deps: bump client-go from v0.24.2 to v0.25.0-alpha.2

[DmitriyLewen]

Description

k8s.io/client-go v0.24.x. contains github.com/emicklei/go-restful v2.9.5 with critical vulnerability CVE-2022-1996.
Bumped k8s.io/client-go to v0.25.0-alpha.2, until stable version v0.25.0 is released.

Related Issues:

• github.com/emicklei/go-restful: CVE-2022-1996 trivy#2486

[knqyf263]

@DmitriyLewen Does v0.24.3 happen to fix it?
https://github.com/kubernetes/client-go/releases/tag/v0.24.3

[DmitriyLewen]

no, i checked it.
v0.24.3 still uses github.com/emicklei/go-restful v2.9.5

[knqyf263]

@josedonizetti @chen-keinan Can you review it? I don't have permission in this repository.

[chen-keinan]

@DmitriyLewen I think we can use replace in for go.mod file instead if getting v0.25.0-alpha.2 , wdyt ?

[DmitriyLewen]

hmm... i don't know which is better.
both options seem to work the same.
replace will remind you to update this version.
But I think dependabot should update this dependency when version v0.25.0 is released.

If you prefer to use replace - tell me, i will change PR.

[knqyf263]

It is a direct dependency. We can update the version rather than the replace directive. @chen-keinan Do you have any advantages of replace in your mind?

[chen-keinan]

I'm ok also with both just prefer not to use alpha version. but fine with it if you do not want to use replace