linkerd2/24.11.8-r0: cve remediation

[octo-sts]

linkerd2/24.11.8-r0: fix GHSA-h97m-ww89-6jmq/GHSA-v778-237x-gjrc/

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/linkerd2.advisories.yaml

[octo-sts]

Gen AI suggestions to solve the build error:

Based on the build log and error output, here's my analysis:

• Detected Error: Not explicitly shown in logs, but appears to fail during "go/bump" step with Go module dependency updates

• Error Category: Version/Dependency

• Failure Point: During go/bump step trying to update dependencies:

  - uses: go/bump
    with:
      deps: golang.org/x/[email protected] [email protected]

• Root Cause Analysis: The go/bump step is trying to update dependencies to specific versions that may be incompatible with the project's Go module requirements

• Suggested Fix:

1. Update the go/bump step to use compatible versions:

  - uses: go/bump
    with:
      deps: golang.org/x/crypto@latest golang.org/x/net@latest

Or remove the go/bump step entirely if the project manages its own dependencies.

• Explanation:

• The linkerd2 project likely has specific version requirements defined in go.mod
• Forcing specific versions via go/bump may break dependency graph resolution
• Letting the project manage its own dependencies through go.mod is safer
• The idna package is part of golang.org/x/net, so specifying it separately may cause conflicts

• Additional Notes:

• Linkerd2 is a complex Go project with many dependencies
• Version bumps should ideally be coordinated with upstream releases
• Consider checking go.mod in the upstream repository for proper version constraints

• References:

• https://github.com/linkerd/linkerd2/blob/main/go.mod
• https://pkg.go.dev/golang.org/x/crypto
• https://pkg.go.dev/golang.org/x/net/idna

Try either removing the go/bump step or updating it to use latest tagged versions that are compatible with the project's requirements.

[kranurag7]

idna was bumped to 1.0.3 which here linkerd/linkerd2#13385 (bump url ends up bumping idna here)