github/node-problem-detector
1
0
Fork 0
mirror of https://github.com/kubernetes/node-problem-detector.git synced 2026-08-28 01:47:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

Bump github.com/prometheus/prometheus to v0.311.3 to fix CVEs

Browse Source 
The bump to v0.311.3 from commit 98e831b4 ("Fix Grype CVEs: update
logrus and prometheus/prometheus") was unintentionally reverted to
v0.35.0 by the go.mod conflict resolution in commit f844870a ("Run go
mod tidy and adapt to prometheus/common v0.67 API").

Re-apply it to fix CVE-2026-42154 (High), CVE-2026-40179 and
CVE-2026-44903 (Medium).

prometheus/prometheus v0.311.3 requires k8s.io/client-go v0.35.x,
which would drag the k8s.io modules past the v0.34 line this branch
must stay on. Pin k8s.io/api, k8s.io/apimachinery and k8s.io/client-go
back to v0.34.1 with replace directives in both the root and test
modules, so the built binaries keep using v0.34.1 (the replacement is
also what gets recorded in the binary build info).

The only prometheus/prometheus package linked into the NPD binaries is
model/value, so none of the k8s-facing prometheus code is compiled.
This commit is contained in:
Ciprian Hacman
2026-07-11 14:43:40 +03:00
parent 32cf258519
commit 6097eaba54
75 changed files with 21553 additions and 2780 deletions
Download Patch File Download Diff File Expand all files Collapse all files
go.mod
+16 -10
View File
@@ -8,7 +8,7 @@ require (
contrib.go.opencensus.io/exporter/stackdriver v0.13.14
github.com/acobaugh/osrelease v0.1.0
github.com/avast/retry-go/v4 v4.6.1
github.com/coreos/go-systemd/v22 v22.5.0
github.com/coreos/go-systemd/v22 v22.6.0
github.com/euank/go-kmsg-parser v2.0.0+incompatible
github.com/hpcloud/tail v1.0.0
github.com/prometheus/client_model v0.6.2
@@ -20,11 +20,11 @@ require (
go.opencensus.io v0.24.0
golang.org/x/sys v0.46.0
google.golang.org/api v0.272.0
k8s.io/api v0.34.1
k8s.io/apimachinery v0.34.1
k8s.io/client-go v0.34.1
k8s.io/klog/v2 v2.130.1
k8s.io/utils v0.0.0-20250604170112-4c0f3b243397
k8s.io/api v0.35.3
k8s.io/apimachinery v0.35.3
k8s.io/client-go v0.35.3
k8s.io/klog/v2 v2.140.0
k8s.io/utils v0.0.0-20251002143259-bc988d571ff4
)
require (
@@ -32,7 +32,7 @@ require (
cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
cloud.google.com/go/monitoring v1.24.3 // indirect
cloud.google.com/go/trace v1.11.7 // indirect
github.com/aws/aws-sdk-go v1.44.72 // indirect
github.com/aws/aws-sdk-go v1.55.7 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/census-instrumentation/opencensus-proto v0.4.1 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect
@@ -77,7 +77,7 @@ require (
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
github.com/prometheus/client_golang v1.23.2 // indirect
github.com/prometheus/prometheus v0.35.0 // indirect
github.com/prometheus/prometheus v0.311.3 // indirect
github.com/prometheus/statsd_exporter v0.22.7 // indirect
github.com/tklauser/go-sysconf v0.3.16 // indirect
github.com/tklauser/numcpus v0.11.0 // indirect
@@ -109,9 +109,15 @@ require (
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b // indirect
sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
sigs.k8s.io/randfill v1.0.0 // indirect
sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
sigs.k8s.io/yaml v1.6.0 // indirect
)
replace k8s.io/api => k8s.io/api v0.34.1
replace k8s.io/apimachinery => k8s.io/apimachinery v0.34.1
replace k8s.io/client-go => k8s.io/client-go v0.34.1