[
https://issues.apache.org/jira/browse/YUNIKORN-3435?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18109126#comment-18109126
]
Wilfred Spiegelenburg commented on YUNIKORN-3435:
-------------------------------------------------
New CVEs announced in golang.org/x/crypto
* CVE-2026-56855
* CVE-2026-78662
We also have a problem in the {{go.mod}} file in {{{}yunikorn-core{}}}. The
replace block downgrades dependencies specified in the indirect block:
{code:java}
replace (
golang.org/x/crypto => golang.org/x/crypto v0.52.0
golang.org/x/net => golang.org/x/net v0.55.0
golang.org/x/sys => golang.org/x/sys v0.45.0
golang.org/x/text => golang.org/x/text v0.37.0
)
{code}
and:
{code:java}
golang.org/x/crypto v0.54.0 // indirect
golang.org/x/net v0.57.0 // indirect
golang.org/x/sys v0.47.0 // indirect
golang.org/x/text v0.40.0 // indirect {code}
We do a similar broken thing in the yunikorn-k8shim {{go.mod}} for the same
set of dependencies
Probably a good point to start folding the replace block into the require block
for all {{golang.org/x/}} dependencies
> upgrade go dependencies for CVEs
> --------------------------------
>
> Key: YUNIKORN-3435
> URL: https://issues.apache.org/jira/browse/YUNIKORN-3435
> Project: Apache YuniKorn
> Issue Type: Improvement
> Components: core - scheduler, shim - kubernetes, webapp
> Reporter: Wilfred Spiegelenburg
> Assignee: weichen lai
> Priority: Major
> Labels: newbie
>
> Two high CVEs in these dependencies
> * golang.org/x/text
> * golang.org/x/net
> -Should also consider moving to the latest K8s 1.36.4 version- this is
> already handled in YUNIKORN-3300
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
