$ the-wire · showcase
Registry client stops fetching foreign bundle layers, client-go bumps x/net for two CVEs
By RepoJournal · Filed · About Kubernetes · Composed from the cited sources · methodology
kubernetes/release closed a signing-time SSRF path in sigstore bundle handling while client-go published the golang.org/x/net 0.62.0 bump for cve-2026-78661 and cve-2026-97045.
Merge pull request #58611 from themoriarti/uk-concepts-multi-tenancy kubernetes/website
The Ukrainian localization gained pages for security multi-tenancy, the security checklist, linux-kernel-security-constraints and service-accounts. Docs-only, with no effect on cluster behavior.
Skip foreign bundle layer URLs and check their digest kubernetes/release
A sigstore bundle layer carrying `urls` used to make the registry client fetch the blob from those hosts when the registry did not have it, and go-containerregistry refuses only private and link-local IP literals, not host names that resolve to them, so a planted referrer could push the signing step at any HTTPS host name. The client now skips foreign bundle layer URLs and checks their digest i...
Merge pull request #143642 from yue9944882/bump-golang-net-cve kubernetes/client-go
The publishing bot merged the golang.org/x/net bump to 0.62.0 for cve-2026-78661 and cve-2026-97045. Two of those CVEs ride in on a transitive dependency, so a go.sum re-resolve is enough to pick up the fix.
Merge pull request #143290 from michaelasp/workqueue-pause kubernetes/client-go
client-go/workqueue adds a Pausable interface to stop and restart item retrieval. Existing queue consumers are untouched until a caller opts into the new interface.
Merge pull request #142938 from mborsz/client-go-connection-pool kubernetes/client-go
A second client-go change adds support for a pool of connections to the API server. The long tail was routine: the remaining vsphere and release dependency bumps, plus kubernetes/org membership additions.
Action items
- → Upgrade golang.org/x/net to 0.62.0 in any module built on client-go to pick up the fixes for cve-2026-78661 and cve-2... kubernetes/client-go [plan]
