Skip to content

Commit a785472

Browse files
nitin-sachdev-29nitin-sachdev-29
authored
Prep release 1.6.4 (#4537)
* Update Go version to 1.23.8 and dependencies to address security vulnerabilities * preparing for 1.6.4 release * Codeowner change (#4535) * changed CODEOWNERS * Add CODEOWNERS to the list of files tracked for skip * fixed CHANGELOG.md * Add triage section to suppress specific vulnerabilities in security scan * Update Dockerfile to use Golang 1.23.8 with Alpine 3.21
1 parent d72a948 commit a785472

File tree

17 files changed

+54
-30
lines changed

17 files changed

+54
-30
lines changed

‎.changelog/4520.txt

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
```release-note:security
2+
Update `golang.org/x/net` to v0.38.0 to address [GHSA-vvgc-356p-c3xw](https://github.com/advisories/GHSA-vvgc-356p-c3xw).
3+
Upgrade to Go 1.23.8 to fix CVE [GO-2025-3563](https://pkg.go.dev/vuln/GO-2025-3563)
4+
```

‎.github/workflows/build.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ jobs:
6363

6464
build:
6565
needs: [get-go-version, get-product-version]
66-
runs-on: ubuntu-20.04 # the GLIBC is too high on 22.04
66+
runs-on: ubuntu-22.04 # the GLIBC is too high on 22.04
6767
strategy:
6868
matrix:
6969
include:

‎.go-version

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.23.0
1+
1.23.8

‎.release/security-scan.hcl

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,15 @@ container {
1919
secrets {
2020
all = true
2121
}
22+
23+
triage {
24+
suppress {
25+
vulnerabilites = [
26+
"CVE-2025-46394",
27+
"CVE-2024-58251"
28+
]
29+
}
30+
}
2231
}
2332

2433
binary {
@@ -40,8 +49,12 @@ binary {
4049
"GHSA-r53h-jv2g-vpx6",
4150
"CVE-2024-26147", # alias
4251
"GHSA-jw44-4f3j-q396", # Tracked in NET-8174
43-
"CVE-2019-25210", # alias
44-
"GO-2022-0635"
52+
"CVE-2019-25210",
53+
"GO-2022-0635",
54+
"GHSA-4hfp-h4cw-hj8p",
55+
"GHSA-5xqw-8hwv-wg92",
56+
"GO-2025-3601",
57+
"GO-2025-3602"
4558
]
4659
}
4760
}

‎CHANGELOG.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
1+
## 1.6.4 (April 24, 2025)
2+
3+
SECURITY:
4+
5+
* Update `golang.org/x/net` to v0.38.0 to address [GHSA-vvgc-356p-c3xw](https://github.com/advisories/GHSA-vvgc-356p-c3xw).
6+
* Upgrade to Go 1.23.8 to fix CVE [GO-2025-3563](https://pkg.go.dev/vuln/GO-2025-3563)
7+
18
## 1.6.3 (March 21, 2025)
29

310
IMPROVEMENTS:

‎acceptance/go.mod

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/hashicorp/consul-k8s/acceptance
22

3-
go 1.23.0
3+
go 1.23.8
44

55
require (
66
github.com/go-logr/logr v1.3.0
@@ -127,7 +127,7 @@ require (
127127
golang.org/x/crypto v0.36.0 // indirect
128128
golang.org/x/exp v0.0.0-20240808152545-0cdaa3abc0fa // indirect
129129
golang.org/x/mod v0.20.0 // indirect
130-
golang.org/x/net v0.37.0 // indirect
130+
golang.org/x/net v0.38.0 // indirect
131131
golang.org/x/oauth2 v0.28.0 // indirect
132132
golang.org/x/sync v0.12.0 // indirect
133133
golang.org/x/sys v0.31.0 // indirect

‎acceptance/go.sum

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -498,8 +498,8 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
498498
golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
499499
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
500500
golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
501-
golang.org/x/net v0.37.0 h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c=
502-
golang.org/x/net v0.37.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
501+
golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
502+
golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
503503
golang.org/x/oauth2 v0.28.0 h1:CrgCKl8PPAVtLnU3c+EDw6x11699EWlsDeWNWKdIOkc=
504504
golang.org/x/oauth2 v0.28.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
505505
golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

‎charts/consul/Chart.yaml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33

44
apiVersion: v2
55
name: consul
6-
version: 1.6.4-dev
7-
appVersion: 1.20-dev
6+
version: 1.6.4
7+
appVersion: 1.20.6
88
kubeVersion: ">=1.22.0-0"
99
description: Official HashiCorp Consul Chart
1010
home: https://www.consul.io
@@ -16,11 +16,11 @@ annotations:
1616
artifacthub.io/prerelease: true
1717
artifacthub.io/images: |
1818
- name: consul
19-
image: docker.mirror.hashicorp.services/hashicorppreview/consul:1.20-dev
19+
image: hashicorp/consul:1.20.6
2020
- name: consul-k8s-control-plane
21-
image: docker.mirror.hashicorp.services/hashicorppreview/consul-k8s-control-plane:1.6-dev
21+
image: hashicorp/consul-k8s-control-plane:1.6.4
2222
- name: consul-dataplane
23-
image: docker.mirror.hashicorp.services/hashicorppreview/consul-dataplane:1.6-dev
23+
image: hashicorp/consul-dataplane:1.6.4
2424
- name: envoy
2525
image: envoyproxy/envoy:v1.25.11
2626
artifacthub.io/license: MPL-2.0

‎charts/consul/values.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ global:
6666
# image: "hashicorp/consul-enterprise:1.10.0-ent"
6767
# ```
6868
# @default: hashicorp/consul:<latest version>
69-
image: docker.mirror.hashicorp.services/hashicorppreview/consul:1.20-dev
69+
image: hashicorp/consul:1.20.6
7070

7171
# Array of objects containing image pull secret names that will be applied to each service account.
7272
# This can be used to reference image pull secrets if using a custom consul or consul-k8s-control-plane Docker image.
@@ -86,7 +86,7 @@ global:
8686
# image that is used for functionality such as catalog sync.
8787
# This can be overridden per component.
8888
# @default: hashicorp/consul-k8s-control-plane:<latest version>
89-
imageK8S: docker.mirror.hashicorp.services/hashicorppreview/consul-k8s-control-plane:1.6-dev
89+
imageK8S: hashicorp/consul-k8s-control-plane:1.6.4
9090

9191
# The image pull policy used globally for images controlled by Consul (consul, consul-dataplane, consul-k8s, consul-telemetry-collector).
9292
# One of "IfNotPresent", "Always", "Never", and "". Refer to https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy
@@ -793,7 +793,7 @@ global:
793793
# The name (and tag) of the consul-dataplane Docker image used for the
794794
# connect-injected sidecar proxies and mesh, terminating, and ingress gateways.
795795
# @default: hashicorp/consul-dataplane:<latest supported version>
796-
imageConsulDataplane: docker.mirror.hashicorp.services/hashicorppreview/consul-dataplane:1.6-dev
796+
imageConsulDataplane: hashicorp/consul-dataplane:1.6.4
797797

798798
# Configuration for running this Helm chart on the Red Hat OpenShift platform.
799799
# This Helm chart currently supports OpenShift v4.x+.

‎cli/go.mod

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/hashicorp/consul-k8s/cli
22

3-
go 1.23.0
3+
go 1.23.8
44

55
replace github.com/hashicorp/consul-k8s/version => ../version
66

@@ -170,7 +170,7 @@ require (
170170
go.opentelemetry.io/proto/otlp v1.3.1 // indirect
171171
go.starlark.net v0.0.0-20230525235612-a134d8f9ddca // indirect
172172
golang.org/x/crypto v0.36.0 // indirect
173-
golang.org/x/net v0.37.0 // indirect
173+
golang.org/x/net v0.38.0 // indirect
174174
golang.org/x/oauth2 v0.28.0 // indirect
175175
golang.org/x/sync v0.12.0 // indirect
176176
golang.org/x/sys v0.31.0 // indirect

