Skip to content

Commit d6f33ce

Browse files
patelchaitanypatelchaitany
authored
chore(deps): Bump Go >= 1.24.12 to fix CVE-2025-61726 (#6219)
* chore(deps): bump Go >= 1.24.12 to fix CVE-2025-61726 Bump the Go toolchain from 1.22.9 to 1.24.12 in the feast-operator go.mod and Dockerfile to fix CVE-2025-61726 (memory exhaustion in net/url query parameter parsing, CVSS 7.5). Signed-off-by: Chaitany patel <patelchaitany93@gmail.com> Made-with: Cursor * Upgraded Operator SDK Signed-off-by: Chaitany patel <patelchaitany93@gmail.com> --------- Signed-off-by: Chaitany patel <patelchaitany93@gmail.com>
1 parent beaa9a6 commit d6f33ce

File tree

16 files changed

+1618
-1109
lines changed

16 files changed

+1618
-1109
lines changed

‎.github/workflows/operator-e2e-integration-tests.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ jobs:
5252
- name: Set up Go
5353
uses: actions/setup-go@v5
5454
with:
55-
go-version: 1.22.9
55+
go-version: 1.24.12
5656

5757
- name: Create KIND cluster
5858
run: |

‎.github/workflows/operator_pr.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414
- name: Install Go
1515
uses: actions/setup-go@v5
1616
with:
17-
go-version: 1.22.9
17+
go-version: 1.24.12
1818
- name: Operator tests
1919
run: make -C infra/feast-operator test
2020
- name: After code formatting, check for uncommitted differences

‎.github/workflows/pr_local_integration_tests.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ jobs:
5959
- name: Install Go
6060
uses: actions/setup-go@v5
6161
with:
62-
go-version: 1.22.9
62+
go-version: 1.24.12
6363
- name: Operator Data Source types test
6464
run: make -C infra/feast-operator test-datasources
6565
- name: Minimize uv cache

‎.github/workflows/registry-rest-api-tests.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ jobs:
5050
- name: Set up Go
5151
uses: actions/setup-go@v5
5252
with:
53-
go-version: 1.22.9
53+
go-version: 1.24.12
5454

5555
- name: Create KIND cluster
5656
run: |

‎.github/workflows/release.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ jobs:
111111
- name: Install Go
112112
uses: actions/setup-go@v2
113113
with:
114-
go-version: 1.22.9
114+
go-version: 1.24.12
115115
- name: Build & version operator-specific release files
116116
run: make -C infra/feast-operator build-installer bundle
117117

@@ -144,7 +144,7 @@ jobs:
144144
- name: Install Go
145145
uses: actions/setup-go@v2
146146
with:
147-
go-version: 1.22.9
147+
go-version: 1.24.12
148148
- name: Compile Go Test Binaries
149149
run: |
150150
cd infra/feast-operator

‎infra/feast-operator/.golangci.bck.yml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
run:
2+
timeout: 5m
3+
allow-parallel-runners: true
4+
5+
issues:
6+
# don't skip warning about doc comments
7+
# don't exclude the default set of lint
8+
exclude-use-default: false
9+
# restore some of the defaults
10+
# (fill in the rest as needed)
11+
exclude-rules:
12+
- path: "api/*"
13+
linters:
14+
- lll
15+
- path: "internal/*"
16+
linters:
17+
- dupl
18+
- lll
19+
- path: "test/*"
20+
linters:
21+
- lll
22+
- path: "upgrade/*"
23+
linters:
24+
- lll
25+
- path: "previous-version/*"
26+
linters:
27+
- lll
28+
linters:
29+
disable-all: true
30+
enable:
31+
- dupl
32+
- errcheck
33+
- goconst
34+
- gocyclo
35+
- gofmt
36+
- goimports
37+
- gosimple
38+
- govet
39+
- ineffassign
40+
- lll
41+
- misspell
42+
- nakedret
43+
- ginkgolinter
44+
- prealloc
45+
- revive
46+
- staticcheck
47+
- typecheck
48+
- unconvert
49+
- unparam
50+
- unused
51+
52+
linters-settings:
53+
revive:
54+
rules:
55+
- name: comment-spacings

‎infra/feast-operator/.golangci.yml‎

Lines changed: 45 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,55 +1,65 @@
1+
version: "2"
12
run:
2-
timeout: 5m
33
allow-parallel-runners: true
4-
5-
issues:
6-
# don't skip warning about doc comments
7-
# don't exclude the default set of lint
8-
exclude-use-default: false
9-
# restore some of the defaults
10-
# (fill in the rest as needed)
11-
exclude-rules:
12-
- path: "api/*"
13-
linters:
14-
- lll
15-
- path: "internal/*"
16-
linters:
17-
- dupl
18-
- lll
19-
- path: "test/*"
20-
linters:
21-
- lll
22-
- path: "upgrade/*"
23-
linters:
24-
- lll
25-
- path: "previous-version/*"
26-
linters:
27-
- lll
284
linters:
29-
disable-all: true
5+
default: none
306
enable:
317
- dupl
328
- errcheck
9+
- ginkgolinter
3310
- goconst
3411
- gocyclo
35-
- gofmt
36-
- goimports
37-
- gosimple
3812
- govet
3913
- ineffassign
4014
- lll
4115
- misspell
4216
- nakedret
43-
- ginkgolinter
4417
- prealloc
4518
- revive
4619
- staticcheck
47-
- typecheck
4820
- unconvert
4921
- unparam
5022
- unused
51-
52-
linters-settings:
53-
revive:
23+
settings:
24+
revive:
25+
rules:
26+
- name: comment-spacings
27+
staticcheck:
28+
checks:
29+
- "all"
30+
- "-QF*"
31+
- "-ST*"
32+
exclusions:
33+
generated: lax
34+
presets: []
5435
rules:
55-
- name: comment-spacings
36+
- linters:
37+
- lll
38+
path: api/*
39+
- linters:
40+
- dupl
41+
- lll
42+
path: internal/*
43+
- linters:
44+
- lll
45+
path: test/*
46+
- linters:
47+
- lll
48+
path: upgrade/*
49+
- linters:
50+
- lll
51+
path: previous-version/*
52+
paths:
53+
- third_party$
54+
- builtin$
55+
- examples$
56+
formatters:
57+
enable:
58+
- gofmt
59+
- goimports
60+
exclusions:
61+
generated: lax
62+
paths:
63+
- third_party$
64+
- builtin$
65+
- examples$

‎infra/feast-operator/Dockerfile‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
# Build the manager binary
2-
FROM registry.access.redhat.com/ubi9/go-toolset:1.22.9 AS builder
2+
FROM registry.access.redhat.com/ubi9/go-toolset:1.24 AS builder
33
ARG TARGETOS
44
ARG TARGETARCH
5+
ENV GOTOOLCHAIN=auto
56

67
# Copy the Go Modules manifests
78
COPY go.mod go.mod

‎infra/feast-operator/Makefile‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -48,15 +48,15 @@ endif
4848

4949
# Set the Operator SDK version to use. By default, what is installed on the system is used.
5050
# This is useful for CI or a project to utilize a specific version of the operator-sdk toolkit.
51-
OPERATOR_SDK_VERSION ?= v1.38.0
51+
OPERATOR_SDK_VERSION ?= v1.41.0
5252
# Image URL to use all building/pushing image targets
5353
# During development and testing, and before make deploy we need to export FS_IMG to point to
5454
# the dev image generated using command `make build-feature-server-dev-docker`
5555
IMG ?= $(IMAGE_TAG_BASE):$(VERSION)
5656
FS_IMG ?= quay.io/feastdev/feature-server:$(VERSION)
5757
CJ_IMG ?= quay.io/openshift/origin-cli:4.17
5858
# ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary.
59-
ENVTEST_K8S_VERSION = 1.30.0
59+
ENVTEST_K8S_VERSION = 1.31.0
6060

6161
# Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
6262
ifeq (,$(shell go env GOBIN))
@@ -116,7 +116,7 @@ vet: ## Run go vet against code.
116116

117117
.PHONY: test
118118
test: build-installer vet lint envtest ## Run tests.
119-
KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path --use-deprecated-gcs=false)" go test $$(go list ./... | grep -v test/e2e | grep -v test/data-source-types | grep -v test/upgrade | grep -v test/previous-version) -coverprofile cover.out
119+
KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" go test $$(go list ./... | grep -v test/e2e | grep -v test/data-source-types | grep -v test/upgrade | grep -v test/previous-version) -coverprofile cover.out
120120

121121
# Utilize Kind or modify the e2e tests to load the image locally, enabling compatibility with other vendors.
122122
.PHONY: test-e2e # Run the e2e tests against a Kind k8s instance that is spun up.
@@ -239,11 +239,11 @@ GOLANGCI_LINT = $(LOCALBIN)/golangci-lint
239239
ENVSUBST = $(LOCALBIN)/envsubst
240240

241241
## Tool Versions
242-
KUSTOMIZE_VERSION ?= v5.4.2
243-
CONTROLLER_TOOLS_VERSION ?= v0.15.0
244-
CRD_REF_DOCS_VERSION ?= v0.1.0
245-
ENVTEST_VERSION ?= release-0.18
246-
GOLANGCI_LINT_VERSION ?= v1.63.4
242+
KUSTOMIZE_VERSION ?= v5.4.3
243+
CONTROLLER_TOOLS_VERSION ?= v0.18.0
244+
CRD_REF_DOCS_VERSION ?= v0.3.0
245+
ENVTEST_VERSION ?= release-0.21
246+
GOLANGCI_LINT_VERSION ?= v2.1.0
247247
ENVSUBST_VERSION ?= v1.4.2
248248

249249
.PHONY: kustomize
@@ -264,7 +264,7 @@ $(ENVTEST): $(LOCALBIN)
264264
.PHONY: golangci-lint
265265
golangci-lint: $(GOLANGCI_LINT) ## Download golangci-lint locally if necessary.
266266
$(GOLANGCI_LINT): $(LOCALBIN)
267-
$(call go-install-tool,$(GOLANGCI_LINT),github.com/golangci/golangci-lint/cmd/golangci-lint,$(GOLANGCI_LINT_VERSION))
267+
$(call go-install-tool,$(GOLANGCI_LINT),github.com/golangci/golangci-lint/v2/cmd/golangci-lint,$(GOLANGCI_LINT_VERSION))
268268

269269
.PHONY: envsubst
270270
envsubst: $(ENVSUBST) ## Download envsubst locally if necessary.
@@ -338,7 +338,7 @@ ifeq (,$(shell which opm 2>/dev/null))
338338
set -e ;\
339339
mkdir -p $(dir $(OPM)) ;\
340340
OS=$(shell go env GOOS) && ARCH=$(shell go env GOARCH) && \
341-
curl -sSLo $(OPM) https://github.com/operator-framework/operator-registry/releases/download/v1.23.0/$${OS}-$${ARCH}-opm ;\
341+
curl -sSLo $(OPM) https://github.com/operator-framework/operator-registry/releases/download/v1.55.0/$${OS}-$${ARCH}-opm ;\
342342
chmod +x $(OPM) ;\
343343
}
344344
else

‎infra/feast-operator/cmd/main.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,7 @@ func main() {
105105

106106
// Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server.
107107
// More info:
108-
// - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.18.4/pkg/metrics/server
108+
// - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.21.0/pkg/metrics/server
109109
// - https://book.kubebuilder.io/reference/metrics.html
110110
metricsServerOptions := metricsserver.Options{
111111
BindAddress: metricsAddr,
@@ -123,7 +123,7 @@ func main() {
123123
// FilterProvider is used to protect the metrics endpoint with authn/authz.
124124
// These configurations ensure that only authorized users and service accounts
125125
// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
126-
// https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.18.4/pkg/metrics/filters#WithAuthenticationAndAuthorization
126+
// https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.21.0/pkg/metrics/filters#WithAuthenticationAndAuthorization
127127
metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization
128128
}
129129

0 commit comments

Comments
 (0)