chore: bump duty to v1.0.1237 #21
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -3,179 +3,225 @@ module github.com/flanksource/kopper | |
| go 1.25.6 | ||
|
|
||
| require ( | ||
| github.com/flanksource/commons v1.50.0 | ||
| github.com/flanksource/duty v1.0.1237 | ||
| github.com/go-logr/logr v1.4.3 | ||
| github.com/jackc/pgerrcode v0.0.0-20250907135507-afb5586c32a6 | ||
| github.com/jackc/pgx/v5 v5.8.0 | ||
| github.com/samber/lo v1.53.0 | ||
| k8s.io/apimachinery v0.35.2 | ||
| k8s.io/client-go v0.35.2 | ||
| sigs.k8s.io/controller-runtime v0.22.3 | ||
| ) | ||
|
|
||
| require ( | ||
| cel.dev/expr v0.25.1 // indirect | ||
| github.com/Masterminds/goutils v1.1.1 // indirect | ||
| github.com/Masterminds/semver/v3 v3.4.0 // indirect | ||
| github.com/Masterminds/squirrel v1.5.4 // indirect | ||
| github.com/RaveNoX/go-jsonmerge v1.0.0 // indirect | ||
| github.com/TomOnTime/utfutil v1.0.0 // indirect | ||
| github.com/ajstarks/svgo v0.0.0-20211024235047-1546f124cd8b // indirect | ||
| github.com/alecthomas/chroma/v2 v2.23.1 // indirect | ||
| github.com/antlr4-go/antlr/v4 v4.13.1 // indirect | ||
| github.com/aws/aws-sdk-go-v2 v1.41.1 // indirect | ||
| github.com/aws/smithy-go v1.24.0 // indirect | ||
| github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect | ||
| github.com/beorn7/perks v1.0.1 // indirect | ||
| github.com/bmatcuk/doublestar/v4 v4.10.0 // indirect | ||
| github.com/cenkalti/backoff/v5 v5.0.3 // indirect | ||
| github.com/cert-manager/cert-manager v1.19.4 // indirect | ||
| github.com/cespare/xxhash/v2 v2.3.0 // indirect | ||
| github.com/charmbracelet/colorprofile v0.4.2 // indirect | ||
| github.com/charmbracelet/lipgloss v1.1.0 // indirect | ||
| github.com/charmbracelet/x/ansi v0.11.6 // indirect | ||
| github.com/charmbracelet/x/cellbuf v0.0.15 // indirect | ||
| github.com/charmbracelet/x/term v0.2.2 // indirect | ||
| github.com/clipperhouse/displaywidth v0.11.0 // indirect | ||
| github.com/clipperhouse/uax29/v2 v2.7.0 // indirect | ||
| github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect | ||
| github.com/deckarep/golang-set/v2 v2.8.0 // indirect | ||
| github.com/distribution/reference v0.6.0 // indirect | ||
| github.com/dlclark/regexp2 v1.11.5 // indirect | ||
| github.com/eko/gocache/lib/v4 v4.2.3 // indirect | ||
| github.com/eko/gocache/store/go_cache/v4 v4.2.4 // indirect | ||
| github.com/emicklei/go-restful/v3 v3.13.0 // indirect | ||
| github.com/emirpasic/gods/v2 v2.0.0-alpha // indirect | ||
| github.com/evanphx/json-patch/v5 v5.9.11 // indirect | ||
| github.com/fatih/color v1.18.0 // indirect | ||
| github.com/flanksource/clicky v1.21.1 // indirect | ||
| github.com/flanksource/gomplate/v3 v3.24.74 // indirect | ||
| github.com/flanksource/is-healthy v1.0.86 // indirect | ||
| github.com/flanksource/kubectl-neat v1.0.4 // indirect | ||
| github.com/fsnotify/fsnotify v1.9.0 // indirect | ||
| github.com/fxamacker/cbor/v2 v2.9.0 // indirect | ||
| github.com/ghodss/yaml v1.0.0 // indirect | ||
| github.com/go-jose/go-jose/v3 v3.0.4 // indirect | ||
| github.com/go-logr/stdr v1.2.2 // indirect | ||
| github.com/go-ole/go-ole v1.3.0 // indirect | ||
| github.com/go-openapi/jsonpointer v0.22.4 // indirect | ||
| github.com/go-openapi/jsonreference v0.21.4 // indirect | ||
| github.com/go-openapi/swag v0.25.4 // indirect | ||
| github.com/go-openapi/swag/cmdutils v0.25.4 // indirect | ||
| github.com/go-openapi/swag/conv v0.25.4 // indirect | ||
