Repository navigation
Tags
Tags
Upgrade Go to 1.26.10 to resolve stdlib CVE-2026-111943 (#1128) Upgrades the Go version from `1.26.9` to `1.26.10` (released `2026-10-19`) across all Kf modules to include the latest `crypto/x509` standard library security fix ([CVE-2026-111943](golang/go#82348)). ## Proposed Changes * **[`go.mod`](https://github.com/google/kf/blob/main/go.mod), [`operator/go.mod`](https://github.com/google/kf/blob/main/operator/go.mod), [`first_party/k8s-stateless-subresource/go.mod`](https://github.com/google/kf/blob/main/first_party/k8s-stateless-subresource/go.mod), & [`third_party/forked/v2-buildpack-lifecycle/go.mod`](https://github.com/google/kf/blob/main/third_party/forked/v2-buildpack-lifecycle/go.mod)**: Bump `go` directive from `1.26.9` to `1.26.10`. ## Release Notes ```release-note - Upgrade Go toolchain to 1.26.10 to resolve crypto/x509 CVE-2026-111943 ```
Updated dependencies for kf (#1124) <!-- Include the issue number below --> ## Proposed Changes * `Security`: Upgraded Anthos Service Mesh to 1.29.7-asm.2 * `Changed`: Updated subresource-apiserver and build TaskRun Workload Identity init container (wait-for-wi) image to cloud-sdk:alpine to prevent image pull errors. * `Changed`: Aligned release asmcli installer script and gateway samples to version 1.29. * `Infrastructure`: Updated Cloud Build pipelines and release tooling to use active cloud-sdk:alpine builder images. ## Release Notes <!-- kf follows the Keep A Changelog standard for release notes. https://keepachangelog.com/en/1.0.0/ Changelog entries should be one per line and start with one of the following words: `Added` for new features. `Changed` for changes in existing functionality. `Deprecated` for soon-to-be removed features. `Removed` for now removed features. `Fixed` for any bug fixes. `Security` in case of vulnerabilities. If one of the changes is breaking include that as a second word e.g. Removed BREAKING support for manifests v1 --> ```release-note * `Security`: Upgraded Anthos Service Mesh to 1.29.7-asm.2 to resolve CVE-2026-73513 (GCP-2026-057). * `Changed`: Updated subresource-apiserver and build TaskRun Workload Identity init container (wait-for-wi) image to cloud-sdk:alpine to prevent image pull errors. * `Changed`: Aligned release asmcli installer script and gateway samples to version 1.29. * `Infrastructure`: Updated Cloud Build pipelines and release tooling to use active cloud-sdk:alpine builder images. ``` ## Risks and mitigations Low risk. Standard patch release updating Anthos Service Mesh to latest security patch and updating Cloud SDK base images. ## Dependencies | Dependency | Version | | :--- | :--- | | [Tekton](https://tekton.dev/) | `v1.12.2` | | [Anthos Service Mesh](https://cloud.google.com/service-mesh/docs/gke-install-overview) | `1.29.7-asm.2` | | [Config Connector](https://cloud.google.com//config-connector/docs/how-to/advanced-install) | `1.153.0` |
Updated dependencies for kf (#1124) <!-- Include the issue number below --> ## Proposed Changes * `Security`: Upgraded Anthos Service Mesh to 1.29.7-asm.2 * `Changed`: Updated subresource-apiserver and build TaskRun Workload Identity init container (wait-for-wi) image to cloud-sdk:alpine to prevent image pull errors. * `Changed`: Aligned release asmcli installer script and gateway samples to version 1.29. * `Infrastructure`: Updated Cloud Build pipelines and release tooling to use active cloud-sdk:alpine builder images. ## Release Notes <!-- kf follows the Keep A Changelog standard for release notes. https://keepachangelog.com/en/1.0.0/ Changelog entries should be one per line and start with one of the following words: `Added` for new features. `Changed` for changes in existing functionality. `Deprecated` for soon-to-be removed features. `Removed` for now removed features. `Fixed` for any bug fixes. `Security` in case of vulnerabilities. If one of the changes is breaking include that as a second word e.g. Removed BREAKING support for manifests v1 --> ```release-note * `Security`: Upgraded Anthos Service Mesh to 1.29.7-asm.2 to resolve CVE-2026-73513 (GCP-2026-057). * `Changed`: Updated subresource-apiserver and build TaskRun Workload Identity init container (wait-for-wi) image to cloud-sdk:alpine to prevent image pull errors. * `Changed`: Aligned release asmcli installer script and gateway samples to version 1.29. * `Infrastructure`: Updated Cloud Build pipelines and release tooling to use active cloud-sdk:alpine builder images. ``` ## Risks and mitigations Low risk. Standard patch release updating Anthos Service Mesh to latest security patch and updating Cloud SDK base images. ## Dependencies | Dependency | Version | | :--- | :--- | | [Tekton](https://tekton.dev/) | `v1.12.2` | | [Anthos Service Mesh](https://cloud.google.com/service-mesh/docs/gke-install-overview) | `1.29.7-asm.2` | | [Config Connector](https://cloud.google.com//config-connector/docs/how-to/advanced-install) | `1.153.0` |
