Security Vulnerability: Go Package: github.com/grpc-ecosystem/go-grpc-prometheus - End of Life Notification (EOL)

[anjaniprayaga]

Hi Team,

The latest version of node-feature-discovery image is using the component "Go Package: github.com/grpc-ecosystem/go-grpc-prometheus", which has reached its end of life(PFA). Request you to kindly use the version that is in support.

Thanks,
Anjani

[fmuyassarov]

Thanks for reporting this. Unfortunately, this is an indirect dependency. We would need to bump up those components like etcd, controller manager and etc. I see there is already progress in some of the components like etcd: kubernetes/kubernetes#128419.

[fmuyassarov]

/assign

[marquiz]

Yes, that is an indirect dependency from kubernetes

$ go mod why -m github.com/grpc-ecosystem/go-grpc-prometheus
# github.com/grpc-ecosystem/go-grpc-prometheus
sigs.k8s.io/node-feature-discovery/pkg/nfd-master
k8s.io/kubernetes/pkg/controller
k8s.io/kubernetes/pkg/apis/core/validation
k8s.io/kubernetes/pkg/cluster/ports
k8s.io/cloud-provider/options
k8s.io/apiserver/pkg/server/options
k8s.io/apiserver/pkg/storage/storagebackend/factory
github.com/grpc-ecosystem/go-grpc-prometheus

There's not much we can do about that until kubernetes is fixed