Add release v2.8.10

CHANGELOG.md

@@ -1,3 +1,7 @@
+## Release 2.8.10
+
+This release bumps the Go version to 1.23.1 and the alpine base image to version 3.20.3 as per CVE recommendations.
+
 ## Release 2.8.9
 
 This release bumps the Go version to 1.22.2, the alpine base image to version 3.20.2, and upgrades a dependency as per CVE recommendations.

go.mod

@@ -1,6 +1,6 @@
 module github.com/rajch/weave
 
-go 1.21
+go 1.23.1
 
 require (
 	github.com/andybalholm/go-bit v1.0.1

reweave/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 All changes made to the weave net codebase since the fork will be documented in this file.
 
+## 2.8.10
+
+### Changed
+
+* Changed version in `reweave/Makefile` to 2.8.10
+* Modified reweave and main CHANGELOG.md
+
+## 2.8.10-beta2
+
+### Changed
+
+* Changed go version in `go.mod` to 1.23.1
+* Changed go base image in `reweave/build/Dockerfile` to `golang:1.23.1-bullseye`.
+
+
+## 2.8.10-beta1
+
+### Changed
+
+* Changed the Alpine base image in `reweave/Makefile` and `reweave/build/Dockerfile` to `alpine:3.20.3`
+
 ## 2.8.9
 
 ### Changed

reweave/Makefile

@@ -1,7 +1,7 @@
-IMAGE_VERSION ?= 2.8.9
+IMAGE_VERSION ?= 2.8.10
 REGISTRY_USER ?= rajchaudhuri
 
-ALPINE_BASEIMAGE ?= alpine:3.20.2
+ALPINE_BASEIMAGE ?= alpine:3.20.3
 
 # Targets
 .PHONY: build-images

reweave/build/Dockerfile

@@ -1,13 +1,13 @@
 # syntax=docker/dockerfile:1
-ARG ALPINE_BASEIMAGE=alpine:3.20.2
+ARG ALPINE_BASEIMAGE=alpine:3.20.3
 
 ########
-# Stage 1: go 1.22.2 on debian bullseye
+# Stage 1: go 1.23.1 on debian bullseye
 # This installs cross-compilation tools for supported architectures.
 # It will be built only once for a given build platform. Subsequent
 # stages will start from this and cross-compile for each target
 # architecture.
-FROM --platform=${BUILDPLATFORM} golang:1.22.2-bullseye AS builderbase
+FROM --platform=${BUILDPLATFORM} golang:1.23.1-bullseye AS builderbase
 
 # Support Raspberry Pi 2 and newer
 ENV GOARM 7

reweave/scans/badge.json

@@ -1 +1 @@
-{"schemaVersion": 1, "label": "Vulnerabilty count", "message": "14", "color": "orange"}
+{"schemaVersion": 1, "label": "Vulnerabilty count", "message": "8", "color": "orange"}

reweave/scans/report.md

@@ -1,96 +1,73 @@
 # Vulnerability Report
 
 ```
-Report date: 2024-08-09
+Report date: 2024-10-17
-Unique vulnerability count: 14
+Unique vulnerability count: 8
-Images version: 2.8.9
+Images version: 2.8.10
 ```
 
 ## Scanner Details
 
 ```
 Application:         grype
-Version:             0.79.4
+Version:             0.82.1
-BuildDate:           2024-07-31T15:24:34Z
+BuildDate:           2024-10-15T13:54:04Z
-GitCommit:           0cf393938995de1bf1284a7d156a0ce97816a396
+GitCommit:           50815e59c973cfd0c0247cbc2af00fa37f7cda5d
-GitDescription:      v0.79.4
+GitDescription:      v0.82.1
 Platform:            linux/amd64
-GoVersion:           go1.22.5
+GoVersion:           go1.23.2
 Compiler:            gc
-Syft Version:        v1.10.0
+Syft Version:        v1.14.1
 Supported DB Schema: 5
 ```
 
 ## Vulnerabilities
 
-### weave-kube: (14) 
+### weave-kube: (8) 
 
 ```
-NAME        INSTALLED   FIXED-IN  TYPE       VULNERABILITY   SEVERITY 
+NAME        INSTALLED   FIXED-IN  TYPE  VULNERABILITY  SEVERITY 
-bind-libs   9.18.27-r0            apk        CVE-2024-4076   High      
+bind-libs   9.18.27-r0            apk   CVE-2024-4076  High      
-bind-libs   9.18.27-r0            apk        CVE-2024-1975   High      
+bind-libs   9.18.27-r0            apk   CVE-2024-1975  High      
-bind-libs   9.18.27-r0            apk        CVE-2024-1737   High      
+bind-libs   9.18.27-r0            apk   CVE-2024-1737  High      
-bind-libs   9.18.27-r0            apk        CVE-2024-0760   High      
+bind-libs   9.18.27-r0            apk   CVE-2024-0760  High      
-bind-tools  9.18.27-r0            apk        CVE-2024-4076   High      
+bind-tools  9.18.27-r0            apk   CVE-2024-4076  High      
-bind-tools  9.18.27-r0            apk        CVE-2024-1975   High      
+bind-tools  9.18.27-r0            apk   CVE-2024-1975  High      
-bind-tools  9.18.27-r0            apk        CVE-2024-1737   High      
+bind-tools  9.18.27-r0            apk   CVE-2024-1737  High      
-bind-tools  9.18.27-r0            apk        CVE-2024-0760   High      
+bind-tools  9.18.27-r0            apk   CVE-2024-0760  High
-curl        8.9.0-r0              apk        CVE-2024-7264   Unknown   
-stdlib      go1.22.2              go-module  CVE-2024-24790  Critical  
-stdlib      go1.22.2              go-module  CVE-2024-24791  High      
-stdlib      go1.22.2              go-module  CVE-2024-24789  Medium    
-stdlib      go1.22.2              go-module  CVE-2024-24787  Medium    
-stdlib      go1.22.2              go-module  CVE-2024-24788  Unknown
 ```
 
-### weave-npc: (5) 
+### weave-npc: (0) 
 
 ```
-NAME    INSTALLED  FIXED-IN  TYPE       VULNERABILITY   SEVERITY 
+No vulnerabilities found
-stdlib  go1.22.2             go-module  CVE-2024-24790  Critical  
-stdlib  go1.22.2             go-module  CVE-2024-24791  High      
-stdlib  go1.22.2             go-module  CVE-2024-24789  Medium    
-stdlib  go1.22.2             go-module  CVE-2024-24787  Medium    
-stdlib  go1.22.2             go-module  CVE-2024-24788  Unknown
 ```
 
-### weave: (14) 
+### weave: (8) 
 
 ```
-NAME        INSTALLED   FIXED-IN  TYPE       VULNERABILITY   SEVERITY 
+NAME        INSTALLED   FIXED-IN  TYPE  VULNERABILITY  SEVERITY 
-bind-libs   9.18.27-r0            apk        CVE-2024-4076   High      
+bind-libs   9.18.27-r0            apk   CVE-2024-4076  High      
-bind-libs   9.18.27-r0            apk        CVE-2024-1975   High      
+bind-libs   9.18.27-r0            apk   CVE-2024-1975  High      
-bind-libs   9.18.27-r0            apk        CVE-2024-1737   High      
+bind-libs   9.18.27-r0            apk   CVE-2024-1737  High      
-bind-libs   9.18.27-r0            apk        CVE-2024-0760   High      
+bind-libs   9.18.27-r0            apk   CVE-2024-0760  High      
-bind-tools  9.18.27-r0            apk        CVE-2024-4076   High      
+bind-tools  9.18.27-r0            apk   CVE-2024-4076  High      
-bind-tools  9.18.27-r0            apk        CVE-2024-1975   High      
+bind-tools  9.18.27-r0            apk   CVE-2024-1975  High      
-bind-tools  9.18.27-r0            apk        CVE-2024-1737   High      
+bind-tools  9.18.27-r0            apk   CVE-2024-1737  High      
-bind-tools  9.18.27-r0            apk        CVE-2024-0760   High      
+bind-tools  9.18.27-r0            apk   CVE-2024-0760  High
-curl        8.9.0-r0              apk        CVE-2024-7264   Unknown   
-stdlib      go1.22.2              go-module  CVE-2024-24790  Critical  
-stdlib      go1.22.2              go-module  CVE-2024-24791  High      
-stdlib      go1.22.2              go-module  CVE-2024-24789  Medium    
-stdlib      go1.22.2              go-module  CVE-2024-24787  Medium    
-stdlib      go1.22.2              go-module  CVE-2024-24788  Unknown
 ```
 
-### weaveexec: (14) 
+### weaveexec: (8) 
 
 ```
-NAME        INSTALLED   FIXED-IN  TYPE       VULNERABILITY   SEVERITY 
+NAME        INSTALLED   FIXED-IN  TYPE  VULNERABILITY  SEVERITY 
-bind-libs   9.18.27-r0            apk        CVE-2024-4076   High      
+bind-libs   9.18.27-r0            apk   CVE-2024-4076  High      
-bind-libs   9.18.27-r0            apk        CVE-2024-1975   High      
+bind-libs   9.18.27-r0            apk   CVE-2024-1975  High      
-bind-libs   9.18.27-r0            apk        CVE-2024-1737   High      
+bind-libs   9.18.27-r0            apk   CVE-2024-1737  High      
-bind-libs   9.18.27-r0            apk        CVE-2024-0760   High      
+bind-libs   9.18.27-r0            apk   CVE-2024-0760  High      
-bind-tools  9.18.27-r0            apk        CVE-2024-4076   High      
+bind-tools  9.18.27-r0            apk   CVE-2024-4076  High      
-bind-tools  9.18.27-r0            apk        CVE-2024-1975   High      
+bind-tools  9.18.27-r0            apk   CVE-2024-1975  High      
-bind-tools  9.18.27-r0            apk        CVE-2024-1737   High      
+bind-tools  9.18.27-r0            apk   CVE-2024-1737  High      
-bind-tools  9.18.27-r0            apk        CVE-2024-0760   High      
+bind-tools  9.18.27-r0            apk   CVE-2024-0760  High
-curl        8.9.0-r0              apk        CVE-2024-7264   Unknown   
-stdlib      go1.22.2              go-module  CVE-2024-24790  Critical  
-stdlib      go1.22.2              go-module  CVE-2024-24791  High      
-stdlib      go1.22.2              go-module  CVE-2024-24789  Medium    
-stdlib      go1.22.2              go-module  CVE-2024-24787  Medium    
-stdlib      go1.22.2              go-module  CVE-2024-24788  Unknown
 ```