fix: [CI-23227]: bump vbatts/tar-split to v0.12.2

Resolves the High-severity tar-split (archive/tar) vulnerability flagged by Snyk in the kaniko-docker plugin binary. tar-split is pulled in transitively via go-containerregistry -> estargz. go mod tidy also nudged urfave/cli v1.22.15 -> v1.22.16 (benign patch). Co-authored-by: Cursor <cursoragent@cursor.com>
fix: [CI-23227]: Vuln-Fix-Kaniko
2026-06-24 18:11:25 +08:00 · 2026-06-24 15:18:44 +05:30 · 2026-06-24 15:16:17 +05:30 · 2026-06-18 22:05:06 +05:30 · 2026-04-28 17:40:42 +05:30
15 changed files with 55 additions and 55 deletions
@@ -11,7 +11,7 @@ platform:

 steps:
 - name: build
-  image: golang:1.22.4
+  image: golang:1.25.10
  commands:
  - go test ./...
  - sh scripts/build.sh
@@ -178,7 +178,7 @@ pool:

 steps:
 - name: build
-  image: golang:1.22.4
+  image: golang:1.25.10
  commands:
  - go test ./...
  - sh scripts/build.sh
@@ -37,7 +37,7 @@ pipeline:
                      identifier: Build
                      spec:
                        connectorRef: Plugins_Docker_Hub_Connector
-                        image: golang:1.25.7
+                        image: golang:1.25.10
                        shell: Sh
                        command: |-
                          go test ./...
@@ -322,7 +322,7 @@ pipeline:
                      identifier: Build_and_Test
                      spec:
                        connectorRef: Plugins_Docker_Hub_Connector
-                        image: golang:1.25.7
+                        image: golang:1.25.10
                        shell: Sh
                        command: |-
                          go test ./...
@@ -618,7 +618,7 @@ pipeline:
                      identifier: build_binary
                      spec:
                        connectorRef: Plugins_Docker_Hub_Connector
-                        image: golang:1.25.7
+                        image: golang:1.25.10
                        shell: Sh
                        command: |-
                          go test ./...
@@ -923,7 +923,7 @@ pipeline:
                      identifier: build_binary
                      spec:
                        connectorRef: Plugins_Docker_Hub_Connector
-                        image: golang:1.25.7
+                        image: golang:1.25.10
                        shell: Sh
                        command: |-
                          go test ./...
@@ -35,7 +35,7 @@ pipeline:
                      identifier: Build
                      spec:
                        connectorRef: Plugins_Docker_Hub_Connector
-                        image: golang:1.25.7
+                        image: golang:1.25.10
                        shell: Sh
                        command: |-
                          go test ./...
@@ -320,7 +320,7 @@ pipeline:
                      identifier: Build_and_Test
                      spec:
                        connectorRef: Plugins_Docker_Hub_Connector
-                        image: golang:1.25.7
+                        image: golang:1.25.10
                        shell: Sh
                        command: |-
                          go test ./...
@@ -1,5 +1,5 @@
-FROM harnesscommunity/kaniko-executor:1.25.0-linux-amd64
+FROM harnesscommunity/kaniko-executor:1.25.15-linux-amd64

-ENV KANIKO_VERSION=1.25.0
+ENV KANIKO_VERSION=1.25.15
 ADD release/linux/amd64/kaniko-acr /kaniko/
 ENTRYPOINT ["/kaniko/kaniko-acr"]
@@ -1,8 +1,8 @@
-FROM harnesscommunity/kaniko-executor:1.25.0-linux-arm64
+FROM harnesscommunity/kaniko-executor:1.25.15-linux-arm64

 ENV HOME /root
 ENV USER root

-ENV KANIKO_VERSION=1.25.0
+ENV KANIKO_VERSION=1.25.15
 ADD release/linux/arm64/kaniko-acr /kaniko/
 ENTRYPOINT ["/kaniko/kaniko-acr"]
@@ -1,5 +1,5 @@
-FROM harnesscommunity/kaniko-executor:1.25.0-linux-amd64
+FROM harnesscommunity/kaniko-executor:1.25.15-linux-amd64

-ENV KANIKO_VERSION=1.25.0
+ENV KANIKO_VERSION=1.25.15
 ADD release/linux/amd64/kaniko-docker /kaniko/
 ENTRYPOINT ["/kaniko/kaniko-docker"]
@@ -1,8 +1,8 @@
-FROM harnesscommunity/kaniko-executor:1.25.0-linux-arm64
+FROM harnesscommunity/kaniko-executor:1.25.15-linux-arm64

 ENV HOME /root
 ENV USER root

-ENV KANIKO_VERSION=1.25.0
+ENV KANIKO_VERSION=1.25.15
 ADD release/linux/arm64/kaniko-docker /kaniko/
 ENTRYPOINT ["/kaniko/kaniko-docker"]
@@ -1,5 +1,5 @@
-FROM harnesscommunity/kaniko-executor:1.25.0-linux-amd64
+FROM harnesscommunity/kaniko-executor:1.25.15-linux-amd64

