Bump k8s.io/apimachinery from 0.34.3 to 0.35.0 #62
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -1,16 +1,16 @@ | ||||||||||||||||
| module github.com/openstack-lightspeed/operator | ||||||||||||||||
|
|
||||||||||||||||
| go 1.25.0 | ||||||||||||||||
|
|
||||||||||||||||
| require ( | ||||||||||||||||
| github.com/go-logr/logr v1.4.3 | ||||||||||||||||
| github.com/onsi/ginkgo/v2 v2.27.4 | ||||||||||||||||
| github.com/onsi/gomega v1.39.0 | ||||||||||||||||
| github.com/openstack-k8s-operators/lib-common/modules/common v0.6.0 | ||||||||||||||||
| github.com/operator-framework/api v0.37.0 | ||||||||||||||||
| k8s.io/apimachinery v0.35.0 | ||||||||||||||||
| k8s.io/client-go v0.34.2 | ||||||||||||||||
|
Comment on lines
+11
to
12
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
# Check all k8s.io dependencies and their versions
rg -n "k8s\.io/" go.mod | sortRepository: openstack-lightspeed/operator Length of output: 813 🌐 Web query:
💡 Result: No—it’s not a supported/expected combination to use What versions should match?Kubernetes tags its staging Go modules so that Kubernetes Kubernetes version compatibility matrix (client-go ↔ Kubernetes)From the
So:
Practical guidance
Sources: Kubernetes client-go versioning + compatibility matrix[1], client-go Critical: Unsupported Kubernetes dependency version mismatch.
Both Fix: Either upgrade 🤖 Prompt for AI Agents |
||||||||||||||||
| k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 | ||||||||||||||||
| sigs.k8s.io/controller-runtime v0.22.4 | ||||||||||||||||
| ) | ||||||||||||||||
|
|
||||||||||||||||
|
|
@@ -71,34 +71,34 @@ require ( | |||||||||||||||
| go.opentelemetry.io/proto/otlp v1.7.0 // indirect | ||||||||||||||||
| go.uber.org/multierr v1.11.0 // indirect | ||||||||||||||||
| go.uber.org/zap v1.27.0 // indirect | ||||||||||||||||
| go.yaml.in/yaml/v2 v2.4.3 // indirect | ||||||||||||||||
| go.yaml.in/yaml/v3 v3.0.4 // indirect | ||||||||||||||||
| golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b // indirect | ||||||||||||||||
| golang.org/x/mod v0.29.0 // indirect | ||||||||||||||||
| golang.org/x/net v0.47.0 // indirect | ||||||||||||||||
| golang.org/x/oauth2 v0.30.0 // indirect | ||||||||||||||||
| golang.org/x/sync v0.18.0 // indirect | ||||||||||||||||
| golang.org/x/sys v0.38.0 // indirect | ||||||||||||||||
| golang.org/x/term v0.37.0 // indirect | ||||||||||||||||
| golang.org/x/text v0.31.0 // indirect | ||||||||||||||||
| golang.org/x/time v0.12.0 // indirect | ||||||||||||||||
| golang.org/x/tools v0.38.0 // indirect | ||||||||||||||||
| gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect | ||||||||||||||||
| google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 // indirect | ||||||||||||||||
| google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect | ||||||||||||||||
| google.golang.org/grpc v1.73.0 // indirect | ||||||||||||||||
|
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
# Check for security advisories for grpc-go
gh api graphql -f query='
{
securityVulnerabilities(first: 5, ecosystem: GO, package: "google.golang.org/grpc") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'Repository: openstack-lightspeed/operator Length of output: 233 🌐 Web query:
💡 Result:
Sources 🏁 Script executed: cd . && head -100 go.mod | tail -20Repository: openstack-lightspeed/operator Length of output: 1058 🏁 Script executed: rg "google.golang.org/grpc" go.mod -A 1 -B 1Repository: openstack-lightspeed/operator Length of output: 254 🏁 Script executed: rg "require \(" go.mod -A 50 | head -60Repository: openstack-lightspeed/operator Length of output: 2956 🏁 Script executed: # Check which direct dependency pulls in grpc by checking their go.mod files
# Let's look at the most likely candidates: k8s.io/client-go, sigs.k8s.io/controller-runtime
cd . && grep -E "k8s.io/client-go|sigs.k8s.io/controller-runtime|github.com/openstack-k8s-operators/lib-common" go.mod | grep "require ("Repository: openstack-lightspeed/operator Length of output: 55 🏁 Script executed: # Try to understand the dependency chain by checking the module graph info
# Since we can't run 'go mod graph' which might be slow, let's search for any mentions of how to resolve this
cat go.mod | tail -5Repository: openstack-lightspeed/operator Length of output: 274 Update
🧰 Tools🪛 OSV Scanner (2.3.3)[CRITICAL] 89-89: google.golang.org/grpc 1.73.0: gRPC-Go has an authorization bypass via missing leading slash in :path 🤖 Prompt for AI Agents |
||||||||||||||||
| google.golang.org/protobuf v1.36.8 // indirect | ||||||||||||||||
| gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect | ||||||||||||||||
| gopkg.in/inf.v0 v0.9.1 // indirect | ||||||||||||||||
| gopkg.in/yaml.v3 v3.0.1 // indirect | ||||||||||||||||
| k8s.io/api v0.34.2 // indirect | ||||||||||||||||
| k8s.io/apiextensions-apiserver v0.34.2 // indirect | ||||||||||||||||
| k8s.io/apiserver v0.34.2 // indirect | ||||||||||||||||
| k8s.io/component-base v0.34.2 // indirect | ||||||||||||||||
| k8s.io/klog/v2 v2.130.1 // indirect | ||||||||||||||||
| k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect | ||||||||||||||||
| sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.33.0 // indirect | ||||||||||||||||
| sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect | ||||||||||||||||
| sigs.k8s.io/randfill v1.0.0 // indirect | ||||||||||||||||
| sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect | ||||||||||||||||
| sigs.k8s.io/yaml v1.6.0 // indirect | ||||||||||||||||
|
|
||||||||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: openstack-lightspeed/operator
Length of output: 90
🌐 Web query:
What is the latest stable release of Go? Has Go 1.25.0 been released?💡 Result:
Sources:
[1] Go “Release History” page (lists go1.26.1 release date) (go.dev)
[2] Go blog announcement “Go 1.25 is released” (go.dev)
Citations:
Update Go toolchain version or CI environment: pipeline failure due to version mismatch.
The CI pipeline is failing because
go.modrequires Go 1.25.0, but the build environment is using Go 1.24.11. Go 1.25.0 is a valid released version, so the issue is that the CI environment needs to be updated to support it, or the go.mod requirement needs to be lowered to match the available toolchain.🤖 Prompt for AI Agents