Skip to content

Commit 1f719a0

Browse files
ATGardnerATGardner
authored
fixed sec vulns (#766)
1 parent f85df1f commit 1f719a0

File tree

7 files changed

+160
-145
lines changed

7 files changed

+160
-145
lines changed

‎CODEOWNERS‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,6 @@
1-
* [email protected] [email protected] [email protected] [email protected]
1+
# https://github.com/orgs/codefresh-io/teams/r-d/teams
2+
# use teams and github usernames, instead of email addresses
3+
* @codefresh-io/Backend
4+
5+
# only teamleads can approve CODEOOWNERS rule changes
6+
CODEOWNERS @codefresh-io/teamleads

‎Dockerfile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM golang:1.23.3-alpine3.20 as base
1+
FROM golang:1.23.4-alpine3.21 AS base
22

33
WORKDIR /go/src/github.com/codefresh-io/cli-v2
44

@@ -27,7 +27,7 @@ RUN go mod verify
2727

2828
############################### CLI ###############################
2929
### Compile
30-
FROM golang:1.23.3-alpine3.20 as codefresh-build
30+
FROM golang:1.23.4-alpine3.21 AS codefresh-build
3131

3232
WORKDIR /go/src/github.com/codefresh-io/cli-v2
3333

@@ -45,7 +45,7 @@ ARG SEGMENT_WRITE_KEY
4545
RUN make local DEV_MODE=false SEGMENT_WRITE_KEY=${SEGMENT_WRITE_KEY}
4646

4747
### Run
48-
FROM alpine:3.20 as codefresh
48+
FROM alpine:3.21 AS codefresh
4949

5050
WORKDIR /go/src/github.com/codefresh-io/cli-v2
5151

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
VERSION=v0.1.68
1+
VERSION=v0.1.69
22

33
OUT_DIR=dist
44
YEAR?=$(shell date +"%Y")

‎build/Dockerfile.helper‎

Lines changed: 6 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,23 @@
1-
# docker buildx build --platform linux/amd64,linux/arm64 -t quay.io/codefresh/golang-ci-helper:1.21.12 -f Dockerfile.helper .
2-
FROM golang:1.22.5-alpine3.20
1+
# docker buildx build --platform linux/amd64,linux/arm64 --build-arg GO_VERSION -t quay.io/codefresh/golang-ci-helper:${GO_VERSION} -f Dockerfile.helper .
2+
ARG GO_VERSION=1.23.4
3+
FROM golang:${GO_VERSION}-alpine3.20
34

45
RUN apk -U add --no-cache \
56
bash \
6-
ca-certificates \
7-
curl \
8-
g++ \
9-
gcc \
10-
git \
11-
jq \
12-
make \
7+
@@ -13,14 +14,14 @@ RUN apk -U add --no-cache \
138
openssl \
149
&& update-ca-certificates
1510

16-
ARG GH_VERSION=2.52.0
11+
ARG GH_VERSION=2.64.0
1712
RUN curl -L https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_amd64.tar.gz --output gh.tar.gz \
1813
&& tar -xzf gh.tar.gz \
1914
&& mv gh_${GH_VERSION}_linux_amd64/bin/gh /usr/local/bin \
2015
&& rm gh.tar.gz \
2116
&& rm -rf gh_${GH_VERSION}_linux_amd64
2217

23-
ARG KUSTOMIZE_VERSION=5.4.2
18+
ARG KUSTOMIZE_VERSION=5.5.0
2419
RUN curl -Ls https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv${KUSTOMIZE_VERSION}/kustomize_v${KUSTOMIZE_VERSION}_linux_amd64.tar.gz --output kustomize.tar.gz \
2520
&& tar -xzf kustomize.tar.gz \
2621
&& mv ./kustomize /usr/bin \
2722
&& rm kustomize.tar.gz
28-
2923
ENTRYPOINT [ "/bin/bash" ]

‎docs/releases/release_notes.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ cf version
2323

2424
```bash
2525
# download and extract the binary
26-
curl -L --output - https://github.com/codefresh-io/cli-v2/releases/download/v0.1.68/cf-linux-amd64.tar.gz | tar zx
26+
curl -L --output - https://github.com/codefresh-io/cli-v2/releases/download/v0.1.69/cf-linux-amd64.tar.gz | tar zx
2727

2828
# move the binary to your $PATH
2929
mv ./cf-linux-amd64 /usr/local/bin/cf
@@ -36,7 +36,7 @@ cf version
3636

3737
```bash
3838
# download and extract the binary
39-
curl -L --output - https://github.com/codefresh-io/cli-v2/releases/download/v0.1.68/cf-darwin-amd64.tar.gz | tar zx
39+
curl -L --output - https://github.com/codefresh-io/cli-v2/releases/download/v0.1.69/cf-darwin-amd64.tar.gz | tar zx
4040

4141
# move the binary to your $PATH
4242
mv ./cf-darwin-amd64 /usr/local/bin/cf

‎go.mod‎

Lines changed: 33 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
module github.com/codefresh-io/cli-v2
22

3-
go 1.23
3+
go 1.23.1
44

5-
toolchain go1.23.3
5+
toolchain go1.23.4
66

77
require (
88
github.com/Masterminds/semver/v3 v3.3.0
99
github.com/argoproj-labs/argocd-autopilot v0.4.18
1010
github.com/argoproj/argo-cd/v2 v2.13.1
1111
github.com/argoproj/argo-events v1.9.2
12-
github.com/argoproj/argo-workflows/v3 v3.5.8
12+
github.com/argoproj/argo-workflows/v3 v3.6.2
1313
github.com/briandowns/spinner v1.23.1
1414
github.com/codefresh-io/go-sdk v1.3.1
1515
github.com/fatih/color v1.16.0
@@ -32,7 +32,7 @@ require (
3232
github.com/spf13/viper v1.19.0
3333
github.com/stretchr/testify v1.10.0
3434
golang.org/x/exp v0.0.0-20240416160154-fe59bbe5cc7f
35-
golang.org/x/text v0.18.0
35+
golang.org/x/text v0.21.0
3636
gopkg.in/segmentio/analytics-go.v3 v3.1.0
3737
helm.sh/helm/v3 v3.14.2
3838
k8s.io/api v0.31.0
@@ -55,8 +55,7 @@ require (
5555
github.com/Masterminds/goutils v1.1.1 // indirect
5656
github.com/Masterminds/sprig/v3 v3.3.0 // indirect
5757
github.com/Masterminds/squirrel v1.5.4 // indirect
58-
github.com/Microsoft/go-winio v0.6.1 // indirect
59-
github.com/Microsoft/hcsshim v0.11.4 // indirect
58+
github.com/Microsoft/go-winio v0.6.2 // indirect
6059
github.com/PagerDuty/go-pagerduty v1.7.0 // indirect
6160
github.com/ProtonMail/go-crypto v1.0.0 // indirect
6261
github.com/RocketChat/Rocket.Chat.Go.SDK v0.0.0-20210112200207-10ab4d695d60 // indirect
@@ -66,23 +65,23 @@ require (
6665
github.com/antonmedv/expr v1.15.5 // indirect
6766
github.com/argoproj/gitops-engine v0.7.1-0.20240905010810-bd7681ae3f8b // indirect
6867
github.com/argoproj/notifications-engine v0.4.1-0.20240606074338-0802cd427621 // indirect
69-
github.com/argoproj/pkg v0.13.7-0.20230901113346-235a5432ec98 // indirect
68+
github.com/argoproj/pkg v0.13.7-0.20240704113442-a69fd34a8117 // indirect
7069
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
7170
github.com/aws/aws-sdk-go v1.55.5 // indirect
72-
github.com/aws/aws-sdk-go-v2 v1.24.1 // indirect
73-
github.com/aws/aws-sdk-go-v2/config v1.25.12 // indirect
74-
github.com/aws/aws-sdk-go-v2/credentials v1.16.16 // indirect
75-
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.11 // indirect
76-
github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.10 // indirect
77-
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.10 // indirect
78-
github.com/aws/aws-sdk-go-v2/internal/ini v1.7.1 // indirect
79-
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4 // indirect
80-
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.10 // indirect
71+
github.com/aws/aws-sdk-go-v2 v1.30.1 // indirect
72+
github.com/aws/aws-sdk-go-v2/config v1.27.23 // indirect
73+
github.com/aws/aws-sdk-go-v2/credentials v1.17.24 // indirect
74+
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.9 // indirect
75+
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.13 // indirect
76+
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.13 // indirect
77+
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect
78+
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.3 // indirect
79+
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.15 // indirect
8180
github.com/aws/aws-sdk-go-v2/service/sqs v1.29.7 // indirect
82-
github.com/aws/aws-sdk-go-v2/service/sso v1.18.7 // indirect
83-
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.7 // indirect
84-
github.com/aws/aws-sdk-go-v2/service/sts v1.26.7 // indirect
85-
github.com/aws/smithy-go v1.19.0 // indirect
81+
github.com/aws/aws-sdk-go-v2/service/sso v1.22.1 // indirect
82+
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.2 // indirect
83+
github.com/aws/aws-sdk-go-v2/service/sts v1.30.1 // indirect
84+
github.com/aws/smithy-go v1.20.3 // indirect
8685
github.com/beorn7/perks v1.0.1 // indirect
8786