-ENV KANIKO_VERSION=1.25.0
+ENV KANIKO_VERSION=1.25.15
 ADD release/linux/amd64/kaniko-ecr /kaniko/
 ENTRYPOINT ["/kaniko/kaniko-ecr"]
@@ -1,8 +1,8 @@
-FROM harnesscommunity/kaniko-executor:1.25.0-linux-arm64
+FROM harnesscommunity/kaniko-executor:1.25.15-linux-arm64

 ENV HOME /root
 ENV USER root
-ENV KANIKO_VERSION=1.25.0
+ENV KANIKO_VERSION=1.25.15

 ADD release/linux/arm64/kaniko-ecr /kaniko/
 ENTRYPOINT ["/kaniko/kaniko-ecr"]
@@ -1,5 +1,5 @@
-FROM harnesscommunity/kaniko-executor:1.25.0-linux-amd64
+FROM harnesscommunity/kaniko-executor:1.25.15-linux-amd64

-ENV KANIKO_VERSION=1.25.0
+ENV KANIKO_VERSION=1.25.15
 ADD release/linux/amd64/kaniko-gar /kaniko/
 ENTRYPOINT ["/kaniko/kaniko-gar"]
@@ -1,8 +1,8 @@
-FROM harnesscommunity/kaniko-executor:1.25.0-linux-arm64
+FROM harnesscommunity/kaniko-executor:1.25.15-linux-arm64

 ENV HOME /root
 ENV USER root
-ENV KANIKO_VERSION=1.25.0
+ENV KANIKO_VERSION=1.25.15

 ADD release/linux/arm64/kaniko-gar /kaniko/
 ENTRYPOINT ["/kaniko/kaniko-gar"]
@@ -1,5 +1,5 @@
-FROM harnesscommunity/kaniko-executor:1.25.0-linux-amd64
+FROM harnesscommunity/kaniko-executor:1.25.15-linux-amd64

-ENV KANIKO_VERSION=1.23.2
+ENV KANIKO_VERSION=1.25.15
 ADD release/linux/amd64/kaniko-gcr /kaniko/
 ENTRYPOINT ["/kaniko/kaniko-gcr"]
@@ -1,8 +1,8 @@
-FROM harnesscommunity/kaniko-executor:1.25.0-linux-arm64
+FROM harnesscommunity/kaniko-executor:1.25.15-linux-arm64

 ENV HOME /root
 ENV USER root
-ENV KANIKO_VERSION=1.23.2
+ENV KANIKO_VERSION=1.25.15

 ADD release/linux/arm64/kaniko-gcr /kaniko/
 ENTRYPOINT ["/kaniko/kaniko-gcr"]
@@ -17,8 +17,8 @@ require (
 	github.com/pkg/errors v0.9.1
 	github.com/sirupsen/logrus v1.9.3
 	github.com/stretchr/testify v1.11.1
-	github.com/urfave/cli v1.22.15
-	golang.org/x/mod v0.26.0
+	github.com/urfave/cli v1.22.16
+	golang.org/x/mod v0.28.0
 )

 require (
@@ -49,13 +49,13 @@ require (
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	github.com/vbatts/tar-split v0.11.6 // indirect
-	golang.org/x/crypto v0.41.0 // indirect
-	golang.org/x/net v0.43.0 // indirect
-	golang.org/x/sync v0.16.0 // indirect
-	golang.org/x/sys v0.35.0 // indirect
-	golang.org/x/text v0.28.0 // indirect
+	github.com/vbatts/tar-split v0.12.2 // indirect
+	golang.org/x/crypto v0.43.0 // indirect
+	golang.org/x/net v0.45.0 // indirect
+	golang.org/x/sync v0.17.0 // indirect
+	golang.org/x/sys v0.37.0 // indirect
+	golang.org/x/text v0.30.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

-go 1.25.7
+go 1.25.10
@@ -10,7 +10,7 @@ github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJ
 github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 h1:XRzhVemXdgvJqCH0sFfrBUTnUJSBrBf7++ypk+twtRs=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk=
-github.com/BurntSushi/toml v1.3.2/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
+github.com/BurntSushi/toml v1.4.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/aws/aws-sdk-go v1.44.52 h1:kHLbYJj59C7VrsLM4gm7pxsvaNIvhXCCIDYEFFoQ+VE=
 github.com/aws/aws-sdk-go v1.44.52/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
 github.com/aws/aws-sdk-go-v2 v1.16.7 h1:zfBwXus3u14OszRxGcqCDS4MfMCv10e8SMJ2r8Xm0Ns=
@@ -43,7 +43,7 @@ github.com/containerd/stargz-snapshotter/estargz v0.16.3 h1:7evrXtoh1mSbGj/pfRcc
 github.com/containerd/stargz-snapshotter/estargz v0.16.3/go.mod h1:uyr4BfYfOj3G9WBVE8cOlQmXAbPN9VEQpBBeJIuOipU=
 github.com/coreos/go-semver v0.3.0 h1:wkHLiw0WNATZnSG7epLsujiMCgPAc9xhjJ4tgnAxmfM=
 github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
-github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/cpuguy83/go-md2man/v2 v2.0.5/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/cpuguy83/go-md2man/v2 v2.0.6 h1:XJtiaUW6dEEqVuZiMTn1ldk455QWwEIsMIJlo5vtkx0=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -111,29 +111,29 @@ github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXl
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/urfave/cli v1.22.15 h1:nuqt+pdC/KqswQKhETJjo7pvn/k4xMUxgW6liI7XpnM=
-github.com/urfave/cli v1.22.15/go.mod h1:wSan1hmo5zeyLGBjRJbzRTNk8gwoYa2B9n4q9dmRIc0=
-github.com/vbatts/tar-split v0.11.6 h1:4SjTW5+PU11n6fZenf2IPoV8/tz3AaYHMWjf23envGs=
-github.com/vbatts/tar-split v0.11.6/go.mod h1:dqKNtesIOr2j2Qv3W/cHjnvk9I8+G7oAkFDFN6TCBEI=
-golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
-golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
-golang.org/x/mod v0.26.0 h1:EGMPT//Ezu+ylkCijjPc+f4Aih7sZvaAr+O3EHBxvZg=
-golang.org/x/mod v0.26.0/go.mod h1:/j6NAhSk8iQ723BGAUyoAcn7SlD7s15Dp9Nd/SfeaFQ=
+github.com/urfave/cli v1.22.16 h1:MH0k6uJxdwdeWQTwhSO42Pwr4YLrNLwBtg1MRgTqPdQ=
+github.com/urfave/cli v1.22.16/go.mod h1:EeJR6BKodywf4zciqrdw6hpCPk68JO9z5LazXZMn5Po=
+github.com/vbatts/tar-split v0.12.2 h1:w/Y6tjxpeiFMR47yzZPlPj/FcPLpXbTUi/9H7d3CPa4=
+github.com/vbatts/tar-split v0.12.2/go.mod h1:eF6B6i6ftWQcDqEn3/iGFRFRo8cBIMSJVOpnNdfTMFA=
+golang.org/x/crypto v0.43.0 h1:dduJYIi3A3KOfdGOHX8AVZ/jGiyPa3IbBozJ5kNuE04=
+golang.org/x/crypto v0.43.0/go.mod h1:BFbav4mRNlXJL4wNeejLpWxB7wMbc79PdRGhWKncxR0=
+golang.org/x/mod v0.28.0 h1:gQBtGhjxykdjY9YhZpSlZIsbnaE2+PgjfLWUQTnoZ1U=
+golang.org/x/mod v0.28.0/go.mod h1:yfB/L0NOf/kmEbXjzCPOx1iK1fRutOydrCMsqRhEBxI=
 golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
-golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
-golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
-golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/net v0.45.0 h1:RLBg5JKixCy82FtLJpeNlVM0nrSqpCRYzVU1n8kj0tM=
+golang.org/x/net v0.45.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY=
+golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
+golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
-golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.37.0 h1:fdNQudmxPjkdUTPnLn5mdQv7Zwvbvpaxqs831goi9kQ=
+golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
-golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
+golang.org/x/text v0.30.0 h1:yznKA/E9zq54KzlzBEAWn1NXSQ8DIp/NYMy88xJjl4k=
+golang.org/x/text v0.30.0/go.mod h1:yDdHFIX9t+tORqspjENWgzaCVXgk0yYnYuSZ8UzzBVM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
Author	SHA1	Message	Date
Gargithakur01	3b94e510b6	fix: [CI-23227]: bump vbatts/tar-split to v0.12.2 Resolves the High-severity tar-split (archive/tar) vulnerability flagged by Snyk in the kaniko-docker plugin binary. tar-split is pulled in transitively via go-containerregistry -> estargz. go mod tidy also nudged urfave/cli v1.22.15 -> v1.22.16 (benign patch). Co-authored-by: Cursor <cursoragent@cursor.com>	2026-06-24 15:18:44 +05:30
Gargithakur01	c4e18cc2c3	fix: [CI-23227]: Vuln-Fix-Kaniko Co-authored-by: Cursor <cursoragent@cursor.com>	2026-06-24 15:16:17 +05:30
vinayakharness2026	bddbd90032	fix: remediate vulnerabilities in plugins/kaniko - upgrade kaniko-executor base to 1.25.15 and x/crypto to v0.43.0 (#169 )	2026-06-18 22:05:06 +05:30
Devansh Mathur	9e87be9c9a	fix: [CI-22323]: Adding PLUGIN_ prefix for ACR vars. (#168 )	2026-04-28 17:40:42 +05:30