Skip to content

[addon-operator] Bump shell-operator and gRPC - #842

Merged
yalosev merged 2 commits into
mainfrom
chore/fix-shell-operator-cves
Oct 7, 2026
Merged

yalosev merged 2 commits into
mainfrom
chore/fix-shell-operator-cves

Conversation

@Glitchy-Sheep

@Glitchy-Sheep Glitchy-Sheep commented Oct 6, 2026 •

Copy link
Copy Markdown
Contributor

Overview

What this PR does / why we need it

Fixes CVE-2026-84445 in addon-operator: v1.25.0 lowered gRPC to v1.83.1 after v1.24.21 (#836) had already moved to v1.83.2.

Pins the released shell-operator v1.21.1, which restores gRPC v1.83.2 in shell-operator as well.

Special notes for your reviewer

  • Local checks: go build ./..., go vet ./..., go test -race -count=1 ./... (30 packages), go mod verify and go mod tidy -diff.
  • After merge, publish an addon-operator patch release for Deckhouse main. The planned version is v1.25.1.
  • The existing image release failure needs a separate builder fix: Dockerfile uses Go 1.26.1, but go.mod requires 1.26.4.

Signed-off-by: Roman Berezkin <roman.berezkin@flant.com>
@Glitchy-Sheep Glitchy-Sheep added the dependencies Pull requests that update a dependency file label Oct 6, 2026
@Glitchy-Sheep Glitchy-Sheep self-assigned this Oct 6, 2026
Replace the temporary pseudo-version with the released tag.

Signed-off-by: Roman Berezkin <roman.berezkin@flant.com>
@Glitchy-Sheep
Glitchy-Sheep marked this pull request as ready for review October 7, 2026 07:51
@yalosev
yalosev merged commit c7a7a3d into main Oct 7, 2026
8 of 9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants