Skip to content

fix(deps): fix Go dependency vulnerabilities on alauda-v0.43.0 - #91

Merged
l-qing merged 3 commits into
alauda-v0.43.0from
fix/vuln-alauda-v0.43.0-by-go-vuln-fix-2
Apr 22, 2026
Merged

fix(deps): fix Go dependency vulnerabilities on alauda-v0.43.0#91
l-qing merged 3 commits into
alauda-v0.43.0from
fix/vuln-alauda-v0.43.0-by-go-vuln-fix-2

Conversation

@alaudabot

@alaudabot alaudabot commented Apr 22, 2026

Copy link
Copy Markdown
  • upgrade github.com/tektoncd/pipeline to v1.11.1 to address CVE-2026-25542, CVE-2026-40923, CVE-2026-40924, and CVE-2026-40938
  • upgrade OTLP HTTP exporters to v1.43.0 to address CVE-2026-39882
  • pin knative.dev/pkg to a compatible revision so the updated pipeline dependency graph still resolves with the existing triggers dependency set
  • refresh vendored dependencies and confirm Trivy re-scan for go.mod and tools/go.mod returns 0 fixable vulnerabilities

@l-qing
fix(deps): fix Go dependency vulnerabilities on alauda-v0.43.0
d90f1b2 
- upgrade github.com/tektoncd/pipeline to v1.11.1 for CVE-2026-25542, CVE-2026-40923, CVE-2026-40924, and CVE-2026-40938

- upgrade OTLP HTTP exporters to v1.43.0 for CVE-2026-39882

- vendor updated modules and pin knative.dev/pkg to a compatible revision for the new pipeline dependency graph
alaudabot
alaudabot commented Apr 22, 2026
View reviewed changes

@alaudabot alaudabot left a comment

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Summary

This PR upgrades Go dependencies to patch multiple CVEs (CVE-2026-25542, CVE-2026-40923, CVE-2026-40924, CVE-2026-40938, CVE-2026-39882) and refreshes vendored dependencies across 2126 files. Key upgrades include tektoncd/pipeline v1.6.1→v1.11.1, OTLP HTTP exporters to v1.43.0, and Kubernetes libraries to v0.35.3. A replace directive pins knative.dev/pkg to a compatible pseudo-version to maintain resolution with the existing tektoncd/triggers dependency set.

Review Statistics

Category Count
Critical Issues 0
Warnings 0
Suggestions 3

Suggestions

  • go.mod line 372: Add a comment above the replace knative.dev/pkg directive explaining why this specific pseudo-version is pinned (e.g., required for compatibility with tektoncd/triggers v0.34.0).

  • go.mod line 369: The replace github.com/sigstore/timestamp-authority directive references a personal fork. Verify it is actively maintained or consider upstreaming the security fix.

  • go.mod lines 26–32: The Kubernetes library triple and tektoncd/pipeline are upgraded concurrently. Consider adding integration test coverage for the new Kubernetes library versions.

Positive Feedback

  • Excellent PR description with explicit CVE references and clear rationale.
  • All relevant CVEs addressed with appropriate library upgrades.
  • gogo/protobuf fully removed from the vendor tree.
  • go.sum updated consistently with go.mod.
  • Vendor refresh appears complete and consistent.

Status: No blocking issues found.

@alaudabot

alaudabot commented Apr 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Author

🤖 AI Code Review

Property Value
Model opencode/minimax-m2.5-free
Style strict
Issues Found 0
Config Source centralized
Profile ❌ Not Found
Personalized Prompt ❌ No
Prompt Path .github/review/profiles/alaudadevops/tektoncd-cli/pr-review.md
Alauda Skills ✅ base-authoring, base-m365, base-skill-setup, builders-component-knowledge, builders-confluence, builders-jira, builders-publish-errata, builders-story-split, devops-autodns, devops-candidate-version-supervisor, devops-connectors-acceptance-test, devops-connectors-explore, devops-connectors-poc-case, devops-connectors-review, devops-connectors-unit-test, devops-connectors-write-user-docs, devops-fix-go-vulns, devops-gen-advanced-form-descriptors, devops-knowledge-adoption, devops-refresh-containerfile-digests, devops-refresh-containerfile-tags, devops-replace-strings, devops-scan-docker-keywords, devops-sync-alauda-github-releases, devops-tekton-dynamic-form-optimizer, devops-tekton-operator-task-e2e, devops-tekton-task-generator, devops-tekton-task-overview-template, devops-tekton-task-version-upgrade, devops-tekton-upgrade-notes, devops-tool-report-troubleshoot, devops-ui-e2e-code-audit, devops-ui-e2e-fix-base-on-report, devops-ui-e2e-regression-and-fix, devops-ui-generate-e2e-from-feature, devops-ui-pre-setup, devops-upgrade-go
Reviewed at 2026-04-22 17:17:00 UTC

Summary

This PR fixes Go dependency vulnerabilities by upgrading github.com/tektoncd/pipeline from v1.6.1 to v1.11.1 (addressing CVE-2026-25542, CVE-2026-40923, CVE-2026-40924, CVE-2026-40938), OTLP HTTP exporters to v1.43.0 (addressing CVE-2026-39882), and refreshing all vendored dependencies. The changes include additional source code fixes for fatih/color library compatibility and input validation for plugin names.

Review Statistics

Category Count
Critical Issues 0
Warnings 0
Suggestions 2
Files Reviewed 9 (non-vendor)

Critical Issues

Issues that MUST be addressed before merging (security, bugs, breaking changes)

None identified. This is a security-focused dependency upgrade with appropriate fixes.

Warnings

Issues that SHOULD be addressed but are not blocking

None identified.

Suggestions

Recommendations for improvement (nice to have)

  • pkg/plugins/plugins.go:17: Consider adding test coverage for the new isValidPluginName function. Since this is a security-sensitive validation, having unit tests would ensure the validation behaves correctly for edge cases (e.g., empty string, path separators).

  • pkg/plugins/plugins.go:17: The function name isValidPluginName suggests it's a predicate. Consider adding a more descriptive comment explaining what makes a plugin name valid in this context, for future maintainers.

Positive Feedback

The PR demonstrates good security practices:

  1. Input validation: The addition of isValidPluginName in pkg/plugins/plugins.go:17-24 adds explicit validation for plugin names, preventing potential path traversal or injection issues when invoking plugins.

  2. Compatibility handling: The newColor helper function in pkg/formatted/color.go:37-46 properly handles the new fatih/color behavior regarding NO_COLOR environment variable, ensuring color output respects user preferences.

  3. Clean dependency management: The use of a replace directive for knative.dev/pkg ensures dependency graph compatibility while still addressing vulnerabilities.

  4. Comprehensive update: The PR addresses multiple CVEs (CVE-2026-25542, CVE-2026-40923, CVE-2026-40924, CVE-2026-40938, CVE-2026-39882) in a single coherent change.

Review Note: Given the large number of changed files (2,132), this review focused on non-vendor source code changes. The vendor directory updates are automated dependency refreshes and do not warrant manual inspection.

ℹ️ About this review

This review was automatically generated using the run-actions workflow.

  • Shared prompt: .github/prompts/code-review.md
  • Config source: centralized
  • Profile path: Not Found
  • Profile ref: 32955711ef1af066b0af463dc0cecc5ccc39be41
  • No repository-specific prompt configured
  • Alauda skills: base-authoring, base-m365, base-skill-setup, builders-component-knowledge, builders-confluence, builders-jira, builders-publish-errata, builders-story-split, devops-autodns, devops-candidate-version-supervisor, devops-connectors-acceptance-test, devops-connectors-explore, devops-connectors-poc-case, devops-connectors-review, devops-connectors-unit-test, devops-connectors-write-user-docs, devops-fix-go-vulns, devops-gen-advanced-form-descriptors, devops-knowledge-adoption, devops-refresh-containerfile-digests, devops-refresh-containerfile-tags, devops-replace-strings, devops-scan-docker-keywords, devops-sync-alauda-github-releases, devops-tekton-dynamic-form-optimizer, devops-tekton-operator-task-e2e, devops-tekton-task-generator, devops-tekton-task-overview-template, devops-tekton-task-version-upgrade, devops-tekton-upgrade-notes, devops-tool-report-troubleshoot, devops-ui-e2e-code-audit, devops-ui-e2e-fix-base-on-report, devops-ui-e2e-regression-and-fix, devops-ui-generate-e2e-from-feature, devops-ui-pre-setup, devops-upgrade-go

l-qing added 2 commits April 22, 2026 12:04
@l-qing
fix(test): restore compatibility after dependency upgrades
27e8dfd 
- drop the removed knative test metrics exporter initialization

- keep formatted output color handling aligned with color.NoColor under newer fatih/color behavior
@l-qing
fix(security): satisfy gosec plugin checks
98b06b9 
- validate plugin names before resolving plugin binaries

- use DirEntry metadata directly when listing plugin executables

- document the intentional plugin exec path for gosec
@l-qing
l-qing merged commit 8e8f7b2 into alauda-v0.43.0 Apr 22, 2026
9 checks passed
@l-qing
l-qing deleted the fix/vuln-alauda-v0.43.0-by-go-vuln-fix-2 branch April 22, 2026 17:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@l-qing l-qing l-qing approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@alaudabot @l-qing