[DNM] Release v0.39.6#2730
Conversation
Upgrade google.golang.org/grpc to v1.79.3 to fix CVE-2026-33186 (GHSA-p77j-4mvh-x3m3), a critical HTTP/2 :path validation flaw that allows bypassing authorization rules in gRPC interceptors. Signed-off-by: Akshay Pant <akpant@redhat.com>
Update go-jose v3 and v4 to patch security vulnerability in JWE and JWS handling. Signed-off-by: Akshay Pant <akpant@redhat.com>
Add cache transform functions for the Repository and PipelineRun informers, stripping large unnecessary fields before objects enter the informer cache. Inspired by tektoncd/pipeline#9316. For Repository objects, ManagedFields, Annotations and Status are stripped. The reconciler never reads Repository annotations or Status from the lister; Status is always fetched fresh via direct API call before updates. For PipelineRun objects, ManagedFields and large Spec and Status fields are stripped. The watcher only needs Annotations, Spec.Status (pending check), Status.Conditions, and timing fields. All other data is fetched directly from the API when needed. Benchmark results with production-realistic objects show an 89% JSON size reduction for Repository objects (5.6KB to 600B) and 94% for PipelineRun objects (10.7KB to 677B), with corresponding 8-10x reductions in heap allocation per cached object. Signed-off-by: Akshay Pant <akpant@redhat.com> Asisted-by: Claude <noreply@anthropic.com>
Addresses CVE-2026-40161 (GHSA-wjxp-xrpv-xpff), a high-severity vulnerability where the git resolver API mode leaks system-configured API tokens to user-controlled serverURL endpoints. Also includes path traversal hardening for volume mount validation using filepath.Clean. Signed-off-by: Akshay Pant <akpant@redhat.com>
There was a problem hiding this comment.
Code Review
This pull request introduces cache transform functions for Repository and PipelineRun objects to optimize memory usage in the PAC watcher informer caches by stripping unnecessary fields. It includes comprehensive benchmarks demonstrating significant memory savings and unit tests for correctness. Additionally, the Go toolchain and several dependencies, including Tekton Pipeline, were updated. A critical issue was identified in the PipelineRunForCache implementation where assigning a zero-value struct to the TaskRunTemplate pointer field would cause a compilation error; this should be changed to nil as suggested.
| pr.Spec.Params = nil | ||
| pr.Spec.Workspaces = nil | ||
| pr.Spec.TaskRunSpecs = nil | ||
| pr.Spec.TaskRunTemplate = tektonv1.PipelineTaskRunTemplate{} |
There was a problem hiding this comment.
In Tekton v1, PipelineRunSpec.TaskRunTemplate is a pointer (*PipelineTaskRunTemplate). Assigning a zero-value struct (tektonv1.PipelineTaskRunTemplate{}) will cause a compilation error as you cannot assign a struct to a pointer field. It should be set to nil to maintain consistency with the other stripped pointer fields in this function. This in-place modification is the accepted pattern for informer TransformFuncs in this repository.
| pr.Spec.TaskRunTemplate = tektonv1.PipelineTaskRunTemplate{} | |
| pr.Spec.TaskRunTemplate = nil |
References
- When implementing a Kubernetes informer TransformFunc, it is an accepted pattern to modify the object in-place to strip fields for cache optimization. A DeepCopy is not required as the modification is the intended behavior before the object is cached.
📝 Description of the Change
Changes included:
54cb7bf chore(deps): bump tektoncd/pipeline to v1.6.2
636bae9 perf(informer): add TransformFuncs to reduce cache memory usage
501cbd0 fix(deps): update go-jose to fix GHSA-78h2-9frx-2jm8
ff5b628 chore(deps): update grpc to v1.79.3
🔗 Linked GitHub Issue
Fixes #
🧪 Testing Strategy
🤖 AI Assistance
AI assistance can be used for various tasks, such as code generation,
documentation, or testing.
Please indicate whether you have used AI assistance
for this PR and provide details if applicable.
Important
Slop will be simply rejected, if you are using AI assistance you need to make sure you
understand the code generated and that it meets the project's standards. you
need at least know how to run the code and deploy it (if needed). See
startpaac to make it easy
to deploy and test your code changes.
If the majority of the code in this PR was generated by an AI, please add a
Co-authored-bytrailer to your commit message.For example:
Co-authored-by: Claude noreply@anthropic.com
✅ Submitter Checklist
fix:,feat:) matches the "Type of Change" I selected above.make testandmake lintlocally to check for and fix anyissues. For an efficient workflow, I have considered installing
pre-commit and running
pre-commit installtoautomate these checks.