Merge pull request #3625 from fluxcd/release/1.25.3

Release 1.25.3

.circleci/config.yml

@@ -6,7 +6,7 @@ jobs:
       image: ubuntu-2004:202010-01
     resource_class: large
     environment:
-      GO_VERSION: 1.16.7
+      GO_VERSION: 1.17.12
       # We don't need a GOPATH but CircleCI defines it, so we override it
       GOPATH: /home/circleci/go
       GO111MODULE: 'on'

.github/workflows/ci.yaml

@@ -22,7 +22,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v2
         with:
-          go-version: 1.16.x
+          go-version: 1.17.x
       - name: Run tests
         run: make test TEST_FLAGS="-race -tags integration -timeout 5m"
       - name: Check codegen
@@ -60,7 +60,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v2
         with:
-          go-version: 1.16.x
+          go-version: 1.17.x
       - name: Download cache
         uses: actions/download-artifact@v1
         with:

CHANGELOG.md

@@ -8,6 +8,27 @@
 > requests](https://github.com/fluxcd/toolkit/discussions) for Flux v2
 > and Toolkit components.
 
+## 1.25.3 (2022-07-27)
+
+This release includes a base image upgrade to the Alpine 3.15.5 upstream
+that mitigates a number of CVE issues detected from the base image.
+
+Go dependencies have been upgraded as well. This release has no code changes.
+
+### Maintenance and documentation
+
+- snap: update go requirement [fluxcd/flux#3624][]
+- Update dependencies [fluxcd/flux#3623][]
+- Update module github.com/prometheus/client_golang to v1.12.2 [fluxcd/flux#3620][]
+
+### Thanks
+
+Thanks to @dholbach, @kingdonb and @pjbgf for their contributions to this release.
+
+[fluxcd/flux#3624]: https://github.com/fluxcd/flux/pull/3624
+[fluxcd/flux#3623]: https://github.com/fluxcd/flux/pull/3623
+[fluxcd/flux#3620]: https://github.com/fluxcd/flux/pull/3620
+
 ## 1.25.2 (2022-05-26)
 
 This patch release reverts a deprecation induced during an upgrade of OpenSSH.

chart/flux/CHANGELOG.md

@@ -1,3 +1,10 @@
+## 1.13.1 (2022-05-26)
+
+### Improvements
+
+ - Updated Flux to `1.25.2`
+   [fluxcd/flux#3615](https://github.com/fluxcd/flux/pull/3615)
+
 ## 1.13.0 (2022-05-05)
 
 ### Improvements

chart/flux/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
-appVersion: "1.25.1"
-version: 1.13.0
+appVersion: "1.25.2"
+version: 1.13.1
 kubeVersion: ">=1.16.0-0"
 name: flux
 description: Flux is a tool that automatically ensures that the state of a cluster matches what is specified in version control

chart/flux/values.yaml

@@ -9,7 +9,7 @@ logFormat: fmt
 
 image:
   repository: docker.io/fluxcd/flux
-  tag: 1.25.1
+  tag: 1.25.2
   pullPolicy: IfNotPresent
   pullSecret:
 

deploy/flux-deployment.yaml

@@ -66,7 +66,7 @@ spec:
         # There are no ":latest" images for flux. Find the most recent
         # release or image version at https://hub.docker.com/r/fluxcd/flux/tags
         # and replace the tag here.
-        image: docker.io/fluxcd/flux:1.25.2
+        image: docker.io/fluxcd/flux:1.25.3
         imagePullPolicy: IfNotPresent
         resources:
           requests:

docker/kubectl.version

@@ -1,4 +1,4 @@
-KUBECTL_VERSION=v1.21.11
-KUBECTL_CHECKSUM_amd64=84d128d1021167d3c58cc142115b0a6b31a50e3e78eb234648cdb6e26f42ab76143c0b5fd34f5476d963f2d09d8907031425eb0ceec529db6eab44a404b55530
-KUBECTL_CHECKSUM_arm=4cd3ef06b8eb806f17eab383c8b97b943c8864e8103e9330732dfcc849cc76baaf0d5bd000be11551485010fd51fb428e8cc243a30bf5bdaf1ab5df1903027be
-KUBECTL_CHECKSUM_arm64=62601d78baf10115246de1956bd0f24c30d412e910c942ebbda87157fd9eb3845c213b47075cb94c08dc301b493f5d25c3d39d0229d02a365bfa37bd0f0ee0f4
+KUBECTL_VERSION=v1.21.14
+KUBECTL_CHECKSUM_amd64=52a98cc64abeea4187391cbf0ad5bdd69b6920c2b29b8f9afad194441e642fb8f252e14a91c095ef1e85a23e5bb587916bd319566b6e8d1e03be5505400f44b4
+KUBECTL_CHECKSUM_arm=fb204c3494bb7acf59ea0dc2b6f94c5a7d2b7e6d69c05b7a7e77b3fc438e574e9ac5f8720a4ae8f2f660822262aa8c4723bfe269c49ed641031f8259210e5b48
+KUBECTL_CHECKSUM_arm64=ed613592035b45c4f4571eed2b739c837def4287aacc7c37665e596484aa6dbd299224ef12ec329cfa8a655e20b6bee6f6fc3204bc79b92d832171073ddde191

docker/kustomize.version

@@ -1,2 +1,3 @@
+# Any version above 3.8.7 results in regression explained in fluxcd/flux#3500.
 KUSTOMIZE_VERSION=3.8.7
 KUSTOMIZE_CHECKSUM=4a3372d7bfdffe2eaf729e77f88bc94ce37dc84de55616bfe90aac089bf6fd02

docker/sops.version

@@ -1,2 +1,2 @@
-SOPS_VERSION=v3.7.2
-SOPS_CHECKSUM=0f54a5fc68f82d3dcb0d3310253f2259fef1902d48cfa0a8721b82803c575024
+SOPS_VERSION=v3.7.3
+SOPS_CHECKSUM=53aec65e45f62a769ff24b7e5384f0c82d62668dd96ed56685f649da114b4dbb

go.mod

@@ -2,16 +2,9 @@ module github.com/fluxcd/flux
 
 go 1.16
 
-// remove when https://github.com/docker/distribution/pull/2905 is released.
-// Update: on 2021-02-25 this has been merged, 2.7.2 should include it soon!
-replace github.com/docker/distribution => github.com/fluxcd/distribution v0.0.0-20190419185413-6c9727e5e5de
-
-// fix go-autorest ambiguous import caused by sops
-// sops needs to update their deps ref: https://github.com/kubernetes/client-go/issues/628
-// replace github.com/Azure/go-autorest => github.com/Azure/go-autorest v12.2.0+incompatible
-
 // transitive requirement from Helm Operator
 replace (
+	github.com/docker/distribution => github.com/docker/distribution v2.8.1+incompatible
 	github.com/docker/docker => github.com/docker/docker v0.7.3-0.20190327010347-be7ac8be2ae0
 	github.com/fluxcd/helm-operator => github.com/fluxcd/helm-operator v1.4.0
 	github.com/fluxcd/helm-operator/pkg/install => github.com/fluxcd/helm-operator/pkg/install v0.0.0-20200213151218-f7e487142b46
@@ -20,60 +13,63 @@ replace (
 // dgrijalva/jwt-go is no longer maintained, replacing with a fork which is community maintained.
 replace github.com/dgrijalva/jwt-go => github.com/golang-jwt/jwt v3.2.2+incompatible
 
-// Pin kubernetes dependencies to 1.21.3
+// Pin kubernetes dependencies to 1.21.14
 replace (
-	k8s.io/api => k8s.io/api v0.21.3
-	k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.21.3
-	k8s.io/apimachinery => k8s.io/apimachinery v0.21.3
-	k8s.io/client-go => k8s.io/client-go v0.21.3
-	k8s.io/code-generator => k8s.io/code-generator v0.21.3
+	k8s.io/api => k8s.io/api v0.21.14
+	k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.21.14
+	k8s.io/apimachinery => k8s.io/apimachinery v0.21.14
+	k8s.io/client-go => k8s.io/client-go v0.21.14
+	k8s.io/code-generator => k8s.io/code-generator v0.21.14
 )
 
