Add release v2.8.10

Go version upgraded to 1.23.1
Scan results on 2024-10-17
2024-10-17 17:25:04 +05:30 · 2024-10-17 14:41:56 +05:30 · 2024-10-17 13:03:20 +05:30 · 2024-10-17 12:16:12 +05:30 · 2024-10-16 10:10:51 +05:30
7 changed files with 73 additions and 71 deletions
@@ -1,3 +1,7 @@
+## Release 2.8.10
+
+This release bumps the Go version to 1.23.1 and the alpine base image to version 3.20.3 as per CVE recommendations.
+
 ## Release 2.8.9

 This release bumps the Go version to 1.22.2, the alpine base image to version 3.20.2, and upgrades a dependency as per CVE recommendations.
@@ -1,6 +1,6 @@
 module github.com/rajch/weave

-go 1.21
+go 1.23.1

 require (
 	github.com/andybalholm/go-bit v1.0.1
@@ -2,6 +2,27 @@

 All changes made to the weave net codebase since the fork will be documented in this file.

+## 2.8.10
+
+### Changed
+
+* Changed version in `reweave/Makefile` to 2.8.10
+* Modified reweave and main CHANGELOG.md
+
+## 2.8.10-beta2
+
+### Changed
+
+* Changed go version in `go.mod` to 1.23.1
+* Changed go base image in `reweave/build/Dockerfile` to `golang:1.23.1-bullseye`.
+
+
+## 2.8.10-beta1
+
+### Changed
+
+* Changed the Alpine base image in `reweave/Makefile` and `reweave/build/Dockerfile` to `alpine:3.20.3`
+
 ## 2.8.9

 ### Changed
@@ -1,7 +1,7 @@
-IMAGE_VERSION ?= 2.8.9
+IMAGE_VERSION ?= 2.8.10
 REGISTRY_USER ?= rajchaudhuri

-ALPINE_BASEIMAGE ?= alpine:3.20.2
+ALPINE_BASEIMAGE ?= alpine:3.20.3

 # Targets
 .PHONY: build-images
@@ -1,13 +1,13 @@
 # syntax=docker/dockerfile:1
-ARG ALPINE_BASEIMAGE=alpine:3.20.2
+ARG ALPINE_BASEIMAGE=alpine:3.20.3

 ########
-# Stage 1: go 1.22.2 on debian bullseye
+# Stage 1: go 1.23.1 on debian bullseye
 # This installs cross-compilation tools for supported architectures.
 # It will be built only once for a given build platform. Subsequent
 # stages will start from this and cross-compile for each target
 # architecture.
-FROM --platform=${BUILDPLATFORM} golang:1.22.2-bullseye AS builderbase
+FROM --platform=${BUILDPLATFORM} golang:1.23.1-bullseye AS builderbase

 # Support Raspberry Pi 2 and newer
 ENV GOARM 7
@@ -1 +1 @@
-{"schemaVersion": 1, "label": "Vulnerabilty count", "message": "14", "color": "orange"}
+{"schemaVersion": 1, "label": "Vulnerabilty count", "message": "8", "color": "orange"}
@@ -1,96 +1,73 @@
 # Vulnerability Report

 ```
-Report date: 2024-08-09
-Unique vulnerability count: 14
-Images version: 2.8.9
+Report date: 2024-10-17
+Unique vulnerability count: 8
+Images version: 2.8.10
 ```

 ## Scanner Details

 ```
 Application:         grype
-Version:             0.79.4
-BuildDate:           2024-07-31T15:24:34Z
-GitCommit:           0cf393938995de1bf1284a7d156a0ce97816a396
-GitDescription:      v0.79.4
+Version:             0.82.1
+BuildDate:           2024-10-15T13:54:04Z
+GitCommit:           50815e59c973cfd0c0247cbc2af00fa37f7cda5d
+GitDescription:      v0.82.1
 Platform:            linux/amd64
-GoVersion:           go1.22.5
+GoVersion:           go1.23.2
 Compiler:            gc
-Syft Version:        v1.10.0
+Syft Version:        v1.14.1
 Supported DB Schema: 5
 ```

 ## Vulnerabilities

-### weave-kube: (14) 
+### weave-kube: (8) 

 ```
-NAME        INSTALLED   FIXED-IN  TYPE       VULNERABILITY   SEVERITY 
-bind-libs   9.18.27-r0            apk        CVE-2024-4076   High      
-bind-libs   9.18.27-r0            apk        CVE-2024-1975   High      
-bind-libs   9.18.27-r0            apk        CVE-2024-1737   High      
-bind-libs   9.18.27-r0            apk        CVE-2024-0760   High      
-bind-tools  9.18.27-r0            apk        CVE-2024-4076   High      
-bind-tools  9.18.27-r0            apk        CVE-2024-1975   High      
-bind-tools  9.18.27-r0            apk        CVE-2024-1737   High      
-bind-tools  9.18.27-r0            apk        CVE-2024-0760   High      
-curl        8.9.0-r0              apk        CVE-2024-7264   Unknown   
-stdlib      go1.22.2              go-module  CVE-2024-24790  Critical  
-stdlib      go1.22.2              go-module  CVE-2024-24791  High      
-stdlib      go1.22.2              go-module  CVE-2024-24789  Medium    
-stdlib      go1.22.2              go-module  CVE-2024-24787  Medium    
-stdlib      go1.22.2              go-module  CVE-2024-24788  Unknown
+NAME        INSTALLED   FIXED-IN  TYPE  VULNERABILITY  SEVERITY 
+bind-libs   9.18.27-r0            apk   CVE-2024-4076  High      
+bind-libs   9.18.27-r0            apk   CVE-2024-1975  High      
+bind-libs   9.18.27-r0            apk   CVE-2024-1737  High      
+bind-libs   9.18.27-r0            apk   CVE-2024-0760  High      
+bind-tools  9.18.27-r0            apk   CVE-2024-4076  High      
+bind-tools  9.18.27-r0            apk   CVE-2024-1975  High      
+bind-tools  9.18.27-r0            apk   CVE-2024-1737  High      
+bind-tools  9.18.27-r0            apk   CVE-2024-0760  High
 ```

-### weave-npc: (5) 
+### weave-npc: (0) 

 ```
-NAME    INSTALLED  FIXED-IN  TYPE       VULNERABILITY   SEVERITY 
-stdlib  go1.22.2             go-module  CVE-2024-24790  Critical  
-stdlib  go1.22.2             go-module  CVE-2024-24791  High      
-stdlib  go1.22.2             go-module  CVE-2024-24789  Medium    
-stdlib  go1.22.2             go-module  CVE-2024-24787  Medium    
-stdlib  go1.22.2             go-module  CVE-2024-24788  Unknown
+No vulnerabilities found
 ```

-### weave: (14) 
+### weave: (8) 

 ```
-NAME        INSTALLED   FIXED-IN  TYPE       VULNERABILITY   SEVERITY 
-bind-libs   9.18.27-r0            apk        CVE-2024-4076   High      
-bind-libs   9.18.27-r0            apk        CVE-2024-1975   High      
-bind-libs   9.18.27-r0            apk        CVE-2024-1737   High      
-bind-libs   9.18.27-r0            apk        CVE-2024-0760   High      
-bind-tools  9.18.27-r0            apk        CVE-2024-4076   High      
-bind-tools  9.18.27-r0            apk        CVE-2024-1975   High      
-bind-tools  9.18.27-r0            apk        CVE-2024-1737   High      
-bind-tools  9.18.27-r0            apk        CVE-2024-0760   High      
-curl        8.9.0-r0              apk        CVE-2024-7264   Unknown   
-stdlib      go1.22.2              go-module  CVE-2024-24790  Critical  
-stdlib      go1.22.2              go-module  CVE-2024-24791  High      
-stdlib      go1.22.2              go-module  CVE-2024-24789  Medium    
-stdlib      go1.22.2              go-module  CVE-2024-24787  Medium    
-stdlib      go1.22.2              go-module  CVE-2024-24788  Unknown
+NAME        INSTALLED   FIXED-IN  TYPE  VULNERABILITY  SEVERITY 
+bind-libs   9.18.27-r0            apk   CVE-2024-4076  High      
+bind-libs   9.18.27-r0            apk   CVE-2024-1975  High      
+bind-libs   9.18.27-r0            apk   CVE-2024-1737  High      
+bind-libs   9.18.27-r0            apk   CVE-2024-0760  High      
+bind-tools  9.18.27-r0            apk   CVE-2024-4076  High      
+bind-tools  9.18.27-r0            apk   CVE-2024-1975  High      
+bind-tools  9.18.27-r0            apk   CVE-2024-1737  High      
+bind-tools  9.18.27-r0            apk   CVE-2024-0760  High
 ```

-### weaveexec: (14) 
+### weaveexec: (8) 

 ```
-NAME        INSTALLED   FIXED-IN  TYPE       VULNERABILITY   SEVERITY 
-bind-libs   9.18.27-r0            apk        CVE-2024-4076   High      
-bind-libs   9.18.27-r0            apk        CVE-2024-1975   High      
-bind-libs   9.18.27-r0            apk        CVE-2024-1737   High      
-bind-libs   9.18.27-r0            apk        CVE-2024-0760   High      
-bind-tools  9.18.27-r0            apk        CVE-2024-4076   High      
-bind-tools  9.18.27-r0            apk        CVE-2024-1975   High      
-bind-tools  9.18.27-r0            apk        CVE-2024-1737   High      
-bind-tools  9.18.27-r0            apk        CVE-2024-0760   High      
-curl        8.9.0-r0              apk        CVE-2024-7264   Unknown   
-stdlib      go1.22.2              go-module  CVE-2024-24790  Critical  
-stdlib      go1.22.2              go-module  CVE-2024-24791  High      
-stdlib      go1.22.2              go-module  CVE-2024-24789  Medium    
-stdlib      go1.22.2              go-module  CVE-2024-24787  Medium    
-stdlib      go1.22.2              go-module  CVE-2024-24788  Unknown
+NAME        INSTALLED   FIXED-IN  TYPE  VULNERABILITY  SEVERITY 
+bind-libs   9.18.27-r0            apk   CVE-2024-4076  High      
+bind-libs   9.18.27-r0            apk   CVE-2024-1975  High      
+bind-libs   9.18.27-r0            apk   CVE-2024-1737  High      
+bind-libs   9.18.27-r0            apk   CVE-2024-0760  High      
+bind-tools  9.18.27-r0            apk   CVE-2024-4076  High      
+bind-tools  9.18.27-r0            apk   CVE-2024-1975  High      
+bind-tools  9.18.27-r0            apk   CVE-2024-1737  High      
+bind-tools  9.18.27-r0            apk   CVE-2024-0760  High
 ```
Author	SHA1	Message	Date
Raj Chaudhuri	84afe28bee	Add release v2.8.10	2024-10-17 17:25:04 +05:30
Raj Chaudhuri	6512da7cc1	Go version upgraded to 1.23.1	2024-10-17 14:41:56 +05:30
Raj Chaudhuri	fab7297623	Scan results on 2024-10-17	2024-10-17 13:03:20 +05:30
Raj Chaudhuri	ca2ba767d9	Alpine base image upgraded to 3.20.3	2024-10-17 12:16:12 +05:30
Raj Chaudhuri	f32a2a6955	Scan results on 2024-10-16	2024-10-16 10:10:51 +05:30