Tags: google/kf
Tags
Update Tekton Pipelines, ASM, KCC versions + CVE fixes (#1118) ## Proposed Changes * Upgraded ASM to 1.29.5 * Upgraded Tekton Pipelines to 1.12.2 * Upgraded KCC to 1.153.0 * Fixed CVE-2025-22868 * Fixed GHSA-m425-mq94-257g * Fixed CVE-2024-24786 * Fixed CVE-2025-30204 * Fixed CVE-2026-46680 * Fixed CVE-2025-15558 * Fixed CVE-2026-34040
Upgrade Go packages to fix CVEs (#1114) ## Proposed Changes ### 1. Root Module (github.com/google/kf/v2) Upgraded github.com/docker/docker replacement version from v20.10.24+incompatible to v28.5.2+incompatible in root go.mod (resolves GO-2025-3829). Refactored Term/Console Packages: The docker/docker/pkg/term dependency was removed in newer Docker CLI/engine versions. The importing code was refactored to use the modern alternative github.com/moby/term: - ssh.go - term.go - resize.go - term_writer.go ### 2. Submodule first_party/k8s-stateless-subresource Upgraded google.golang.org/protobuf to v1.33.0 (resolves GO-2024-2611). Upgraded google.golang.org/grpc to v1.56.3 (resolves GO-2023-2153). Upgraded golang.org/x/oauth2 to v0.27.0 (resolves GO-2025-3488). Upgraded github.com/golang/protobuf to v1.5.4 for compatibility. ### 3. Operator Module (github.com/google/kf/v2/operator) Upgraded Go Toolchain from go1.20 to go1.25.0 in operator/go.mod . Upgraded golang.org/x/net to v0.56.0 (resolves GO-2026-5026, GO-2026-4918, and GO-2024-2687). Upgraded github.com/google/go-cmp to v0.6.0 to resolve comparisons clashing with new Go context internals. Added operator/tools.go: Pinned code-generator packages (k8s.io/code-generator) and mock generation frameworks (github.com/golang/mock/mockgen) so they are correctly vendored. Refactored Tests: Modified fake_owner_injector_test.go to use cmpopts.IgnoreFields to skip comparing the Ctx field (containing context internals), resolving panics under Go 1.25+. ### 4. Build & Codegen Fixes Fixed operator/hack/update-codegen.sh: Resolved knative.dev/hack and k8s.io/code-generator script paths from the Go mod cache dynamically to support headless execution and prevent dependency package resolution errors during compilation. Stubbed helper libraries operator/scripts/shared/library.sh and root hack/library.sh to allow codegen scripts to execute correctly. Re-generated Client Fakes & Deepcopy API Objects under the operator's versioned clientset packages.
Pinning go-buildpack version to avoid https://github.com/cloudfoundry… ( #1103) <!-- Include the issue number below --> Workaround for […/go-buildpack/issues/556](cloudfoundry/go-buildpack#556) ## Proposed Changes * Temporarily use fixed version of go-buildpack instead of the latest one.
Retry get Sourcepackage operation from listers with exponential backo… …ff (#1098) ## Release Notes ```release-note `Fixed` race condition like situation where reconciling status/presence of a source package races with consuming source package during the "kf push" operation. ```
Fix pipeline issues by multiple small changes (#1094) ## Proposed Changes * Pin ko version it know it's compatible with used go version * Supply _CLOUDSDK_IMAGE variable to pipelines to force alpine with docker * Add _REF_NAME as a substitution only if it's required
Set version of php-buildpack to v4.6.23 to address git clone error in… … run-lifecycle task (#1081) ## Release Notes ```release-note Changed version of php-buildpack used from latest to v4.6.23 as a workaround to github.com/cloudfoundry/php-buildpack/issues/1110 ```
PreviousNext