local-static-provisioner/2.8.0-r6: cve remediation

[octo-sts]

local-static-provisioner/2.8.0-r6: fix GHSA-4x4m-3c2p-qppc

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/local-static-provisioner.advisories.yaml

---

"Breadcrumbs" for this automated service

• Source Code: https://go/cve-remedy-automation-source
• Logs: https://go/cve-remedy-automation-logs
• Docs: (not provided yet)

Inspected git repositories: https://github.com/kubernetes-sigs/sig-storage-local-static-provisioner@v2.8.0

[octo-sts]

📦 Build Failed: Missing Dependency

go: sigs.k8s.io/sig-storage-local-static-provisioner/pkg/util imports k8s.io/kubernetes/pkg/volume/util/fs imports k8s.io/kubernetes/pkg/volume/util/fsquota imports k8s.io/kubernetes/pkg/features imports k8s.io/client-go/features: module k8s.io/client-go@latest found (v1.5.2, replaced by k8s.io/client-go@v0.29.14), but does not contain package k8s.io/client-go/features

Build Details

Category	Details
Build System	melange/go
Failure Point	go/bump step - gobump execution during 'go mod tidy'

Root Cause Analysis 🔍

The k8s.io/client-go module version v0.29.14 (which replaced v1.5.2) does not contain the required package k8s.io/client-go/features that is being imported through the dependency chain. This indicates a version compatibility issue where the Go module dependency resolution is finding an incompatible version of k8s.io/client-go that lacks the expected package structure.

---

🔍 Build failure fix suggestions

Found similar build failures that have been fixed in the past and analyzed them to suggest a fix:

Similar PRs with fixes

• cluster-api-helm-controller/0.3.2-r4: cve remediation #63421

Suggested Changes

File: local-static-provisioner.yaml

• addition at line 32-35 (pipeline[0] (go/bump step))
  Original:

  - uses: go/bump
    with:
      deps: |-
        golang.org/x/net@v0.38.0
        golang.org/x/oauth2@v0.27.0
        golang.org/x/crypto@v0.45.0
        k8s.io/kubernetes@v1.31.12

Replacement:

  - uses: go/bump
    with:
      deps: |-
        golang.org/x/net@v0.38.0
        golang.org/x/oauth2@v0.27.0
        golang.org/x/crypto@v0.45.0
        k8s.io/kubernetes@v1.31.12
      replaces: |-
        k8s.io/client-go=k8s.io/client-go@v0.31.12

Content:

Add a replaces directive to pin k8s.io/client-go to version v0.31.12, which should contain the required k8s.io/client-go/features package that is missing in the problematic v0.29.14 version

Click to expand fix analysis

Analysis

The similar fix shows a pattern of resolving Kubernetes module compatibility issues by adding explicit version constraints in the go/bump step. In the fixed example, when k8s.io/apiserver@latest (v0.33.4) was missing required packages, the solution was to add a "replaces" directive that pinned k8s.io/apiserver to an older, compatible version (v0.31.12). This approach downgrades problematic modules to versions that contain the required package structure while maintaining overall compatibility.

Click to expand fix explanation

Explanation

The current build failure occurs because k8s.io/client-go@v0.29.14 (which replaced v1.5.2) doesn't contain the k8s.io/client-go/features package. Following the pattern from the similar fix, we need to explicitly pin k8s.io/client-go to a compatible version. Version v0.31.12 is chosen to align with the existing k8s.io/kubernetes@v1.31.12 dependency, ensuring version consistency across the Kubernetes ecosystem components. The k8s.io/client-go/features package was introduced in newer versions of the client-go library, so using v0.31.12 (which is newer than v0.29.14) should contain the required package while maintaining compatibility with other Kubernetes dependencies.

Click to expand alternative approaches

Alternative Approaches

• Pin k8s.io/client-go to a different version like v0.30.x if v0.31.12 introduces other incompatibilities
• Update k8s.io/kubernetes to a version that's compatible with the latest k8s.io/client-go, though this might require more extensive testing
• Add multiple replace directives for other Kubernetes components if version conflicts emerge with just the client-go fix

---

Was this comment helpful? Please use 👍 or 👎 reactions on this comment.

[Dentrax]

Upstream have a PR to mitigate this: kubernetes-sigs/sig-storage-local-static-provisioner#511

But no new releases yet, maybe we should do cherry-pick?

[octo-sts]

This vulnerability remediation is stale and no longer needed. 👋

Advisory CGA-4mx5-8jmv-wf2q has the latest event type of "pending-upstream-fix"

View with: cg advisory show CGA-4mx5-8jmv-wf2q
Or view on GitHub: https://github.com/wolfi-dev/advisories/blob/main/local-static-provisioner.advisories.yaml

ID:      CGA-4mx5-8jmv-wf2q
Package: local-static-provisioner
Aliases: CVE-2025-5187 GHSA-4x4m-3c2p-qppc
Events:
  - "scan/v1" at 2025-08-29 13:07:00 UTC
  - "pending-upstream-fix" at 2025-09-01 13:56:40 UTC

🔀 v2 advisory logic would not have closed this PR: Found 6 advisories, but 2 of them are not resolved (CGA-5wfr-x5h3-pjqj, CGA-j8c3-8pww-h7gr).

[octo-sts]

This vulnerability remediation is stale and no longer needed. 👋

Advisory CGA-4mx5-8jmv-wf2q has the latest event type of "pending-upstream-fix"

View with: cg advisory show CGA-4mx5-8jmv-wf2q
Or view on GitHub: https://github.com/wolfi-dev/advisories/blob/main/local-static-provisioner.advisories.yaml

ID:      CGA-4mx5-8jmv-wf2q
Package: local-static-provisioner
Aliases: CVE-2025-5187 GHSA-4x4m-3c2p-qppc
Events:
  - "scan/v1" at 2025-08-29 13:07:00 UTC
  - "pending-upstream-fix" at 2025-09-01 13:56:40 UTC

🔀 v2 advisory logic would not have closed this PR: Found 4 advisories, but 2 of them are not resolved (CGA-c8fg-pghp-425f, CGA-6cjf-m5fg-6rmx).

[octo-sts]

This vulnerability remediation is stale and no longer needed. 👋

Advisory CGA-4mmj-8hf8-4vv5 has the latest event type of "FIXED"

View with: cg adv show CGA-4mmj-8hf8-4vv5

ID:      CGA-4mmj-8hf8-4vv5
Package: local-static-provisioner
Aliases: CVE-2025-5187 GHSA-4x4m-3c2p-qppc GO-2025-3915 CGA-27qc-3f8h-hx6p
Events:
  - "DETECTION" at 2025-08-29 13:07:00 UTC
  - "PENDING_UPSTREAM_FIX" at 2025-09-01 13:56:40 UTC
  - "FIXED" at 2025-11-07 09:58:26 UTC