argoyle
ad5edfb17a
Unbound Release / Check Preconditions (push) Successful in 26s
Unbound Release / Create Tag (push) Skipped
default-request-adder / vulnerabilities (push) Successful in 1m0s
default-request-adder / test (push) Successful in 1m10s
Unbound Release / Generate Changelog and Handle PR (push) Successful in 44s
Unbound Release / Create Release (push) Failing after 59s
Release / release (push) Failing after 1m44s
default-request-adder / build (push) Successful in 1h3m53s
`govulncheck` was failing in CI. ## Findings | ID | Module | Found | Fixed | Reachable | |----|--------|-------|-------|-----------| | [GO-2026-5970](https://pkg.go.dev/vuln/GO-2026-5970) | `golang.org/x/text` | v0.37.0 | v0.39.0 | Yes — infinite loop on invalid input, reached via `client-go` `LimitRange.Delete` -> `norm.Form.*` (`main.go:83`) | | [GO-2026-5942](https://pkg.go.dev/vuln/GO-2026-5942) | `golang.org/x/net` | v0.55.0 | v0.56.0 | No — panic parsing invalid SVCB/HTTPS RR in `dns/dnsmessage`, required but not called | Both are indirect dependencies, which Renovate does not bump, so they were updated with `go get` + `go mod tidy`. `golang.org/x/sys` (v0.46.0) and `golang.org/x/term` (v0.44.0) came along as transitive requirements. ## Verification ``` $ go test -race ./... ? gitlab.com/unboundsoftware/default-request-adder [no test files] $ govulncheck ./... No vulnerabilities found. ``` The pending Kubernetes v0.36.3 bump is left to its own Renovate branch. Reviewed-on: #347
Default-request-adder
A small container which periodically (every 10s) checks for a LimitRange on all non-excluded namespaces named extreme-request-defaults and creates it using the configured memory settings if absent.