chore(deps): update module k8s.io/client-go to v0.20.0 [security] (release-0.31) by redhat-renovate-bot · Pull Request #448 · k8snetworkplumbingwg/ovs-cni

redhat-renovate-bot · 2026-03-15T03:44:21Z

This PR contains the following updates:

Package	Type	Update	Change
k8s.io/client-go	replace	minor	`v0.19.1` -> `v0.20.0`

Kubernetes client-go vulnerable to Sensitive Information Leak via Log File

CVE-2020-8565 / GHSA-8cfg-vx93-jvxw / GO-2021-0064

More information

Details

In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.5, <= v1.18.13, <= v1.17.15, < v1.20.0-alpha2.

Severity

CVSS Score: 4.7 / 10 (Medium)
Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Unauthorized credential disclosure via debug logs in k8s.io/kubernetes and k8s.io/client-go

CVE-2020-8565 / GHSA-8cfg-vx93-jvxw / GO-2021-0064

More information

Details

Authorization tokens may be inappropriately logged if the verbosity level is set to a debug level. This is due to an incomplete fix for CVE-2019-11250.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Release Notes

kubernetes/client-go (k8s.io/client-go)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

Signed-off-by: redhat-renovate-bot <redhat-internal-renovate@redhat.com>

redhat-renovate-bot · 2026-03-15T03:44:23Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -t ./...
go: downloading k8s.io/client-go v0.20.0
go: downloading golang.org/x/sys v0.28.0
go: downloading golang.org/x/net v0.33.0
go: downloading golang.org/x/text v0.21.0
go: downloading golang.org/x/crypto v0.31.0
go: downloading golang.org/x/term v0.27.0
go: github.com/k8snetworkplumbingwg/ovs-cni/pkg/marker imports
	k8s.io/client-go/kubernetes imports
	k8s.io/client-go/kubernetes/typed/apiserverinternal/v1alpha1 imports
	k8s.io/api/apiserverinternal/v1alpha1: cannot find module providing package k8s.io/api/apiserverinternal/v1alpha1
go: github.com/k8snetworkplumbingwg/ovs-cni/pkg/marker imports
	k8s.io/client-go/kubernetes imports
	k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta1 imports
	k8s.io/api/flowcontrol/v1beta1: cannot find module providing package k8s.io/api/flowcontrol/v1beta1
go: github.com/k8snetworkplumbingwg/ovs-cni/pkg/marker imports
	k8s.io/client-go/kubernetes imports
	k8s.io/client-go/kubernetes/typed/node/v1 imports
	k8s.io/api/node/v1: cannot find module providing package k8s.io/api/node/v1

kubevirt-bot · 2026-03-15T03:44:25Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: redhat-renovate-bot
Once this PR has been reviewed and has the lgtm label, please assign alonakaplan for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

gemini-code-assist · 2026-03-15T03:44:32Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request updates the k8s.io/client-go dependency to version v0.20.0. This update is critical as it incorporates a fix for CVE-2020-8565, a security vulnerability that could lead to sensitive information leakage through log files if logging levels are set too high.

Highlights

Dependency Update: Updated the k8s.io/client-go module from v0.19.1 to v0.20.0.
Security Fix: Addressed CVE-2020-8565, which prevents sensitive information like authorization and bearer tokens from being logged at high verbosity levels.

Changelog

go.mod
- Updated k8s.io/client-go module from v0.19.1 to v0.20.0.

Activity

This pull request was automatically generated by redhat-renovate-bot to update a dependency.
No human activity or reviews have been recorded yet.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

kubevirt-bot · 2026-03-15T03:45:14Z

@redhat-renovate-bot: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-e2e-ovs-cni	`9752e16`	link	true	`/test pull-e2e-ovs-cni-0.31`

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

gemini-code-assist

Code Review

This pull request updates k8s.io/client-go to v0.20.0 to address a security vulnerability. While the update is necessary, it introduces a version skew between k8s.io/client-go and other Kubernetes dependencies which are pinned to v0.19.1. This can lead to compatibility issues. My review includes a critical comment suggesting an alternative approach to update all related k8s.io dependencies to a consistent v0.19.x version to mitigate this risk while still fixing the vulnerability.

gemini-code-assist · 2026-03-15T03:46:33Z

go.mod

 	k8s.io/apiserver => k8s.io/apiserver v0.19.1
 	k8s.io/cli-runtime => k8s.io/cli-runtime v0.19.1
-	k8s.io/client-go => k8s.io/client-go v0.19.1
+	k8s.io/client-go => k8s.io/client-go v0.20.0


Updating k8s.io/client-go to v0.20.0 while keeping other k8s.io dependencies at v0.19.1 introduces a version skew between different minor versions of Kubernetes components. This is not recommended and can lead to subtle bugs and incompatibilities.

To fix the security vulnerability (CVE-2020-8565) while maintaining version consistency, I suggest updating all k8s.io dependencies to a patched version within the v0.19.x series, such as v0.19.16. This aligns with the // Pinned to kubernetes-1.19.1 comment and avoids the risks of mixing major versions.

Suggested change for the whole replace block:

// Pinned to kubernetes-1.19.16 replace ( k8s.io/api => k8s.io/api v0.19.16 k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.19.16 k8s.io/apimachinery => k8s.io/apimachinery v0.19.16 k8s.io/apiserver => k8s.io/apiserver v0.19.16 k8s.io/cli-runtime => k8s.io/cli-runtime v0.19.16 k8s.io/client-go => k8s.io/client-go v0.19.16 k8s.io/cloud-provider => k8s.io/cloud-provider v0.19.16 k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.19.16 k8s.io/code-generator => k8s.io/code-generator v0.19.16 k8s.io/component-base => k8s.io/component-base v0.19.16 k8s.io/cri-api => k8s.io/cri-api v0.19.16 k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.19.16 k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.19.16 k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.19.16 k8s.io/kube-proxy => k8s.io/kube-proxy v0.19.16 k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.19.16 k8s.io/kubectl => k8s.io/kubectl v0.19.16 k8s.io/kubelet => k8s.io/kubelet v0.19.16 k8s.io/legacy-cloud-providers => k8s.io/legacy-cloud-providers v0.19.16 k8s.io/metrics => k8s.io/metrics v0.19.16 k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.19.16 )

chore(deps): update module k8s.io/client-go to v0.20.0 [security]

9752e16

Signed-off-by: redhat-renovate-bot <redhat-internal-renovate@redhat.com>

redhat-renovate-bot added the release-note-none Denotes a PR that doesn't merit a release note. label Mar 15, 2026

kubevirt-bot added the dco-signoff: yes Indicates the PR's author has DCO signed all their commits. label Mar 15, 2026

gemini-code-assist bot reviewed Mar 15, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update module k8s.io/client-go to v0.20.0 [security] (release-0.31)#448

chore(deps): update module k8s.io/client-go to v0.20.0 [security] (release-0.31)#448
redhat-renovate-bot wants to merge 1 commit intorelease-0.31from
renovate/release-0.31-go-k8s.io-client-go-vulnerability

redhat-renovate-bot commented Mar 15, 2026

Uh oh!

redhat-renovate-bot commented Mar 15, 2026

Uh oh!

kubevirt-bot commented Mar 15, 2026

Uh oh!

gemini-code-assist bot commented Mar 15, 2026

Uh oh!

kubevirt-bot commented Mar 15, 2026

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

gemini-code-assist bot Mar 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

redhat-renovate-bot commented Mar 15, 2026

Kubernetes client-go vulnerable to Sensitive Information Leak via Log File

Details

Severity

References

Unauthorized credential disclosure via debug logs in k8s.io/kubernetes and k8s.io/client-go

Details

Severity

References

Release Notes

Configuration

Uh oh!

redhat-renovate-bot commented Mar 15, 2026

⚠️ Artifact update problem

File name: go.sum

Uh oh!

kubevirt-bot commented Mar 15, 2026

Uh oh!

gemini-code-assist bot commented Mar 15, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

kubevirt-bot commented Mar 15, 2026

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Mar 15, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants