Bump version of Go for CVE resolution?

[kubernetes-csi]

Bump version of Go for CVE resolution?

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[mauriciopoppe]

/remove-lifecycle stale

[mauriciopoppe]

I saw that our go.mod file says 1.16 in https://github.com/kubernetes-csi/node-driver-registrar/blob/master/go.mod#L3 however the library that builds the binary uses 1.18 https://github.com/kubernetes-csi/csi-release-tools/blob/master/prow.sh#L89, I'll check this again before the next release

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[Alexshen1987]

We can see the same issue.

[Alexshen1987]

/remove-lifecycle stale

[sharunjoshi]

Are there any updates on fixing the CVE's?

[sharunjoshi]

/remove-lifecycle stale

[sarahhenkens]

Bumping up on this. We are having the same issue

[sarahhenkens]

@mauriciopoppe I think if we do a fresh docker build. It should pick up the latest node 16 or node 18 versions with the security patches included. Just need to do a re-release.

[MobsMao]

Any updates on fixing the CVEs? if bump the go version to 1.18.7 or 1.19.2 CVEs should be solved.

[mauriciopoppe]

A new image will be available soon, I'm waiting for kubernetes/k8s.io#4395 to be merged.

[mauriciopoppe]

Tested that the image is available with docker pull k8s.gcr.io/sig-storage/csi-node-driver-registrar:v2.6.0