Security Vulnerability: Go Package: github.com/grpc-ecosystem/go-grpc-prometheus - End of Life Notification (EOL)

[anjaniprayaga]

Hi Team,

The latest version of node-feature-discovery image is using the component "Go Package: github.com/grpc-ecosystem/go-grpc-prometheus", which has reached its end of life(PFA). Request you to kindly use the version that is in support.

Thanks,
Anjani

[fmuyassarov]

Thanks for reporting this. Unfortunately, this is an indirect dependency. We would need to bump up those components like etcd, controller manager and etc. I see there is already progress in some of the components like etcd: kubernetes/kubernetes#128419.

[fmuyassarov]

/assign

[marquiz]

Yes, that is an indirect dependency from kubernetes

$ go mod why -m github.com/grpc-ecosystem/go-grpc-prometheus
# github.com/grpc-ecosystem/go-grpc-prometheus
sigs.k8s.io/node-feature-discovery/pkg/nfd-master
k8s.io/kubernetes/pkg/controller
k8s.io/kubernetes/pkg/apis/core/validation
k8s.io/kubernetes/pkg/cluster/ports
k8s.io/cloud-provider/options
k8s.io/apiserver/pkg/server/options
k8s.io/apiserver/pkg/storage/storagebackend/factory
github.com/grpc-ecosystem/go-grpc-prometheus

There's not much we can do about that until kubernetes is fixed

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle rotten
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten