SANDBOX-808: update kube & openshift dependencies to 4.17#462
SANDBOX-808: update kube & openshift dependencies to 4.17#462rsoaresd merged 12 commits intocodeready-toolchain:masterfrom
Conversation
rsoaresd
requested review from
MatousJobanek,
alexeykazakov,
fbm3307,
jrosental,
metlos,
mfrancisc,
rajivnathan,
ranakan19 and
xcoulon
as code owners
mfrancisc
left a comment
mfrancisc
left a comment
There was a problem hiding this comment.
Looks good 🚀
Thanks for taking care of this 🙏
|
|
||
| * Go version 1.21.x (1.21.13 or higher) - download for your development environment https://golang.org/dl/[here]. | ||
| * Operator SDK v1.36.0 - download for your development environment https://v1-36-x.sdk.operatorframework.io/docs/installation/#install-from-github-release[here] | ||
| * Go version 1.22.x (1.22.12 or higher) - download for your development environment https://golang.org/dl/[here]. |
There was a problem hiding this comment.
minor - if you keep 1.22.11 in go.mod you'll need to update here.
There was a problem hiding this comment.
Thank you for noticing!! I was trying different versions to check if the vulns would lower down. But I will keep it in 1.22.12. It seems to be all FPs. For more info, check this Slack thread
| module github.com/codeready-toolchain/api | ||
|
|
||
| go 1.21 | ||
| go 1.22.0 |
There was a problem hiding this comment.
I'm just curious if it should be 1.22 instead?
There was a problem hiding this comment.
If I put 1.22 and run go mod tidy, it automatically adds .0 and the toolchain
There was a problem hiding this comment.
@alexeykazakov From what i understand go 1.22 is still a valid version (reference here) but go1.22 < go1.22.0.
"A module’s go line must declare a version greater than or equal to the go version declared by each of the modules listed in require statements." (ref here )
So i'm guessing one of the dependencies have a go version higher than go.122
hope it helps
| module github.com/codeready-toolchain/api | ||
|
|
||
| go 1.21 | ||
| go 1.22.0 |
There was a problem hiding this comment.
readme, its mentioned 1.22.12 or higher, so it doesnt make sense to have 1.22.0 here.. ?
There was a problem hiding this comment.
I was trying to figure out if we could remove toolchain from the go.mod, but I reverted to included now:
go 1.22.0
toolchain go1.22.12
There was a problem hiding this comment.
For my understanding , why toolchain go1.22.12 is being added when we run go mod tidy?
There was a problem hiding this comment.
@fbm3307 Go 1.21 introduced the toolchain directive, which allows specifying the minimum Go toolchain version required for your module. While not new in 1.22, it's essential to ensure this directive aligns with your project's requirements, especially when upgrading. That's why it is being added.
Checkout toolchain directive doc here. I also found go directive doc informative
There was a problem hiding this comment.
Thanks for the explanation !
|
6 participants
Description
Update dependencies
Note
Operator SDK will be updated in the next set of PRs along with toolchain-cicd and operators update
Changes in
k8s.io/kube-openapi/cmd/openapi-gen--output-dirdeprecated--output-diris now required--output-file-baseis now--output-file--output-packageis now--output-pkgIssue ticket number and link
SANDBOX-808
Note
snyk reports a lot of vulnerabilities regarding go 1.22. From snyk's source, it seems all FPs. For more info, check this Slack thread
Checks
Did you run
make generatetarget? yesDid
make generatechange anything in other projects (host-operator, member-operator)? yesIn case of new CRD, did you the following? N/A
resources/setup/roles/host.yamlin the sandbox-sre repositoryPROJECTfile: https://github.com/codeready-toolchain/host-operator/blob/master/PROJECTCSVfile: https://github.com/codeready-toolchain/host-operator/blob/master/config/manifests/bases/host-operator.clusterserviceversion.yamlIn case other projects are changed, please provides PR links.