Skip to content

Commit 4275e52

Browse files
dimetrondimetron
authored
cve fixes 2026.01 - nextJS upgraded (#1223)
- cve fixes - bump outdated versions - NextJS v16 (kept Tailwind v3) @tailwindcss/postcss (v4) is incompatible with v3.x --------- Signed-off-by: Dmytro Rashko <[email protected]>
1 parent 26aa87e commit 4275e52

40 files changed

+4874
-5245
lines changed

‎.github/workflows/ci.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -166,7 +166,7 @@ jobs:
166166
- name: Setup Node.js
167167
uses: actions/setup-node@v4
168168
with:
169-
node-version: '20'
169+
node-version: '24'
170170
cache: 'npm'
171171
cache-dependency-path: ui/package-lock.json
172172

@@ -244,7 +244,7 @@ jobs:
244244
- name: golangci-lint
245245
uses: golangci/golangci-lint-action@v9
246246
with:
247-
version: v2.7.2
247+
version: v2.8.0
248248
working-directory: go
249249

250250
python-test:

‎Makefile‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ DOCKER_BUILDER ?= docker buildx
2929
DOCKER_BUILD_ARGS ?= --push --platform linux/$(LOCALARCH)
3030

3131
KIND_CLUSTER_NAME ?= kagent
32-
KIND_IMAGE_VERSION ?= 1.34.0
32+
KIND_IMAGE_VERSION ?= 1.35.0
3333

3434
CONTROLLER_IMAGE_NAME ?= controller
3535
UI_IMAGE_NAME ?= ui
@@ -57,9 +57,9 @@ LDFLAGS := "-X github.com/$(DOCKER_REPO)/go/internal/version.Version=$(VERSION)
5757
-X github.com/$(DOCKER_REPO)/go/internal/version.BuildDate=$(BUILD_DATE)"
5858

5959
#tools versions
60-
TOOLS_UV_VERSION ?= 0.8.22
61-
TOOLS_BUN_VERSION ?= 1.2.22
62-
TOOLS_NODE_VERSION ?= 22.19.0
60+
TOOLS_UV_VERSION ?= 0.9.2
61+
TOOLS_BUN_VERSION ?= 1.3.6
62+
TOOLS_NODE_VERSION ?= 24.13.0
6363
TOOLS_PYTHON_VERSION ?= 3.13
6464

6565
# build args

‎go/cli/internal/cli/mcp/secrets.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -214,9 +214,9 @@ func loadEnvFile(filename string) (map[string]string, error) {
214214
continue // Skip empty lines and comments
215215
}
216216

217-
if idx := strings.Index(line, "="); idx != -1 {
218-
key := strings.TrimSpace(line[:idx])
219-
value := strings.TrimSpace(line[idx+1:])
217+
if key, value, found := strings.Cut(line, "="); found {
218+
key = strings.TrimSpace(key)
219+
value = strings.TrimSpace(value)
220220
if key != "" {
221221
envVars[key] = value
222222
}

