Skip to content

Bump github.com/kube-vip/kube-vip from 0.5.5 to 0.9.1 #42

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Bump github.com/kube-vip/kube-vip from 0.5.5 to 0.9.1 #42

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Jun 5, 2025 •
edited by bito-code-review bot
Loading

Bumps github.com/kube-vip/kube-vip from 0.5.5 to 0.9.1.

Release notes

Sourced from github.com/kube-vip/kube-vip's releases.

v0.9.1

Highlights

  • Metadata for container images
  • Proper handling of endpoints after restart

What's Changed

New Contributors

Full Changelog: kube-vip/kube-vip@v0.9.0...v0.9.1

v0.9.0

Highlights

  • Manifest generation of RBAC resources (ClusterRole, ClusterRoleBinding and ServiceAccount)
  • DualStack in BGP mode
  • Deterministic handling of two Services using the same LoadBalancer IP in ARP mode

Breaking

  • When you use the environment variable vip_cidr please rename it to vip_subnet
    • ENV: vip_cidr got replaced by vip_subnet
    • CLI: --cidr got replaced by --vipSubnet
    • YAML: vipCidr got replaced by vipSubnet
  • Drop support of Equinix Metal Platform (Removed)
    • CLI: --metal, ENV: vip_packet, YAML: enableMetal
    • CLI: --metalKey, ENV: PACKET_AUTH_TOKEN
    • CLI: --metalProject, ENV: vip_packetproject
    • CLI: --metalProjectId, ENV: vip_packetprojectid

What's Changed

... (truncated)

Commits
  • a71d361 Bump version
  • cf24ad8 Bump github.com/onsi/ginkgo/v2 from 2.22.2 to 2.23.4
  • 0c04088 Bump github.com/cloudflare/ipvs from 0.10.3 to 0.11.0
  • 22489ad Bump golang.org/x/sys from 0.31.0 to 0.32.0
  • 1fa3da4 Bump github.com/gookit/slog from 0.5.7 to 0.5.8
  • d497df3 Fixed instance finding and route deletion in RT mode
  • bdd3c5c Bump anchore/sbom-action from 0.18.0 to 0.19.0
  • 5b41db2 feat: Add opencontainers annotations during release
  • 1eb3577 fix: s/endoints/endpoints/ in RBAC manifest generation code
  • 7d7036f Merge pull request #1130 from kube-vip/fix/upnp
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Summary by Bito

This PR updates the go.mod file with multiple dependency version upgrades and a new Go version. Key modules including kube-vip, logr, ginkgo/v2, and various Kubernetes packages have been updated to their latest releases, enhancing stability, compatibility, and performance across the project.

@dependabot
Bump github.com/kube-vip/kube-vip from 0.5.5 to 0.9.1
0b04374 
Bumps [github.com/kube-vip/kube-vip](https://github.com/kube-vip/kube-vip) from 0.5.5 to 0.9.1.
- [Release notes](https://github.com/kube-vip/kube-vip/releases)
- [Commits](kube-vip/kube-vip@v0.5.5...v0.9.1)

---
updated-dependencies:
- dependency-name: github.com/kube-vip/kube-vip
  dependency-version: 0.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jun 5, 2025
@bito-code-review Bito Code Review
Copy link

bito-code-review bot commented Jun 5, 2025 •
edited
Loading

Code Review Agent Run #f49722

Actionable Suggestions - 0
Security Concerns - 9
  • Vulnerability 1
    • Dependency Name: golang.org/x/oauth2
    • Dependency Version: None
    • Vulnerability Name: GO-2025-3488
    • Vulnerability Description: An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.
    • Fixed in Version: v0.27.0
    • Code Suggestion: 
      
@@ -1,1 +1,1 @@
- golang.org/x/oauth2 v0.26.0
+ golang.org/x/oauth2 v0.27.0
  • Vulnerability 2
    • Dependency Name: stdlib
    • Dependency Version: None
    • Vulnerability Name: GO-2025-3373
    • Vulnerability Description: A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain.
    • Fixed in Version: v1.23.5
    • Code Suggestion: 
      
@@ -1,1 +1,1 @@
- go 1.23.4
+ go 1.23.5
  • Vulnerability 3
    • Dependency Name: stdlib
    • Dependency Version: None
    • Vulnerability Name: GO-2025-3420
    • Vulnerability Description: The HTTP client drops sensitive headers after following a cross-domain redirect but incorrectly restores them for subsequent same-domain redirects.
    • Fixed in Version: v1.23.5
    • Code Suggestion: 
      
@@ -1,1 +1,1 @@
- go 1.23.4
+ go 1.23.5
  • Vulnerability 4
    • Dependency Name: stdlib
    • Dependency Version: None
    • Vulnerability Name: GO-2025-3447
    • Vulnerability Description: Due to variable time instruction in assembly implementation, bits of secret scalars are leaked on ppc64le architecture.
    • Fixed in Version: v1.23.6
    • Code Suggestion: 
      
@@ -1,1 +1,1 @@
- go 1.23.5
+ go 1.23.6
  • Vulnerability 5
    • Dependency Name: stdlib
    • Dependency Version: None
    • Vulnerability Name: GO-2025-3563
    • Vulnerability Description: The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines, permitting request smuggling.
    • Fixed in Version: v1.23.8
    • Code Suggestion: 
      
@@ -1,1 +1,1 @@
- go 1.23.6
+ go 1.23.8
  • Vulnerability 6
    • Dependency Name: golang.org/x/net
    • Dependency Version: None
    • Vulnerability Name: GO-2024-2687
    • Vulnerability Description: An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending excessive CONTINUATION frames.
    • Fixed in Version: v0.23.0
    • Code Suggestion: 
      
@@ -1,1 +1,1 @@
- golang.org/x/net v0.22.0
+ golang.org/x/net v0.23.0
  • Vulnerability 7
    • Dependency Name: golang.org/x/net
    • Dependency Version: None
    • Vulnerability Name: GO-2024-3333
    • Vulnerability Description: An attacker can craft an input to the Parse functions that would be processed non-linearly, causing extremely slow parsing and denial of service.
    • Fixed in Version: v0.33.0
    • Code Suggestion: 
      
@@ -1,1 +1,1 @@
- golang.org/x/net v0.23.0
+ golang.org/x/net v0.33.0
  • Vulnerability 8
    • Dependency Name: golang.org/x/net
    • Dependency Version: None
    • Vulnerability Name: GO-2025-3503
    • Vulnerability Description: Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component.
    • Fixed in Version: v0.36.0
    • Code Suggestion: 
      
@@ -1,1 +1,1 @@
- golang.org/x/net v0.33.0
+ golang.org/x/net v0.36.0
  • Vulnerability 9
    • Dependency Name: golang.org/x/net
    • Dependency Version: None
    • Vulnerability Name: GO-2025-3595
    • Vulnerability Description: The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character as self-closing.
    • Fixed in Version: v0.38.0
    • Code Suggestion: 
      
@@ -1,1 +1,1 @@
- golang.org/x/net v0.36.0
+ golang.org/x/net v0.38.0
Review Details
  • Files reviewed - 1 · Commit Range: 0b04374..0b04374
    • go.mod
  • Files skipped - 1
    • go.sum - Reason: Filter setting
  • Tools
    • Whispers (Secret Scanner) - ✔︎ Successful
    • Detect-secrets (Secret Scanner) - ✔︎ Successful
    • GOVULNCHECK (Security Vulnerability) - ✔︎ Successful
    • OWASP (Security Vulnerability) - ✔︎ Successful
    • SNYK (Security Vulnerability) - ✔︎ Successful
Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

  • /review - Manually triggers a full AI review.

  • /pause - Pauses automatic reviews on this pull request.

  • /resume - Resumes automatic reviews.

  • /resolve - Marks all Bito-posted review comments as resolved.

  • /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Default Agent You can customize the agent settings here or contact your Bito workspace admin at [email protected].

Documentation & Help

AI Code Review powered by Bito Logo

@bito-code-review Bito Code Review
Copy link

Changelist by Bito

This pull request implements the following key changes.

Key Change Files Impacted
Feature Improvement - Module Dependency Updates

- go.mod - Upgraded Go version from 1.20 to 1.24.2 and updated multiple dependencies including kube-vip from 0.5.5 to 0.9.1, logr, ginkgo/v2, and various Kubernetes libraries to enhance compatibility and performance.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file go Pull requests that update go code
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants