[DNM] Release v0.42.1#2728
Closed
theakshaypant wants to merge 3 commits into
Closed
Conversation
Update go-jose v3 and v4 to patch security vulnerability in JWE and JWS handling. Signed-off-by: Akshay Pant <akpant@redhat.com>
Addresses CVE-2026-40161 (GHSA-wjxp-xrpv-xpff), a high-severity vulnerability where the git resolver API mode leaks system-configured API tokens to user-controlled serverURL endpoints. Also includes path traversal hardening for volume mount validation using filepath.Clean. Signed-off-by: Akshay Pant <akpant@redhat.com>
Add cache transform functions for the Repository and PipelineRun informers, stripping large unnecessary fields before objects enter the informer cache. Inspired by tektoncd/pipeline#9316. For Repository objects, ManagedFields, Annotations and Status are stripped. The reconciler never reads Repository annotations or Status from the lister; Status is always fetched fresh via direct API call before updates. For PipelineRun objects, ManagedFields and large Spec and Status fields are stripped. The watcher only needs Annotations, Spec.Status (pending check), Status.Conditions, and timing fields. All other data is fetched directly from the API when needed. Benchmark results with production-realistic objects show an 89% JSON size reduction for Repository objects (5.6KB to 600B) and 94% for PipelineRun objects (10.7KB to 677B), with corresponding 8-10x reductions in heap allocation per cached object. Signed-off-by: Akshay Pant <akpant@redhat.com> Asisted-by: Claude <noreply@anthropic.com>
theakshaypant
force-pushed
the
release-v0.42.1
branch
from
e2a4bdb to
1761873
Compare
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces cache transform functions for Repository and PipelineRun objects to reduce memory consumption in the PAC watcher informer caches. By stripping non-essential fields like ManagedFields, Annotations, and large Status or Spec sub-fields before caching, the implementation significantly lowers the heap footprint. The changes include comprehensive unit tests and benchmarks demonstrating the memory savings. Additionally, several dependencies were updated, and the GitLab provider was adjusted to correctly handle the "skipped" status conclusion. I have no feedback to provide as no review comments were submitted.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📝 Description of the Change
Changes included:
e2a4bdb perf(informer): add TransformFuncs to reduce cache memory usage
bda0fa4 chore(deps): bump tektoncd/pipeline to v1.9.3
adb71b4 fix(deps): update go-jose to fix GHSA-78h2-9frx-2jm8
5f5514e fix(gitlab): map skipped status correctly
f541028 chore(deps): update grpc and tektoncd/pipeline
🔗 Linked GitHub Issue
Fixes #
🧪 Testing Strategy
🤖 AI Assistance
AI assistance can be used for various tasks, such as code generation,
documentation, or testing.
Please indicate whether you have used AI assistance
for this PR and provide details if applicable.
Important
Slop will be simply rejected, if you are using AI assistance you need to make sure you
understand the code generated and that it meets the project's standards. you
need at least know how to run the code and deploy it (if needed). See
startpaac to make it easy
to deploy and test your code changes.
If the majority of the code in this PR was generated by an AI, please add a
Co-authored-bytrailer to your commit message.For example:
Co-authored-by: Claude noreply@anthropic.com
✅ Submitter Checklist
fix:,feat:) matches the "Type of Change" I selected above.make testandmake lintlocally to check for and fix anyissues. For an efficient workflow, I have considered installing
pre-commit and running
pre-commit installtoautomate these checks.