From fbdd9bb6ed05dcd68615ecd468f86bc69d991c53 Mon Sep 17 00:00:00 2001 From: Evan Nemerson Date: Fri, 4 Sep 2026 12:37:42 -0400 Subject: [PATCH] CP-47363: Upgrade prometheus-config-reloader to v0.93.1 Brings the bundled config reloader up two minor versions, from v0.91.0, picking up upstream's own dependency work and clearing the three high-severity x/crypto findings that were blocking the image scan. This binary is built from upstream prometheus-operator source, so its dependency versions are upstream's rather than this repository's, and the build carries go get overrides for the ones upstream has not caught up on. Those overrides name exact versions, so each goes stale as new advisories land against the version it names. That had already happened: the override named x/crypto v0.53.0, which has since had three advisories filed against it, so the line written to clear findings had become the reason for them. Upgrading lets two of the three surviving overrides go. Upstream now ships x/net v0.57.0 and x/text v0.40.0, both ahead of what the old pins asked for, so keeping those would have downgraded them. Only x/crypto still needs raising. No etcd override is added. The image scan reports an etcd advisory, but that dependency reaches the image through the bundled Alloy binary rather than this one, so an override here cannot affect it. Co-Authored-By: Claude Opus 5 (1M context) --- docker/Dockerfile | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/docker/Dockerfile b/docker/Dockerfile index 1334c5d6..2b1d270d 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -2,7 +2,7 @@ ARG DEPLOY_IMAGE=scratch # prometheus-config-reloader version, built from source in the "reloader" stage. # Git tag — Dependabot can't track it, so bump by hand (see DEVELOPMENT.md). -ARG RELOADER_VERSION=v0.91.0 +ARG RELOADER_VERSION=v0.93.1 # Multi-stage Docker build with platform-specific cache optimization: # 1. base-tools: Install system packages and tools (cached per platform) @@ -90,9 +90,12 @@ WORKDIR /reloader-src RUN git clone --depth 1 --branch "${RELOADER_VERSION}" \ https://github.com/prometheus-operator/prometheus-operator.git . -# Bump vulnerable deps ahead of upstream's pins so the scan passes; drop when upstream catches up. +# Upstream still ships x/crypto v0.54.0, which has GO-2026-6303, GO-2026-6354 +# and GO-2026-6355 open against it. This is an exact version and so downgrades +# as readily as it upgrades: check what upstream resolves before touching it, +# and delete it once upstream passes it rather than bumping it forever. RUN --mount=type=cache,target=/go/pkg/mod,id=gomod-reloader-$TARGETPLATFORM \ - go get golang.org/x/crypto@v0.53.0 golang.org/x/net@v0.56.0 golang.org/x/text@v0.39.0 + go get golang.org/x/crypto@v0.56.0 RUN --mount=type=cache,target=/go/pkg/mod,id=gomod-reloader-$TARGETPLATFORM \ --mount=type=cache,target=/root/.cache/go-build,id=gobuild-reloader-$TARGETPLATFORM \