| github.com/go-openapi/swag/fileutils v0.25.4 // indirect | ||
| github.com/go-openapi/swag/jsonname v0.25.4 // indirect | ||
| github.com/go-openapi/swag/jsonutils v0.25.4 // indirect | ||
| github.com/go-openapi/swag/loading v0.25.4 // indirect | ||
| github.com/go-openapi/swag/mangling v0.25.4 // indirect | ||
| github.com/go-openapi/swag/netutils v0.25.4 // indirect | ||
| github.com/go-openapi/swag/stringutils v0.25.4 // indirect | ||
| github.com/go-openapi/swag/typeutils v0.25.4 // indirect | ||
| github.com/go-openapi/swag/yamlutils v0.25.4 // indirect | ||
| github.com/go-stack/stack v1.8.1 // indirect | ||
| github.com/go-xmlfmt/xmlfmt v1.1.3 // indirect | ||
| github.com/gobwas/glob v0.2.3 // indirect | ||
| github.com/goccy/go-json v0.10.5 // indirect | ||
| github.com/goccy/go-yaml v1.19.2 // indirect | ||
| github.com/golang-jwt/jwt/v5 v5.3.0 // indirect | ||
| github.com/google/btree v1.1.3 // indirect | ||
| github.com/google/cel-go v0.27.0 // indirect | ||
| github.com/google/gnostic-models v0.7.1 // indirect | ||
| github.com/google/go-cmp v0.7.0 // indirect | ||
| github.com/google/uuid v1.6.0 // indirect | ||
| github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect | ||
| github.com/gosimple/slug v1.15.0 // indirect | ||
| github.com/gosimple/unidecode v1.0.1 // indirect | ||
| github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect | ||
| github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.5 // indirect | ||
| github.com/hairyhenderson/toml v0.4.2-0.20210923231440-40456b8e66cf // indirect | ||
| github.com/hairyhenderson/yaml v0.0.0-20220618171115-2d35fca545ce // indirect | ||
| github.com/henvic/httpretty v0.1.4 // indirect | ||
| github.com/inconshreveable/mousetrap v1.1.0 // indirect | ||
| github.com/itchyny/gojq v0.12.18 // indirect | ||
| github.com/itchyny/timefmt-go v0.1.7 // indirect | ||
| github.com/jackc/chunkreader/v2 v2.0.1 // indirect | ||
| github.com/jackc/pgconn v1.14.3 // indirect | ||
| github.com/jackc/pgio v1.0.0 // indirect | ||
| github.com/jackc/pgpassfile v1.0.0 // indirect | ||
| github.com/jackc/pgproto3/v2 v2.3.3 // indirect | ||
|
There was a problem hiding this comment. ❓ Verification inconclusiveScript executed: #!/bin/bash
# Check for security advisories and patched versions for pgproto3
echo "=== Checking pgproto3 security advisories ==="
gh api graphql -f query='
{
securityVulnerabilities(first: 10, ecosystem: GO, package: "github.com/jackc/pgproto3/v2") {
nodes {
advisory {
summary
severity
ghsaId
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'
echo ""
echo "=== Checking latest version of pgproto3/v2 ==="
curl -s "https://proxy.golang.org/github.com/jackc/pgproto3/v2/@latest" | jq -r '.Version'Repository: flanksource/kopper Repository: flanksource/kopper stdout: stderr: GHSA-jqcq-xjh3-6g23 pgproto3 vulnerability GHSA-jqcq-xjh3-6g23 is a Denial of Service (DoS) vulnerability in the github.com/jackc/pgproto3/v2 Go library, which implements the PostgreSQL wire protocol version 3. The issue is in the DataRow.Decode function, which fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with oversized field lengths, causing excessive memory allocation or crashes in client applications using pgproto3/v2. It is also tracked as CVE-2026-4427, as noted in Red Hat Bugzilla. The advisory was published around March 19, 2026, making it a very recent vulnerability (today is 2026-03-20). Affected package: github.com/jackc/pgproto3/v2 (pure protocol library, used by higher-level drivers like pgx v4). Impact: Clients connecting to untrusted PostgreSQL servers are vulnerable to DoS by a malicious server sending crafted DataRow messages. No patch version or remediation details are available in current sources; check the GitHub advisory for updates. Mitigation: Avoid connecting to untrusted PostgreSQL servers, or use higher-level libraries that may have additional validation (e.g., pgx v5 integrates pgproto3 differently). This is distinct from the earlier GHSA-7jwh-3vrq-q3m8 (CVE-2024-27304), which was an SQL injection via integer overflow in message sizing, fixed in pgproto3/v2 2.3.3. Citations:
GHSA-x6gf-mpr2-68h6 pgproto3 negative field length GHSA-x6gf-mpr2-68h6 is a GitHub Security Advisory ID referencing a potential vulnerability in github.com/jackc/pgproto3/v2, as noted in Go's vulndb tracking (result 1 and 5). It appears related to a recent denial-of-service (DoS) issue in pgproto3/v2 where a negative field length in DataRow.Decode causes a panic due to slice bounds out of range (CVE-2026-4427, results 10,12,13). A malicious or compromised PostgreSQL server can send a crafted DataRow message with negative int32 field length (uint32 0x80000000–0xFFFFFFFE), bypassing bounds checks since len >= 0 always passes when msgSize < 0, leading to panic at src[rp : rp+msgSize : rp+msgSize]. Severity: CVSS 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Affected: github.com/jackc/pgproto3 v2.3.3 (EOL July 1, 2025; result 19). pgx v5 pgproto3 not vulnerable (result 10). Fix: Add msgSize < 0 check before bounds check. Golang/vulndb is tracking for inclusion (results 1,5,7). No official GHSA page found for this ID; may be internal/proposed ID. Citations:
github.com/jackc/pgproto3/v2 security advisories patched version The primary security advisory for github.com/jackc/pgproto3/v2 (used with pgx v4) is GHSA-7jwh-3vrq-q3m8 (CVE-2024-27304), a SQL injection vulnerability due to integer overflow in protocol message size calculation, allowing a single large message to be interpreted as multiple unauthorized messages. Affected versions are before v2.3.3. Patched in v2.3.3 via commit 945c2126f6db8f3bea7eeebe307c01fe92bca007. An older DoS vulnerability (unbounded StartupMessage length) was patched in v2.1.1. A recent vulnerability (CVE-2026-4427, March 2026), improper input validation in DataRow.Decode causing panic from negative field length (from malicious/compromised PG server), affects >=v2.0.0 with no fixed version listed (Snyk). The repository was archived July 2025, with only security fixes promised until EOL July 1, 2025; no patch found as of 2026-03-20. Recommendation: Upgrade to v2.3.3+ for known patched issues (CVE-2024-27304). For pgx v5+, pgproto3 is integrated (patched in v5.5.4). Monitor for CVE-2026-4427 patch or migrate from archived repo. Citations:
HIGH severity vulnerability in github.com/jackc/pgproto3/v2 v2.3.3 with no available patch. The dependency is affected by CVE-2026-4427, a denial of service vulnerability in the DataRow.Decode function that fails to validate field lengths. A malicious or compromised PostgreSQL server can send crafted messages with invalid field lengths, causing panics or excessive memory allocation in client applications. Severity: CVSS 7.5 High. The pgproto3/v2 repository was archived in July 2025 with end-of-life July 1, 2025, and no patched version is currently available for this March 2026 vulnerability. Consider migrating to pgx v5, which integrates pgproto3 differently and is not affected. 🧰 Tools🪛 OSV Scanner (2.3.3)[HIGH] 102-102: github.com/jackc/pgproto3/v2 2.3.3: Denial of service in github.com/jackc/pgproto3/v2 [HIGH] 102-102: github.com/jackc/pgproto3/v2 2.3.3: pgproto3: Negative field length panics in DataRow.Decode 🤖 Prompt for AI Agents |
||
| github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect | ||
| github.com/jackc/pgtype v1.14.4 // indirect | ||
| github.com/jackc/pgx/v4 v4.18.3 // indirect | ||
| github.com/jackc/puddle v1.3.0 // indirect | ||
| github.com/jackc/puddle/v2 v2.2.2 // indirect | ||
| github.com/jeremywohl/flatten v1.0.1 // indirect | ||
| github.com/jinzhu/inflection v1.0.0 // indirect | ||
| github.com/jinzhu/now v1.1.5 // indirect | ||
| github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24 // indirect | ||
| github.com/json-iterator/go v1.1.12 // indirect | ||
| github.com/kr/pretty v0.3.1 // indirect | ||
| github.com/kr/text v0.2.0 // indirect | ||
| github.com/labstack/echo/v4 v4.15.0 // indirect | ||
| github.com/labstack/gommon v0.4.2 // indirect | ||
| github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 // indirect | ||
| github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 // indirect | ||
| github.com/liamylian/jsontime/v2 v2.0.0 // indirect | ||
| github.com/lib/pq v1.10.9 // indirect | ||
| github.com/lmittmann/tint v1.1.3 // indirect | ||
| github.com/lrita/cmap v0.0.0-20231108122212-cb084a67f554 // indirect | ||
| github.com/lucasb-eyer/go-colorful v1.3.0 // indirect | ||
| github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3 // indirect | ||
| github.com/mattn/go-colorable v0.1.14 // indirect | ||
| github.com/mattn/go-isatty v0.0.20 // indirect | ||
| github.com/mattn/go-runewidth v0.0.20 // indirect | ||
| github.com/mitchellh/reflectwalk v1.0.2 // indirect | ||
| github.com/moby/spdystream v0.5.0 // indirect | ||
| github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect | ||
| github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect | ||
| github.com/muesli/termenv v0.16.0 // indirect | ||
| github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect | ||
| github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect | ||
| github.com/ohler55/ojg v1.28.0 // indirect | ||
| github.com/oklog/ulid/v2 v2.1.1 // indirect | ||
| github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 // indirect | ||
| github.com/olekukonko/errors v1.2.0 // indirect | ||
| github.com/olekukonko/ll v0.1.7 // indirect | ||
| github.com/olekukonko/tablewriter v1.1.3 // indirect | ||
| github.com/opencontainers/go-digest v1.0.0 // indirect | ||
| github.com/orcaman/concurrent-map/v2 v2.0.1 // indirect | ||
| github.com/patrickmn/go-cache v2.1.0+incompatible // indirect | ||
| github.com/peterbourgon/diskv v2.0.1+incompatible // indirect | ||
| github.com/pkg/errors v0.9.1 // indirect | ||
| github.com/playwright-community/playwright-go v0.5700.1 // indirect | ||
| github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect | ||
| github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect | ||
| github.com/prometheus/client_golang v1.23.2 // indirect | ||
| github.com/prometheus/client_model v0.6.2 // indirect | ||
| github.com/prometheus/common v0.67.5 // indirect | ||
| github.com/prometheus/procfs v0.20.1 // indirect | ||
| github.com/richardlehane/mscfb v1.0.6 // indirect | ||
| github.com/richardlehane/msoleps v1.0.6 // indirect | ||
| github.com/rivo/uniseg v0.4.7 // indirect | ||
| github.com/robertkrimen/otto v0.5.1 // indirect | ||
| github.com/robfig/cron/v3 v3.0.1 // indirect | ||
| github.com/rogpeppe/go-internal v1.14.1 // indirect | ||
| github.com/samber/oops v1.21.0 // indirect | ||
| github.com/shirou/gopsutil/v3 v3.24.5 // indirect | ||
| github.com/shoenig/go-m1cpu v0.1.7 // indirect | ||
| github.com/sirupsen/logrus v1.9.4 // indirect | ||
| github.com/spf13/cobra v1.10.2 // indirect | ||
| github.com/spf13/pflag v1.0.10 // indirect | ||
| github.com/tidwall/gjson v1.18.0 // indirect | ||
| github.com/tidwall/match v1.2.0 // indirect | ||
| github.com/tidwall/pretty v1.2.1 // indirect | ||
| github.com/tidwall/sjson v1.2.5 // indirect | ||
| github.com/tiendc/go-deepcopy v1.7.2 // indirect | ||
| github.com/timberio/go-datemath v0.1.0 // indirect | ||
| github.com/tj/go-naturaldate v1.3.0 // indirect | ||
| github.com/tklauser/go-sysconf v0.3.16 // indirect | ||
| github.com/tklauser/numcpus v0.11.0 // indirect | ||
| github.com/ugorji/go/codec v1.3.1 // indirect | ||
| github.com/ulikunitz/xz v0.5.15 // indirect | ||
| github.com/valyala/bytebufferpool v1.0.0 // indirect | ||
| github.com/valyala/fasttemplate v1.2.2 // indirect | ||
| github.com/x448/float16 v0.8.4 // indirect | ||
| github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect | ||
| github.com/xuri/efp v0.0.1 // indirect | ||
| github.com/xuri/excelize/v2 v2.10.1 // indirect | ||
| github.com/xuri/nfp v0.0.2-0.20250530014748-2ddeb826f9a9 // indirect | ||
| github.com/yuin/gopher-lua v1.1.1 // indirect | ||
| github.com/yusufpapurcu/wmi v1.2.4 // indirect | ||
| go.opentelemetry.io/auto/sdk v1.2.1 // indirect | ||
| go.opentelemetry.io/otel v1.41.0 // indirect | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.39.0 // indirect | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.39.0 // indirect | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.39.0 // indirect | ||
| go.opentelemetry.io/otel/metric v1.41.0 // indirect | ||
| go.opentelemetry.io/otel/sdk v1.40.0 // indirect | ||
| go.opentelemetry.io/otel/trace v1.41.0 // indirect | ||
| go.opentelemetry.io/proto/otlp v1.9.0 // indirect | ||
| go.yaml.in/yaml/v2 v2.4.3 // indirect | ||
| go.yaml.in/yaml/v3 v3.0.4 // indirect | ||
| golang.org/x/crypto v0.48.0 // indirect | ||
| golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa // indirect | ||
| golang.org/x/net v0.51.0 // indirect | ||
| golang.org/x/oauth2 v0.34.0 // indirect | ||
| golang.org/x/sync v0.19.0 // indirect | ||
| golang.org/x/sys v0.41.0 // indirect | ||
| golang.org/x/term v0.40.0 // indirect | ||
| golang.org/x/text v0.34.0 // indirect | ||
| golang.org/x/time v0.14.0 // indirect | ||
| gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect | ||
| google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171 // indirect | ||
| google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect | ||
| google.golang.org/grpc v1.78.0 // indirect | ||
|
There was a problem hiding this comment. 🧩 Analysis chain🌐 Web query:
💡 Result: GHSA-p77j-4mvh-x3m3 is a critical authorization bypass vulnerability (CVE-2026-33186, CVSS 9.1) in google.golang.org/grpc (gRPC-Go). It stems from improper input validation of the HTTP/2 :path pseudo-header. The server accepts requests missing the leading slash (e.g., "Service/Method" instead of "/Service/Method"), routes them correctly, but authorization interceptors see the raw non-canonical path. This causes "deny" rules for canonical paths to fail matching, allowing bypass if there's a fallback "allow" rule. Affected: All versions before 1.79.3. Impacts gRPC-Go servers using path-based authorization (e.g., grpc/authz) with specific deny rules for canonical paths and fallback allow. Patched: Upgrade to v1.79.3 or later (also latest master branch). The fix rejects invalid :path immediately with codes.Unimplemented. Workaround: Custom unary interceptor to reject if info.FullMethod lacks leading '/'. Published: 2026-03-18. Citations:
Upgrade google.golang.org/grpc to v1.79.3 or later to patch critical authorization bypass vulnerability. google.golang.org/grpc v1.78.0 contains GHSA-p77j-4mvh-x3m3 (CVE-2026-33186, CVSS 9.1), a critical authorization bypass vulnerability. The issue stems from improper validation of the HTTP/2 :path pseudo-header, allowing servers to route requests with non-canonical paths while authorization interceptors fail to match deny rules, potentially enabling bypass if a fallback allow rule exists. Upgrade to v1.79.3 or later. 🧰 Tools🪛 OSV Scanner (2.3.3)[CRITICAL] 208-208: google.golang.org/grpc 1.78.0: gRPC-Go has an authorization bypass via missing leading slash in :path 🤖 Prompt for AI Agents |
||
| google.golang.org/protobuf v1.36.11 // indirect | ||
| gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect | ||
| gopkg.in/inf.v0 v0.9.1 // indirect | ||
| gopkg.in/sourcemap.v1 v1.0.5 // indirect | ||
| gopkg.in/yaml.v2 v2.4.0 // indirect | ||
| gopkg.in/yaml.v3 v3.0.1 // indirect | ||
| gorm.io/gorm v1.31.1 // indirect | ||
| k8s.io/api v0.35.2 // indirect | ||
| k8s.io/apiextensions-apiserver v0.35.2 // indirect | ||
| k8s.io/klog/v2 v2.130.1 // indirect | ||
| k8s.io/kube-openapi v0.0.0-20260304202019-5b3e3fdb0acf // indirect | ||
| k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 // indirect | ||
| layeh.com/gopher-json v0.0.0-20201124131017-552bb3c4c3bf // indirect | ||
| sigs.k8s.io/gateway-api v1.5.0 // indirect | ||
| sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect | ||
| sigs.k8s.io/randfill v1.0.0 // indirect | ||
| sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect | ||
| sigs.k8s.io/yaml v1.6.0 // indirect | ||
| ) | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🌐 Web query:
Is controller-runtime v0.22.3 compatible with k8s.io/client-go v0.35.2 and k8s.io/apimachinery v0.35.2?💡 Result:
No, controller-runtime v0.22.3 is not compatible with k8s.io/client-go v0.35.2 and k8s.io/apimachinery v0.35.2. controller-runtime v0.22.x is tested and compatible only with k8s.io/client-go v0.34.x and k8s.io/apimachinery v0.34.x, as stated in the official compatibility matrix in the project's README and VERSIONING.md. Compatibility with other versions is unsupported and not tested. v0.35.x corresponds to Kubernetes 1.35, while v0.34.x aligns with Kubernetes 1.34. Use controller-runtime v0.23.x or later for v0.35.x support.
Citations:
🏁 Script executed:
Repository: flanksource/kopper
Length of output: 331
Upgrade controller-runtime to v0.23.x or later for compatibility with k8s.io packages v0.35.2.
controller-runtime v0.22.3 requires k8s.io/client-go and k8s.io/apimachinery v0.34.x, but your go.mod specifies v0.35.2. This version mismatch will cause runtime incompatibilities. Upgrade to controller-runtime v0.23.x or later to support Kubernetes v0.35.x packages.
🤖 Prompt for AI Agents