github/node-problem-detector
1
0
Fork 0
mirror of https://github.com/kubernetes/node-problem-detector.git synced 2026-08-23 22:26:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

Bump github.com/prometheus/prometheus to v0.311.3 to fix CVEs

Browse Source 
The bump to v0.311.3 from commit 98e831b4 ("Fix Grype CVEs: update
logrus and prometheus/prometheus") was unintentionally reverted to
v0.35.0 by the go.mod conflict resolution in commit f844870a ("Run go
mod tidy and adapt to prometheus/common v0.67 API").

Re-apply it to fix CVE-2026-42154 (High), CVE-2026-40179 and
CVE-2026-44903 (Medium).

prometheus/prometheus v0.311.3 requires k8s.io/client-go v0.35.x,
which would drag the k8s.io modules past the v0.34 line this branch
must stay on. Pin k8s.io/api, k8s.io/apimachinery and k8s.io/client-go
back to v0.34.1 with replace directives in both the root and test
modules, so the built binaries keep using v0.34.1 (the replacement is
also what gets recorded in the binary build info).

The only prometheus/prometheus package linked into the NPD binaries is
model/value, so none of the k8s-facing prometheus code is compiled.
This commit is contained in:
Ciprian Hacman
2026-07-11 14:43:40 +03:00
parent 32cf258519
commit 6097eaba54
75 changed files with 21553 additions and 2780 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/go.mod
+9 -3
View File
@@ -13,9 +13,9 @@ require (
golang.org/x/crypto v0.53.0
golang.org/x/oauth2 v0.36.0
google.golang.org/api v0.272.0
k8s.io/apimachinery v0.34.1
k8s.io/apimachinery v0.35.3
k8s.io/component-base v0.34.1
k8s.io/klog/v2 v2.130.1
k8s.io/klog/v2 v2.140.0
k8s.io/node-problem-detector v0.8.20
sigs.k8s.io/boskos v0.0.0-20250612085457-e9e53220ffb6
)
@@ -75,8 +75,14 @@ require (
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect
k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect
sigs.k8s.io/controller-runtime v0.16.5 // indirect
sigs.k8s.io/prow v0.0.0-20240619181241-cfb8754e0459 // indirect
sigs.k8s.io/yaml v1.6.0 // indirect
)
replace k8s.io/api => k8s.io/api v0.34.1
replace k8s.io/apimachinery => k8s.io/apimachinery v0.34.1
replace k8s.io/client-go => k8s.io/client-go v0.34.1
test/go.sum
+4 -4
View File
@@ -750,10 +750,10 @@ k8s.io/apimachinery v0.34.1 h1:dTlxFls/eikpJxmAC7MVE8oOeP1zryV7iRyIjB0gky4=
k8s.io/apimachinery v0.34.1/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
k8s.io/component-base v0.34.1 h1:v7xFgG+ONhytZNFpIz5/kecwD+sUhVE6HU7qQUiRM4A=
k8s.io/component-base v0.34.1/go.mod h1:mknCpLlTSKHzAQJJnnHVKqjxR7gBeHRv0rPXA7gdtQ0=
k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y=
k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 h1:SjGebBtkBqHFOli+05xYbK8YF1Dzkbzn+gDM4X9T4Ck=
k8s.io/utils v0.0.0-20251002143259-bc988d571ff4/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=