Skip to content

v2.5.3: Patch vulnerable dependencies #68

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
indrora merged 9 commits into from
May 21, 2026
Merged

v2.5.3: Patch vulnerable dependencies #68

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
3340f53
feat: release 2.5.0 (#62)
indrora Jan 22, 2026
3dcb8de
Merge 2.5.1 to main (#65)
indrora Apr 22, 2026
9d03316
Merge 2.5.2 to main (#67)
indrora Apr 30, 2026
0a24a40
chore(deps): patch vulnerable dependencies
irby May 14, 2026
8b04778
fix(tests): fix test failures caused by merge conflict resolution issue
irby May 14, 2026
43e49b1
chore(docs): update CHANGELOG
irby May 14, 2026
5c200fa
chore(ci): update trigger for dependency review
irby May 14, 2026
57acca4
Merge branch 'release-2.5' into chore/AB#86154/patch-vulnerabilites
irby May 14, 2026
8195ff2
chore(ci): address copilot feedback
irby May 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 14 additions & 1 deletion .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,4 +71,17 @@ jobs:
(echo; echo "Unexpected difference in directories after code generation. Run 'make generate manifests' and commit."; exit 1)

- name: Lint Helm manifests
run: make lint-manifests
run: make lint-manifests

dependency-review:
name: Dependency Review
runs-on: ubuntu-latest
if: github.event_name == 'pull_request'
steps:
- name: Checkout code
uses: actions/checkout@v5

- name: Dependency Review
uses: actions/dependency-review-action@v5
with:
fail-on-severity: critical
7 changes: 7 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,10 @@
# v2.5.3
## Security
- Updated dependencies to address various security vulnerabilities:
- google.golang.org/grpc -> v1.79.3 (CVE-2026-33186)
- github.com/Azure/go-ntlmssp -> v0.1.1 (CVE-2026-32952)
- golang.org/x/crypto -> v0.46.0 (CVE-2025-58181 & CVE-2025-47914)

# v2.5.2
## Fixes
- Fixes an issue where a namespace may not be properly applied if applying the Helm template without a namespace specified / using `kubectl apply -f` directly with the rendered template.
Expand Down
4 changes: 4 additions & 0 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,10 @@ lint: golangci-lint ## Run golangci-lint linter & yamllint
lint-fix: golangci-lint ## Run golangci-lint linter and perform fixes
$(GOLANGCI_LINT) run --fix

.PHONY: fix
fix:
go fix ./...

.PHONY: helm-template
helm-template: ## Render Helm chart templates to stdout (includes CRDs).
helm template $(HELM_RELEASE_NAME) $(HELM_CHART_DIR) --include-crds
Expand Down
34 changes: 17 additions & 17 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,9 @@ require (
github.com/Keyfactor/keyfactor-auth-client-go v1.3.1
github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.2
github.com/cert-manager/cert-manager v1.16.2
github.com/go-logr/logr v1.4.2
github.com/stretchr/testify v1.10.0
golang.org/x/oauth2 v0.30.0
github.com/go-logr/logr v1.4.3
github.com/stretchr/testify v1.11.1
golang.org/x/oauth2 v0.34.0
Comment thread
irby marked this conversation as resolved.
k8s.io/api v0.31.1
k8s.io/apimachinery v0.31.1
k8s.io/client-go v0.31.1
Expand All @@ -24,23 +24,23 @@ require (
github.com/google/s2a-go v0.1.9 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.3.4 // indirect
github.com/googleapis/gax-go/v2 v2.14.1 // indirect
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 // indirect
go.opentelemetry.io/otel v1.34.0 // indirect
go.opentelemetry.io/otel/metric v1.34.0 // indirect
go.opentelemetry.io/otel/trace v1.34.0 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20250219182151-9fdb1cabc7b2 // indirect
google.golang.org/grpc v1.70.0 // indirect
go.opentelemetry.io/otel v1.39.0 // indirect
go.opentelemetry.io/otel/metric v1.39.0 // indirect
go.opentelemetry.io/otel/trace v1.39.0 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
google.golang.org/grpc v1.79.3 // indirect
)

require (
cloud.google.com/go/compute/metadata v0.6.0 // indirect
cloud.google.com/go/compute/metadata v0.9.0 // indirect
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.10.1
github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.1 // indirect
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets v1.3.1 // indirect
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.1 // indirect
github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
github.com/Azure/go-ntlmssp v0.1.1 // indirect
github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/blang/semver/v4 v4.0.0 // indirect
Expand Down Expand Up @@ -86,16 +86,16 @@ require (
github.com/x448/float16 v0.8.4 // indirect
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.27.0 // indirect
golang.org/x/crypto v0.39.0 // indirect
golang.org/x/crypto v0.46.0 // indirect
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
golang.org/x/net v0.41.0
golang.org/x/sys v0.33.0 // indirect
golang.org/x/term v0.32.0 // indirect
golang.org/x/text v0.26.0 // indirect
golang.org/x/net v0.48.0
golang.org/x/sys v0.39.0 // indirect
golang.org/x/term v0.38.0 // indirect
golang.org/x/text v0.32.0 // indirect
golang.org/x/time v0.10.0 // indirect
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
google.golang.org/api v0.223.0
google.golang.org/protobuf v1.36.5 // indirect
google.golang.org/protobuf v1.36.10 // indirect
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
Expand Down
Loading
Loading