Skip to content

Commit 278e8b4

Browse files
masontikhonovmasontikhonov
authored
fix: fix CVE in venona (#619)
1 parent f9b8231 commit 278e8b4

File tree

7 files changed

+253
-504
lines changed

7 files changed

+253
-504
lines changed

‎venona/Dockerfile‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM golang:1.23-alpine3.22 AS build
1+
FROM golang:1.25-alpine3.22 AS build
22
RUN apk -U add --no-cache git make ca-certificates && update-ca-certificates
33
ENV USER=venona
44
ENV UID=10001
@@ -14,17 +14,16 @@ WORKDIR /venona
1414
COPY . .
1515
RUN go mod download -x
1616
RUN go mod verify
17-
# compile
1817
RUN make build
1918

20-
FROM alpine:3.22
21-
# copy ca-certs and user details
19+
20+
FROM alpine:3.22.1 AS prod
2221
COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
2322
COPY --from=build /etc/passwd /etc/passwd
2423
COPY --from=build /etc/group /etc/group
2524
WORKDIR /home/venona
26-
RUN chown -R venona:venona /home/venona && chmod 755 /home/venona
27-
# copy binary
25+
RUN chown -R venona:venona /home/venona \
26+
&& chmod 755 /home/venona
2827
COPY --from=build /venona/venona /usr/local/bin/venona
2928
USER venona:venona
3029

‎venona/Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,4 +85,4 @@ $(GOBIN)/mockery:
8585

8686
$(GOBIN)/golangci-lint:
8787
@echo installing: golangci-lint
88-
@curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(GOBIN) v2.2.1
88+
@curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(GOBIN) v2.4.0

‎venona/VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
2.0.6
1+
2.0.7

‎venona/build/Dockerfile.tester‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
# quay.io/codefresh/venona-tester
2-
FROM golang:1.23-alpine3.21
2+
FROM golang:1.25-alpine3.22
33

44
RUN apk -U add --no-cache ca-certificates git make gcc g++ bash && update-ca-certificates
55
RUN go install github.com/client9/misspell/cmd/misspell@v0.3.4 && \
66
go install github.com/fzipp/gocyclo/cmd/gocyclo@v0.6.0 && \
7-
go install github.com/securego/gosec/v2/cmd/gosec@v2.16.0 && \
7+
go install github.com/securego/gosec/v2/cmd/gosec@v2.22.8 && \
88
go install github.com/google/addlicense@v1.1.1 && \
99
go install github.com/github/hub@v2.11.2+incompatible
1010

‎venona/go.mod‎

Lines changed: 68 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -1,83 +1,92 @@
11
module github.com/codefresh-io/go/venona
22

3-
go 1.23
3+
go 1.25
44

55
require (
6-
github.com/gorilla/mux v1.8.0
7-
github.com/hashicorp/go-retryablehttp v0.7.7
8-
github.com/inconshreveable/log15 v0.0.0-20200109203555-b30bc20e4fd1
9-
github.com/newrelic/go-agent/v3 v3.39.0
10-
github.com/newrelic/go-agent/v3/integrations/nrgorilla v1.1.0
11-
github.com/prometheus/client_golang v1.16.0
12-
github.com/spf13/cobra v1.1.3
13-
github.com/spf13/pflag v1.0.5
14-
github.com/spf13/viper v1.7.1
6+
github.com/gorilla/mux v1.8.1
7+
github.com/hashicorp/go-retryablehttp v0.7.8
8+
github.com/inconshreveable/log15 v2.16.0+incompatible
9+
github.com/newrelic/go-agent/v3 v3.40.1
10+
github.com/newrelic/go-agent/v3/integrations/nrgorilla v1.2.5
11+
github.com/prometheus/client_golang v1.23.2
12+
github.com/spf13/cobra v1.10.1
13+
github.com/spf13/pflag v1.0.10
14+
github.com/spf13/viper v1.21.0
1515
github.com/stretchr/objx v0.5.2
16-
github.com/stretchr/testify v1.10.0
16+
github.com/stretchr/testify v1.11.1
1717
gopkg.in/yaml.v2 v2.4.0
18-
k8s.io/api v0.27.3
19-
k8s.io/apimachinery v0.27.3
20-
k8s.io/client-go v0.27.3
18+
k8s.io/api v0.34.1
19+
k8s.io/apimachinery v0.34.1
20+
k8s.io/client-go v0.34.1
2121
)
2222

