$ the-wire · showcase
kubectl always uses WebSockets; node-problem-detector 1.37.0 patches three CVEs
By RepoJournal · Filed · About Kubernetes · Composed from the cited sources · methodology
kubectl's WebSocket migration reaches GA and the environment variables that gated it are gone, while node-problem-detector ships a release built on a stack of gRPC and OpenTelemetry CVE fixes.
kubectl: always use WebSockets for exec, attach and port-forward kubernetes/kubernetes
KUBECTL_REMOTE_COMMAND_WEBSOCKETS and KUBECTL_PORT_FORWARD_WEBSOCKETS are removed; kubectl now tries WebSockets first and falls back to SPDY for exec, attach, cp and port-forward. If your tooling or CI sets either variable to force the old transport, that pin no longer does anything.
v1.37.0 kubernetes/node-problem-detector
The release replaces OpenCensus with OpenTelemetry for metrics export, with Prometheus metric names deliberately unchanged, and adds per-rule invoke_interval for custom plugin monitor rules plus zswap metrics memory/zswap_bytes_used and memory/zswap_compression_efficiency. Health checks moved to kube-proxy /livez to avoid false alerts during Cluster Autoscaler scale-down, and Chainguard joins t...
Bump google.golang.org/grpc to v1.83.2 to fix CVEs kubernetes/node-problem-detector
google.golang.org/grpc goes to v1.83.2, addressing CVE-2026-84304 (GO-2026-6348), which is reachable through the gRPC client used by the metric exporters, along with CVE-2026-84445 (GO-2026-6443) and CVE-2026-84303 (GO-2026-6441). The bumps came from scanning the post-submit image and branch head with Trivy, Grype, Docker Scout and govulncheck.
Bump go.opentelemetry.io/otel modules to v1.45.0 to fix CVE-2026-81870 kubernetes/node-problem-detector
The go.opentelemetry.io/otel modules move to v1.45.0 for CVE-2026-81870 (GO-2026-6505), where exporter config logging may leak endpoint URLs, reachable through OpenTelemetry meter provider initialization. Prometheus exporters pick up the same fix at v0.67.0.
generators: skip unexported fields of types with custom unmarshalling kubernetes/kube-openapi
openapi-gen and the names_match API rule now skip unexported, non-embedded fields of types with custom unmarshalling, using the same implementsCustomUnmarshalling check mustEnforceDefault relies on; plain structs are unchanged. The change exists for kubernetes/kubernetes, where metav1.FieldsV1 stores an interned unique.Handle[string], the planned new default.
Action items
- → Upgrade kubernetes/node-problem-detector to v1.37.0 to pick up the gRPC v1.83.2 and OpenTelemetry v1.45.0 CVE fixes kubernetes/node-problem-detector [plan]
- → Remove KUBECTL_REMOTE_COMMAND_WEBSOCKETS and KUBECTL_PORT_FORWARD_WEBSOCKETS from scripts and CI config before the ne... kubernetes/kubernetes [plan]
