Security fix for 2026 August - #192
Merged
Merged
Conversation
Go module upgrades: - golang.org/x/net v0.55.0 → v0.56.0 (watchdog, hivedscheduler, frameworkcontroller, cilium, k8s-host-device-plugin, k8s-rdma-shared-dev-plugin, kube-scheduler, reverseproxy, job-exporter) - golang.org/x/text → v0.39.0 (all above services) - google.golang.org/grpc → v1.82.1 (cilium, k8s-host-device-plugin, k8s-rdma-shared-dev-plugin, kube-scheduler, job-exporter, grafana) - github.com/pion/dtls/v3 v3.0.11 → removed (reverseproxy) - Upgrade frp v0.68.1 → v0.70.1 (reverseproxy) Node.js package upgrades: - axios → 1.18.x (alert-handler, rest-server, job-status-change-notification) - body-parser → 2.3.0 (alert-handler, rest-server) - brace-expansion → 5.0.7+ (all three Node.js services) - fast-uri → 3.1.4 (rest-server, job-status-change-notification) - js-yaml → 4.3.0 (job-status-change-notification) System packages fixed via no-cache rebuild: - libkrb5support0, libsqlite3-0, tar, wget (job-exporter, log-manager-nginx, postgresql-init-client, reverseproxy, cilium-agent, cilium-envoy) Co-Authored-By: Claude <noreply@anthropic.com>
- alert-handler: regenerate yarn.lock to fix nested body-parser 2.2.1 (express/node_modules/body-parser was not covered by resolution) - job-status-change-notification: brace-expansion 5.0.7 → 5.0.8 - cilium-agent: add cel-go v0.29.0 pin - kube-scheduler: add cel-go v0.29.0 pin Co-Authored-By: Claude <noreply@anthropic.com>
- Replace react-router-dom ^7.13.2 with react-router ^8.3.0 (react-router v8 merged react-router-dom into react-router) - Update all 6 import statements from 'react-router-dom' to 'react-router' Co-Authored-By: Claude <noreply@anthropic.com>
Rebuilt 6 images to fix glibc USN-8611-1 (CVSS 9.8) and gopacket GHSA-g6v3-7xmc-w563: - cilium-agent: add gopacket v1.6.1 - cilium-envoy: libc6 2.39-0ubuntu8.8 - grafana, job-exporter, log-manager-nginx, postgresql-init-client: libc6 2.35-0ubuntu3.14 Co-Authored-By: Claude <noreply@anthropic.com>
Rui Gao (hippogr)
temporarily deployed
to
auto-test
August 12, 2026 06:53 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
Contributor
There was a problem hiding this comment.
Pull request overview
This PR is a dependency/security refresh across the web portal (React), Node-based services, Go modules, and several container build Dockerfiles.
Changes:
- Replace/update routing and JS dependencies in the web portal, plus bump various Node package versions/locks for security.
- Bump multiple Go indirect dependencies (notably
golang.org/x/*) and adjust container builds to pull newer module versions. - Update pinned versions for third-party components built in Dockerfiles (e.g., FRP, grpc/text).
Reviewed changes
Copilot reviewed 21 out of 27 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| src/webportal/src/app/job-submission/yaml-edit-page.jsx | Switches router hook import source. |
| src/webportal/src/app/job-submission/job-wizard.jsx | Switches router hook import source. |
| src/webportal/src/app/job-submission/job-submission.jsx | Switches router component imports (router entrypoint). |
| src/webportal/src/app/job-submission/components/topbar/import-config.jsx | Switches router hook import source. |
| src/webportal/src/app/job-submission/components/submission-section.jsx | Switches router hook import source. |
| src/webportal/src/app/job-submission-demo/job-submission.jsx | Switches router component imports (demo entrypoint). |
| src/webportal/package.json | Updates React router dependency. |
| src/watchdog/src/go.sum | Bumps golang.org/x/* module sums. |
| src/watchdog/src/go.mod | Bumps golang.org/x/* indirect module versions. |
| src/rest-server/yarn.lock | Updates lockfile for security-related JS dependency bumps. |
| src/rest-server/package.json | Bumps axios/body-parser/js-yaml and related overrides/resolutions. |
| src/pylon/build/reverseproxy.common.dockerfile | Updates FRP version and adjusts Go dependency patching during build. |
| src/job-exporter/build/job-exporter.common.dockerfile | Adds Go module bumps (text/grpc) during nerdctl build. |
| src/hivedscheduler/src/go.sum | Bumps golang.org/x/* module sums. |
| src/hivedscheduler/src/go.mod | Bumps golang.org/x/* indirect module versions. |
| src/hivedscheduler/build/kube-scheduler.k8s.dockerfile | Updates x/net, adds x/text, bumps grpc/cel-go during build. |
| src/grafana/build/grafana.common.dockerfile | Adds grpc bump + go mod tidy in plugin build stage. |
| src/frameworkcontroller/src/go.sum | Bumps golang.org/x/* module sums. |
| src/frameworkcontroller/src/go.mod | Bumps golang.org/x/* indirect module versions. |
| src/device-plugin/build/k8s-rdma-shared-dev-plugin.k8s.dockerfile | Updates Go deps and alters build approach for the device plugin binary. |
| src/device-plugin/build/k8s-host-device-plugin.k8s.dockerfile | Bumps pinned Go module requirements (net/text/grpc). |
| src/cilium/build/cilium-operator.common.dockerfile | Bumps x/net, adds x/text, bumps grpc during build. |
| src/cilium/build/cilium-agent.common.dockerfile | Bumps x/net, adds x/text, bumps grpc/cel-go/gopacket during build. |
| src/alert-manager/src/job-status-change-notification/yarn.lock | Updates lockfile for security-related JS dependency bumps. |
| src/alert-manager/src/job-status-change-notification/package.json | Bumps axios/brace-expansion/fast-uri and adds js-yaml pin. |
| src/alert-manager/src/alert-handler/yarn.lock | Updates lockfile for security-related JS dependency bumps. |
| src/alert-manager/src/alert-handler/package.json | Bumps axios/body-parser/js-yaml and related overrides/resolutions. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
zhogu
approved these changes
Aug 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security fix for August 2026