[PR] Bump Kubernetes libraries to 0.29.15 [skywalking-rover]

["kezhenxu94 (via GitHub)" <gi...@apache.org>]

kezhenxu94 opened a new pull request, #217:
URL: https://github.com/apache/skywalking-rover/pull/217

   ### Motivation
   
   Rover's Kubernetes libraries are pinned at `v0.23.5`. `k8s.io/apimachinery` at that version is flagged for **CVE-2023-44487** (HTTP/2 Rapid Reset) by image scanners, so images built from rover keep failing security scans.
   
   The underlying vulnerability is already mitigated by the Go toolchain and `golang.org/x/net` versions those images ship — the finding is driven by the module version string rather than by reachable vulnerable code. Bumping the dependency is the practical way to clear it.
   
   ### Changes
   
   - `k8s.io/api`, `k8s.io/apimachinery`, `k8s.io/client-go`: `v0.23.5` → `v0.29.15`
   - `pkg/process/finders/kubernetes/registry.go`: adapt `OnAdd` to the client-go 0.27 handler signature
   - `CHANGES.md`: changelog entry under 0.8.0
   
   ### On the `registry.go` change
   
   client-go 0.27 added an `isInInitialList bool` parameter to `cache.ResourceEventHandler.OnAdd`, so `*StaticNamespaceRegistry` no longer satisfied the interface and `AddEventHandler` stopped compiling.
   
   The new parameter is ignored: the handler already calls `recomposePodServiceName()` on every add, and it should keep doing so for both the initial list and subsequent adds, so no behaviour changes.
   
   ### Verification
   
   - `GOOS=linux go build ./pkg/process/finders/kubernetes/... ./pkg/accesslog/collector/... ./pkg/accesslog/common/...` — clean
   - `GOOS=linux go vet ./pkg/process/finders/kubernetes/...` — clean
   - `go test ./pkg/process/finders/...` — passing
   
   (The `pkg/accesslog/bpf` package needs `go generate` for its bpf2go output, so it does not build from a bare checkout either before or after this change.)
   
   /cc @kezhenxu94
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Bump Kubernetes libraries to 0.29.15 [skywalking-rover]

["kezhenxu94 (via GitHub)" <gi...@apache.org>]

kezhenxu94 merged PR #217:
URL: https://github.com/apache/skywalking-rover/pull/217


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org