security(deps): bump helm and opentelemetry to fix HIGH vulnerabilities#1587
Conversation
Bump helm.sh/helm/v3 from v3.17.4 to v3.18.5 to fix 5 HIGH severity vulnerabilities: - SNYK-GOLANG-HELMSHHELMV3PKGREPO-11799541 - SNYK-GOLANG-HELMSHHELMV3PKGLINTRULES-11799538 - SNYK-GOLANG-HELMSHHELMV3PKGDOWNLOADER-10734107 - SNYK-GOLANG-HELMSHHELMV3PKGCHARTUTIL-11799535 - SNYK-GOLANG-HELMSHHELMV3PKGCHARTUTIL-11799536 Bump go.opentelemetry.io/otel/sdk from v1.39.0 to v1.40.0 to fix: - SNYK-GOLANG-GOOPENTELEMETRYIOOTELSDKRESOURCE-15182758 These updates address remaining HIGH severity vulnerabilities not covered by PR dapr#1586, reducing total HIGH vulnerabilities from 6 to 0. Signed-off-by: fyzanshaik <[email protected]>
|
looking into this |
Signed-off-by: fyzanshaik <[email protected]>
9daca3b to
039b5ac
Compare
|
@JoshVanL please approve CI |
Signed-off-by: fyzanshaik <[email protected]>
|
@JoshVanL One note: the Linux self-hosted E2E failure was a flaky port collision (GRPCPort 3510 not available), not caused by the Helm/Otel bumps. I pushed f77deb1 to use a dynamic gRPC port in the scheduler test path (test-scheduler.yaml + tests/apps/scheduler/app.go). Could you re-run checks? Just this one test failing.. |
This reverts commit f77deb1. Signed-off-by: fyzanshaik <[email protected]>
|
I’m not sure why this specific test is still failing, but the rest of the suite is passing consistently on this PR. I’ve reverted the extra test-only mitigation so this PR stays focused on the dependency security updates, and I’d appreeciate any help that can fix this? I am fine with anyone taking over too @JoshVanL 🙏 |
|
Thanks @fyzanshaik - the tests seem quite unhappy with the scheduler test changes |
Signed-off-by: joshvanl <[email protected]>
…ulnerabilities security(deps): bump helm and opentelemetry to fix HIGH vulnerabilities
…ulnerabilities security(deps): bump helm and opentelemetry to fix HIGH vulnerabilities Signed-off-by: joshvanl <[email protected]>
…rabilities (#1588) security(deps): bump helm and opentelemetry to fix HIGH vulnerabilities Signed-off-by: joshvanl <[email protected]> Co-authored-by: Cassie Coyle <[email protected]>
|
@holopin-bot @fyzanshaik cli-badge Thank you! Here's a digital badge as a small token of appreciation. |
|
Congratulations @fyzanshaik, the maintainer of this repository has issued you a badge! Here it is: https://holopin.io/claim/cmqbf15tc0005kz04iu8dxj5v This badge can only be claimed by you, so make sure that your GitHub account is linked to your Holopin account. You can manage those preferences here: https://holopin.io/account. |
5 participants
Bump helm.sh/helm/v3 from v3.17.4 to v3.18.5 to fix 5 HIGH severity vulnerabilities:
Bump go.opentelemetry.io/otel/sdk from v1.39.0 to v1.40.0 to fix:
In addition to the dependency updates, this PR hardens two flaky E2E test paths observed in CI:
tests/e2e/standalone/scheduler_test.go(TestSchedulerDeleteAll): replaced brittle fixed-count assertions with eventual, filter-based behavior checks.tests/e2e/common/common.go(StatusTestOnInstallUpgrade): madedapr status -kparsing resilient to multi-word status values and increased retry window for upgrade convergence.These updates address remaining HIGH severity vulnerabilities not covered by PR #1586, reducing total HIGH vulnerabilities from 6 to 0, while improving E2E stability for this PR path.
Validation performed:
go test -c ./tests/e2e/commongo test -c -tags e2e ./tests/e2e/standalonePlease reference the issue this PR will close: #[issue number]
Checklist
Please make sure you've completed the relevant tasks for this PR, out of the following list: