The bump to v0.311.3 from commit 98e831b4 ("Fix Grype CVEs: update
logrus and prometheus/prometheus") was unintentionally reverted to
v0.35.0 by the go.mod conflict resolution in commit f844870a ("Run go
mod tidy and adapt to prometheus/common v0.67 API").
Re-apply it to fix CVE-2026-42154 (High), CVE-2026-40179 and
CVE-2026-44903 (Medium).
prometheus/prometheus v0.311.3 requires k8s.io/client-go v0.35.x,
which would drag the k8s.io modules past the v0.34 line this branch
must stay on. Pin k8s.io/api, k8s.io/apimachinery and k8s.io/client-go
back to v0.34.1 with replace directives in both the root and test
modules, so the built binaries keep using v0.34.1 (the replacement is
also what gets recorded in the binary build info).
The only prometheus/prometheus package linked into the NPD binaries is
model/value, so none of the k8s-facing prometheus code is compiled.
- Update github.com/sirupsen/logrus v1.9.0 -> v1.9.3 in test/go.mod
to fix GHSA-4f99-4q7p-p3gh (High)
- Update github.com/prometheus/prometheus v0.35.0 -> v0.311.3
to fix GHSA-vffh-x6r8-xx99 (Medium)
- Run go mod tidy and go mod vendor to update vendor directory
Added replace statement for apache/thrift, since it has been recently
moved from git.apache.org/thrift.git to github.com/apache/thrift, and is
causing `go get` to fail.
See https://github.com/jenkins-x/jx/pull/3321 for more detail.
Commands used:
GO111MODULE=on go get k8s.io/test-infra/boskos/client
GO111MODULE=on go mod vendor
This is generated using below commands:
go get -u -v go.opencensus.io/...
go get -u -v contrib.go.opencensus.io/exporter/prometheus
godep update ./...
godep save ./...
Ciprian Hacman
Bruno ChauvetandCiprian Hacman
github-actions
Fan Shang Xiang
Mike Miranda
Fan Shang Xiang
Varsha Teratipally
Karan Goel
Xuewei Zhang
Zhen Wang
andy xie
Lantao Liu