build(deps): update Core 2 dependencies #6574
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
In order to significantly reduce the number of CVEs in Core 2 images, we:
- update to golang 1.24.4
- update all the package dependencies to their latest versions (this has
required minor code fixes)
- update the base Dockerfile builder images to ones using golang 1.24
- update github workflows to use golang 1.24
- during updates, the following changes have been manually made:
* update `github.com/imdario/mergo` (deprecated) -> `dario.cat/mergo`
* update `github.com/golang/protobuf` (deprecated) ->
`google.golang.org/protobuf`
* `google.golang.org/grpc/status` now requires messages (for example in
`status.Errorf`) to have a printf format (like "%s") rather than pointing
directly to a string.
Adds makefile targets for production docker image builds that contain an automatically generated software bill of materials (SBOM) Update the Docker build images CI action to push images with SBOM metadata to dockerhub
lc525
force-pushed
the
quickfix/package-updates
branch
from
fefbc3a to
fae1ed8
Compare
lc525
force-pushed
the
quickfix/package-updates
branch
from
37ce948 to
fc9719f
Compare
jtayl222
pushed a commit
to jtayl222/seldon-core
that referenced
this pull request
Jul 20, 2025
# Why
Target fixing of CVEs in preparation for the 2.9.1 release
## Summary of changes
- Update golang to 1.24.4
- Update golang dependencies across codebase
- Update kubebuilder and operator dependencies
- Update ubi-micro to 9.6
- Update dataflow dependencies
- Update MLServer to 1.7.1
- Generate Docker images with SBOM metadata
## Changeset details
* build(deps): Update golang to 1.24.4, together with dependencies
In order to significantly reduce the number of CVEs in Core 2 images, we:
- update to golang 1.24.4
- update all the package dependencies to their latest versions (this has
required minor code fixes)
- update the base Dockerfile builder images to ones using golang 1.24
- update github workflows to use golang 1.24
- during updates, the following changes have been manually made:
* update `github.com/imdario/mergo` (deprecated) -> `dario.cat/mergo`
* update `github.com/golang/protobuf` (deprecated) ->
`google.golang.org/protobuf`
* `google.golang.org/grpc/status` now requires messages (for example in
`status.Errorf`) to have a printf format (like "%s") rather than pointing
directly to a string.
* feat(build): CI to create docker images with sbom metadata
Adds makefile targets for production docker image builds that contain an
automatically generated software bill of materials (SBOM)
Update the Docker build images CI action to push images with SBOM metadata
to dockerhub
* build(deps): Update kubebuilder and operator support packages
* build(deps): Update MLServer to 1.7.1
* build(deps): Update ubi-micro to 9.6
* build(deps): Update dataflow-engine dependencies
* build(ci): update CI linter version to support golang 1.24
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Why
Target fixing of CVEs in preparation for the 2.9.1 release
What
Summary of changes
Tests
Tested that all updated packages work as expected by running smoke-test in kind (involving models and pipelines).