‎go/config/crd/bases/kagent.dev_agents.yaml‎

Lines changed: 61 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -884,7 +884,7 @@ spec:
884884
resources:
885885
description: |-
886886
resources represents the minimum resources the volume should have.
887-
If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
887+
Users are allowed to specify resource requirements
888888
that are lower than previous value but must still be higher than capacity recorded in the
889889
status field of the claim.
890890
More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
@@ -1765,6 +1765,24 @@ spec:
17651765
description: Kubelet's generated CSRs will
17661766
be addressed to this signer.
17671767
type: string
1768+
userAnnotations:
1769+
additionalProperties:
1770+
type: string
1771+
description: |-
1772+
userAnnotations allow pod authors to pass additional information to
1773+
the signer implementation. Kubernetes does not restrict or validate this
1774+
metadata in any way.
1775+
1776+
These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of
1777+
the PodCertificateRequest objects that Kubelet creates.
1778+
1779+
Entries are subject to the same validation as object metadata annotations,
1780+
with the addition that all keys must be domain-prefixed. No restrictions
1781+
are placed on values, except an overall size limitation on the entire field.
1782+
1783+
Signers should document the keys and values they support. Signers should
1784+
deny requests that contain keys they do not recognize.
1785+
type: object
17681786
required:
17691787
- keyType
17701788
- signerName
@@ -4092,9 +4110,10 @@ spec:
40924110
operator:
40934111
description: |-
40944112
Operator represents a key's relationship to the value.
4095-
Valid operators are Exists and Equal. Defaults to Equal.
4113+
Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
40964114
Exists is equivalent to wildcard for value, so that a pod can
40974115
tolerate all taints of a particular category.
4116+
Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
40984117
type: string
40994118
tolerationSeconds:
41004119
description: |-
@@ -4766,7 +4785,7 @@ spec:
47664785
resources:
47674786
description: |-
47684787
resources represents the minimum resources the volume should have.
4769-
If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
4788+
Users are allowed to specify resource requirements
47704789
that are lower than previous value but must still be higher than capacity recorded in the
47714790
status field of the claim.
47724791
More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
@@ -5652,6 +5671,24 @@ spec:
56525671
description: Kubelet's generated CSRs
56535672
will be addressed to this signer.
56545673
type: string
5674+
userAnnotations:
5675+
additionalProperties:
5676+
type: string
5677+
description: |-
5678+
userAnnotations allow pod authors to pass additional information to
5679+
the signer implementation. Kubernetes does not restrict or validate this
5680+
metadata in any way.
5681+
5682+
These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of
5683+
the PodCertificateRequest objects that Kubelet creates.
5684+
5685+
Entries are subject to the same validation as object metadata annotations,
5686+
with the addition that all keys must be domain-prefixed. No restrictions
5687+
are placed on values, except an overall size limitation on the entire field.
5688+
5689+
Signers should document the keys and values they support. Signers should
5690+
deny requests that contain keys they do not recognize.
5691+
type: object
56555692
required:
56565693
- keyType
56575694
- signerName
@@ -7765,9 +7802,10 @@ spec:
77657802
operator:
77667803
description: |-
77677804
Operator represents a key's relationship to the value.
7768-
Valid operators are Exists and Equal. Defaults to Equal.
7805+
Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
77697806
Exists is equivalent to wildcard for value, so that a pod can
77707807
tolerate all taints of a particular category.
7808+
Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
77717809
type: string
77727810
tolerationSeconds:
77737811
description: |-
@@ -8439,7 +8477,7 @@ spec:
84398477
resources:
84408478
description: |-
84418479
resources represents the minimum resources the volume should have.
8442-
If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
8480+
Users are allowed to specify resource requirements
84438481
that are lower than previous value but must still be higher than capacity recorded in the
84448482
status field of the claim.
84458483
More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
@@ -9325,6 +9363,24 @@ spec:
93259363
description: Kubelet's generated CSRs
93269364
will be addressed to this signer.
93279365
type: string
9366+
userAnnotations:
9367+
additionalProperties:
9368+
type: string
9369+
description: |-
9370+
userAnnotations allow pod authors to pass additional information to
9371+
the signer implementation. Kubernetes does not restrict or validate this
9372+
metadata in any way.
9373+
9374+
These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of
9375+
the PodCertificateRequest objects that Kubelet creates.
9376+
9377+
Entries are subject to the same validation as object metadata annotations,
9378+
with the addition that all keys must be domain-prefixed. No restrictions
9379+
are placed on values, except an overall size limitation on the entire field.
9380+
9381+
Signers should document the keys and values they support. Signers should
9382+
deny requests that contain keys they do not recognize.
9383+
type: object
93289384
required:
93299385
- keyType
93309386
- signerName

‎go/go.mod‎

Lines changed: 33 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/kagent-dev/kagent/go
22

