Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[NET-2420] security: re-enable security scan release block #3628

Merged
merged 9 commits into from
Feb 17, 2024
Merged

[NET-2420] security: re-enable security scan release block #3628

merged 9 commits into from
Feb 17, 2024

Commits on Feb 14, 2024

  1. security: upgrade helm/v3 to 3.13.3 

    Addresses multiple CVEs:
- CVE-2023-25165
- CVE-2022-23524
- CVE-2022-23526
- CVE-2022-23525
    @zalimeni
    zalimeni committed Feb 14, 2024
    Configuration menu
    Copy the full SHA
    18ab5b1 View commit details
    Browse the repository at this point in the history

  2. chore: upgrade k8s dependencies to match controller-runtime

    @zalimeni
    zalimeni committed Feb 14, 2024
    Configuration menu
    Copy the full SHA
    3449458 View commit details
    Browse the repository at this point in the history

  3. security: upgrade containerd to latest 

    Addresses GHSA-7ww5-4wqc-m92c (GO-2023-2412)
    @zalimeni
    zalimeni committed Feb 14, 2024
    Configuration menu
    Copy the full SHA
    22343e3 View commit details
    Browse the repository at this point in the history

  4. security: upgrade docker/docker to latest 

    Addresses GHSA-jq35-85cj-fj4p
    @zalimeni
    zalimeni committed Feb 14, 2024
    Configuration menu
    Copy the full SHA
    0ffcb83 View commit details
    Browse the repository at this point in the history

  5. security: upgrade docker/distribution to latest 

    Addresses CVE-2023-2253
    @zalimeni
    zalimeni committed Feb 14, 2024
    Configuration menu
    Copy the full SHA
    ae2348a View commit details
    Browse the repository at this point in the history

  6. security: upgrade filepath-securejoin to latest patch 

    Addresses GHSA-6xv5-86q9-7xr8 (GO-2023-2048)
    @zalimeni
    zalimeni committed Feb 14, 2024
    Configuration menu
    Copy the full SHA
    c950489 View commit details
    Browse the repository at this point in the history

  7. chore: upgrade oras-go to fix docker incompatibility

    @zalimeni
    zalimeni committed Feb 14, 2024
    Configuration menu
    Copy the full SHA
    57a10bc View commit details
    Browse the repository at this point in the history

  8. Add changelog

    @zalimeni
    zalimeni committed Feb 14, 2024
    Configuration menu
    Copy the full SHA
    8e9f1e6 View commit details
    Browse the repository at this point in the history

Commits on Feb 17, 2024

  1. security: re-enable security scan release block 

    This was previously disabled due to an unresolved false-positive CVE.
Re-enabling both secrets and OSV + Go Modules scanning, which per our
current scan results should not be a blocker to future releases.

Also add security scans on PR and merge to protected branches to allow
proactive triage going forward.

See hashicorp/consul#19978 for similar change in that repo, adapted
here.
    @zalimeni
    zalimeni committed Feb 17, 2024
    Configuration menu
    Copy the full SHA
    8fda3bb View commit details
    Browse the repository at this point in the history