Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: (IAC-1193) Update Dependencies to Resolve Security Issues #92

Merged
merged 5 commits into from
Nov 13, 2023

Conversation

jarpat
Copy link
Contributor

@jarpat jarpat commented Nov 9, 2023

Changes

Updates 3rd party dependencies in this project to resolve security findings from our scanning tool. Consumers of the Dockerfile will automatically have these updated dependencies installed, and users who directly run this project on this host will need to update the dependencies themselves.

Update summary:

  • ansible 8.0.0 -> 8.6.0
    • Not a major change, while the bundled collections are updated, ansible-core goes from 2.15.0 -> 2.15.6
  • helm 3.12.0 -> 3.13.2
  • terraform 1.4.5 -> 1.6.3
  • kubectl 1.26.7 -> 1.26.10
  • hashicorp/vsphere & hashicorp/local are now pinned rather than being a version range.

Note: Although the versions have been bumped up, there are no breaking changes. A user could still use the same 3rd party dependencies from viya4-iac-k8s:3.5.0 and not run into any issues. We will still advise users to update versions in our release notes.

Tests

Scenario Provider K8s Version Order Cadence Notes
1 OSS v1.26.7 ****** fast:2020
2 OSS v1.26.7 n/a n/a downgraded the ansible collection version and terraform version to check compatibility

@jarpat jarpat self-assigned this Nov 9, 2023
@jarpat jarpat added the enhancement New feature or request label Nov 9, 2023
Copy link

@sayeun sayeun left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

@jarpat jarpat merged commit e5ebbf5 into staging Nov 13, 2023
4 checks passed
@jarpat jarpat mentioned this pull request Nov 30, 2023
@jarpat jarpat deleted the IAC-1193 branch December 8, 2023 18:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants