Upgrade module k8s.io/client-go in internal/backend/remote-state/kubernetes #36318
+272
−318
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I'm proposing bumping the
k8s.io/client-go
go module ininternal/backend/remote-state/kubernetes
. The rationale is that Prisma Cloud container vulnerability scanning reports a vulnerability on the indirect dependencygithub.com/emicklei/go-restful/v3
in this module.For reference: within the Prisma Cloud ecosystem, this vulnerability is referred to as
PRISMA-2022-0227
, rated7.5 - High
. The vulnerability is fixed in versionsv.3.10.0
and upwards ofgithub.com/emicklei/go-restful/v3
.A similar question was asked on HashiCorp Discuss here. To illustrate, a similar issue was raised on Kubernetes link.
My workflow for creating this PR:
go -C internal/backend/remote-state/kubernetes get -u k8s.io/client-go
to upgrade the modulemake syncdeps
as per instructions I found in this repogo test ./...
to verify tests are still passingFixes #36319
Target Release
1.11.x
CHANGELOG entry