Upgrade Go to 1.26.5 to resolve stdlib CVEs (#1121) ## Description Upgrades the Go version to `1.26.5` across `go.mod`, `operator/go.mod`, and `first_party/k8s-stateless-subresource/go.mod` to resolve Go standard library vulnerabilities CVE-2026-39822 and CVE-2026-42505 across controller and subresource components. ## Changes - Bump Go version to 1.26.5 in root and submodules - Cleaned up module vendor dependencies - Verified with unit tests (`./hack/unit-test.sh`) ## Changelog Security: Fixed CVE-2026-39822 and CVE-2026-42505 by upgrading Go to 1.26.5
Update Tekton Pipelines, ASM, KCC versions + CVE fixes (#1118) ## Proposed Changes * Upgraded ASM to 1.29.5 * Upgraded Tekton Pipelines to 1.12.2 * Upgraded KCC to 1.153.0 * Fixed CVE-2025-22868 * Fixed GHSA-m425-mq94-257g * Fixed CVE-2024-24786 * Fixed CVE-2025-30204 * Fixed CVE-2026-46680 * Fixed CVE-2025-15558 * Fixed CVE-2026-34040
Upgrade Go packages to fix CVEs (#1114) ## Proposed Changes ### 1. Root Module (github.com/google/kf/v2) Upgraded github.com/docker/docker replacement version from v20.10.24+incompatible to v28.5.2+incompatible in root go.mod (resolves GO-2025-3829). Refactored Term/Console Packages: The docker/docker/pkg/term dependency was removed in newer Docker CLI/engine versions. The importing code was refactored to use the modern alternative github.com/moby/term: - ssh.go - term.go - resize.go - term_writer.go ### 2. Submodule first_party/k8s-stateless-subresource Upgraded google.golang.org/protobuf to v1.33.0 (resolves GO-2024-2611). Upgraded google.golang.org/grpc to v1.56.3 (resolves GO-2023-2153). Upgraded golang.org/x/oauth2 to v0.27.0 (resolves GO-2025-3488). Upgraded github.com/golang/protobuf to v1.5.4 for compatibility. ### 3. Operator Module (github.com/google/kf/v2/operator) Upgraded Go Toolchain from go1.20 to go1.25.0 in operator/go.mod . Upgraded golang.org/x/net to v0.56.0 (resolves GO-2026-5026, GO-2026-4918, and GO-2024-2687). Upgraded github.com/google/go-cmp to v0.6.0 to resolve comparisons clashing with new Go context internals. Added operator/tools.go: Pinned code-generator packages (k8s.io/code-generator) and mock generation frameworks (github.com/golang/mock/mockgen) so they are correctly vendored. Refactored Tests: Modified fake_owner_injector_test.go to use cmpopts.IgnoreFields to skip comparing the Ctx field (containing context internals), resolving panics under Go 1.25+. ### 4. Build & Codegen Fixes Fixed operator/hack/update-codegen.sh: Resolved knative.dev/hack and k8s.io/code-generator script paths from the Go mod cache dynamically to support headless execution and prevent dependency package resolution errors during compilation. Stubbed helper libraries operator/scripts/shared/library.sh and root hack/library.sh to allow codegen scripts to execute correctly. Re-generated Client Fakes & Deepcopy API Objects under the operator's versioned clientset packages.
Pinning go-buildpack version to avoid https://github.com/cloudfoundry… ( #1103) <!-- Include the issue number below --> Workaround for […/go-buildpack/issues/556](cloudfoundry/go-buildpack#556) ## Proposed Changes * Temporarily use fixed version of go-buildpack instead of the latest one.
Retry get Sourcepackage operation from listers with exponential backo… …ff (#1098) ## Release Notes ```release-note `Fixed` race condition like situation where reconciling status/presence of a source package races with consuming source package during the "kf push" operation. ```
Fix pipeline issues by multiple small changes (#1094) ## Proposed Changes * Pin ko version it know it's compatible with used go version * Supply _CLOUDSDK_IMAGE variable to pipelines to force alpine with docker * Add _REF_NAME as a substitution only if it's required
PreviousNext