+// Version v1.5.0 breaks make test
+replace github.com/spf13/cobra => github.com/spf13/cobra v1.4.0
+
 // github.com/fluxcd/flux/pkg/install lives in this very repository, so use that
 replace github.com/fluxcd/flux/pkg/install => ./pkg/install
 
 require (
-	github.com/Azure/azure-sdk-for-go v38.0.0+incompatible // indirect
 	github.com/Jeffail/gabs v1.4.0
 	github.com/Masterminds/semver/v3 v3.1.1
-	github.com/aws/aws-sdk-go v1.43.27
+	github.com/aws/aws-sdk-go v1.44.61
 	github.com/bradfitz/gomemcache v0.0.0-20220106215444-fb4bf637b56d
-	github.com/cheggaaa/pb/v3 v3.0.8
+	github.com/cheggaaa/pb/v3 v3.1.0
 	github.com/docker/distribution v2.8.1+incompatible
-	github.com/evanphx/json-patch v4.11.0+incompatible
+	github.com/evanphx/json-patch v5.6.0+incompatible
 	github.com/fluxcd/flux/pkg/install v0.0.0-00010101000000-000000000000
 	github.com/fluxcd/helm-operator v1.4.2
 	github.com/ghodss/yaml v1.0.0
 	github.com/go-kit/kit v0.12.0
 	github.com/golang/gddo v0.0.0-20210115222349-20d68f94ee1f
-	github.com/google/go-containerregistry v0.8.0
+	github.com/google/go-containerregistry v0.11.0
 	github.com/google/go-github/v28 v28.1.1
 	github.com/gorilla/mux v1.8.0
 	github.com/gorilla/websocket v1.5.0
-	github.com/imdario/mergo v0.3.12
+	github.com/imdario/mergo v0.3.13
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opentracing-contrib/go-stdlib v1.0.0 // indirect
 	github.com/pkg/errors v0.9.1
 	github.com/pkg/term v1.1.0
-	github.com/prometheus/client_golang v1.11.0
+	github.com/prometheus/client_golang v1.12.2
 	github.com/prometheus/client_model v0.2.0
 	github.com/ryanuber/go-glob v1.0.0
-	github.com/spf13/cobra v1.3.0
+	github.com/spf13/cobra v1.5.0
 	github.com/spf13/pflag v1.0.5
-	github.com/stretchr/testify v1.7.1
+	github.com/stretchr/testify v1.8.0
+	// Latest versions of github.com/weaveworks/common are not supporterd by Flux.
 	github.com/weaveworks/common v0.0.0-20190410110702-87611edc252e
 	github.com/weaveworks/go-checkpoint v0.0.0-20220223124739-fd9899e2b4f2
 	github.com/whilp/git-urls v1.0.0
 	github.com/xeipuuv/gojsonschema v1.2.0
-	go.mozilla.org/sops/v3 v3.7.2
+	go.mozilla.org/sops/v3 v3.7.3
 	golang.org/x/crypto v0.0.0-20220427172511-eb4f295cb31f // indirect
-	golang.org/x/oauth2 v0.0.0-20220309155454-6242fa91716a
-	golang.org/x/sys v0.0.0-20220328115105-d36c6a25d886
-	golang.org/x/time v0.0.0-20220224211638-0e9765cccd65
+	golang.org/x/oauth2 v0.0.0-20220722155238-128564f6959c
+	golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f
+	golang.org/x/time v0.0.0-20220722155302-e5dcc9cfc0b9
 	gopkg.in/yaml.v2 v2.4.0
-	k8s.io/api v0.21.3
-	k8s.io/apiextensions-apiserver v0.21.3
-	k8s.io/apimachinery v0.21.3
+	k8s.io/api v0.21.14
+	k8s.io/apiextensions-apiserver v0.21.14
+	k8s.io/apimachinery v0.21.14
 	k8s.io/client-go v11.0.0+incompatible
 	k8s.io/klog v1.0.0
 )