Skip to content

Commit d22cd97

Browse files
dmcwhorter-ddldmcwhorter-ddl
authored
Upgrade Go to 1.22 and various other libraries to address vulnerabilities (#48)
1 parent 3dd6bec commit d22cd97

34 files changed

+30505
-39694
lines changed

‎.circleci/config.yml

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,11 @@ parameters:
1212
jobs:
1313
build-and-push:
1414
docker:
15-
- image: cimg/base:2022.12@sha256:dc4d22de8262c8d50f86987ba49d5d122cfec6b7c7443e181e70cc2314486e12
15+
- image: cimg/base:2024.07
1616
resource_class: medium
1717
steps:
1818
- go/install:
19-
version: "1.20"
19+
version: "1.22.5"
2020
- run:
2121
name: "Install kustomize"
2222
command: |
@@ -27,7 +27,7 @@ jobs:
2727
$SUDO chmod +x ./kustomize
2828
$SUDO mv ./kustomize /usr/local/bin
2929
- setup_remote_docker:
30-
version: 20.10.14
30+
version: docker24
3131
- checkout
3232
- run:
3333
name: "Docker login"
@@ -42,22 +42,22 @@ jobs:
4242

4343
test:
4444
machine:
45-
image: ubuntu-2004:current
45+
image: ubuntu-2404:current
4646
environment:
4747
KUBECONFIG: "/etc/rancher/k3s/k3s.yaml"
48-
KUSTOMIZE_VERSION: "v4.3.0"
48+
KUSTOMIZE_VERSION: "v4.5.7"
4949
K3S_KUBECONFIG_MODE: "644"
5050
resource_class: large
5151
steps:
5252
- attach_workspace:
5353
at: ~/
5454
- checkout
5555
- helm/install-helm-client:
56-
version: v3.13.1
56+
version: v3.15.3
5757
- run:
5858
name: Install and Launch Kubernetes
5959
command: |
60-
curl -sfL https://get.k3s.io | INSTALL_K3S_VERSION=v1.28.3+k3s1 sh -x -
60+
curl -sfL https://get.k3s.io | INSTALL_K3S_VERSION=v1.28.11+k3s2 sh -x -
6161
sleep 10
6262
kubectl wait --for=condition=Available --timeout=60s deployments --all -n kube-system
6363
- run:

‎core-builder/Dockerfile

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -91,8 +91,8 @@ RUN apt-get remove -y --auto-remove \
9191

9292
# INSTALL GO
9393
ENV PATH /usr/local/go/bin:$PATH
94-
RUN wget https://dl.google.com/go/go1.20.10.linux-amd64.tar.gz && \
95-
tar -zxvf go1.20.10.linux-amd64.tar.gz && \
94+
RUN wget https://dl.google.com/go/go1.22.5.linux-amd64.tar.gz && \
95+
tar -zxvf go1.22.5.linux-amd64.tar.gz && \
9696
mv go/ /usr/local/go
9797

9898
# Install kubebuilder (using github link)

‎executor/Dockerfile.executor

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Build the manager binary
2-
# 1.20-bookworm image points to the latest go 1.20.x
3-
FROM golang:1.20-bookworm as builder
2+
# 1.22-bookworm image points to the latest go 1.22.x
3+
FROM golang:1.22-bookworm as builder
44

55
WORKDIR /workspace
66
# Copy the Go Modules manifests

‎executor/api/rabbitmq/consumer_test.go

Lines changed: 18 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,6 @@ func TestConsume(t *testing.T) {
2929
},
3030
}
3131
seldonMessageEnc, _ := proto2.Marshal(&seldonMessage)
32-
seldonMessage.XXX_sizecache = 0 // to make test cases match
3332

3433
t.Run("success", func(t *testing.T) {
3534
mockChan := &mockChannel{}
@@ -53,18 +52,18 @@ func TestConsume(t *testing.T) {
5352
}
5453

