Skip to content

Tags: google/kf

Tags

v2.12.1

Toggle v2.12.1's commit message

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
Update Tekton Pipelines, ASM, KCC versions + CVE fixes (#1118)

## Proposed Changes
* Upgraded ASM to 1.29.5
* Upgraded Tekton Pipelines to 1.12.2
* Upgraded KCC  to 1.153.0
* Fixed CVE-2025-22868
* Fixed GHSA-m425-mq94-257g 
* Fixed CVE-2024-24786
* Fixed CVE-2025-30204
* Fixed CVE-2026-46680
* Fixed CVE-2025-15558 
* Fixed CVE-2026-34040

v2.12.0

Toggle v2.12.0's commit message

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
Upgrade Go packages to fix CVEs (#1114)

## Proposed Changes


### 1. Root Module (github.com/google/kf/v2)
Upgraded github.com/docker/docker replacement version from
v20.10.24+incompatible to v28.5.2+incompatible in root

go.mod
 (resolves GO-2025-3829).
Refactored Term/Console Packages: The docker/docker/pkg/term dependency
was removed in newer Docker CLI/engine versions. The importing code was
refactored to use the modern alternative github.com/moby/term:

- ssh.go
- term.go
- resize.go
- term_writer.go

### 2. Submodule first_party/k8s-stateless-subresource
Upgraded google.golang.org/protobuf to v1.33.0 (resolves GO-2024-2611).
Upgraded google.golang.org/grpc to v1.56.3 (resolves GO-2023-2153).
Upgraded golang.org/x/oauth2 to v0.27.0 (resolves GO-2025-3488).
Upgraded github.com/golang/protobuf to v1.5.4 for compatibility.
### 3. Operator Module (github.com/google/kf/v2/operator)
Upgraded Go Toolchain from go1.20 to go1.25.0 in 

operator/go.mod
.
Upgraded golang.org/x/net to v0.56.0 (resolves GO-2026-5026,
GO-2026-4918, and GO-2024-2687).
Upgraded github.com/google/go-cmp to v0.6.0 to resolve comparisons
clashing with new Go context internals.
Added operator/tools.go: Pinned code-generator packages
(k8s.io/code-generator) and mock generation frameworks
(github.com/golang/mock/mockgen) so they are correctly vendored.
Refactored Tests:
Modified 

fake_owner_injector_test.go
to use cmpopts.IgnoreFields to skip comparing the Ctx field (containing
context internals), resolving panics under Go 1.25+.
### 4. Build & Codegen Fixes
Fixed operator/hack/update-codegen.sh:
Resolved knative.dev/hack and k8s.io/code-generator script paths from
the Go mod cache dynamically to support headless execution and prevent
dependency package resolution errors during compilation.
Stubbed helper libraries operator/scripts/shared/library.sh and root
hack/library.sh to allow codegen scripts to execute correctly.
Re-generated Client Fakes & Deepcopy API Objects under the operator's
versioned clientset packages.

v2.11.32

Toggle v2.11.32's commit message

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
Pinning go-buildpack version to avoid https://github.com/cloudfoundry… (

#1103)

<!-- Include the issue number below -->
Workaround for
[…/go-buildpack/issues/556](cloudfoundry/go-buildpack#556)

## Proposed Changes
* Temporarily use fixed version of go-buildpack instead of the latest
one.

v2.11.31

Toggle v2.11.31's commit message

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
Retry get Sourcepackage operation from listers with exponential backo…

…ff (#1098)

## Release Notes

```release-note
`Fixed` race condition like situation where reconciling status/presence of a source package races with consuming source package during the "kf push" operation.

```

v2.11.30

Toggle v2.11.30's commit message

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
Fix pipeline issues by multiple small changes (#1094)

## Proposed Changes

* Pin ko version it know it's compatible with used go version
* Supply _CLOUDSDK_IMAGE variable to pipelines to force alpine with
docker
* Add _REF_NAME as a substitution only if it's required

v2.11.29

Toggle v2.11.29's commit message

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
Cluster deletion improvements (#1088)

## Proposed Changes
* added a small Bash wrapper that retries cluster deletion a couple of
times, if it fails - this step has been flaky recently

v2.11.28

Toggle v2.11.28's commit message
updated deploy-pages version to v4

v2.11.27

Toggle v2.11.27's commit message

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
Set version of php-buildpack to v4.6.23 to address git clone error in…

… run-lifecycle task (#1081)

## Release Notes

```release-note
Changed version of php-buildpack used from latest to v4.6.23 as a workaround to github.com/cloudfoundry/php-buildpack/issues/1110
```

v2.11.26

Toggle v2.11.26's commit message

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
Increased source package size limit to 3 GB (#1068)

## Proposed Changes
* Increase size limit for SourcePackage from 1 to 3 GB
## Release Notes
Changed size limit for SourcePackage from 1 to 3 GB

v2.11.25

Toggle v2.11.25's commit message

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
Updated Tekton dependency to the newest patch for current LTS version (

…#1065)

## Proposed Changes

* Updated Tekton Pipelines dependency to the newest patch for current
LTS version - v0.53.3

## Release Notes

Changed version of Tekton Pipelines dependency