Skip to content

Bump k8s.io/apimachinery from 0.32.3 to 0.35.2 #702

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Bump k8s.io/apimachinery from 0.32.3 to 0.35.2 #702

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
50 changes: 26 additions & 24 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,33 +1,31 @@
module github.com/openshift/ingress-node-firewall

go 1.24.0

toolchain go1.24.1
go 1.25.0

require (
github.com/Masterminds/sprig v2.22.0+incompatible
github.com/bpfman/bpfman-operator v0.5.7-0.20250318195503-7377aa509673
github.com/cilium/ebpf v0.18.0
github.com/go-logr/logr v1.4.2
github.com/go-logr/logr v1.4.3
github.com/golang/glog v1.2.5
github.com/google/gopacket v1.1.19
github.com/kennygrant/sanitize v1.2.4
github.com/onsi/ginkgo v1.16.5
github.com/onsi/gomega v1.37.0
github.com/onsi/gomega v1.38.2
github.com/pkg/errors v0.9.1
github.com/prometheus/client_golang v1.22.0
github.com/prometheus/common v0.63.0
github.com/vishvananda/netlink v1.3.1-0.20250206174618-62fb240731fa
golang.org/x/sys v0.32.0
golang.org/x/sys v0.38.0
gopkg.in/mcuadros/go-syslog.v2 v2.3.0
k8s.io/api v0.32.3
k8s.io/apiextensions-apiserver v0.32.3
k8s.io/apimachinery v0.32.3
k8s.io/apimachinery v0.35.2
k8s.io/client-go v0.32.3
k8s.io/component-base v0.32.3
k8s.io/klog v1.0.0
k8s.io/kubernetes v1.32.3
k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738
k8s.io/utils v0.0.0-20251002143259-bc988d571ff4
sigs.k8s.io/controller-runtime v0.20.4
Comment on lines 21 to 29
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Mar 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

Kubernetes client-go apimachinery version compatibility v0.32 v0.35

💡 Result:

  • Rule of thumb: keep the Kubernetes Go “staging” modules on the same minor v0.x line (e.g., k8s.io/client-go, k8s.io/apimachinery, k8s.io/api, etc.). apimachinery explicitly provides no compatibility guarantees and its branches “track Kubernetes” (so mixing minors is not supported) [2].
  • Mapping: client-go publishes v0.x.y tags that match Kubernetes v1.x.y minors (e.g., v0.32.x ↔ Kubernetes v1.32.x) [1].
  • So for your cases:
    • If you use k8s.io/client-go v0.32.*, use k8s.io/apimachinery v0.32.* (and other k8s.io/* modules on v0.32.*) [1][2].
    • If you move to k8s.io/apimachinery v0.35.*, move k8s.io/client-go to v0.35.* as well (and align the rest of k8s.io/*) [2].
  • Cluster skew note (client-go ↔ cluster): client-go publishes a compatibility matrix; as of the current pkg.go.dev page it’s shown through Kubernetes 1.34 (with “exact match” on same-minor, and partial compatibility across nearby minors) [1]. client-go v0.35.2 exists, but the matrix section on that page hasn’t been updated to include Kubernetes 1.35 yet [1].

Sources: [1] k8s.io/client-go docs (pkg.go.dev) [2] k8s.io/apimachinery docs (pkg.go.dev)

🌐 Web query:

Go Minimal Version Selection MVS highest version module resolution

💡 Result:

Go modules use Minimal Version Selection (MVS) to decide one version per module path for a build:

  • Each require in every go.mod states a minimum version of that dependency (there are no “maximum” constraints in MVS). (research.swtch.com)
  • MVS builds the module requirement graph, and for each module it selects the highest version that is required anywhere in the graph (i.e., the max of all stated minimums for that module). That produces the overall minimal set of versions that still satisfies all requirements. (research.swtch.com)
  • Practically: if any direct or transitive dependency requires example.com/lib v1.4.0 and another requires v1.7.2, the resolved version is v1.7.2 (for that module path). (dev.to)

So “highest version module resolution” in Go is: highest version demanded by any dependency, not “always latest on the internet.” The selected version only increases when some require (direct or transitive) increases. (research.swtch.com)

Citations:

🏁 Script executed:

# Check if there's any go.sum or other context that might show the actual dependency resolution
cd /tmp && git rev-parse --show-toplevel 2>/dev/null || echo "Not a git repo"

Repository: openshift/ingress-node-firewall

Length of output: 89

🏁 Script executed:

# Search for any documentation or comments in the repo about versioning strategy
rg -i "apimachinery|client-go|version.*compat" --max-count=20

Repository: openshift/ingress-node-firewall

Length of output: 50388

Align all Kubernetes staging modules to the same minor version.