github.com/blang/semver/v4 v4.0.0 // indirect
8887
github.com/bmatcuk/doublestar/v4 v4.6.1 // indirect
@@ -96,24 +95,25 @@ require (
9695
github.com/chainguard-dev/git-urls v1.0.2 // indirect
9796
github.com/chzyer/readline v1.5.1 // indirect
9897
github.com/cloudflare/circl v1.3.7 // indirect
99-
github.com/containerd/containerd v1.7.11 // indirect
98+
github.com/containerd/containerd v1.7.20 // indirect
99+
github.com/containerd/errdefs v0.1.0 // indirect
100100
github.com/containerd/log v0.1.0 // indirect
101+
github.com/containerd/platforms v0.2.1 // indirect
101102
github.com/coreos/go-oidc/v3 v3.11.0 // indirect
102103
github.com/cpuguy83/go-md2man/v2 v2.0.4 // indirect
103104
github.com/cyphar/filepath-securejoin v0.3.2 // indirect
104105
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
105106
github.com/davidmz/go-pageant v1.0.2 // indirect
106107
github.com/desertbit/timer v0.0.0-20180107155436-c41aec40b27f // indirect
107108
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
108-
github.com/distribution/reference v0.5.0 // indirect
109+
github.com/distribution/reference v0.6.0 // indirect
109110
github.com/dlclark/regexp2 v1.11.4 // indirect
110-
github.com/docker/cli v24.0.7+incompatible // indirect
111-
github.com/docker/distribution v2.8.2+incompatible // indirect
112-
github.com/docker/docker v24.0.9+incompatible // indirect
111+
github.com/docker/cli v27.1.0+incompatible // indirect
112+
github.com/docker/distribution v2.8.3+incompatible // indirect
113+
github.com/docker/docker v27.1.1+incompatible // indirect
113114
github.com/docker/docker-credential-helpers v0.7.0 // indirect
114-
github.com/docker/go-connections v0.4.0 // indirect
115+
github.com/docker/go-connections v0.5.0 // indirect
115116
github.com/docker/go-metrics v0.0.1 // indirect
116-
github.com/docker/go-units v0.5.0 // indirect
117117
github.com/dustin/go-humanize v1.0.1 // indirect
118118
github.com/emicklei/go-restful/v3 v3.11.0 // indirect
119119
github.com/emirpasic/gods v1.18.1 // indirect
@@ -225,7 +225,6 @@ require (
225225
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
226226
github.com/modern-go/reflect2 v1.0.2 // indirect
227227
github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
228-
github.com/morikuni/aec v1.0.0 // indirect
229228
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
230229
github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
231230
github.com/oklog/ulid v1.3.1 // indirect
@@ -287,15 +286,14 @@ require (
287286
go.starlark.net v0.0.0-20230525235612-a134d8f9ddca // indirect
288287
go.uber.org/automaxprocs v1.5.3 // indirect
289288
go.uber.org/multierr v1.11.0 // indirect
290-
golang.org/x/crypto v0.27.0 // indirect
289+
golang.org/x/crypto v0.31.0 // indirect
291290
golang.org/x/mod v0.17.0 // indirect
292-
golang.org/x/net v0.29.0 // indirect
291+
golang.org/x/net v0.33.0 // indirect
293292
golang.org/x/oauth2 v0.23.0 // indirect
294-
golang.org/x/sync v0.8.0 // indirect
295-
golang.org/x/sys v0.25.0 // indirect
296-
golang.org/x/term v0.24.0 // indirect
293+
golang.org/x/sync v0.10.0 // indirect
294+
golang.org/x/sys v0.28.0 // indirect
295+
golang.org/x/term v0.27.0 // indirect
297296
golang.org/x/time v0.6.0 // indirect
298-
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
299297
gomodules.xyz/envconfig v1.3.1-0.20190308184047-426f31af0d45 // indirect
300298
gomodules.xyz/notify v0.1.1 // indirect
301299
google.golang.org/api v0.181.0 // indirect
@@ -325,7 +323,7 @@ require (
325323
k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 // indirect
326324
layeh.com/gopher-json v0.0.0-20190114024228-97fed8db8427 // indirect
327325
nhooyr.io/websocket v1.8.7 // indirect
328-
oras.land/oras-go v1.2.4 // indirect
326+
oras.land/oras-go v1.2.6 // indirect
329327
oras.land/oras-go/v2 v2.5.0 // indirect
330328
sigs.k8s.io/controller-runtime v0.19.0 // indirect
331329
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect

0 commit comments

Comments
 (0)