‎cli/go.sum

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -680,8 +680,8 @@ golang.org/x/net v0.0.0-20210421230115-4e50805a0758/go.mod h1:72T/g9IO56b78aLF+1
680680
golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
681681
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
682682
golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
683-
golang.org/x/net v0.37.0 h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c=
684-
golang.org/x/net v0.37.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
683+
golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
684+
golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
685685
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
686686
golang.org/x/oauth2 v0.28.0 h1:CrgCKl8PPAVtLnU3c+EDw6x11699EWlsDeWNWKdIOkc=
687687
golang.org/x/oauth2 v0.28.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=

‎control-plane/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
# go-discover builds the discover binary (which we don't currently publish
1818
# either).
1919
ARG GOLANG_VERSION
20-
FROM golang:${GOLANG_VERSION}-alpine3.19 as go-discover
20+
FROM golang:${GOLANG_VERSION}-alpine3.21 as go-discover
2121
RUN CGO_ENABLED=0 go install github.com/hashicorp/go-discover/cmd/discover@275a71457aa412bf20df9f9b77c380667164a5e6
2222

2323
# dev copies the binary from a local build

‎control-plane/cni/go.mod

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ require (
4040
github.com/pkg/errors v0.9.1 // indirect
4141
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
4242
github.com/spf13/pflag v1.0.5 // indirect
43-
golang.org/x/net v0.37.0 // indirect
43+
golang.org/x/net v0.38.0 // indirect
4444
golang.org/x/oauth2 v0.28.0 // indirect
4545
golang.org/x/sys v0.31.0 // indirect
4646
golang.org/x/term v0.30.0 // indirect
@@ -58,4 +58,4 @@ require (
5858
sigs.k8s.io/yaml v1.3.0 // indirect
5959
)
6060

61-
go 1.23.0
61+
go 1.23.8

‎control-plane/cni/go.sum

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -147,8 +147,8 @@ golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLL
147147
golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
148148
golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
149149
golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
150-
golang.org/x/net v0.37.0 h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c=
151-
golang.org/x/net v0.37.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
150+
golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
151+
golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
152152
golang.org/x/oauth2 v0.28.0 h1:CrgCKl8PPAVtLnU3c+EDw6x11699EWlsDeWNWKdIOkc=
153153
golang.org/x/oauth2 v0.28.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
154154
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

‎control-plane/go.mod

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -143,7 +143,7 @@ require (
143143
go.uber.org/multierr v1.11.0 // indirect
144144
golang.org/x/crypto v0.36.0 // indirect
145145
golang.org/x/mod v0.20.0 // indirect
146-
golang.org/x/net v0.37.0 // indirect
146+
golang.org/x/net v0.38.0 // indirect
147147
golang.org/x/oauth2 v0.28.0 // indirect
148148
golang.org/x/sync v0.12.0 // indirect
149149
golang.org/x/sys v0.31.0 // indirect
@@ -163,4 +163,4 @@ require (
163163
sigs.k8s.io/yaml v1.3.0 // indirect
164164
)
165165

166-
go 1.23.0
166+
go 1.23.8

‎control-plane/go.sum

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -522,8 +522,8 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
522522
golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
523523
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
524524
golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
525-
golang.org/x/net v0.37.0 h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c=
526-
golang.org/x/net v0.37.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
525+
golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
526+
golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
527527
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
528528
golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
529529
golang.org/x/oauth2 v0.28.0 h1:CrgCKl8PPAVtLnU3c+EDw6x11699EWlsDeWNWKdIOkc=

‎version/version.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ var (
2222
// A pre-release marker for the version. If this is "" (empty string)
2323
// then it means that it is a final release. Otherwise, this is a pre-release
2424
// such as "dev" (in development), "beta", "rc1", etc.
25-
VersionPrerelease = "dev"
25+
VersionPrerelease = ""
2626
)
2727

2828
// GetHumanVersion composes the parts of the version in a way that's suitable

0 commit comments

Comments
 (0)