From ae348338c3c93123fc1c88aa72a20b9f76d7176a Mon Sep 17 00:00:00 2001 From: dkarpele Date: Tue, 27 Oct 2026 20:46:19 +0100 Subject: [PATCH 1/3] chore: bump github.com/argoproj/argo-cd/v3 v3.3.12 -> v3.3.18 to fix CVE-2026-55797 Signed-off-by: dkarpele --- go.mod | 12 ++++++------ go.sum | 24 ++++++++++++------------ 2 files changed, 18 insertions(+), 18 deletions(-) diff --git a/go.mod b/go.mod index 9c9530cfaa2..0d9d2cb3898 100644 --- a/go.mod +++ b/go.mod @@ -6,8 +6,8 @@ require ( github.com/argoproj-labs/argo-rollouts-manager v0.0.8-0.20260224121037-1824164aac67 github.com/argoproj-labs/argocd-image-updater v1.1.3 github.com/argoproj-labs/argocd-operator v0.18.1-0.20260722081502-6aada215f18b - github.com/argoproj/argo-cd/v3 v3.3.12 - github.com/argoproj/gitops-engine v0.7.1-0.20251217140045-5baed5604d2d + github.com/argoproj/argo-cd/v3 v3.3.18 + github.com/argoproj/gitops-engine v0.7.1-0.20250908182407-97ad5b59a627 github.com/go-logr/logr v1.4.4 github.com/google/go-cmp v0.7.0 github.com/google/uuid v1.6.1-0.20241114170450-2d3c2a9cc518 @@ -154,9 +154,9 @@ require ( github.com/xlab/treeprint v1.2.0 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 // indirect - go.opentelemetry.io/otel v1.43.0 // indirect - go.opentelemetry.io/otel/metric v1.43.0 // indirect - go.opentelemetry.io/otel/trace v1.43.0 // indirect + go.opentelemetry.io/otel v1.44.0 // indirect + go.opentelemetry.io/otel/metric v1.44.0 // indirect + go.opentelemetry.io/otel/trace v1.44.0 // indirect go.uber.org/multierr v1.11.0 // indirect go.yaml.in/yaml/v2 v2.4.2 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect @@ -189,7 +189,7 @@ require ( k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b // indirect k8s.io/kubectl v0.34.0 // indirect k8s.io/kubernetes v1.34.2 // indirect - oras.land/oras-go/v2 v2.6.0 // indirect + oras.land/oras-go/v2 v2.6.2 // indirect sigs.k8s.io/gateway-api v1.1.0 // indirect sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect sigs.k8s.io/kustomize/api v0.21.0 // indirect diff --git a/go.sum b/go.sum index 66fa50b87a5..d05b6a163c0 100644 --- a/go.sum +++ b/go.sum @@ -41,8 +41,8 @@ github.com/argoproj-labs/argocd-image-updater v1.1.3 h1:/kPvpuig9Y5zq5rJE4tAC+I8 github.com/argoproj-labs/argocd-image-updater v1.1.3/go.mod h1:jR1GYyDoLM/kBPmG0BbXwPnQO51LP6Tg19Y/cXT6CfA= github.com/argoproj-labs/argocd-operator v0.18.1-0.20260722081502-6aada215f18b h1:kMpJnNXR0cjAFTwx8lOOYhBEfvIFzljPtWetmzvs8YU= github.com/argoproj-labs/argocd-operator v0.18.1-0.20260722081502-6aada215f18b/go.mod h1:+DhHjYc3ZQ7jzw18bZutBrU7ARUKnZZEYzyR6FclUQg= -github.com/argoproj/argo-cd/v3 v3.3.12 h1:1MaIMR+KkSzaRyu5kigXZVaM66c01W+orqfhKw/pHl4= -github.com/argoproj/argo-cd/v3 v3.3.12/go.mod h1:LdPjAnIFbx0khaB6vLsOKrGoSWeJ8kzOt//jF1ltCPg= +github.com/argoproj/argo-cd/v3 v3.3.18 h1:JXrjFeVQWTecSSxCd1OdHEyrJmzUzsP66FxCoHfRGZM= +github.com/argoproj/argo-cd/v3 v3.3.18/go.mod h1:uKv6abJMdL9WPDsAk05AW0BdMjBZpb7q7JpSH1N186Q= github.com/argoproj/gitops-engine v0.7.1-0.20251217140045-5baed5604d2d h1:iUJYrbSvpV9n8vyl1sBt1GceM60HhHfnHxuzcm5apDg= github.com/argoproj/gitops-engine v0.7.1-0.20251217140045-5baed5604d2d/go.mod