Repository navigation
Conversation
📝 WalkthroughWalkthroughDependency versions were updated in Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
pkg/client/v1/proto/Makefile (1)
14-15:⚠️ Potential issue | 🟡 MinorEcho messages reference
*_grpc.pb.gofiles that won't be generated without the gRPC plugin.Lines 14 and 28 mention
*_grpc.pb.gofiles, but if using--gogo_outwithplugins=grpc, the gRPC stubs are embedded in the*.pb.gofile rather than split into a separate*_grpc.pb.gofile. Update the messages accordingly once you confirm the generation output.Also applies to: 28-28
🤖 Fix all issues with AI agents
In `@go.mod`:
- Line 326: The go.mod currently pins github.com/opencontainers/selinux to
v1.12.0 which is vulnerable (GHSA-cgrx-mc8f-2prm); update the module requirement
for github.com/opencontainers/selinux to v1.13.0 or later in go.mod, run `go get
github.com/opencontainers/selinux@v1.13.0` (or newer) and then `go mod tidy`/`go
mod vendor` to propagate the change, and also verify any dependency on
opencontainers/runc is upgraded to a patched release (>= v1.2.8, >= v1.3.3, or
>= v1.4.0-rc.3) to fully address the container escape vulnerability.
- Line 81: Update the indirect dependency on github.com/anchore/grype to a safe
version (v0.104.1 or later) in go.mod; specifically change the module
requirement for "github.com/anchore/grype" from v0.99.1 to at least v0.104.1,
then run go get github.com/anchore/grype@v0.104.1 (or newer) and go mod tidy to
update the module graph and vendor files so the vulnerable versions are removed.
- Line 321: Update the kubescape/opa-utils module to v0.0.289 (or v0.0.292) in
go.mod to pull OPA v1.4.0+ and eliminate the HIGH Rego injection vulnerability
(currently pulling github.com/open-policy-agent/opa v0.70.0 indirectly); run go
get github.com/kubescape/opa-utils@v0.0.289 and go mod tidy to update the
lockfile. After upgrading, search the codebase for imports beginning with
github.com/open-policy-agent/opa and update them to
github.com/open-policy-agent/opa/v1 where used (adjust any affected packages or
tests), then run go test/build to ensure compile-time fixes are applied.
In `@pkg/client/v1/proto/Makefile`:
- Around line 9-11: The Makefile invocation for protoc-gen-gogo is missing the
gRPC plugin flag so service stubs aren't generated; update the gogo generation
line used for storage_service.proto so it includes the grpc plugin (e.g., change
the current --gogo_out=. / --gogo_opt usage to supply plugins=grpc, for example
--gogo_out=plugins=grpc:. and keep --gogo_opt=paths=source_relative or
alternatively add plugins=grpc to --gogo_opt like
--gogo_opt=plugins=grpc,paths=source_relative) so that storage_service.proto
generates gRPC service stubs.
🧹 Nitpick comments (1)
pkg/client/v1/proto/Makefile (1)
17-20: Document whygogo/protobufis required despite its deprecated status.
gogo/protobufis officially deprecated and unmaintained; the ecosystem has largely migrated to Google's officialgoogle.golang.org/protobuftoolchain (used by Cosmos SDK's gogoproto fork, Temporal, OpenTelemetry, and others). If this codebase requires gogo for compatibility with an existing dependency (e.g.,kubescape/storageusing gogo-generated types), document that constraint in the Makefile or README. Otherwise, this introduces technical debt and security risk.
| github.com/anchore/go-struct-converter v0.0.0-20250211213226-cce56d595160 // indirect | ||
| github.com/anchore/go-sync v0.0.0-20250714163430-add63db73ad1 // indirect | ||
| github.com/anchore/go-version v1.2.2-0.20210903204242-51efa5b487c4 // indirect | ||
| github.com/anchore/grype v0.99.1 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
GHSA-6gxw-85q2-q646 anchore grype credential disclosure
💡 Result:
GHSA-6gxw-85q2-q646 (CVE-2025-65965) is a credential disclosure issue in Anchore Grype where configured registry credentials (username/password/token) can be written unsanitized into JSON output files under specific output modes. [1]
- Affected versions: Grype v0.68.0 through v0.104.0 (i.e.,
>=0.68.0and<0.104.1). [1][2] - When it leaks: If registry auth is configured and you write JSON output directly to a file using
--fileor--output json=<file>(or equivalent). Credentials may also be exposed via custom templates that referenceDescriptor.Registry.Authfields. [1][3] - Fixed in: v0.104.1. [1][3]
- Workaround (if you can’t upgrade): Avoid
--file/--output json=<file>and instead write sanitized JSON to stdout and redirect, e.g.grype --output json image > out.json. [1][3]
Recommendation: Upgrade Grype to 0.104.1+ and rotate any registry credentials that may have been written to JSON output files. [1][3]
Sources: [1] OSV entry for GHSA-6gxw-85q2-q646, [2] Go vulnerability report GO-2025-4160, [3] GitLab advisory for CVE-2025-65965.
🌐 Web query:
anchore grype v0.99.1 vulnerability patched version history
💡 Result:
Grype v0.99.1 (released 2025‑09‑01) does not include a security vulnerability patch; its release notes list only bug fixes (e.g., “present fix available version in grype JSON output”). [1]
If you meant the known Grype vulnerability that affects versions including v0.99.1, the relevant “patched version history” is:
CVE-2025-65965 / GHSA-6gxw-85q2-q646 (credential disclosure in JSON file output)
- Vulnerable versions: v0.68.0 → v0.104.0 (this range includes v0.99.1) [2][3]
- Patched (fixed) in: v0.104.1 [2][3]
- Published: 2025‑11‑25 [3]
So: v0.99.1 is vulnerable to CVE‑2025‑65965, and you need v0.104.1+ to be patched. [2][3]
Sources: [1] [2] [3]
HIGH vulnerability: anchore/grype v0.99.1 has a credential disclosure flaw (GHSA-6gxw-85q2-q646).
This version writes registry credentials unsanitized to JSON output when using --output json=<file> or --file modes. The vulnerability affects versions v0.68.0 through v0.104.0. Although an indirect dependency, upgrade to v0.104.1 or later to resolve this. If you cannot upgrade immediately, use --output json with stdout redirection (> file.json) instead of file-based output.
🧰 Tools
🪛 OSV Scanner (2.3.2)
[HIGH] 81-81: github.com/anchore/grype 0.99.1: Grype has a credential disclosure vulnerability in its JSON output in github.com/anchore/grype
(GO-2025-4160)
[HIGH] 81-81: github.com/anchore/grype 0.99.1: Grype has a credential disclosure vulnerability in its JSON output
🤖 Prompt for AI Agents
In `@go.mod` at line 81, Update the indirect dependency on
github.com/anchore/grype to a safe version (v0.104.1 or later) in go.mod;
specifically change the module requirement for "github.com/anchore/grype" from
v0.99.1 to at least v0.104.1, then run go get github.com/anchore/grype@v0.104.1
(or newer) and go mod tidy to update the module graph and vendor files so the
vulnerable versions are removed.
| github.com/olekukonko/ll v0.0.9 // indirect | ||
| github.com/olekukonko/tablewriter v1.0.9 // indirect | ||
| github.com/olvrng/ujson v1.1.0 // indirect | ||
| github.com/open-policy-agent/opa v0.70.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
GHSA-6m8w-jc87-6cr7 OPA Rego injection fix version
💡 Result:
For GHSA-6m8w-jc87-6cr7 (CVE-2025-46569) affecting Open Policy Agent (OPA) via HTTP Data API path injection of Rego, the issue is fixed in OPA v1.4.0.
- Affected: all versions < 1.4.0
- Fix version: 1.4.0 (upgrade to 1.4.0 or later) [1][2]
Sources: [1] [2]
🏁 Script executed:
# Get context around line 321 in go.mod to understand the dependency chain
head -330 go.mod | tail -20Repository: kubescape/backend
Length of output: 1164
🏁 Script executed:
# Find which direct dependencies pull in OPA as transitive
# First, get all direct dependencies
grep -v "//" go.mod | grep -v "require" | awk 'NF && !/^$/' | head -50
# Search for dependencies that commonly depend on OPA
rg "kubewarden|styra|kyverno|gatekeep|conftest" go.modRepository: kubescape/backend
Length of output: 896
🏁 Script executed:
# Use go mod why to trace the dependency chain
cd . && go mod why github.com/open-policy-agent/opa 2>/dev/null || echo "go command not available, using grep alternative"
# Search go.sum for OPA references to see all versions
grep "open-policy-agent/opa" go.sum | head -20Repository: kubescape/backend
Length of output: 349
🏁 Script executed:
# Search for which dependency might be pulling OPA by looking at go.sum patterns
# Check if there are any other indirect OPA dependencies mentioned
rg "open-policy-agent" go.sum
# Check recent releases or tags of kubescape/opa-utils to see if newer versions use OPA 1.4.0+
# First, let's look for any documentation about dependencies in the repo
find . -maxdepth 2 -name "*.md" -type f | xargs grep -l "opa-utils\|open-policy-agent" 2>/dev/null || echo "No matching docs found"Repository: kubescape/backend
Length of output: 268
🌐 Web query:
kubescape/opa-utils latest version OPA dependency upgrade
💡 Result:
- Latest
kubescape/opa-utilsversion: v0.0.292 (released Jan 21, 2026). [1] - OPA dependency in the latest version:
github.com/open-policy-agent/opa v0.61.0(pergo.modonmain, which corresponds to the latest release line). [2]
Where the OPA 1.x upgrade happened (historically):
- Tag v0.0.288: “upgrade open-policy-agent to 1.x”. [3]
- Tag v0.0.289: bump
github.com/open-policy-agent/opafrom 1.3.0 to 1.4.0 (Dependabot PR). [3][4]
If you’re doing an OPA 1.x upgrade now
- In addition to bumping the module version in
go.mod, OPA recommends switching Go imports fromgithub.life-white.uk/open-policy-agent/opa/...togithub.life-white.uk/open-policy-agent/opa/v1/...(e.g.,opa/v1/rego,opa/v1/ast, etc.). [5]
Sources: [1] (github.com) [2] (github.com) [3] (github.com) [4] (github.com) [5] (openpolicyagent.org)
Citations:
- 1: https://github.com/kubescape/opa-utils
- 2: https://github.com/kubescape/opa-utils/blob/main/go.mod
- 3: https://github.com/kubescape/opa-utils/tags
- 4: kubescape/opa-utils@f54318a
- 5: https://www.openpolicyagent.org/docs/v0-upgrade?utm_source=openai
Upgrade kubescape/opa-utils to resolve HIGH vulnerability in indirect OPA dependency.
The open-policy-agent/opa v0.70.0 dependency has a HIGH severity Rego injection flaw via HTTP Data API path (GHSA-6m8w-jc87-6cr7). The fix is available in OPA v1.4.0+, which is included in kubescape/opa-utils v0.0.289 onwards. Upgrade from v0.0.283 to at least v0.0.289 (or the latest v0.0.292).
Note: OPA 1.x requires updating import paths from github.com/open-policy-agent/opa/... to github.com/open-policy-agent/opa/v1/... across the codebase.
🧰 Tools
🪛 OSV Scanner (2.3.2)
[HIGH] 321-321: github.com/open-policy-agent/opa 0.70.0: OPA server Data API HTTP path injection of Rego in github.com/open-policy-agent/opa
(GO-2025-3660)
[HIGH] 321-321: github.com/open-policy-agent/opa 0.70.0: OPA server Data API HTTP path injection of Rego
🤖 Prompt for AI Agents
In `@go.mod` at line 321, Update the kubescape/opa-utils module to v0.0.289 (or
v0.0.292) in go.mod to pull OPA v1.4.0+ and eliminate the HIGH Rego injection
vulnerability (currently pulling github.com/open-policy-agent/opa v0.70.0
indirectly); run go get github.com/kubescape/opa-utils@v0.0.289 and go mod tidy
to update the lockfile. After upgrading, search the codebase for imports
beginning with github.com/open-policy-agent/opa and update them to
github.com/open-policy-agent/opa/v1 where used (adjust any affected packages or
tests), then run go test/build to ensure compile-time fixes are applied.
| github.com/opencontainers/go-digest v1.0.0 // indirect | ||
| github.com/opencontainers/image-spec v1.1.1 // indirect | ||
| github.com/opencontainers/runtime-spec v1.2.1 // indirect | ||
| github.com/opencontainers/selinux v1.12.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
GHSA-cgrx-mc8f-2prm opencontainers selinux vulnerability
💡 Result:
GHSA-cgrx-mc8f-2prm (aka CVE-2025-52881) is a High-severity vulnerability in github.com/opencontainers/runc (and a related fix in github.com/opencontainers/selinux) involving procfs write redirection that can be abused from inside a container to cause container escape and/or host denial of service (e.g., by redirecting privileged /proc writes to sensitive procfs nodes). It also includes an attack where LSM label writes become a no-op, potentially letting the container process run with runc’s own LSM label (on SELinux, likely container_runtime_t). [1][2]
Affected / fixed versions
- runc affected:
<= 1.2.7,<= 1.3.2,<= 1.4.0-rc.2→ fixed in1.2.8,1.3.3,1.4.0-rc.3[1] - opencontainers/selinux affected:
<= 1.12.0→ fixed in1.13.0[1][2]
Practical guidance
- Upgrade to a patched runc version (and
opencontainers/selinuxv1.13.0+if you vendor it). [1][2] - Don’t rely on SELinux/container-selinux alone as a mitigation here; the advisory notes LSM profiles often won’t meaningfully block the more powerful redirected-write attacks. [1]
- Prefer rootless containers where possible to reduce impact. [1]
Sources: [1] [2]
Update opencontainers/selinux to v1.13.0+ to address container escape (GHSA-cgrx-mc8f-2prm).
GHSA-cgrx-mc8f-2prm is a HIGH severity vulnerability in opencontainers/runc with a related fix in opencontainers/selinux. Affected selinux versions are ≤ 1.12.0. Upgrade to selinux v1.13.0 or later. Also verify that opencontainers/runc is upgraded to a patched version (≥ 1.2.8, ≥ 1.3.3, or ≥ 1.4.0-rc.3 depending on the release branch).
🧰 Tools
🪛 OSV Scanner (2.3.2)
[HIGH] 326-326: github.com/opencontainers/selinux 1.12.0: Container escape and DDoS due to arbitrary write gadgets and procfs write redirects in github.com/opencontainers/runc
(GO-2025-4098)
[HIGH] 326-326: github.com/opencontainers/selinux 1.12.0: runc container escape and denial of service due to arbitrary write gadgets and procfs write redirects
🤖 Prompt for AI Agents
In `@go.mod` at line 326, The go.mod currently pins
github.com/opencontainers/selinux to v1.12.0 which is vulnerable
(GHSA-cgrx-mc8f-2prm); update the module requirement for
github.com/opencontainers/selinux to v1.13.0 or later in go.mod, run `go get
github.com/opencontainers/selinux@v1.13.0` (or newer) and then `go mod tidy`/`go
mod vendor` to propagate the change, and also verify any dependency on
opencontainers/runc is upgraded to a patched release (>= v1.2.8, >= v1.3.3, or
>= v1.4.0-rc.3) to fully address the container escape vulnerability.
| --gogo_out=. \ | ||
| --gogo_opt=paths=source_relative \ | ||
| storage_service.proto |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, find and read the storage_service.proto file
fd --type f 'storage_service.proto' -x cat {}Repository: kubescape/backend
Length of output: 5520
🏁 Script executed:
# Check the Makefile to see its full context
fd --type f 'Makefile' -path '*/client/v1/proto/*' -x cat -n {}Repository: kubescape/backend
Length of output: 229
🏁 Script executed:
# Look for any git history that might show the previous state
cd pkg/client/v1/proto && git log --oneline -10 Makefile 2>/dev/null || echo "No git history available"Repository: kubescape/backend
Length of output: 118
🌐 Web query:
protoc-gen-gogo syntax for gRPC generation and --gogo_opt flag support documentation
💡 Result:
protoc-gen-gogo gRPC generation syntax
protoc-gen-gogo (and the related gogo generators) enable gRPC stubs via the grpc sub-plugin, passed as a parameter to --gogo_out:
protoc -I=. -I=$GOPATH/src -I=$GOPATH/src/github.com/gogo/protobuf/protobuf \
--gogo_out=plugins=grpc:. \
my.protoThis “comma-separated options, then : then output dir” format (and the available parameters) is documented in the gogo/protobuf README:
plugins=plugin1+plugin2(gogo’s repo providesgrpc)paths=(import|source_relative)Mfoo/bar.proto=quux/shmeimport mapping (plus some deprecated options) [1]
--gogo_opt flag support (how it’s supposed to work)
protoc can also accept an additional per-plugin options flag of the form --<name>_opt (e.g., --gogo_opt). Internally, protoc concatenates:
- options provided in
--gogo_out=<opts>:<outdir> - plus options provided via one or more
--gogo_opt=<opts>
and passes the combined comma-joined string to the generator. This behavior is documented in the protobuf compiler CommandLineInterface API/header comments (example shown as--foo_out ... --foo_opt ...). [2]
So, these are equivalent in effect:
# All options embedded in --gogo_out
protoc --gogo_out=plugins=grpc,paths=source_relative:. my.proto# Options split across --gogo_out and --gogo_opt
protoc --gogo_out=paths=source_relative:. \
--gogo_opt=plugins=grpc \
my.protoNotes
- gogo/protobuf itself is deprecated, per its upstream repo notice. [3]
Sources: gogo/protobuf README (parameters + gRPC plugin) [1], protoc CommandLineInterface docs/comments (how *_opt combines with *_out) [2], gogo/protobuf deprecation notice [3].
[1] (chromium.googlesource.com)
[2] (cobalt.googlesource.com)
[3] (github.com)
Citations:
- 1: https://chromium.googlesource.com/external/github.com/gogo/protobuf/%2B/refs/heads/master/README?utm_source=openai
- 2: https://cobalt.googlesource.com/cobalt/%2B/HEAD%5E/third_party/protobuf/src/google/protobuf/compiler/command_line_interface.h?utm_source=openai
- 3: https://github.com/gogo/protobuf?utm_source=openai
Add missing plugins=grpc option to generate gRPC service stubs.
The proto file defines RPC services that require the plugins=grpc option to generate gRPC stubs. Currently, the Makefile is missing this option.
Proposed fix
`@protoc` \
--proto_path=. \
--proto_path=../../../../vendor \
--gogo_out=. \
- --gogo_opt=paths=source_relative \
+ --gogo_opt=plugins=grpc,paths=source_relative \
storage_service.proto📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| --gogo_out=. \ | |
| --gogo_opt=paths=source_relative \ | |
| storage_service.proto | |
| --gogo_out=. \ | |
| --gogo_opt=plugins=grpc,paths=source_relative \ | |
| storage_service.proto |
🤖 Prompt for AI Agents
In `@pkg/client/v1/proto/Makefile` around lines 9 - 11, The Makefile invocation
for protoc-gen-gogo is missing the gRPC plugin flag so service stubs aren't
generated; update the gogo generation line used for storage_service.proto so it
includes the grpc plugin (e.g., change the current --gogo_out=. / --gogo_opt
usage to supply plugins=grpc, for example --gogo_out=plugins=grpc:. and keep
--gogo_opt=paths=source_relative or alternatively add plugins=grpc to --gogo_opt
like --gogo_opt=plugins=grpc,paths=source_relative) so that
storage_service.proto generates gRPC service stubs.
Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@go.mod`:
- Around line 20-22: Update the PR text that labels the three dependencies as
"major version bumps": remove that phrase and replace it with language that they
are coordinated recent releases (google.golang.org/grpc v1.78.0,
k8s.io/apimachinery v0.35.0, k8s.io/client-go v0.35.0), note that the k8s
packages correspond to Kubernetes v1.35.0 and grpc v1.78.0 is a v1 minor
release, and add a short sentence advising to verify testing/compatibility in
your environment rather than calling them major upgrades.
🧹 Nitpick comments (2)
go.mod (1)
9-9: Direct dependency on deprecatedgogo/protobuf.
gogo/protobufv1.3.2 is the final release of a now-deprecated project. Adding it as a new direct dependency increases long-term maintenance burden. If this is required for compatibility withkubescape/storageor other ecosystem dependencies that already use gogo-generated types, that's understandable — but worth a comment ingo.modexplaining the rationale so future maintainers know it's intentional.pkg/client/v1/proto/Makefile (1)
19-19:gogo/protobufis officially deprecated and no longer maintained.Consider either:
- Documenting the rationale for using it (e.g., if required by
kubescape/storageor other dependencies), or- Migrating to
google.golang.org/protobufwithplanetscale/vtprotobuf(protoc-gen-go-vtproto), which provides gogo-equivalent performance optimizations for the modern protobuf API.
| google.golang.org/grpc v1.78.0 | ||
| k8s.io/apimachinery v0.35.0 | ||
| k8s.io/client-go v0.35.0 |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
k8s.io client-go v0.35.0 release
💡 Result:
k8s.io/client-go v0.35.0 is the client-go tag that corresponds to Kubernetes v1.35.0, which was released on 2025-12-17 (so v0.35.0 became available at that time as part of the v1.35.0 release publishing process). [1][2]
Install/pin it with:
go get k8s.io/client-go@v0.35.0For “what changed”, use the Kubernetes v1.35.0 changelog (client-go is published from Kubernetes staging): CHANGELOG-1.35.md. [3][4]
Sources: [1] https://kubernetes.io/releases [2] https://pkg.go.dev/k8s.io/client-go/kubernetes [3] https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.35.md [4] https://github.com/kubernetes/client-go
🌐 Web query:
google.golang.org/grpc v1.78.0 release
💡 Result:
google.golang.org/grpc v1.78.0 corresponds to grpc-go “Release 1.78.0”, published December 23, 2025 (tag v1.78.0, commit 9df039e). [1][2]
Highlights (from the v1.78.0 release notes)
- Behavior changes
- Client URL validation now rejects target URLs with unbracketed colons in the hostname (aligned with Go 1.26+ URL parsing/validation). [1]
- Transport client returns
Unknownon malformedgrpc-status. [1] - xDS resolver: drop previous route resources and error when no matching virtual host; retain last valid resource to avoid transient failures after a successful update. [1]
- New features
- OpenTelemetry stats: add backend service label to weighted round robin (A89) metrics. [1]
- OpenTelemetry stats: add subchannel metrics (intended to eventually replace pickfirst metrics). [1]
- Client: graceful switch balancer close now waits for pending goroutines; add
experimental.AcceptCompressorsto restrict advertisedgrpc-accept-encoding. [1]
- Bug fixes
- xDS: fix
StringMatcherregex behavior whenignore_case=true. [1] - Client connectivity-state and
OnFinishinvocation fixes; xdsClient race fix. [1]
- xDS: fix
- Performance
mem: round up pool allocations >1MiB to nearest 4KiB. [1]
Sources: GitHub release notes for grpc-go v1.78.0 [1] and the v1.78.0 tag/commit metadata [2].
🌐 Web query:
k8s.io/apimachinery v0.35.0 release Kubernetes
💡 Result:
k8s.io/apimachinery v0.35.0 is the staged library release that corresponds to Kubernetes v1.35.0 (the tag message explicitly says “Kubernetes release v1.35.0” and is based on the Kubernetes v1.35.0 release tag). It was tagged on Dec 17, 2025. [1] [2]
Sources:
[1] kubernetes/apimachinery tags (v0.35.0)
[2] kubernetes/kubernetes release (v1.35.0)
🏁 Script executed:
# Check the go.mod file to see the context and current state of dependencies
cat -n go.mod | head -250Repository: kubescape/backend
Length of output: 14448
Remove the characterization of these as "major version bumps"—they are coordinated recent releases, not major upgrades.
The versions exist and were released in December 2025 (k8s.io v0.35.0 on 12/17, grpc v1.78.0 on 12/23). These are not major version bumps: k8s.io/apimachinery and k8s.io/client-go v0.35.0 correspond to Kubernetes v1.35.0, and google.golang.org/grpc v1.78.0 is a minor release within the v1 major version. All k8s.io packages in the dependency tree are aligned to v0.35.0, and sigs.k8s.io/controller-runtime v0.21.0 should be compatible. However, these are very recent releases (1–2 months old); verify they have been adequately tested in your environment and dependency ecosystem.
🤖 Prompt for AI Agents
In `@go.mod` around lines 20 - 22, Update the PR text that labels the three
dependencies as "major version bumps": remove that phrase and replace it with
language that they are coordinated recent releases (google.golang.org/grpc
v1.78.0, k8s.io/apimachinery v0.35.0, k8s.io/client-go v0.35.0), note that the
k8s packages correspond to Kubernetes v1.35.0 and grpc v1.78.0 is a v1 minor
release, and add a short sentence advising to verify testing/compatibility in
your environment rather than calling them major upgrades.
Summary by CodeRabbit