SANDBOX-808: update kube & openshift dependencies to 4.17 #462
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| name: govulncheck | ||
| on: | ||
| pull_request: | ||
| branches: | ||
| - master | ||
|
|
||
| jobs: | ||
| govulncheck: | ||
| name: govulncheck | ||
| runs-on: ubuntu-24.04 | ||
|
|
||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Install Go | ||
| uses: actions/setup-go@v5 | ||
| with: | ||
| go-version-file: go.mod | ||
|
|
||
| - name: Run govulncheck | ||
| uses: golang/govulncheck-action@v1 | ||
| with: | ||
| go-version-input: ${{ steps.install-go.outputs.go-version }} | ||
| go-package: ./... |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,41 +1,43 @@ | ||
| module github.com/codeready-toolchain/api | ||
|
|
||
| go 1.22.0 | ||
|
Contributor
There was a problem hiding this comment. I'm just curious if it should be
Contributor
Author
There was a problem hiding this comment. If I put 1.22 and run
Contributor
There was a problem hiding this comment. @alexeykazakov From what i understand go 1.22 is still a valid version (reference here) but go1.22 < go1.22.0.
Contributor
There was a problem hiding this comment. readme, its mentioned 1.22.12 or higher, so it doesnt make sense to have 1.22.0 here.. ?
Contributor
Author
There was a problem hiding this comment. I was trying to figure out if we could remove toolchain from the go.mod, but I reverted to included now:
Contributor
There was a problem hiding this comment. For my understanding , why toolchain go1.22.12 is being added when we run go mod tidy?
Contributor
There was a problem hiding this comment. @fbm3307 Go 1.21 introduced the toolchain directive, which allows specifying the minimum Go toolchain version required for your module. While not new in 1.22, it's essential to ensure this directive aligns with your project's requirements, especially when upgrading. That's why it is being added.
Contributor
There was a problem hiding this comment. Thanks for the explanation ! |
||
|
|
||
| toolchain go1.22.12 | ||
|
|
||
| require ( | ||
| github.com/go-bindata/go-bindata v3.1.2+incompatible | ||
| // using latest commit from 'github.com/openshift/api branch release-4.17' | ||
| github.com/openshift/api v0.0.0-20250214103856-0cfc958f642b | ||
| k8s.io/api v0.30.1 | ||
| k8s.io/apimachinery v0.30.1 | ||
| k8s.io/code-generator v0.30.1 | ||
| k8s.io/gengo v0.0.0-20230829151522-9cce18d56c01 | ||
| k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 | ||
| sigs.k8s.io/controller-runtime v0.18.4 | ||
| sigs.k8s.io/controller-tools v0.15.0 | ||
| ) | ||
|
|
||
| require ( | ||
| github.com/emicklei/go-restful/v3 v3.11.0 // indirect | ||
| github.com/fatih/color v1.16.0 // indirect | ||
| github.com/go-logr/logr v1.4.1 // indirect | ||
| github.com/go-openapi/jsonpointer v0.19.6 // indirect | ||
| github.com/go-openapi/jsonreference v0.20.2 // indirect | ||
| github.com/go-openapi/swag v0.22.3 // indirect | ||
| github.com/gobuffalo/flect v1.0.2 // indirect | ||
| github.com/gogo/protobuf v1.3.2 // indirect | ||
| github.com/golang/protobuf v1.5.4 // indirect | ||
| github.com/google/gnostic-models v0.6.8 // indirect | ||
| github.com/google/gofuzz v1.2.0 // indirect | ||
| github.com/inconshreveable/mousetrap v1.1.0 // indirect | ||
| github.com/josharian/intern v1.0.0 // indirect | ||
| github.com/json-iterator/go v1.1.12 // indirect | ||
| github.com/mailru/easyjson v0.7.7 // indirect | ||
| github.com/mattn/go-colorable v0.1.13 // indirect | ||
| github.com/mattn/go-isatty v0.0.20 // indirect | ||
| github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect | ||
| github.com/modern-go/reflect2 v1.0.2 // indirect | ||
| github.com/spf13/cobra v1.8.0 // indirect | ||
| github.com/spf13/pflag v1.0.5 // indirect | ||
| golang.org/x/mod v0.17.0 // indirect | ||
| golang.org/x/net v0.33.0 // indirect | ||
|
|
@@ -47,8 +49,9 @@ require ( | |
| gopkg.in/inf.v0 v0.9.1 // indirect | ||
| gopkg.in/yaml.v2 v2.4.0 // indirect | ||
| gopkg.in/yaml.v3 v3.0.1 // indirect | ||
| k8s.io/apiextensions-apiserver v0.30.1 // indirect | ||
| k8s.io/gengo/v2 v2.0.0-20240228010128-51d4e06bde70 // indirect | ||
| k8s.io/klog/v2 v2.120.1 // indirect | ||
| k8s.io/utils v0.0.0-20230726121419-3b25d923346b // indirect | ||
| sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect | ||
| sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
minor - if you keep
1.22.11in go.mod you'll need to update here.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you for noticing!! I was trying different versions to check if the vulns would lower down. But I will keep it in 1.22.12. It seems to be all FPs. For more info, check this Slack thread