nic-6443 opened a new pull request, #2844: URL: https://github.com/apache/apisix-ingress-controller/pull/2844
### Type of change: - [x] Chore ### What this PR does / why we need it: Bumps the dependencies that currently have open security advisories against this repo. All of them are indirect, and the first six are only reachable from the e2e suite through terratest, so nothing here changes what gets linked into the controller binary. ``` github.com/jackc/pgx/v5 v5.7.1 -> v5.9.2 filippo.io/edwards25519 v1.1.0 -> v1.1.1 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.7 -> v1.7.8 github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.44.0 -> v1.65.0 github.com/aws/aws-sdk-go-v2/service/lambda v1.69.0 -> v1.88.5 github.com/aws/aws-sdk-go-v2/service/s3 v1.69.0 -> v1.97.3 github.com/klauspost/compress v1.18.0 -> v1.18.7 go.opentelemetry.io/otel (+ metric/sdk/trace) v1.43.0 -> v1.44.0 ``` That covers GHSA-9jj7-4m8r-rfcm, GHSA-xgrm-4fwx-7qm8, GHSA-j88v-2chj-qfwx (pgx), GHSA-fw7p-63qq-7hpr (edwards25519), GHSA-xmrv-pmrh-hhx2 (aws-sdk-go-v2), plus GO-2026-5841 (OOB read in klauspost/compress/s2) and GO-2026-5158 (otel baggage header length) which `govulncheck` flags but Dependabot doesn't. After the bump `govulncheck -test ./...` reports no reachable vulnerabilities. The one thing left is GO-2026-5932, the advisory saying `golang.org/x/crypto/openpgp` is unmaintained — it has no fixed version, and we only pull `golang.org/x/crypto` in for `bcrypt` via `Masterminds/sprig`, so there is nothing to do about it here. No test cases are added since this is a dependency-version-only change; `go build ./...`, `go vet ./test/...` and the unit tests all pass locally. ### Pre-submission checklist: - [x] Did you explain what problem does this PR solve? Or what new features have been added? - [x] Have you added corresponding test cases? - [x] Have you modified the corresponding document? - [x] Is this PR backward compatible? **If it is not backward compatible, please discuss on the [mailing list](https://github.com/apache/apisix-ingress-controller#community) first** -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
