Align knative/serving version across Modelmesh repositories

[spolti]

Describe the bug

Recently we had 2 CVEs in the knative/serving component which led us to update it to a newer version that would require k8s dependencies to be bumped to 0.27.x., but it is incompatible with controller-runtime 0.14.x.

For this reason, to be able to update the knative/serving to a newer version we had to pin down the k8s version to 0.26.x.

There are two vulnerabilities that are fixed by bumping Knative to 0.39.3:

• CVE: PR chore: Update indirect dependency to knative.dev/serving v0.37.5 #468
• https://security.snyk.io/vuln/SNYK-GOLANG-KNATIVEDEVSERVINGPKGAUTOSCALERMETRICS-6091906

To property update it, we would need, first, address #481 to not need to pin the k8s version, once it is updated, we can revert the replace tag changes and start using k8s 0.27.x

[spolti]

Affected repositories:

• KServe
• modelmesh-serving

[ckadner]

There are two vulnerabilities that are fixed by bumping Knative to 0.39.3:

• CVE: PR chore: Update indirect dependency to knative.dev/serving v0.37.5 #468
• https://security.snyk.io/vuln/SNYK-GOLANG-KNATIVEDEVSERVINGPKGAUTOSCALERMETRICS-6091906

And

• https://github.com/kserve/modelmesh-serving/security/dependabot/11

They all describe the same vulnerability, however.

---

The Snyk and CVE reports recommend several "safe" versions to upgrade to. However, that list is not exhaustive. In fact the fix knative/serving#14523 for the vulnerability was back-ported to several release streams:

• v0.37.5: https://github.com/knative/serving/tree/v0.37.5/pkg/autoscaler/metrics
• v0.38.3: https://github.com/knative/serving/tree/v0.38.3/pkg/autoscaler/metrics
• v0.39.0: https://github.com/knative/serving/tree/v0.39.0/pkg/autoscaler/metrics
• v0.40.0: knative/serving@fff40ef
• v1.10.5: https://github.com/knative/serving/tree/knative-v1.10.5/pkg/autoscaler/metrics
• v1.11.3: https://github.com/knative/serving/tree/knative-v1.11.3/pkg/autoscaler/metrics
• v1.12.0: https://github.com/knative/serving/tree/knative-v1.12.0/pkg/autoscaler/metrics

[spolti]

Ideally, we should be using the latest 0.3X.x, right?

[ckadner]

Ideally, we should be using the latest 0.3X.x, right?

Well, possibly, yes, but we do need to pick the (latest) knative/serving version that aligns with the selected KServe version, Go version, etc

[spolti]

Indeed.
I'll take a look on this and share it here.