Update github.com/fxamacker/cbor/v2 to v2.9.1

Parser hardening for the kube-apiserver CBOR deserializer (PRs #750,
#753, #757): fixes tag-1 epoch float64 overflow into time.Time fields
(directly reachable via DecTagOptional decode path), RawMessage clone
defense, and keyasint type-confusion fixes.

Kubernetes-commit: dc29a934e460eb29130de6724787ca1b677e31e0
This commit is contained in:
Davanum Srinivas
2026-04-23 21:43:02 -04:00
committed by Kubernetes Publisher
parent b7ee5f3764
commit 1bcc1dadb4
2 changed files with 45 additions and 33 deletions
+19 -11
View File
@@ -8,10 +8,10 @@ godebug default=go1.26
require (
golang.org/x/time v0.14.0
k8s.io/api v0.0.0-20260424110828-103005c29633
k8s.io/apimachinery v0.0.0-20260424110436-5138150d0bbc
k8s.io/client-go v0.0.0-20260424111355-1f2893e6110a
k8s.io/code-generator v0.0.0-20260424112400-c459c16f4dc7
k8s.io/api v0.0.0
k8s.io/apimachinery v0.0.0
k8s.io/client-go v0.0.0
k8s.io/code-generator v0.0.0
k8s.io/klog/v2 v2.140.0
k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a
k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2
@@ -21,7 +21,7 @@ require (
require (
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
github.com/emicklei/go-restful/v3 v3.13.0 // indirect
github.com/fxamacker/cbor/v2 v2.9.0 // indirect
github.com/fxamacker/cbor/v2 v2.9.1 // indirect
github.com/go-logr/logr v1.4.3 // indirect
github.com/go-openapi/jsonpointer v0.21.0 // indirect
github.com/go-openapi/jsonreference v0.20.2 // indirect
@@ -39,14 +39,14 @@ require (
github.com/x448/float16 v0.8.4 // indirect
go.yaml.in/yaml/v2 v2.4.3 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect
golang.org/x/mod v0.34.0 // indirect
golang.org/x/net v0.53.0 // indirect
golang.org/x/mod v0.33.0 // indirect
golang.org/x/net v0.52.0 // indirect
golang.org/x/oauth2 v0.35.0 // indirect
golang.org/x/sync v0.20.0 // indirect
golang.org/x/sys v0.43.0 // indirect
golang.org/x/term v0.42.0 // indirect
golang.org/x/text v0.36.0 // indirect
golang.org/x/tools v0.43.0 // indirect
golang.org/x/sys v0.42.0 // indirect
golang.org/x/term v0.41.0 // indirect
golang.org/x/text v0.35.0 // indirect
golang.org/x/tools v0.42.0 // indirect
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
@@ -56,3 +56,11 @@ require (
sigs.k8s.io/randfill v1.0.0 // indirect
sigs.k8s.io/yaml v1.6.0 // indirect
)
replace (
k8s.io/api => ../api
k8s.io/apimachinery => ../apimachinery
k8s.io/client-go => ../client-go
k8s.io/code-generator => ../code-generator
k8s.io/streaming => ../streaming
)