From 9569cc414fb110f582ac1df2ceeadd9a65348346 Mon Sep 17 00:00:00 2001 From: Richard Wall Date: Fri, 9 Oct 2026 15:58:16 +0000 Subject: [PATCH] Upgrade Go to 1.27.2 and golang.org/x/net to v0.60.0 - The nightly govulncheck workflow failed on 9 October with 11 newly published vulnerabilities that the agent calls. All 11 are in the Go 1.27.1 standard library. Five of them, in HTTP/2, also affect golang.org/x/net v0.58.0. - Run make upgrade-klone to pick up Go 1.27.2 from makefile-modules. This also updates the base-static and base-static-csi digests and bumps helm-unittest and goimports. - Bump golang.org/x/net to v0.60.0. Co-Authored-By: Claude Signed-off-by: Richard Wall --- go.mod | 2 +- go.sum | 4 ++-- klone.yaml | 22 +++++++++++----------- make/_shared/oci-build/00_mod.mk | 4 ++-- make/_shared/tools/00_mod.mk | 22 +++++++++++----------- 5 files changed, 27 insertions(+), 27 deletions(-) diff --git a/go.mod b/go.mod index c9e40c5b..6f61f752 100644 --- a/go.mod +++ b/go.mod @@ -94,7 +94,7 @@ require ( go.yaml.in/yaml/v3 v3.0.5 // indirect golang.org/x/crypto v0.57.0 // indirect golang.org/x/exp v0.0.0-20260824195058-e88cd73687aa // indirect - golang.org/x/net v0.58.0 // indirect + golang.org/x/net v0.60.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sys v0.48.0 // indirect golang.org/x/term v0.46.0 // indirect diff --git a/go.sum b/go.sum index d9c81b2e..70755241 100644 --- a/go.sum +++ b/go.sum @@ -250,8 +250,8 @@ golang.org/x/exp v0.0.0-20260824195058-e88cd73687aa h1:QSyA8ishJCyT21kER9KwNt0b7 golang.org/x/exp v0.0.0-20260824195058-e88cd73687aa/go.mod h1:zeBbvyFKDaLwa7CH/zI8KXt7gTl14SF7sO08Pl5jBCM= golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o= -golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= -golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= diff --git a/klone.yaml b/klone.yaml index 11e66b52..e8aa57e3 100644 --- a/klone.yaml +++ b/klone.yaml @@ -10,55 +10,55 @@ targets: - folder_name: generate-verify repo_url: https://github.com/cert-manager/makefile-modules.git repo_ref: main - repo_hash: 2a76aa931c14d5f9cf98846c66abb444b18e78da + repo_hash: 652e78728e713e8895d7fa755c7aa096911a18eb repo_path: modules/generate-verify - folder_name: go repo_url: https://github.com/cert-manager/makefile-modules.git repo_ref: main - repo_hash: 2a76aa931c14d5f9cf98846c66abb444b18e78da + repo_hash: 652e78728e713e8895d7fa755c7aa096911a18eb repo_path: modules/go - folder_name: helm repo_url: https://github.com/cert-manager/makefile-modules.git repo_ref: main - repo_hash: 2a76aa931c14d5f9cf98846c66abb444b18e78da + repo_hash: 652e78728e713e8895d7fa755c7aa096911a18eb repo_path: modules/helm - folder_name: help repo_url: https://github.com/cert-manager/makefile-modules.git repo_ref: main - repo_hash: 2a76aa931c14d5f9cf98846c66abb444b18e78da + repo_hash: 652e78728e713e8895d7fa755c7aa096911a18eb repo_path: modules/help - folder_name: kind repo_url: https://github.com/cert-manager/makefile-modules.git repo_ref: main - repo_hash: 2a76aa931c14d5f9cf98846c66abb444b18e78da + repo_hash: 652e78728e713e8895d7fa755c7aa096911a18eb repo_path: modules/kind - folder_name: klone repo_url: https://github.com/cert-manager/makefile-modules.git repo_ref: main - repo_hash: 2a76aa931c14d5f9cf98846c66abb444b18e78da + repo_hash: 652e78728e713e8895d7fa755c7aa096911a18eb repo_path: modules/klone - folder_name: licenses repo_url: https://github.com/cert-manager/makefile-modules.git repo_ref: main - repo_hash: 2a76aa931c14d5f9cf98846c66abb444b18e78da + repo_hash: 652e78728e713e8895d7fa755c7aa096911a18eb repo_path: modules/licenses - folder_name: oci-build repo_url: https://github.com/cert-manager/makefile-modules.git repo_ref: main - repo_hash: 2a76aa931c14d5f9cf98846c66abb444b18e78da + repo_hash: 652e78728e713e8895d7fa755c7aa096911a18eb repo_path: modules/oci-build - folder_name: oci-publish repo_url: https://github.com/cert-manager/makefile-modules.git repo_ref: main - repo_hash: 2a76aa931c14d5f9cf98846c66abb444b18e78da + repo_hash: 652e78728e713e8895d7fa755c7aa096911a18eb repo_path: modules/oci-publish - folder_name: repository-base repo_url: https://github.com/cert-manager/makefile-modules.git repo_ref: main - repo_hash: 2a76aa931c14d5f9cf98846c66abb444b18e78da + repo_hash: 652e78728e713e8895d7fa755c7aa096911a18eb repo_path: modules/repository-base - folder_name: tools repo_url: https://github.com/cert-manager/makefile-modules.git repo_ref: main - repo_hash: 2a76aa931c14d5f9cf98846c66abb444b18e78da + repo_hash: 652e78728e713e8895d7fa755c7aa096911a18eb repo_path: modules/tools diff --git a/make/_shared/oci-build/00_mod.mk b/make/_shared/oci-build/00_mod.mk index 112b8312..d09e64f3 100644 --- a/make/_shared/oci-build/00_mod.mk +++ b/make/_shared/oci-build/00_mod.mk @@ -14,11 +14,11 @@ # Use distroless as minimal base image to package the manager binary # To get latest SHA run "crane digest quay.io/jetstack/base-static:latest" -base_image_static := quay.io/jetstack/base-static@sha256:357d77bfada2c7902f60e0f3509eeb002c4739856066415126531103b22b5fac +base_image_static := quay.io/jetstack/base-static@sha256:516427682e450b65d12d884079d94b3247808940e4538af9246d1ec90d0d073f # Use custom apko-built image as minimal base image to package the manager binary # To get latest SHA run "crane digest quay.io/jetstack/base-static-csi:latest" -base_image_csi-static := quay.io/jetstack/base-static-csi@sha256:66ac24702010759a508cc547909e401e4bb7b851f07c41a2b44b3d18c2611cf8 +base_image_csi-static := quay.io/jetstack/base-static-csi@sha256:b4c561613d6060ecb7103be4004d8cc952c14381b15549a3fb0c0960b0d78e69 # Utility functions fatal_if_undefined = $(if $(findstring undefined,$(origin $1)),$(error $1 is not set)) diff --git a/make/_shared/tools/00_mod.mk b/make/_shared/tools/00_mod.mk index ba0588e8..833f647b 100644 --- a/make/_shared/tools/00_mod.mk +++ b/make/_shared/tools/00_mod.mk @@ -32,7 +32,7 @@ export GOVENDOR_DIR ?