2323
require (
2424
github.com/beorn7/perks v1.0.1 // indirect
2525
github.com/cespare/xxhash/v2 v2.3.0 // indirect
2626
github.com/davecgh/go-spew v1.1.1 // indirect
27-
github.com/emicklei/go-restful/v3 v3.10.0 // indirect
28-
github.com/evanphx/json-patch v4.12.0+incompatible // indirect
29-
github.com/fsnotify/fsnotify v1.4.7 // indirect
30-
github.com/go-logr/logr v1.2.3 // indirect
31-
github.com/go-openapi/jsonpointer v0.19.6 // indirect
32-
github.com/go-openapi/jsonreference v0.20.1 // indirect
33-
github.com/go-openapi/swag v0.22.3 // indirect
34-
github.com/go-stack/stack v1.8.0 // indirect
27+
github.com/emicklei/go-restful/v3 v3.13.0 // indirect
28+
github.com/fsnotify/fsnotify v1.9.0 // indirect
29+
github.com/fxamacker/cbor/v2 v2.9.0 // indirect
30+
github.com/go-logr/logr v1.4.3 // indirect
31+
github.com/go-openapi/jsonpointer v0.22.0 // indirect
32+
github.com/go-openapi/jsonreference v0.21.1 // indirect
33+
github.com/go-openapi/swag v0.24.1 // indirect
34+
github.com/go-openapi/swag/cmdutils v0.24.0 // indirect
35+
github.com/go-openapi/swag/conv v0.24.0 // indirect
36+
github.com/go-openapi/swag/fileutils v0.24.0 // indirect
37+
github.com/go-openapi/swag/jsonname v0.24.0 // indirect
38+
github.com/go-openapi/swag/jsonutils v0.24.0 // indirect
39+
github.com/go-openapi/swag/loading v0.24.0 // indirect
40+
github.com/go-openapi/swag/mangling v0.24.0 // indirect
41+
github.com/go-openapi/swag/netutils v0.24.0 // indirect
42+
github.com/go-openapi/swag/stringutils v0.24.0 // indirect
43+
github.com/go-openapi/swag/typeutils v0.24.0 // indirect
44+
github.com/go-openapi/swag/yamlutils v0.24.0 // indirect
45+
github.com/go-stack/stack v1.8.1 // indirect
46+
github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
3547
github.com/gogo/protobuf v1.3.2 // indirect
36-
github.com/golang/protobuf v1.5.4 // indirect
37-
github.com/google/gnostic v0.5.7-v3refs // indirect
38-
github.com/google/go-cmp v0.6.0 // indirect
39-
github.com/google/gofuzz v1.1.0 // indirect
48+
github.com/google/gnostic-models v0.7.0 // indirect
4049
github.com/google/uuid v1.6.0 // indirect
4150
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
42-
github.com/hashicorp/hcl v1.0.0 // indirect
43-
github.com/inconshreveable/mousetrap v1.0.0 // indirect
51+
github.com/inconshreveable/mousetrap v1.1.0 // indirect
4452
github.com/josharian/intern v1.0.0 // indirect
4553
github.com/json-iterator/go v1.1.12 // indirect
46-
github.com/magiconair/properties v1.8.1 // indirect
47-
github.com/mailru/easyjson v0.7.7 // indirect
48-
github.com/mattn/go-colorable v0.1.13 // indirect
54+
github.com/mailru/easyjson v0.9.0 // indirect
55+
github.com/mattn/go-colorable v0.1.14 // indirect
4956
github.com/mattn/go-isatty v0.0.20 // indirect
50-
github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
51-
github.com/mitchellh/mapstructure v1.1.2 // indirect
5257
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
53-
github.com/modern-go/reflect2 v1.0.2 // indirect
58+
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
