From a5800dd0860ff0e0955855b3aea8e7a2d82d11bd Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 29 Oct 2026 22:54:25 +0000 Subject: [PATCH 1/2] fix(tunnel): bump go-jose to v4.1.6 in frpc build The vuln (images) Trivy scan fails on master and every PR: the frpc binary in the tunnel-frp image embeds github.com/go-jose/go-jose/v4 v4.1.4 (CVE-2026-116587, HIGH, fixed in 4.1.6). #811 only bumped the operator; tunnel/frpc/go.mod still pinned 4.1.4. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Claude --- tunnel/frpc/go.mod | 2 +- tunnel/frpc/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/tunnel/frpc/go.mod b/tunnel/frpc/go.mod index c9e283cab..860eb39f4 100644 --- a/tunnel/frpc/go.mod +++ b/tunnel/frpc/go.mod @@ -15,7 +15,7 @@ require ( github.com/coreos/go-oidc/v3 v3.18.0 // indirect github.com/fatedier/frp v0.71.0 // indirect github.com/fatedier/golib v0.8.2 // indirect - github.com/go-jose/go-jose/v4 v4.1.4 // indirect + github.com/go-jose/go-jose/v4 v4.1.6 // indirect github.com/golang/snappy v0.0.4 // indirect github.com/gorilla/mux v1.8.1 // indirect github.com/hashicorp/yamux v0.1.1 // indirect diff --git a/tunnel/frpc/go.sum b/tunnel/frpc/go.sum index 9c0bf698b..73d2adc13 100644 --- a/tunnel/frpc/go.sum +++ b/tunnel/frpc/go.sum @@ -23,8 +23,8 @@ github.com/fatedier/golib v0.8.2 h1:02n2Dg7KJ7rR7p7n4/6hBUjaLQf2J7EiHYZQsgGTvww= github.com/fatedier/golib v0.8.2/go.mod h1:ArUGvPg2cOw/py2RAuBt46nNZH2VQ5Z70p109MAZpJw= github.com/fatedier/yamux v0.0.0-20250825093530-d0154be01cd6 h1:u92UUy6FURPmNsMBUuongRWC0rBqN6gd01Dzu+D21NE= github.com/fatedier/yamux v0.0.0-20250825093530-d0154be01cd6/go.mod h1:c5/tk6G0dSpXGzJN7Wk1OEie8grdSJAmeawId9Zvd34= -github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= -github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= +github.com/go-jose/go-jose/v4 v4.1.6 h1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4= +github.com/go-jose/go-jose/v4 v4.1.6/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q= github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A= github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= From 906f4d7295a4964733d755b913596d89c9d35a37 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 29 Oct 2026 23:32:21 +0000 Subject: [PATCH 2/2] fix(operator): replace deprecated Result.Requeue in restore lifecycle staticcheck SA1019 fails lint (operator) on master since #760: use RequeueAfter: time.Nanosecond, matching restore_controller.go. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Claude --- operator/internal/controller/restore_lifecycle.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/operator/internal/controller/restore_lifecycle.go b/operator/internal/controller/restore_lifecycle.go index 91916ea54..ff0b64bfe 100644 --- a/operator/internal/controller/restore_lifecycle.go +++ b/operator/internal/controller/restore_lifecycle.go @@ -293,7 +293,7 @@ func (r *RestoreReconciler) cleanupRestore(ctx context.Context, rs *gameplanev1a return ctrl.Result{}, err } if progressed { - return ctrl.Result{Requeue: true}, nil + return ctrl.Result{RequeueAfter: time.Nanosecond}, nil } if !stopped { return ctrl.Result{RequeueAfter: 5 * time.Second}, nil