k8s.io/apimachinery v0.35.2 is incompatible with the v0.32.3 line used by k8s.io/api, k8s.io/apiextensions-apiserver, k8s.io/client-go, and k8s.io/component-base. Per Kubernetes documentation, apimachinery does not guarantee cross-release compatibility, and Go's module selection will pick the highest version (v0.35.2) for each module path. Either upgrade all Kubernetes staging modules to v0.35.x together or keep apimachinery on v0.32.x.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@go.mod` around lines 21 - 29, The go.mod currently mixes Kubernetes staging
versions: k8s.io/api, k8s.io/apiextensions-apiserver, k8s.io/client-go,
k8s.io/component-base, k8s.io/klog, k8s.io/kubernetes are at v0.32.3 while
k8s.io/apimachinery is at v0.35.2 which will cause incompatible resolution; pick
a single minor series and align all staging modules accordingly by changing the
k8s.io/apimachinery entry to v0.32.3 (or upgrading the other k8s.io/* entries to
v0.35.2 consistently), then run module resolution (go mod tidy) to ensure the
dependency graph is consistent; specifically update the k8s.io/apimachinery
version line in go.mod to match the rest or update all k8s.io/* lines to the
same v0.35.x release.

)

Expand All @@ -42,17 +40,16 @@ require (
github.com/evanphx/json-patch v4.12.0+incompatible // indirect
github.com/evanphx/json-patch/v5 v5.9.11 // indirect
github.com/fsnotify/fsnotify v1.7.0 // indirect
github.com/fxamacker/cbor/v2 v2.7.0 // indirect
github.com/fxamacker/cbor/v2 v2.9.0 // indirect
github.com/go-logr/zapr v1.3.0 // indirect
github.com/go-openapi/jsonpointer v0.21.0 // indirect
github.com/go-openapi/jsonreference v0.21.0 // indirect
github.com/go-openapi/swag v0.23.0 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang/protobuf v1.5.4 // indirect
github.com/google/btree v1.1.3 // indirect
github.com/google/gnostic-models v0.6.8 // indirect
github.com/google/gnostic-models v0.7.0 // indirect
github.com/google/go-cmp v0.7.0 // indirect
github.com/google/gofuzz v1.2.0 // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/gorilla/websocket v1.5.0 // indirect
github.com/huandu/xstrings v1.3.2 // indirect
Expand All @@ -65,35 +62,40 @@ require (
github.com/mitchellh/reflectwalk v1.0.2 // indirect
github.com/moby/spdystream v0.5.0 // indirect
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
github.com/modern-go/reflect2 v1.0.2 // indirect
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
github.com/nxadm/tail v1.4.8 // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/prometheus/client_model v0.6.1 // indirect
github.com/prometheus/procfs v0.15.1 // indirect
github.com/spf13/pflag v1.0.5 // indirect
github.com/spf13/pflag v1.0.9 // indirect
github.com/vishvananda/netns v0.0.4 // indirect
github.com/x448/float16 v0.8.4 // indirect
go.opentelemetry.io/otel v1.32.0 // indirect
go.opentelemetry.io/otel/trace v1.32.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.27.0 // indirect
golang.org/x/crypto v0.36.0 // indirect
golang.org/x/net v0.37.0 // indirect
go.yaml.in/yaml/v2 v2.4.3 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect
golang.org/x/crypto v0.44.0 // indirect
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Mar 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

# First, check the current state of go.mod file
cd / && find . -name "go.mod" -type f 2>/dev/null | head -5

Repository: openshift/ingress-node-firewall

Length of output: 391

🏁 Script executed:

# Search for vulnerability information
# Let's check the Go vulnerability database reference
rg "golang.org/x/crypto" --type go -A 2 -B 2

Repository: openshift/ingress-node-firewall

Length of output: 634

🌐 Web query:

GO-2025-4135 CVE-2025-47914 golang.org/x/crypto vulnerability

💡 Result:

GO-2025-4135 (CVE-2025-47914, GHSA-f6x5-jh6r-wrfv) is a DoS issue in golang.org/x/crypto/ssh/agent: SSH agent servers don’t validate message sizes when handling new identity requests, so a malformed message can trigger an out-of-bounds read and panic (crash). Affected versions: golang.org/x/crypto/ssh/agent before v0.45.0 (notably code paths involving ServeAgent and ForwardToAgent). Fix: upgrade golang.org/x/crypto to v0.45.0 or later (tagged Nov 19, 2025). [1][2]

Sources:
[1] Go Vulnerability Database entry GO-2025-4135 (pkg.go.dev) (pkg.go.dev)
[2] golang-announce: “Vulnerabilities in golang.org/x/crypto” (Nov 19, 2025) (groups.google.com)

Citations:

🌐 Web query:

golang.org/x/crypto v0.45.0 release notes security patch

💡 Result:

golang.org/x/crypto doesn’t publish detailed “release notes” on GitHub releases (the repo uses tags), but v0.45.0 was tagged Nov 19, 2025. [1]

Security fixes included in / addressed by v0.45.0:

  • GO-2025-4134 / CVE-2025-58181 (in golang.org/x/crypto/ssh): SSH servers parsing GSSAPI auth requests didn’t validate the number of mechanisms, allowing an attacker to trigger unbounded memory consumption (DoS). Fixed in v0.45.0. [2]
  • GO-2025-4135 / CVE-2025-47914 (in golang.org/x/crypto/ssh/agent): SSH agent servers didn’t validate message sizes for “new identity” requests, which could cause a panic due to an out-of-bounds read (DoS). Fixed in v0.45.0. [3]

Patch guidance: upgrade your dependency to golang.org/x/crypto v0.45.0 or later. [2][3]

Sources
[1] https://github.com/golang/crypto/tags
[2] https://osv.dev/vulnerability/GO-2025-4134
[3] https://pkg.go.dev/vuln/GO-2025-4135

🏁 Script executed:

cat -n ./home/jailuser/git/go.mod | sed -n '75,85p'

Repository: openshift/ingress-node-firewall

Length of output: 133

🌐 Web query:

golang.org/x/crypto latest version 2025 2026

💡 Result:

  • Latest overall (as of March 9, 2026): golang.org/x/crypto v0.48.0 (released Feb 9, 2026). [1]
  • Latest released in 2026 (so far): v0.48.0 (Feb 9, 2026). [1]
  • Latest released in 2025: v0.46.0 (Dec 8, 2025). [1]

To install:

go get golang.org/x/crypto@v0.48.0
# or
go get golang.org/x/crypto@latest

Sources
[1] Go package versions list for golang.org/x/crypto (pkg.go.dev) (pkg.go.dev)

Citations:

🏁 Script executed:

fd go.mod --type f | grep -v vendor | grep -v ".go/pkg/mod"

Repository: openshift/ingress-node-firewall

Length of output: 81

🏁 Script executed:

# Also try checking git ls-files for go.mod
git ls-files | grep "go.mod$"

Repository: openshift/ingress-node-firewall

Length of output: 81

🏁 Script executed:

cat -n go.mod | sed -n '75,90p'

Repository: openshift/ingress-node-firewall

Length of output: 863

🏁 Script executed:

# Also search for golang.org/x/crypto line in go.mod
rg "golang.org/x/crypto" go.mod -n

Repository: openshift/ingress-node-firewall

Length of output: 118

Bump golang.org/x/crypto to v0.45.0 or later to fix GO-2025-4135.

The current version (v0.44.0) is vulnerable to GO-2025-4135 / CVE-2025-47914, a DoS issue in golang.org/x/crypto/ssh/agent where SSH agent servers don't validate message sizes on new identity requests, triggering an out-of-bounds read and panic. Upgrade to v0.45.0 or later to resolve this vulnerability.

Proposed fix 
-	golang.org/x/crypto v0.44.0 // indirect
+	golang.org/x/crypto v0.45.0 // indirect
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
golang.org/x/crypto v0.44.0 // indirect
golang.org/x/crypto v0.45.0 // indirect
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@go.mod` at line 81, Update the indirect dependency golang.org/x/crypto from
v0.44.0 to v0.45.0 (or newer) to address GO-2025-4135/CVE-2025-47914; edit the
go.mod entry for golang.org/x/crypto (currently "golang.org/x/crypto v0.44.0 //
indirect") to at least v0.45.0, then run the module update commands (e.g., "go
get golang.org/x/crypto@v0.45.0" and "go mod tidy") to ensure the lockfile and
module graph are refreshed and the vulnerable version is replaced.

golang.org/x/net v0.47.0 // indirect
golang.org/x/oauth2 v0.25.0 // indirect
golang.org/x/sync v0.12.0 // indirect
golang.org/x/term v0.30.0 // indirect
golang.org/x/text v0.23.0 // indirect
golang.org/x/time v0.7.0 // indirect
golang.org/x/sync v0.18.0 // indirect
golang.org/x/term v0.37.0 // indirect
golang.org/x/text v0.31.0 // indirect
golang.org/x/time v0.9.0 // indirect
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
google.golang.org/protobuf v1.36.5 // indirect
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
google.golang.org/protobuf v1.36.8 // indirect
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/klog/v2 v2.130.1 // indirect
k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f // indirect
sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
sigs.k8s.io/randfill v1.0.0 // indirect
sigs.k8s.io/structured-merge-diff/v4 v4.4.2 // indirect
sigs.k8s.io/yaml v1.4.0 // indirect
sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
sigs.k8s.io/yaml v1.6.0 // indirect
)
Loading