5459
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
55-
github.com/pelletier/go-toml v1.2.0 // indirect
56-
github.com/pkg/errors v0.9.1 // indirect
60+
github.com/pelletier/go-toml/v2 v2.2.4 // indirect
5761
github.com/pmezard/go-difflib v1.0.0 // indirect
58-
github.com/prometheus/client_model v0.3.0 // indirect
59-
github.com/prometheus/common v0.42.0 // indirect
60-
github.com/prometheus/procfs v0.10.1 // indirect
61-
github.com/spf13/afero v1.1.2 // indirect
62-
github.com/spf13/cast v1.3.0 // indirect
63-
github.com/spf13/jwalterweatherman v1.0.0 // indirect
64-
github.com/subosito/gotenv v1.2.0 // indirect
65-
golang.org/x/net v0.25.0 // indirect
66-
golang.org/x/oauth2 v0.20.0 // indirect
67-
golang.org/x/sys v0.20.0 // indirect
68-
golang.org/x/term v0.20.0 // indirect
69-
golang.org/x/text v0.15.0 // indirect
70-
golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect
71-
google.golang.org/genproto v0.0.0-20230110181048-76db0878b65f // indirect
72-
google.golang.org/grpc v1.65.0 // indirect
73-
google.golang.org/protobuf v1.34.2 // indirect
62+
github.com/prometheus/client_model v0.6.2 // indirect
63+
github.com/prometheus/common v0.66.1 // indirect
64+
github.com/prometheus/procfs v0.17.0 // indirect
65+
github.com/sagikazarmark/locafero v0.11.0 // indirect
66+
github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
67+
github.com/spf13/afero v1.15.0 // indirect
68+
github.com/spf13/cast v1.10.0 // indirect
69+
github.com/subosito/gotenv v1.6.0 // indirect
70+
github.com/x448/float16 v0.8.4 // indirect
71+
go.yaml.in/yaml/v2 v2.4.3 // indirect
72+
go.yaml.in/yaml/v3 v3.0.4 // indirect
73+
golang.org/x/net v0.44.0 // indirect
74+
golang.org/x/oauth2 v0.31.0 // indirect
75+
golang.org/x/sys v0.36.0 // indirect
76+
golang.org/x/term v0.35.0 // indirect
77+
golang.org/x/text v0.29.0 // indirect
78+
golang.org/x/time v0.13.0 // indirect
79+
google.golang.org/genproto/googleapis/rpc v0.0.0-20250908214217-97024824d090 // indirect
80+
google.golang.org/grpc v1.75.1 // indirect
81+
google.golang.org/protobuf v1.36.9 // indirect
82+
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
7483
gopkg.in/inf.v0 v0.9.1 // indirect
75-
gopkg.in/ini.v1 v1.51.0 // indirect
7684
gopkg.in/yaml.v3 v3.0.1 // indirect
77-
k8s.io/klog/v2 v2.90.1 // indirect
78-
k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f // indirect
79-
k8s.io/utils v0.0.0-20230209194617-a36077c30491 // indirect
80-
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
81-
sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
82-
sigs.k8s.io/yaml v1.3.0 // indirect
85+
k8s.io/klog/v2 v2.130.1 // indirect
86+
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
87+
k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d // indirect
88+
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
89+
sigs.k8s.io/randfill v1.0.0 // indirect
90+
sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
91+
sigs.k8s.io/yaml v1.6.0 // indirect
8392
)

0 commit comments

Comments
 (0)