remove `shared` module
* Move `cli` folder contents into project root
* Fix linter
* Change the module name from `github.com/kubeshark/kubeshark/cli` to `github.com/kubeshark/kubeshark`
* Set the default `Makefile` rule to `build`
* Add `lint` rule
* Fix the linter errors
* Remove `tap` directory
* Fix the depedencies and build errors
* Fix the linter errors
* Use `kubeshark/worker` image as tapper
* Arrange the pod prefixes and suffixes
* Don't install any dependencies in the CI
* Remove `devops` directory
* Don't generate eBPF object files in the CI
* Fix `Makefile`
* Update `Dockerfile`
* Remove the `ui` directory
* Deploy the UI in a separate pod named `front`
* Fix the port number
* Fix the port forwarding
* Call `postFrontStarted` only after `kubeshark-api-server` and `front` are ready
* Fix linter
* Fix `yaml` comments
M. Mert Yildiran