3-
go 1.25.5
3+
go 1.25.6
44

55
require (
66
github.com/abiosoft/ishell/v2 v2.0.2
@@ -13,7 +13,7 @@ require (
1313
github.com/go-logr/logr v1.4.3
1414
github.com/gorilla/mux v1.8.1
1515
github.com/hashicorp/go-multierror v1.1.1
16-
github.com/jedib0t/go-pretty/v6 v6.6.8
16+
github.com/jedib0t/go-pretty/v6 v6.7.8
1717
github.com/kagent-dev/kmcp v0.2.2
1818
github.com/kagent-dev/mockllm v0.0.3
1919
github.com/modelcontextprotocol/go-sdk v1.2.0
@@ -25,14 +25,14 @@ require (
2525
github.com/stoewer/go-strcase v1.3.1
2626
github.com/stretchr/testify v1.11.1
2727
go.uber.org/automaxprocs v1.6.0
28-
golang.org/x/text v0.29.0
28+
golang.org/x/text v0.33.0
2929
gorm.io/driver/postgres v1.6.0
30-
gorm.io/gorm v1.31.0
31-
k8s.io/api v0.34.1
32-
k8s.io/apimachinery v0.34.1
33-
k8s.io/client-go v0.34.1
34-
k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d
35-
sigs.k8s.io/controller-runtime v0.22.1
30+
gorm.io/gorm v1.31.1
31+
k8s.io/api v0.35.0
32+
k8s.io/apimachinery v0.35.0
33+
k8s.io/client-go v0.35.0
34+
k8s.io/utils v0.0.0-20260108192941-914a6e750570
35+
sigs.k8s.io/controller-runtime v0.23.0
3636
sigs.k8s.io/yaml v1.6.0
3737
trpc.group/trpc-go/trpc-a2a-go v0.2.5
3838
)
@@ -44,20 +44,23 @@ require (
4444
github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
4545
github.com/aymanbagabas/go-udiff v0.3.1 // indirect
4646
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
47-
github.com/charmbracelet/colorprofile v0.3.2 // indirect
48-
github.com/charmbracelet/x/ansi v0.10.1 // indirect
49-
github.com/charmbracelet/x/cellbuf v0.0.13 // indirect
50-
github.com/charmbracelet/x/exp/golden v0.0.0-20250922100529-c9afca5d6f21 // indirect
51-
github.com/charmbracelet/x/term v0.2.1 // indirect
47+
github.com/charmbracelet/colorprofile v0.4.1 // indirect
48+
github.com/charmbracelet/x/ansi v0.11.4 // indirect
49+
github.com/charmbracelet/x/cellbuf v0.0.14 // indirect
50+
github.com/charmbracelet/x/exp/golden v0.0.0-20260119114936-fd556377ea59 // indirect
51+
github.com/charmbracelet/x/term v0.2.2 // indirect
52+
github.com/clipperhouse/displaywidth v0.7.0 // indirect
53+
github.com/clipperhouse/stringish v0.1.1 // indirect
54+
github.com/clipperhouse/uax29/v2 v2.3.1 // indirect
5255
github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
5356
github.com/evanphx/json-patch v5.9.11+incompatible // indirect
54-
github.com/google/jsonschema-go v0.3.0 // indirect
57+
github.com/google/jsonschema-go v0.4.2 // indirect
5558
github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
5659
github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75 // indirect
5760
github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
5861
github.com/muesli/cancelreader v0.2.2 // indirect
5962
github.com/muesli/termenv v0.16.0 // indirect
60-
github.com/ncruces/go-strftime v0.1.9 // indirect
63+
github.com/ncruces/go-strftime v1.0.0 // indirect
6164
github.com/openai/openai-go/v3 v3.16.0 // indirect
6265
github.com/sahilm/fuzzy v0.1.1 // indirect
6366
github.com/tidwall/gjson v1.18.0 // indirect
@@ -95,7 +98,6 @@ require (
9598
github.com/go-openapi/swag v0.23.1 // indirect
9699
github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
97100
github.com/goccy/go-json v0.10.5 // indirect
98-
github.com/gogo/protobuf v1.3.2 // indirect
99101
github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
100102
github.com/google/btree v1.1.3 // indirect
101103
github.com/google/cel-go v0.26.1 // indirect
@@ -123,12 +125,10 @@ require (
123125
github.com/mailru/easyjson v0.9.1 // indirect
124126
github.com/mattn/go-colorable v0.1.14 // indirect
125127
github.com/mattn/go-isatty v0.0.20 // indirect
126-
github.com/mattn/go-runewidth v0.0.17 // indirect
128+
github.com/mattn/go-runewidth v0.0.19 // indirect
127129
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
128130
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
129131
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
130-
github.com/onsi/ginkgo/v2 v2.25.3 // indirect
131-
github.com/onsi/gomega v1.38.2 // indirect
132132
github.com/pelletier/go-toml/v2 v2.2.4 // indirect
133133
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
134134
github.com/prometheus/client_model v0.6.2 // indirect
@@ -155,13 +155,13 @@ require (
155155
go.uber.org/multierr v1.11.0 // indirect
156156
go.uber.org/zap v1.27.0 // indirect
157157
go.yaml.in/yaml/v2 v2.4.3 // indirect
158-
golang.org/x/crypto v0.42.0 // indirect
159-
golang.org/x/exp v0.0.0-20250911091902-df9299821621 // indirect
160-
golang.org/x/net v0.44.0 // indirect
158+
golang.org/x/crypto v0.47.0 // indirect
159+
golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 // indirect
160+
golang.org/x/net v0.48.0 // indirect
161161
golang.org/x/oauth2 v0.31.0 // indirect
162-
golang.org/x/sync v0.17.0 // indirect
163-
golang.org/x/sys v0.36.0 // indirect
164-
golang.org/x/term v0.35.0 // indirect
162+
golang.org/x/sync v0.19.0 // indirect
163+
golang.org/x/sys v0.40.0 // indirect
164+
golang.org/x/term v0.39.0 // indirect
165165
golang.org/x/time v0.13.0 // indirect
166166
gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
167167
google.golang.org/genproto/googleapis/api v0.0.0-20250922171735-9219d122eba9 // indirect
@@ -171,16 +171,16 @@ require (
171171
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
172172
gopkg.in/inf.v0 v0.9.1 // indirect
173173
gopkg.in/yaml.v3 v3.0.1
174-
k8s.io/apiextensions-apiserver v0.34.1 // indirect
175-
k8s.io/apiserver v0.34.1 // indirect
176-
k8s.io/component-base v0.34.1 // indirect
174+
k8s.io/apiextensions-apiserver v0.35.0 // indirect
175+
k8s.io/apiserver v0.35.0 // indirect
176+
k8s.io/component-base v0.35.0 // indirect
177177
k8s.io/klog/v2 v2.130.1 // indirect
178-
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
179-
modernc.org/libc v1.66.9 // indirect
178+
k8s.io/kube-openapi v0.0.0-20251125145642-4e65d59e963e // indirect
179+
modernc.org/libc v1.67.6 // indirect
180180
modernc.org/mathutil v1.7.1 // indirect
181181
modernc.org/memory v1.11.0 // indirect
182-
modernc.org/sqlite v1.39.0 // indirect
183-
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.33.0 // indirect
182+
modernc.org/sqlite v1.44.2 // indirect
183+
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0 // indirect
184184
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
185185
sigs.k8s.io/randfill v1.0.0 // indirect
186186
)

0 commit comments

Comments
 (0)