5554
payloadHandler := func(pl *SeldonPayloadWithHeaders) error {
56-
assert.Equal(
55+
assert.NotNil(t, pl)
56+
assertSeldonPayloadWithHeadersEqual(
5757
t,
58-
&SeldonPayloadWithHeaders{
58+
SeldonPayloadWithHeaders{
5959
&payload.BytesPayload{
6060
Msg: []byte(`"hello"`),
6161
ContentType: rest.ContentTypeJSON,
6262
ContentEncoding: "",
6363
},
6464
make(map[string][]string),
6565
},
66-
pl,
67-
"payloads not equal",
66+
*pl,
6867
)
6968
return nil
7069
}
@@ -137,16 +136,16 @@ func TestConsume(t *testing.T) {
137136
}
138137

139138
payloadHandler := func(pl *SeldonPayloadWithHeaders) error {
140-
assert.Equal(
139+
assert.NotNil(t, pl)
140+
assertSeldonPayloadWithHeadersEqual(
141141
t,
142-
&SeldonPayloadWithHeaders{
142+
SeldonPayloadWithHeaders{
143143
&payload.ProtoPayload{
144144
Msg: &seldonMessage,
145145
},
146146
make(map[string][]string),
147147
},
148-
pl,
149-
"payloads not equal",
148+
*pl,
150149
)
151150
return nil
152151
}
@@ -171,3 +170,13 @@ func createTestDelivery(ack amqp.Acknowledger, body []byte, contentType string)
171170
ContentEncoding: "",
172171
}
173172
}
173+
174+
func assertSeldonPayloadWithHeadersEqual(t *testing.T, expected SeldonPayloadWithHeaders, actual SeldonPayloadWithHeaders) {
175+
expectedBytes, expectedErr := expected.GetBytes()
176+
actualBytes, actualErr := actual.GetBytes()
177+
assert.Equal(t, expectedErr, actualErr)
178+
assert.Equal(t, expectedBytes, actualBytes)
179+
assert.Equal(t, expected.GetContentType(), actual.GetContentType())
180+
assert.Equal(t, expected.GetContentEncoding(), actual.GetContentEncoding())
181+
assert.Equal(t, expected.Headers, actual.Headers)
182+
}

‎executor/api/rabbitmq/utils_test.go

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,6 @@ func TestDeliveryToPayload(t *testing.T) {
5959
},
6060
}
6161
protoMessageEnc, _ := proto2.Marshal(protoMessage)
62-
protoMessage.XXX_sizecache = 0 // to make test cases match
6362
testDeliveryProto := amqp.Delivery{
6463
Body: protoMessageEnc,
6564
ContentType: payload.APPLICATION_TYPE_PROTOBUF,
@@ -70,7 +69,7 @@ func TestDeliveryToPayload(t *testing.T) {
7069
pl, err := DeliveryToPayload(testDeliveryProto)
7170

7271
assert.NoError(t, err)
73-
assert.Equal(t, protoMessage, pl.GetPayload())
72+
assertSeldonMessageEqual(t, *protoMessage, pl.GetPayload())
7473
})
7574

7675
t.Run("rest payload", func(t *testing.T) {
@@ -83,7 +82,7 @@ func TestDeliveryToPayload(t *testing.T) {
8382
err = jsonpb.UnmarshalString(string(pl.GetPayload().([]byte)), body)
8483

8584
assert.NoError(t, err)
86-
assert.Equal(t, protoMessage, body)
85+
assertSeldonMessageEqual(t, *protoMessage, body)
8786
})
8887
}
8988

@@ -312,3 +311,14 @@ func TestUpdatePayloadWithPuid(t *testing.T) {
312311
assert.Equal(t, oldPayload, updatedPayload)
313312
})
314313
}
314+
315+
func assertSeldonMessageEqual(t *testing.T, expected proto.SeldonMessage, actual interface{}) {
316+
assert.IsType(t, &proto.SeldonMessage{}, actual)
317+
actualMessage := actual.(*proto.SeldonMessage)
318+
assert.Equal(t, expected.Meta, actualMessage.Meta)
319+
assert.Equal(t, expected.DataOneof, actualMessage.DataOneof)
320+
assert.Equal(t, expected.Status.Status, actualMessage.Status.Status)
321+
assert.Equal(t, expected.Status.Info, actualMessage.Status.Info)
322+
assert.Equal(t, expected.Status.Code, actualMessage.Status.Code)
323+
assert.Equal(t, expected.Status.Reason, actualMessage.Status.Reason)
324+
}

‎executor/go.mod

Lines changed: 42 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -1,97 +1,93 @@
11
module github.com/seldonio/seldon-core/executor
22

3-
go 1.20
3+
go 1.22
44

55
require (
66
github.com/cloudevents/sdk-go v1.2.0
77
github.com/confluentinc/confluent-kafka-go v1.8.2
88
github.com/ghodss/yaml v1.0.0
9-
github.com/go-logr/logr v1.2.3
10-
github.com/golang/protobuf v1.5.3
11-
github.com/google/uuid v1.3.0
9+
github.com/go-logr/logr v1.3.0
10+
github.com/golang/protobuf v1.5.4
11+
github.com/google/uuid v1.6.0
1212
github.com/gorilla/mux v1.8.0
1313
github.com/grpc-ecosystem/go-grpc-middleware v1.3.0
14-
github.com/onsi/gomega v1.19.0
14+
github.com/onsi/gomega v1.29.0
1515
github.com/opentracing/opentracing-go v1.2.0
1616
github.com/pkg/errors v0.9.1
17-
github.com/prometheus/client_golang v1.12.1
18-
github.com/prometheus/common v0.34.0
17+
github.com/prometheus/client_golang v1.16.0
18+
github.com/prometheus/common v0.44.0
1919
github.com/rabbitmq/amqp091-go v1.3.4
2020
github.com/seldonio/seldon-core/operator v0.0.0-00010101000000-000000000000
21-
github.com/stretchr/testify v1.8.0
21+
github.com/stretchr/testify v1.8.4
2222
github.com/tensorflow/tensorflow/tensorflow/go/core v0.0.0-00010101000000-000000000000
2323
github.com/uber/jaeger-client-go v2.25.0+incompatible
2424
go.uber.org/automaxprocs v1.4.0
25-
go.uber.org/zap v1.19.1
26-
golang.org/x/xerrors v0.0.0-20220411194840-2f41105eb62f
27-
google.golang.org/grpc v1.56.3
28-
google.golang.org/protobuf v1.30.0
25+
go.uber.org/zap v1.25.0
26+
golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2
27+
google.golang.org/grpc v1.63.3
28+
google.golang.org/protobuf v1.34.2
2929
gotest.tools v2.2.0+incompatible
30-
k8s.io/api v0.25.0
31-
sigs.k8s.io/controller-runtime v0.12.2
30+
k8s.io/api v0.27.16
31+
sigs.k8s.io/controller-runtime v0.15.3
3232
)
3333

3434
require (
35-
github.com/PuerkitoBio/purell v1.1.1 // indirect
36-
github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect
3735
github.com/beorn7/perks v1.0.1 // indirect
3836
github.com/cespare/xxhash/v2 v2.2.0 // indirect
3937
github.com/codahale/hdrhistogram v0.0.0-00010101000000-000000000000 // indirect
4038
github.com/davecgh/go-spew v1.1.1 // indirect
41-
github.com/emicklei/go-restful v2.15.0+incompatible // indirect
4239
github.com/emicklei/go-restful/v3 v3.10.0 // indirect
43-
github.com/evanphx/json-patch v5.6.0+incompatible // indirect
4440
github.com/evanphx/json-patch/v5 v5.6.0 // indirect
45-
github.com/fsnotify/fsnotify v1.5.1 // indirect
46-
github.com/go-logr/zapr v1.2.0 // indirect
47-
github.com/go-openapi/jsonpointer v0.19.5 // indirect
48-
github.com/go-openapi/jsonreference v0.19.6 // indirect
49-
github.com/go-openapi/swag v0.21.1 // indirect
41+
github.com/fsnotify/fsnotify v1.6.0 // indirect
42+
github.com/go-logr/zapr v1.2.4 // indirect
43+
github.com/go-openapi/jsonpointer v0.19.6 // indirect
44+
github.com/go-openapi/jsonreference v0.20.1 // indirect
45+
github.com/go-openapi/swag v0.22.3 // indirect
5046
github.com/gogo/protobuf v1.3.2 // indirect
5147
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
5248
github.com/google/gnostic v0.5.7-v3refs // indirect
53-
github.com/google/go-cmp v0.5.9 // indirect
49+
github.com/google/go-cmp v0.6.0 // indirect
5450
github.com/google/gofuzz v1.2.0 // indirect
5551
github.com/imdario/mergo v0.3.12 // indirect
5652
github.com/josharian/intern v1.0.1-0.20211109044230-42b52b674af5 // indirect
5753
github.com/json-iterator/go v1.1.12 // indirect
5854
github.com/kedacore/keda/v2 v2.7.1 // indirect
5955
github.com/lightstep/tracecontext.go v0.0.0-20181129014701-1757c391b1ac // indirect
6056
github.com/mailru/easyjson v0.7.7 // indirect
61-
github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
57+
github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
6258
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
6359
github.com/modern-go/reflect2 v1.0.2 // indirect
6460
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
6561
github.com/pmezard/go-difflib v1.0.0 // indirect
66-
github.com/prometheus/client_model v0.2.0 // indirect
67-
github.com/prometheus/procfs v0.7.3 // indirect
62+
github.com/prometheus/client_model v0.4.0 // indirect
63+
github.com/prometheus/procfs v0.10.1 // indirect
6864
github.com/spf13/pflag v1.0.5 // indirect
69-
github.com/stretchr/objx v0.4.0 // indirect
65+
github.com/stretchr/objx v0.5.0 // indirect
7066
github.com/uber/jaeger-lib v2.2.0+incompatible // indirect
7167
go.opencensus.io v0.23.0 // indirect
7268
go.uber.org/atomic v1.9.0 // indirect
73-
go.uber.org/multierr v1.6.0 // indirect
74-
golang.org/x/net v0.17.0 // indirect
75-
golang.org/x/oauth2 v0.7.0 // indirect
76-
golang.org/x/sys v0.13.0 // indirect
77-
golang.org/x/term v0.13.0 // indirect
78-
golang.org/x/text v0.13.0 // indirect
79-
golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect
80-
gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect
81-
google.golang.org/appengine v1.6.7 // indirect
82-
google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 // indirect
69+
go.uber.org/multierr v1.10.0 // indirect
70+
golang.org/x/net v0.26.0 // indirect
71+
golang.org/x/oauth2 v0.17.0 // indirect
72+
golang.org/x/sys v0.21.0 // indirect
73+
golang.org/x/term v0.21.0 // indirect
74+
golang.org/x/text v0.16.0 // indirect
75+
golang.org/x/time v0.3.0 // indirect
76+
gomodules.xyz/jsonpatch/v2 v2.3.0 // indirect
77+
google.golang.org/appengine v1.6.8 // indirect
78+
google.golang.org/genproto/googleapis/rpc v0.0.0-20240227224415-6ceb2ff114de // indirect
8379
gopkg.in/inf.v0 v0.9.1 // indirect
8480
gopkg.in/yaml.v2 v2.4.0 // indirect
8581
gopkg.in/yaml.v3 v3.0.1 // indirect
86-
k8s.io/apiextensions-apiserver v0.24.2 // indirect
87-
k8s.io/apimachinery v0.25.0 // indirect
88-
k8s.io/client-go v0.25.0 // indirect
89-
k8s.io/component-base v0.24.2 // indirect
90-
k8s.io/klog/v2 v2.70.1 // indirect
91-
k8s.io/kube-openapi v0.0.0-20220803162953-67bda5d908f1 // indirect
92-
k8s.io/utils v0.0.0-20220728103510-ee6ede2d64ed // indirect
82+
k8s.io/apiextensions-apiserver v0.27.16 // indirect
83+
k8s.io/apimachinery v0.27.16 // indirect
84+
k8s.io/client-go v0.27.16 // indirect
85+
k8s.io/component-base v0.27.16 // indirect
86+
k8s.io/klog/v2 v2.90.1 // indirect
87+
k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f // indirect
88+
k8s.io/utils v0.0.0-20230209194617-a36077c30491 // indirect
9389
knative.dev/pkg v0.0.0-20220502225657-4fced0164c9a // indirect
94-
sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 // indirect
90+
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
9591
sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
9692
sigs.k8s.io/yaml v1.3.0 // indirect
9793
)

0 commit comments

Comments
 (0)