Need fix for CVE-2023-45288

[andriisoldatenko]

Need fix for CVE-2023-45288

[jwstein3400]

@jsafrane Hi it appears that a new tag was released last week: https://github.com/kubernetes-csi/csi-lib-utils/releases/tag/v0.18.0
Does that mean we can expect to see all the CSI sidecars uplifted and tagged for release?

[andriisoldatenko]

@ggriffiths could you please help to understand how to bump go version? I see https://github.com/kubernetes/kubernetes/blob/master/.go-version#L1

and I see

livenessprobe/release-tools/prow.sh

Line 89 in f8c3f43

configvar CSI_PROW_GO_VERSION_BUILD "1.21.5" "Go version for building the component" # depends on component's source code

but it's unclear how to bump it correctly.

[jsafrane]

I think this repo will get a new go version when it gets updated to Kubernetes 1.30 libraries. I'm waiting for a new github.com/kubernetes-csi/csi-lib-utils tag and then we will update all CSI sidecars.

[andriisoldatenko]

@jsafrane thanks!

[andriisoldatenko]

Problem that new release doesn't exist in registry:

Trying to pull registry.k8s.io/sig-storage/livenessprobe:v2.13.0...
Error: initializing source docker://registry.k8s.io/sig-storage/livenessprobe:v2.13.0: reading manifest v2.13.0 in registry.k8s.io/sig-storage/livenessprobe: manifest unknown: Failed to fetch "v2.13.0"

cc @jsafrane

[jsafrane]

Windows image build fails because of microsoft/Windows-Containers#493 :-(
We need fixed Windows base images to get a final 2.13 build of all images.