h1:PauXVUVcfiTgC+34lDdWzPS101g4NpsUtDAjFBnWf94= github.com/argoproj/pkg v0.13.7-0.20250305113207-cbc37dc61de5 h1:YBoLSjpoaJXaXAldVvBRKJuOPvIXz9UOv6S96gMJM/Q= @@ -455,16 +455,16 @@ go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 h1:YH4g8lQroajqUwWbq/tr2QX1JFmEXaDLgG+ew9bLMWo= go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0/go.mod h1:fvPi2qXDqFs8M4B4fmJhE92TyQs9Ydjlg3RvfUp+NbQ= -go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I= -go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0= -go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM= -go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY= -go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg= -go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg= +go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= +go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= +go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= +go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= +go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58= +go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0= go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2WKg+sEJTtB8= go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew= -go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A= -go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0= +go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= +go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.uber.org/mock v0.5.2 h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko= @@ -686,8 +686,8 @@ k8s.io/kubernetes v1.34.2 h1:WQdDvYJazkmkwSncgNwGvVtaCt4TYXIU3wSMRgvp3MI= k8s.io/kubernetes v1.34.2/go.mod h1:m6pZk6a179pRo2wsTiCPORJ86iOEQmfIzUvtyEF8BwA= k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y= k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= -oras.land/oras-go/v2 v2.6.0 h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc= -oras.land/oras-go/v2 v2.6.0/go.mod h1:magiQDfG6H1O9APp+rOsvCPcW1GD2MM7vgnKY0Y+u1o= +oras.land/oras-go/v2 v2.6.2 h1:N04RXngAp1LJKTG6ifz3xHPipasEkWr+hFmInja5YKo= +oras.land/oras-go/v2 v2.6.2/go.mod h1:PlTtg4JTDJkDe8yVHpM2wz7/YDc00GVas+i4jAW2TZ4= sigs.k8s.io/controller-runtime v0.22.3 h1:I7mfqz/a/WdmDCEnXmSPm8/b/yRTy6JsKKENTijTq8Y= sigs.k8s.io/controller-runtime v0.22.3/go.mod h1:+QX1XUpTXN4mLoblf4tqr5CQcyHPAki2HLXqQMY6vh8= sigs.k8s.io/gateway-api v1.1.0 h1:DsLDXCi6jR+Xz8/xd0Z1PYl2Pn0TyaFMOPPZIj4inDM= From 190da199a67498f32b728aa23f762bfd6bae344a Mon Sep 17 00:00:00 2001 From: dkarpele Date: Tue, 27 Oct 2026 20:49:36 +0100 Subject: [PATCH 2/3] chore: fix gitops-engine version Signed-off-by: dkarpele --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index 0d9d2cb3898..e8a29ad6e56 100644 --- a/go.mod +++ b/go.mod @@ -7,7 +7,7 @@ require ( github.com/argoproj-labs/argocd-image-updater v1.1.3 github.com/argoproj-labs/argocd-operator v0.18.1-0.20260722081502-6aada215f18b github.com/argoproj/argo-cd/v3 v3.3.18 - github.com/argoproj/gitops-engine v0.7.1-0.20250908182407-97ad5b59a627 + github.com/argoproj/gitops-engine v0.7.1-0.20251217140045-5baed5604d2d github.com/go-logr/logr v1.4.4 github.com/google/go-cmp v0.7.0 github.com/google/uuid v1.6.1-0.20241114170450-2d3c2a9cc518 From c6a96efd80d6640d050135112a40c305acd91ede Mon Sep 17 00:00:00 2001 From: dkarpele Date: Tue, 27 Oct 2026 22:03:58 +0100 Subject: [PATCH 3/3] chore: add replace directive for gitops-engine Signed-off-by: dkarpele --- go.mod | 5 +++++ go.sum | 8 ++++---- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/go.mod b/go.mod index e8a29ad6e56..24d31a5b6fa 100644 --- a/go.mod +++ b/go.mod @@ -199,6 +199,11 @@ require ( ) replace ( + // argo-cd v3.3.18 declares gitops-engine at a pseudo-version where go.mod + // didn't exist yet, then overrides with replace => ./gitops-engine locally. + // Downstream consumers must resolve it themselves; pin to the v3.3.18 commit. + github.com/argoproj/gitops-engine => github.com/argoproj/argo-cd/gitops-engine v0.0.0-20261022134330-d0b5dfda404d + github.com/golang/protobuf => github.com/golang/protobuf v1.5.4 github.com/grpc-ecosystem/grpc-gateway => github.com/grpc-ecosystem/grpc-gateway v1.16.0 diff --git a/go.sum b/go.sum index d05b6a163c0..9c77f23dd80 100644 --- a/go.sum +++ b/go.sum @@ -41,10 +41,10 @@ github.com/argoproj-labs/argocd-image-updater v1.1.3 h1:/kPvpuig9Y5zq5rJE4tAC+I8 github.com/argoproj-labs/argocd-image-updater v1.1.3/go.mod h1:jR1GYyDoLM/kBPmG0BbXwPnQO51LP6Tg19Y/cXT6CfA= github.com/argoproj-labs/argocd-operator v0.18.1-0.20260722081502-6aada215f18b h1:kMpJnNXR0cjAFTwx8lOOYhBEfvIFzljPtWetmzvs8YU= github.com/argoproj-labs/argocd-operator v0.18.1-0.20260722081502-6aada215f18b/go.mod h1:+DhHjYc3ZQ7jzw18bZutBrU7ARUKnZZEYzyR6FclUQg= +github.com/argoproj/argo-cd/gitops-engine v0.0.0-20261022134330-d0b5dfda404d h1:Zpmz9XF6yve8q+NPx7+Gj1epdlFQ4VvPH7dXlKDA7F8= +github.com/argoproj/argo-cd/gitops-engine v0.0.0-20261022134330-d0b5dfda404d/go.mod h1:ZTnrhMy9ghikucp6W3lo4Fdk5VcDLHsGy2Q/MKF2wT8= github.com/argoproj/argo-cd/v3 v3.3.18 h1:JXrjFeVQWTecSSxCd1OdHEyrJmzUzsP66FxCoHfRGZM= github.com/argoproj/argo-cd/v3 v3.3.18/go.mod h1:uKv6abJMdL9WPDsAk05AW0BdMjBZpb7q7JpSH1N186Q= -github.com/argoproj/gitops-engine v0.7.1-0.20251217140045-5baed5604d2d h1:iUJYrbSvpV9n8vyl1sBt1GceM60HhHfnHxuzcm5apDg= -github.com/argoproj/gitops-engine v0.7.1-0.20251217140045-5baed5604d2d/go.mod h1:PauXVUVcfiTgC+34lDdWzPS101g4NpsUtDAjFBnWf94= github.com/argoproj/pkg v0.13.7-0.20250305113207-cbc37dc61de5 h1:YBoLSjpoaJXaXAldVvBRKJuOPvIXz9UOv6S96gMJM/Q= github.com/argoproj/pkg v0.13.7-0.20250305113207-cbc37dc61de5/go.mod h1:ebVOzFJphdN1p6EG2mIMECv/3Rk/almSaxIYuFAmsSw= github.com/argoproj/pkg/v2 v2.0.1 h1:O/gCETzB/3+/hyFL/7d/VM/6pSOIRWIiBOTb2xqAHvc= @@ -467,8 +467,8 @@ go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/ go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= -go.uber.org/mock v0.5.2 h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko= -go.uber.org/mock v0.5.2/go.mod h1:wLlUxC2vVTPTaE3UD51E0BGOAElKrILxhVSDYQLld5o= +go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y= +go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU= go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0= go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y= go.uber.org/zap v1.28.0 h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo=