From 1654059aa6ff181953e0fbb747ecc9142e1e5dd2 Mon Sep 17 00:00:00 2001 From: Matt Boersma Date: Fri, 16 Jan 2026 08:48:16 -0700 Subject: [PATCH 1/7] Bump Go to v1.24.12 --- Makefile | 2 +- Tiltfile | 4 ++-- netlify.toml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/Makefile b/Makefile index 5d3571a59464..f586b7f192d6 100644 --- a/Makefile +++ b/Makefile @@ -23,7 +23,7 @@ SHELL:=/usr/bin/env bash # # Go. # -GO_VERSION ?= 1.24.11 +GO_VERSION ?= 1.24.12 GO_DIRECTIVE_VERSION ?= 1.23.0 GO_CONTAINER_IMAGE ?= docker.io/library/golang:$(GO_VERSION) diff --git a/Tiltfile b/Tiltfile index 8fb7b277e7ee..df364d64d1f7 100644 --- a/Tiltfile +++ b/Tiltfile @@ -172,7 +172,7 @@ def load_provider_tilt_files(): tilt_helper_dockerfile_header = """ # Tilt image -FROM golang:1.24.11 as tilt-helper +FROM golang:1.24.12 as tilt-helper # Install delve. Note this should be kept in step with the Go release minor version. RUN go install github.com/go-delve/delve/cmd/dlv@v1.24 # Support live reloading with Tilt @@ -183,7 +183,7 @@ RUN wget --output-document /restart.sh --quiet https://raw.githubusercontent.com """ tilt_dockerfile_header = """ -FROM golang:1.24.11 as tilt +FROM golang:1.24.12 as tilt WORKDIR / COPY --from=tilt-helper /process.txt . COPY --from=tilt-helper /start.sh . diff --git a/netlify.toml b/netlify.toml index e34fbc89910b..7730394c6251 100644 --- a/netlify.toml +++ b/netlify.toml @@ -4,7 +4,7 @@ publish = "docs/book/book" [build.environment] - GO_VERSION = "1.24.11" + GO_VERSION = "1.24.12" # Standard Netlify redirects [[redirects]] From 0528a4635056155befc74bd51304e143c73716df Mon Sep 17 00:00:00 2001 From: irapandey Date: Tue, 10 Feb 2026 21:19:47 +0530 Subject: [PATCH 2/7] bump go to 1.24.13 --- Makefile | 2 +- Tiltfile | 4 ++-- netlify.toml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/Makefile b/Makefile index f586b7f192d6..09d975ebd895 100644 --- a/Makefile +++ b/Makefile @@ -23,7 +23,7 @@ SHELL:=/usr/bin/env bash # # Go. # -GO_VERSION ?= 1.24.12 +GO_VERSION ?= 1.24.13 GO_DIRECTIVE_VERSION ?= 1.23.0 GO_CONTAINER_IMAGE ?= docker.io/library/golang:$(GO_VERSION) diff --git a/Tiltfile b/Tiltfile index df364d64d1f7..0853fc5cbb02 100644 --- a/Tiltfile +++ b/Tiltfile @@ -172,7 +172,7 @@ def load_provider_tilt_files(): tilt_helper_dockerfile_header = """ # Tilt image -FROM golang:1.24.12 as tilt-helper +FROM golang:1.24.13 as tilt-helper # Install delve. Note this should be kept in step with the Go release minor version. RUN go install github.com/go-delve/delve/cmd/dlv@v1.24 # Support live reloading with Tilt @@ -183,7 +183,7 @@ RUN wget --output-document /restart.sh --quiet https://raw.githubusercontent.com """ tilt_dockerfile_header = """ -FROM golang:1.24.12 as tilt +FROM golang:1.24.13 as tilt WORKDIR / COPY --from=tilt-helper /process.txt . COPY --from=tilt-helper /start.sh . diff --git a/netlify.toml b/netlify.toml index 7730394c6251..5f5446eddf63 100644 --- a/netlify.toml +++ b/netlify.toml @@ -4,7 +4,7 @@ publish = "docs/book/book" [build.environment] - GO_VERSION = "1.24.12" + GO_VERSION = "1.24.13" # Standard Netlify redirects [[redirects]] From 3050dd776576b67f65c0cb84f78e75a70a50a683 Mon Sep 17 00:00:00 2001 From: Stefan Bueringer Date: Thu, 19 Feb 2026 10:49:51 +0100 Subject: [PATCH 3/7] Add retry in test framework when getting manifest YAMLs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Stefan Büringer buringerst@vmware.com --- test/framework/clusterctl/repository.go | 47 +++++++++++++++++-------- 1 file changed, 33 insertions(+), 14 deletions(-) diff --git a/test/framework/clusterctl/repository.go b/test/framework/clusterctl/repository.go index 99d4f651834c..91f99b29aa44 100644 --- a/test/framework/clusterctl/repository.go +++ b/test/framework/clusterctl/repository.go @@ -27,10 +27,13 @@ import ( "path/filepath" "regexp" "strings" + "time" "github.com/blang/semver/v4" . "github.com/onsi/gomega" "github.com/pkg/errors" + kerrors "k8s.io/apimachinery/pkg/util/errors" + "k8s.io/apimachinery/pkg/util/wait" clusterctlv1 "sigs.k8s.io/cluster-api/cmd/clusterctl/api/v1alpha3" "sigs.k8s.io/cluster-api/test/framework/exec" @@ -275,21 +278,37 @@ func getComponentSourceFromURL(ctx context.Context, source ProviderVersionSource return nil, errors.Wrap(err, "failed to read file") } case httpURIScheme, httpsURIScheme: - req, err := http.NewRequestWithContext(ctx, http.MethodGet, source.Value, http.NoBody) - if err != nil { - return nil, errors.Wrapf(err, "failed to get %s: failed to create request", source.Value) - } - resp, err := http.DefaultClient.Do(req) - if err != nil { - return nil, errors.Wrapf(err, "failed to get %s", source.Value) - } - if resp.StatusCode != http.StatusOK { - return nil, errors.Errorf("failed to get %s: got status code %d", source.Value, resp.StatusCode) - } - defer resp.Body.Close() - buf, err = io.ReadAll(resp.Body) + var getErr error + err := wait.ExponentialBackoff(wait.Backoff{ + Steps: 5, + Duration: 100 * time.Millisecond, + Factor: 4.0, + }, func() (bool, error) { + req, err := http.NewRequestWithContext(ctx, http.MethodGet, source.Value, http.NoBody) + if err != nil { + getErr = errors.Wrapf(err, "failed to get %s: failed to create request", source.Value) + return false, nil + } + resp, err := http.DefaultClient.Do(req) + if err != nil { + getErr = errors.Wrapf(err, "failed to get %s", source.Value) + return false, nil + } + if resp.StatusCode != http.StatusOK { + getErr = errors.Errorf("failed to get %s: got status code %d", source.Value, resp.StatusCode) + return false, nil + } + defer resp.Body.Close() + buf, err = io.ReadAll(resp.Body) + if err != nil { + getErr = errors.Wrapf(err, "failed to get %s: failed to read body", source.Value) + return false, nil + } + + return true, nil + }) if err != nil { - return nil, errors.Wrapf(err, "failed to get %s: failed to read body", source.Value) + return nil, kerrors.NewAggregate([]error{err, getErr}) } default: return nil, errors.Errorf("unknown scheme for component source %q: allowed values are file, http, https", u.Scheme) From cb8e2541e48c91b4f1b866d5d3d08a1773af9891 Mon Sep 17 00:00:00 2001 From: Adarsh Agrawal Date: Mon, 2 Mar 2026 12:52:35 +0530 Subject: [PATCH 4/7] Disable govulncheck check for release-1.10 Signed-off-by: Adarsh Agrawal --- Makefile | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/Makefile b/Makefile index 09d975ebd895..1f23300ca02c 100644 --- a/Makefile +++ b/Makefile @@ -768,8 +768,7 @@ verify-diagrams: generate-diagrams ## Verify generated diagrams are up to date .PHONY: verify-security verify-security: ## Verify code and images for vulnerabilities $(MAKE) verify-container-images && R1=$$? || R1=$$?; \ - $(MAKE) verify-govulncheck && R2=$$? || R2=$$?; \ - if [ "$$R1" -ne "0" ] || [ "$$R2" -ne "0" ]; then \ + if [ "$$R1" -ne "0" ]; then \ echo "Check for vulnerabilities failed! There are vulnerabilities to be fixed"; \ exit 1; \ fi From ec059100e676aa0cbfd5af701c722fded27f4a0a Mon Sep 17 00:00:00 2001 From: Stefan Bueringer Date: Mon, 2 Mar 2026 14:05:45 +0100 Subject: [PATCH 5/7] Bump trivy to v0.69.2 to fix CI MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Stefan Büringer buringerst@vmware.com --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 09d975ebd895..8ea1a66b3104 100644 --- a/Makefile +++ b/Makefile @@ -139,7 +139,7 @@ HADOLINT_FAILURE_THRESHOLD = warning SHELLCHECK_VER := v0.9.0 -TRIVY_VER := 0.49.1 +TRIVY_VER := 0.69.2 KPROMO_VER := 5ab0dbc74b0228c22a93d240596dff77464aee8f KPROMO_BIN := kpromo From 26e2629c424e40c338d7c1f6dbca6b708b1b8d21 Mon Sep 17 00:00:00 2001 From: Stefan Bueringer Date: Mon, 2 Mar 2026 16:22:40 +0100 Subject: [PATCH 6/7] Ignore darwin otel CVE MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Stefan Büringer buringerst@vmware.com --- .trivyignore | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.trivyignore b/.trivyignore index a667d5c2f23e..f112e3e1223f 100644 --- a/.trivyignore +++ b/.trivyignore @@ -1,3 +1,5 @@ # According to govulncheck we are not using code that is affected by CVEs CVE-2025-47914 CVE-2025-58181 +# otel CVE on Darwin +CVE-2026-24051 From f8f104f80f3e36308f7f0c21eef51abc4390c310 Mon Sep 17 00:00:00 2001 From: fabriziopandini Date: Wed, 11 Mar 2026 19:51:40 +0100 Subject: [PATCH 7/7] Ignore CVE --- .dockerignore | 2 ++ .trivyignore | 3 +++ 2 files changed, 5 insertions(+) diff --git a/.dockerignore b/.dockerignore index f5796e7a7bb5..623f566724e5 100644 --- a/.dockerignore +++ b/.dockerignore @@ -54,3 +54,5 @@ go.work.sum **/*.tmp **/.DS_Store **/*.swp + +tmp/ \ No newline at end of file diff --git a/.trivyignore b/.trivyignore index f112e3e1223f..db90da9940b6 100644 --- a/.trivyignore +++ b/.trivyignore @@ -3,3 +3,6 @@ CVE-2025-47914 CVE-2025-58181 # otel CVE on Darwin CVE-2026-24051 +# Fix available in more recent versions +CVE-2026-25679 +CVE-2026-27142