fix: upgrade github.com/gogo/protobuf to v1.3.2 to fix CVE-2021-3121 for release-3.1

[mainred]

What type of PR is this?

Uncomment only one /kind <> line, hit enter to put that in a new line, and remove leading whitespaces from that line:

/kind api-change
/kind bug
/kind cleanup
/kind design
/kind documentation
/kind failing-test
/kind feature
/kind flake

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

upgrade github.com/gogo/protobuf to v1.3.2 to fix CVE-2021-3121

[k8s-ci-robot]

Welcome @mainred!

It looks like this is your first PR to kubernetes-csi/external-attacher 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-csi/external-attacher has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

[k8s-ci-robot]

Hi @mainred. Thanks for your PR.

I'm waiting for a kubernetes-csi member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: mainred
To complete the pull request process, please assign jsafrane after the PR has been reviewed.
You can assign the PR to them by writing /assign @jsafrane in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[mainred]

@davidz627 @saad-ali could you please take a look?

[pohly]

This is not how you update dependencies. Let's also use this opportunity to update all dependencies to the next minor version, not just those that happen to have known issues.

Please use go get -t -u ./... && go mod tidy && go mod vendor and submit that.

[mainred]

Thanks for pointing this out, let me re-organize other related PRs as well.
I added in the required version into the required field, then go get -t -u ./... && go mod tidy && go mod vendor to upgrade the mod and vendor.

[mainred]

manually added this replacement to fix the namespace change from googleapis to google, google/gnostic#262

[jsafrane]

I'd like to point out that there is no CVE in the external-attacher. CVE-2021-3121 affects only code generated by protobuf v1.3.1. The external-attacher does not generate such code. There may be code in vendor/ that is vulnerable to the CVE, but then you need to update the generated code, not the generator.

In addition, external-attacher v3.1.0 just went out of 1 year of support.

[mainred]

I'd like to point out that there is no CVE in the external-attacher. CVE-2021-3121 affects only code generated by protobuf v1.3.1. The external-attacher does not generate such code. There may be code in vendor/ that is vulnerable to the CVE, but then you need to update the generated code, not the generator.

Agree, external-attacher generates no CVE, so we change only the vendored code in external-attacher, not the code outside of vendor.

In addition, external-attacher v3.1.0 just went out of 1 year of support.

Thanks for pointing this out.