= $(default_shared_dir)/go_vendor # https://go.dev/dl/ # renovate: datasource=golang-version packageName=go -VENDORED_GO_VERSION := 1.27.1 +VENDORED_GO_VERSION := 1.27.2 $(bin_dir)/tools $(DOWNLOAD_DIR)/tools: @mkdir -p $@ @@ -73,7 +73,7 @@ tools := tools += helm=v4.3.0 # https://github.com/helm-unittest/helm-unittest/releases # renovate: datasource=github-releases packageName=helm-unittest/helm-unittest -tools += helm-unittest=v1.2.0 +tools += helm-unittest=v1.2.1 # https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl # renovate: datasource=github-releases packageName=kubernetes/kubernetes tools += kubectl=v1.37.1 @@ -117,7 +117,7 @@ tools += istioctl=1.31.1 tools += controller-gen=v0.22.0 # https://pkg.go.dev/golang.org/x/tools/cmd/goimports?tab=versions # renovate: datasource=go packageName=golang.org/x/tools -tools += goimports=v0.50.0 +tools += goimports=v0.51.0 # https://pkg.go.dev/github.com/google/go-licenses/v2?tab=versions # renovate: datasource=go packageName=github.com/inteon/go-licenses/v2 tools += go-licenses=v2.0.0-20250821024731-e4be79958780 @@ -527,10 +527,10 @@ $(foreach tool_name,$(tool_names),$(eval $(call tool_link_defs,$(tool_name)))) # File downloads # ################## -go_linux_amd64_SHA256SUM=63d339f0da5ab53635a56f2490a7984dfe12dfcff22ad749f63edaf590168445 -go_linux_arm64_SHA256SUM=3450b45a3f9ee8568792736a5c5e70a1f2e9b36c35a8f74958c03e51d7d92bec -go_darwin_amd64_SHA256SUM=8f8f52c6649542cf027bbc9b9c68d1ec042f9f34808a40413f0b8b3f66f3caa4 -go_darwin_arm64_SHA256SUM=ee215d57e0ec269c60cc9ceca68e6bda321ba9ee5afe24f4b0988703c2d87d12 +go_linux_amd64_SHA256SUM=ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5 +go_linux_arm64_SHA256SUM=94f3e30b8e374bc285e7dadc11e0865726b9bc6e85b841ccceaabc0214c6b7c8 +go_darwin_amd64_SHA256SUM=587b59182488b23aa6e5fc25110405a3e0e5b38ed2f5b2f46ed13c32aee356fe +go_darwin_arm64_SHA256SUM=76812b213b1b2302c978d28fa52fa92d541704b9e7d9d5db8002c50e4018c4c5 .PRECIOUS: $(DOWNLOAD_DIR)/tools/go@$(VENDORED_GO_VERSION)_$(HOST_OS)_$(HOST_ARCH).tar.gz $(DOWNLOAD_DIR)/tools/go@$(VENDORED_GO_VERSION)_$(HOST_OS)_$(HOST_ARCH).tar.gz: | $(DOWNLOAD_DIR)/tools @@ -552,10 +552,10 @@ $(DOWNLOAD_DIR)/tools/helm@$(HELM_VERSION)_$(HOST_OS)_$(HOST_ARCH): | $(DOWNLOAD chmod +x $(outfile); \ rm -f $(outfile).tar.gz -helm-unittest_linux_amd64_SHA256SUM=115c690234847d316f0a814beb9cceaf9c21bb407173179c0e82076bdce1efc0 -helm-unittest_linux_arm64_SHA256SUM=4a5cb6b35773734fd438c841e2553f3dbed2206cc027e94e4b093a43652cf888 -helm-unittest_darwin_amd64_SHA256SUM=c19e8f62ef7333c7a39c37ce3a732dc4e1c78a168856176796c49e39c2168c8c -helm-unittest_darwin_arm64_SHA256SUM=f9d1ea0a25455b8aa387865486dd9f49355b600ac875ac504c662a19d18fe09c +helm-unittest_linux_amd64_SHA256SUM=48e86ecc1467b009630e5954375e5d8494139f73b466df5fe8c04fa45b634939 +helm-unittest_linux_arm64_SHA256SUM=c66062713cd3cbb1a80d7098bd1d4a48db8438f56b43fb6377df65447f93f8de +helm-unittest_darwin_amd64_SHA256SUM=3e57daace5249d8dafd5fd2f6fbebf773c7e53a56e904db1f903031866853158 +helm-unittest_darwin_arm64_SHA256SUM=38ec0475b9206ba62454ab0f51a7fecbb9bfe103e9a7a1426f3b799d4f432ab2 # helm-unittest uses "macos" instead of "darwin" in release filenames helm_unittest_os := $(HOST_OS)