Skip to content

Commit

Permalink
fixed sec vulns (#766)
Browse files Browse the repository at this point in the history
  • Loading branch information
ATGardner authored Dec 24, 2024
1 parent f85df1f commit 1f719a0
Show file tree
Hide file tree
Showing 7 changed files with 160 additions and 145 deletions.
7 changes: 6 additions & 1 deletion CODEOWNERS
Validating CODEOWNERS rules …
Original file line number Diff line number Diff line change
@@ -1 +1,6 @@
* [email protected] [email protected] [email protected] [email protected]
# https://github.com/orgs/codefresh-io/teams/r-d/teams
# use teams and github usernames, instead of email addresses
* @codefresh-io/Backend

# only teamleads can approve CODEOOWNERS rule changes
CODEOWNERS @codefresh-io/teamleads
6 changes: 3 additions & 3 deletions Dockerfile
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM golang:1.23.3-alpine3.20 as base
FROM golang:1.23.4-alpine3.21 AS base

WORKDIR /go/src/github.com/codefresh-io/cli-v2

Expand Down Expand Up @@ -27,7 +27,7 @@ RUN go mod verify

############################### CLI ###############################
### Compile
FROM golang:1.23.3-alpine3.20 as codefresh-build
FROM golang:1.23.4-alpine3.21 AS codefresh-build

WORKDIR /go/src/github.com/codefresh-io/cli-v2

Expand All @@ -45,7 +45,7 @@ ARG SEGMENT_WRITE_KEY
RUN make local DEV_MODE=false SEGMENT_WRITE_KEY=${SEGMENT_WRITE_KEY}

### Run
FROM alpine:3.20 as codefresh
FROM alpine:3.21 AS codefresh

WORKDIR /go/src/github.com/codefresh-io/cli-v2

Expand Down
2 changes: 1 addition & 1 deletion Makefile
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
VERSION=v0.1.68
VERSION=v0.1.69

OUT_DIR=dist
YEAR?=$(shell date +"%Y")
Expand Down
18 changes: 6 additions & 12 deletions build/Dockerfile.helper
Original file line number Diff line number Diff line change
@@ -1,29 +1,23 @@
# docker buildx build --platform linux/amd64,linux/arm64 -t quay.io/codefresh/golang-ci-helper:1.21.12 -f Dockerfile.helper .
FROM golang:1.22.5-alpine3.20
# docker buildx build --platform linux/amd64,linux/arm64 --build-arg GO_VERSION -t quay.io/codefresh/golang-ci-helper:${GO_VERSION} -f Dockerfile.helper .
ARG GO_VERSION=1.23.4
FROM golang:${GO_VERSION}-alpine3.20

RUN apk -U add --no-cache \
bash \
ca-certificates \
curl \
g++ \
gcc \
git \
jq \
make \
@@ -13,14 +14,14 @@ RUN apk -U add --no-cache \
openssl \
&& update-ca-certificates

ARG GH_VERSION=2.52.0
ARG GH_VERSION=2.64.0
RUN curl -L https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_amd64.tar.gz --output gh.tar.gz \
&& tar -xzf gh.tar.gz \
&& mv gh_${GH_VERSION}_linux_amd64/bin/gh /usr/local/bin \
&& rm gh.tar.gz \
&& rm -rf gh_${GH_VERSION}_linux_amd64

ARG KUSTOMIZE_VERSION=5.4.2
ARG KUSTOMIZE_VERSION=5.5.0
RUN curl -Ls https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv${KUSTOMIZE_VERSION}/kustomize_v${KUSTOMIZE_VERSION}_linux_amd64.tar.gz --output kustomize.tar.gz \
&& tar -xzf kustomize.tar.gz \
&& mv ./kustomize /usr/bin \
&& rm kustomize.tar.gz

ENTRYPOINT [ "/bin/bash" ]
4 changes: 2 additions & 2 deletions docs/releases/release_notes.md
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ cf version

```bash
# download and extract the binary
curl -L --output - https://github.com/codefresh-io/cli-v2/releases/download/v0.1.68/cf-linux-amd64.tar.gz | tar zx
curl -L --output - https://github.com/codefresh-io/cli-v2/releases/download/v0.1.69/cf-linux-amd64.tar.gz | tar zx

# move the binary to your $PATH
mv ./cf-linux-amd64 /usr/local/bin/cf
Expand All @@ -36,7 +36,7 @@ cf version

```bash
# download and extract the binary
curl -L --output - https://github.com/codefresh-io/cli-v2/releases/download/v0.1.68/cf-darwin-amd64.tar.gz | tar zx
curl -L --output - https://github.com/codefresh-io/cli-v2/releases/download/v0.1.69/cf-darwin-amd64.tar.gz | tar zx

# move the binary to your $PATH
mv ./cf-darwin-amd64 /usr/local/bin/cf
Expand Down
68 changes: 33 additions & 35 deletions go.mod
Original file line number Diff line number Diff line change
@@ -1,15 +1,15 @@
module github.com/codefresh-io/cli-v2

go 1.23
go 1.23.1

toolchain go1.23.3
toolchain go1.23.4

require (
github.com/Masterminds/semver/v3 v3.3.0
github.com/argoproj-labs/argocd-autopilot v0.4.18
github.com/argoproj/argo-cd/v2 v2.13.1
github.com/argoproj/argo-events v1.9.2
github.com/argoproj/argo-workflows/v3 v3.5.8
github.com/argoproj/argo-workflows/v3 v3.6.2
github.com/briandowns/spinner v1.23.1
github.com/codefresh-io/go-sdk v1.3.1
github.com/fatih/color v1.16.0
Expand All @@ -32,7 +32,7 @@ require (
github.com/spf13/viper v1.19.0
github.com/stretchr/testify v1.10.0
golang.org/x/exp v0.0.0-20240416160154-fe59bbe5cc7f
golang.org/x/text v0.18.0
golang.org/x/text v0.21.0
gopkg.in/segmentio/analytics-go.v3 v3.1.0
helm.sh/helm/v3 v3.14.2
k8s.io/api v0.31.0
Expand All @@ -55,8 +55,7 @@ require (
github.com/Masterminds/goutils v1.1.1 // indirect
github.com/Masterminds/sprig/v3 v3.3.0 // indirect
github.com/Masterminds/squirrel v1.5.4 // indirect
github.com/Microsoft/go-winio v0.6.1 // indirect
github.com/Microsoft/hcsshim v0.11.4 // indirect
github.com/Microsoft/go-winio v0.6.2 // indirect
github.com/PagerDuty/go-pagerduty v1.7.0 // indirect
github.com/ProtonMail/go-crypto v1.0.0 // indirect
github.com/RocketChat/Rocket.Chat.Go.SDK v0.0.0-20210112200207-10ab4d695d60 // indirect
Expand All @@ -66,23 +65,23 @@ require (
github.com/antonmedv/expr v1.15.5 // indirect
github.com/argoproj/gitops-engine v0.7.1-0.20240905010810-bd7681ae3f8b // indirect
github.com/argoproj/notifications-engine v0.4.1-0.20240606074338-0802cd427621 // indirect
github.com/argoproj/pkg v0.13.7-0.20230901113346-235a5432ec98 // indirect
github.com/argoproj/pkg v0.13.7-0.20240704113442-a69fd34a8117 // indirect
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
github.com/aws/aws-sdk-go v1.55.5 // indirect
github.com/aws/aws-sdk-go-v2 v1.24.1 // indirect
github.com/aws/aws-sdk-go-v2/config v1.25.12 // indirect
github.com/aws/aws-sdk-go-v2/credentials v1.16.16 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.11 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.10 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.10 // indirect
github.com/aws/aws-sdk-go-v2/internal/ini v1.7.1 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.10 // indirect
github.com/aws/aws-sdk-go-v2 v1.30.1 // indirect
github.com/aws/aws-sdk-go-v2/config v1.27.23 // indirect
github.com/aws/aws-sdk-go-v2/credentials v1.17.24 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.9 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.13 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.13 // indirect
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.3 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.15 // indirect
github.com/aws/aws-sdk-go-v2/service/sqs v1.29.7 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.18.7 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.7 // indirect
github.com/aws/aws-sdk-go-v2/service/sts v1.26.7 // indirect
github.com/aws/smithy-go v1.19.0 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.22.1 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.2 // indirect
github.com/aws/aws-sdk-go-v2/service/sts v1.30.1 // indirect
github.com/aws/smithy-go v1.20.3 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/blang/semver/v4 v4.0.0 // indirect
github.com/bmatcuk/doublestar/v4 v4.6.1 // indirect
Expand All @@ -96,24 +95,25 @@ require (
github.com/chainguard-dev/git-urls v1.0.2 // indirect
github.com/chzyer/readline v1.5.1 // indirect
github.com/cloudflare/circl v1.3.7 // indirect
github.com/containerd/containerd v1.7.11 // indirect
github.com/containerd/containerd v1.7.20 // indirect
github.com/containerd/errdefs v0.1.0 // indirect
github.com/containerd/log v0.1.0 // indirect
github.com/containerd/platforms v0.2.1 // indirect
github.com/coreos/go-oidc/v3 v3.11.0 // indirect
github.com/cpuguy83/go-md2man/v2 v2.0.4 // indirect
github.com/cyphar/filepath-securejoin v0.3.2 // indirect
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
github.com/davidmz/go-pageant v1.0.2 // indirect
github.com/desertbit/timer v0.0.0-20180107155436-c41aec40b27f // indirect
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
github.com/distribution/reference v0.5.0 // indirect
github.com/distribution/reference v0.6.0 // indirect
github.com/dlclark/regexp2 v1.11.4 // indirect
github.com/docker/cli v24.0.7+incompatible // indirect
github.com/docker/distribution v2.8.2+incompatible // indirect
github.com/docker/docker v24.0.9+incompatible // indirect
github.com/docker/cli v27.1.0+incompatible // indirect
github.com/docker/distribution v2.8.3+incompatible // indirect
github.com/docker/docker v27.1.1+incompatible // indirect
github.com/docker/docker-credential-helpers v0.7.0 // indirect
github.com/docker/go-connections v0.4.0 // indirect
github.com/docker/go-connections v0.5.0 // indirect
github.com/docker/go-metrics v0.0.1 // indirect
github.com/docker/go-units v0.5.0 // indirect
github.com/dustin/go-humanize v1.0.1 // indirect
github.com/emicklei/go-restful/v3 v3.11.0 // indirect
github.com/emirpasic/gods v1.18.1 // indirect
Expand Down Expand Up @@ -225,7 +225,6 @@ require (
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
github.com/modern-go/reflect2 v1.0.2 // indirect
github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
github.com/morikuni/aec v1.0.0 // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
github.com/oklog/ulid v1.3.1 // indirect
Expand Down Expand Up @@ -287,15 +286,14 @@ require (
go.starlark.net v0.0.0-20230525235612-a134d8f9ddca // indirect
go.uber.org/automaxprocs v1.5.3 // indirect
go.uber.org/multierr v1.11.0 // indirect
golang.org/x/crypto v0.27.0 // indirect
golang.org/x/crypto v0.31.0 // indirect
golang.org/x/mod v0.17.0 // indirect
golang.org/x/net v0.29.0 // indirect
golang.org/x/net v0.33.0 // indirect
golang.org/x/oauth2 v0.23.0 // indirect
golang.org/x/sync v0.8.0 // indirect
golang.org/x/sys v0.25.0 // indirect
golang.org/x/term v0.24.0 // indirect
golang.org/x/sync v0.10.0 // indirect
golang.org/x/sys v0.28.0 // indirect
golang.org/x/term v0.27.0 // indirect
golang.org/x/time v0.6.0 // indirect
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
gomodules.xyz/envconfig v1.3.1-0.20190308184047-426f31af0d45 // indirect
gomodules.xyz/notify v0.1.1 // indirect
google.golang.org/api v0.181.0 // indirect
Expand Down Expand Up @@ -325,7 +323,7 @@ require (
k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 // indirect
layeh.com/gopher-json v0.0.0-20190114024228-97fed8db8427 // indirect
nhooyr.io/websocket v1.8.7 // indirect
oras.land/oras-go v1.2.4 // indirect
oras.land/oras-go v1.2.6 // indirect
oras.land/oras-go/v2 v2.5.0 // indirect
sigs.k8s.io/controller-runtime v0.19.0 // indirect
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
Expand Down
Loading

0 comments on commit 1f719a0

Please sign in to comment.