Upgrade Go packages to fix CVEs#1114
Merged
Merged
Conversation
balamut-google
force-pushed
the
go_mod_upgrades
branch
from
ebf13f9 to
e7abcd0
Compare
jakweg
approved these changes
Jun 19, 2026
jakweg
left a comment
jakweg
left a comment
Contributor
There was a problem hiding this comment.
If you need to merge go ahead, though I would like to recheck these changes as I still don't quite understand the changes with library.sh etc.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed Changes
1. Root Module (github.com/google/kf/v2)
Upgraded github.com/docker/docker replacement version from v20.10.24+incompatible to v28.5.2+incompatible in root
go.mod
(resolves GO-2025-3829).
Refactored Term/Console Packages: The docker/docker/pkg/term dependency was removed in newer Docker CLI/engine versions. The importing code was refactored to use the modern alternative github.com/moby/term:
2. Submodule first_party/k8s-stateless-subresource
Upgraded google.golang.org/protobuf to v1.33.0 (resolves GO-2024-2611).
Upgraded google.golang.org/grpc to v1.56.3 (resolves GO-2023-2153).
Upgraded golang.org/x/oauth2 to v0.27.0 (resolves GO-2025-3488).
Upgraded github.com/golang/protobuf to v1.5.4 for compatibility.
3. Operator Module (github.com/google/kf/v2/operator)
Upgraded Go Toolchain from go1.20 to go1.25.0 in
operator/go.mod
.
Upgraded golang.org/x/net to v0.56.0 (resolves GO-2026-5026, GO-2026-4918, and GO-2024-2687).
Upgraded github.com/google/go-cmp to v0.6.0 to resolve comparisons clashing with new Go context internals.
Added operator/tools.go: Pinned code-generator packages (k8s.io/code-generator) and mock generation frameworks (github.com/golang/mock/mockgen) so they are correctly vendored.
Refactored Tests:
Modified
fake_owner_injector_test.go
to use cmpopts.IgnoreFields to skip comparing the Ctx field (containing context internals), resolving panics under Go 1.25+.
4. Build & Codegen Fixes
Fixed operator/hack/update-codegen.sh:
Resolved knative.dev/hack and k8s.io/code-generator script paths from the Go mod cache dynamically to support headless execution and prevent dependency package resolution errors during compilation.
Stubbed helper libraries operator/scripts/shared/library.sh and root hack/library.sh to allow codegen scripts to execute correctly.
Re-generated Client Fakes & Deepcopy API Objects under the operator's versioned clientset packages.