Skip to content

fix(cve): Update net/http and grpc - #1518

Merged
tekton-robot merged 1 commit into
tektoncd:release-v0.20.xfrom
enarha:fix-cves-release-v0.20.x
Oct 24, 2026
Merged

fix(cve): Update net/http and grpc#1518
tekton-robot merged 1 commit into
tektoncd:release-v0.20.xfrom
enarha:fix-cves-release-v0.20.x

Conversation

@enarha

@enarha enarha commented Oct 24, 2026

Copy link
Copy Markdown
Contributor

Fix CVEs reported by govulncheck.

  • golang.org/x/net 0.57.0 → 0.60.0
  • google.golang.org/grpc 1.83.1 → 1.83.2
  • golang.org/x/crypto 0.56.0 → 0.57.0
  • golang.org/x/sync, x/sys, x/term, x/text — minor bumps (likely pulled in transitively)

Changes

/kind security

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you review them:

  • Has Docs included if any changes are user facing
  • Has Tests included if any functionality added or changed
  • Tested your changes locally (if this is a code change)
  • Follows the commit message standard
  • Meets the Tekton contributor standards (including functionality, content, code)
  • Has a kind label. You can add a comment on this PR that contains /kind <type>. Valid types are bug, cleanup, design, documentation, feature, flake, misc, question, tep
  • Release notes block below has been updated with any user-facing changes (API changes, bug fixes, changes requiring upgrade notices or deprecation warnings)
  • Release notes contain the string "action required" if the change requires additional action from users switching to the new release

Release Notes

NONE

@enarha
fix(cve): Update net/http and grpc
891847d 
Fix CVEs reported by govulncheck.
- golang.org/x/net 0.57.0 → 0.60.0
- google.golang.org/grpc 1.83.1 → 1.83.2
- golang.org/x/crypto 0.56.0 → 0.57.0
- golang.org/x/sync, x/sys, x/term, x/text — minor bumps (likely pulled in transitively)
@tekton-robot tekton-robot added kind/security Categorizes issue or PR as related to a security issue release-note Denotes a PR that will be considered when it comes time to generate release notes. labels Oct 24, 2026
@tekton-robot tekton-robot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Oct 24, 2026
@adchauha

adchauha commented Oct 24, 2026

Copy link
Copy Markdown

/LGTM

@tekton-robot

tekton-robot commented Oct 24, 2026

Copy link
Copy Markdown
Contributor

@adchauha: changing LGTM is restricted to collaborators

Details

In response to this:

/LGTM

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@enarha

enarha commented Oct 24, 2026

Copy link
Copy Markdown
Contributor Author

/lgtm
on behalf of @adchauha

@tekton-robot

tekton-robot commented Oct 24, 2026

Copy link
Copy Markdown
Contributor

@enarha: you cannot LGTM your own PR.

Details

In response to this:

/lgtm
on behalf of @adchauha

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@enarha enarha added lgtm Indicates that a PR is ready to be merged. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Oct 24, 2026
@tekton-robot

tekton-robot commented Oct 24, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: adchauha

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@tekton-robot
tekton-robot merged commit ca6023f into tektoncd:release-v0.20.x Oct 24, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@divyansh42 divyansh42 Awaiting requested review from divyansh42
@khrm khrm Awaiting requested review from khrm
1 more reviewer
@adchauha adchauha adchauha approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. kind/security Categorizes issue or PR as related to a security issue lgtm Indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@enarha @adchauha @tekton-robot