mirrors/velero
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/velero.git synced 2026-07-27 02:23:29 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
6,140 Commits 58 Branches 185 Tags
5675a744d9a4deeeeb4043bf431dfd0ca36da351
Commit Graph
125 Commits
Author SHA1 Message Date
Xun Jiang/Bruce JiangandGitHub 25402b6209 [1.18] Deprecate inactive maintained packages (#9912)
Run the E2E test on kind / get-go-version (push) Successful in 59s
Details
Run the E2E test on kind / setup-test-matrix (push) Successful in 4s
Details
Main CI / get-go-version (push) Successful in 14s
Details
Run the E2E test on kind / build (push) Failing after 1m48s
Details
Run the E2E test on kind / run-e2e-test (push) Has been skipped
Details
Main CI / Build (push) Failing after 25s
Details 
* Replace github.com/robfig/cron/v3 by github.com/netresearch/go-cron

Replace k8s.io/utils/pointer with k8s.io/utils/ptr

Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>

* Replace gopkg.in/yaml.v3 by go.yaml.in/yaml/v3

Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>

* Replace github.com/joho/godotenv.

Move the needed code into Velero repository.

Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>

* Replace github.com/pkg/errors by github.com/cockroachdb/errors

Change errors.Cause to errors.Is, because github.com/cockroachdb/errors
New() function create a error with error stack with depth 1, but
github.com/pkg/errors's New() function create error with no depth.

Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>

---------

Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>
Signed-off-by: Xun Jiang/Bruce Jiang <59276555+blackpiglet@users.noreply.github.com>
 2026-07-10 11:20:34 +08:00
Xun Jiang/Bruce JiangandGitHub c8ca0670d2 Bump depedencies to fix CVEs for v1.18.2 (#9919) 
* Bump depedencies to fix CVEs for v1.18.2

* Bump base image to paketobuildpacks/run-jammy-tiny:0.2.139
* Bump Golang to 1.25.11-trixie
* Bump golang.org/x/crypto to v0.53.0

Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>

* Fix GitHub action failures.

* Use helm/kind-action to replace engineerd/setup-kind
* Update MinIO Dockerfile URL

Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>

---------

Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>
 2026-06-15 09:23:23 -04:00
Xun Jiang/Bruce JiangandGitHub f90a37302e Merge pull request #9884 from blackpiglet/jxun/1.18/bump_dependency_packages 
[1.18] Remove several deperacated or inactively maintained packages
 2026-06-10 13:47:07 +08:00
Xun Jiang 47b3192670 Bump k8s library versions to v0.33.11 
Bump the ginkgo version in the E2E test Makefile.

Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>
 2026-05-12 12:01:56 +08:00
Xun Jiang 5e3cb1eb68 Bump Velero dependencies to latest version. 
* Fix UT errors: non-constant format string in call to ...
* Fix linter issues.
* Not touch the k8s client version and the controller-runtime version.

Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>
 2026-05-11 16:15:20 +08:00
Xun Jiang d245d3b0d5 Bump golang.net/x/net to 0.51.0 to fix CVE-2026-27141 
Bump paketobuildpacks/run-jammy-tiny to latest tag: 0.2.129
Update the minio Dockerfile directory.

Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>
 2026-05-06 14:58:26 +08:00
Xun Jiang 780f5518a5 Fix CVEs for v1.18.1 
* Bump golang to 1.25.9-trixie
* Bump jammy to 0.2.126
* Bump google.golang.org/grpc and google.golang.org/api in restic to 1.79.3 to fix CVE-2026-33186
* Bump github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream to 1.7.8 to fix GHSA-xmrv-pmrh-hhx2
* Bump github.com/aws/aws-sdk-go-v2/service/s3 to 1.97.3 to fix GHSA-xmrv-pmrh-hhx2
* Bump github.com/moby/spdystream to 0.5.1 to fix CVE-2026-35469
* Bump go.opentelemetry.io/otel/sdk to 1.43.0 to fix CVE-2026-39883

Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>
 2026-04-24 16:44:28 +08:00
Shubham Pampattiwar 124824a478 Bump external-snapshotter to v8.4.0 for VGS v1beta2 support 
Kubernetes 1.34 introduced VolumeGroupSnapshot v1beta2 API and
deprecated v1beta1. Distributions running K8s 1.34+ (e.g. OpenShift
4.21+) have removed v1beta1 VGS CRDs entirely, breaking Velero's
VGS functionality on those clusters.

This change bumps external-snapshotter/client/v8 from v8.2.0 to
v8.4.0 and migrates all VGS API usage from v1beta1 to v1beta2.

The v1beta2 API is structurally compatible - the Spec-level types
(GroupSnapshotHandles, VolumeGroupSnapshotContentSource) are
unchanged. The Status-level change (VolumeSnapshotHandlePairList
replaced by VolumeSnapshotInfoList) does not affect Velero as it
does not directly consume that type.

Fixes #9694

Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
 2026-04-10 17:16:58 -07:00
dependabot[bot]andXun Jiang/Bruce Jiang 4cb9c7b9a2 Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 
Bumps [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) from 4.1.3 to 4.1.4.
- [Release notes](https://github.com/go-jose/go-jose/releases)
- [Commits](https://github.com/go-jose/go-jose/compare/v4.1.3...v4.1.4)

---
updated-dependencies:
- dependency-name: github.com/go-jose/go-jose/v4
  dependency-version: 4.1.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-08 10:11:48 +08:00
dependabot[bot]andXun Jiang 6055bd5478 Bump google.golang.org/grpc from 1.77.0 to 1.79.3 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.77.0 to 1.79.3.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.77.0...v1.79.3)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.79.3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-19 16:33:59 +08:00
Xun Jiang ffa65605a6 Bump go.opentelemetry.io/otel/sdk to 1.40.0 to fix CVE-2026-24051. 
Bump Linux base image to paketobuildpacks/run-jammy-tiny:0.2.104

Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>
 2026-03-02 17:09:23 +08:00
Lyndon-Li c556603ce2 bump kopia to 0.22.3 
Signed-off-by: Lyndon-Li <lyonghui@vmware.com>
 2025-12-30 16:44:52 +08:00
dependabot[bot]andXun Jiang/Bruce Jiang 960a596e7b Bump golang.org/x/crypto from 0.40.0 to 0.45.0 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.40.0 to 0.45.0.
- [Commits](https://github.com/golang/crypto/compare/v0.40.0...v0.45.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.45.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-11-24 17:09:09 +08:00
Priyansh ChoudharyandGitHub f1476defde Update AzureAD Microsoft Authentication Library to v1.5.0 (#9244)
Run the E2E test on kind / build (push) Failing after 9s
Details
Run the E2E test on kind / setup-test-matrix (push) Successful in 3s
Details
Run the E2E test on kind / run-e2e-test (push) Has been skipped
Details
Main CI / Build (push) Failing after 4s
Details
Close stale issues and PRs / stale (push) Failing after 6m3s
Details
Trivy Nightly Scan / Trivy nightly scan (velero-plugin-for-aws, main) (push) Failing after 38s
Details
Trivy Nightly Scan / Trivy nightly scan (velero-plugin-for-gcp, main) (push) Failing after 2s
Details
Trivy Nightly Scan / Trivy nightly scan (velero-plugin-for-microsoft-azure, main) (push) Failing after 6s
Details
Trivy Nightly Scan / Trivy nightly scan (velero, main) (push) Failing after 11m22s
Details 
* Update AzureAD Microsoft Authentication Library to v1.5.0
Signed-off-by: Priyansh Choudhary <im1706@gmail.com>

* Added Changelog
Signed-off-by: Priyansh Choudhary <im1706@gmail.com>

---------

Signed-off-by: Priyansh Choudhary <im1706@gmail.com>
 2025-09-11 14:07:46 -04:00
Xun Jiang e8208097ba Bump k8s library to v1.33. 
Replace deprecated EventExpansion method with WithContext methods.
Modify UTs.
Align the E2E ginkgo CLI version with go.mod

Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>
 2025-09-10 17:58:38 +08:00
Lyndon-Li e6377ff2fd Merge branch 'main' into bump-up-kopia-0.21.1 2025-07-22 13:42:37 +08:00
Lyndon-Li b5502330e5 bump up kopia to v0.21.1 
Signed-off-by: Lyndon-Li <lyonghui@vmware.com>
 2025-07-22 13:40:12 +08:00
Shubham Pampattiwar a73a150d98 Accommodate VGS workflows in PVC CSI plugin 
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>

Add changelog file

Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>

make update

Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>

lint fix

Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>

add unit tests for getVSForPVC func

Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>

Use v1beta1 instead of v1 v1alpha1

Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>

go mod tidy

Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>

update updateVGSCreatedVS func to use retry on conflict

Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>

make update minor fix

Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>

fix ut assert

Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>

Address PR feedback

Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>

minor updates

Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>

remove unsused func and add todo for dep upgrades

Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
 2025-07-21 11:36:40 -07:00
Lyndon-Li 2e7d11e3b6 bump kopia v0.20.1 
Signed-off-by: Lyndon-Li <lyonghui@vmware.com>
 2025-06-18 13:35:12 +08:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		08929d2e1c Bump golang.org/x/net from 0.36.0 to 0.38.0 (#8872) 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.36.0 to 0.38.0.
- [Commits](https://github.com/golang/net/compare/v0.36.0...v0.38.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-version: 0.38.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2025-04-17 02:39:30 -04:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		efad9a0e94 Bump github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2 (#8806) 
Bumps [github.com/golang-jwt/jwt/v5](https://github.com/golang-jwt/jwt) from 5.2.1 to 5.2.2.
- [Release notes](https://github.com/golang-jwt/jwt/releases)
- [Changelog](https://github.com/golang-jwt/jwt/blob/main/VERSION_HISTORY.md)
- [Commits](https://github.com/golang-jwt/jwt/compare/v5.2.1...v5.2.2)

---
updated-dependencies:
- dependency-name: github.com/golang-jwt/jwt/v5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2025-03-24 15:01:52 +08:00
dependabot[bot]andGitHub 55d1592aaa Bump golang.org/x/net from 0.34.0 to 0.36.0 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.34.0 to 0.36.0.
- [Commits](https://github.com/golang/net/compare/v0.34.0...v0.36.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-03-13 01:58:14 +00:00
Tiger KaovilaiandGitHub 5dbf002da7 go-mod-upgrade: golang.org/x/oauth2@v0.27.0 (#8752) 
Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
 2025-03-05 09:21:16 -05:00
Tiger Kaovilai bf2b1185bf CVE-2025-22869 + go1.23 
Including https://go-review.googlesource.com/c/crypto/+/652135 patch to fix CVE

```sh
go get golang.org/x/crypto@v0.35.0 toolchain@none && go mod tidy
```

Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
 2025-03-04 09:47:16 -06:00
Lyndon-Li f12b9c15b2 bump up kopia to 0.19.0 
Signed-off-by: Lyndon-Li <lyonghui@vmware.com>
 2025-02-27 13:35:47 +08:00
Tiger KaovilaiandGitHub a3cee616dc Upgrade go.mod k8s.io/ go.mod to v0.31.3 and set klog.SetLogger() for client-go (#8450)
Run the E2E test on kind / build (push) Failing after 5m44s
Details
Run the E2E test on kind / setup-test-matrix (push) Successful in 3s
Details
Run the E2E test on kind / run-e2e-test (push) Has been skipped
Details
build-image / Build (push) Failing after 10s
Details
Main CI / Build (push) Failing after 31s
Details
Close stale issues and PRs / stale (push) Successful in 7s
Details
Trivy Nightly Scan / Trivy nightly scan (velero, main) (push) Failing after 59s
Details
Trivy Nightly Scan / Trivy nightly scan (velero-restore-helper, main) (push) Failing after 45s
Details 
Also bumped to support upgraded k8s.io/ deps.
- controller-gen to v0.16.5
- sigs.k8s.io/controller-runtime v0.19.2

Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
 2025-02-17 15:05:10 -05:00
Lyndon-Li 7caa52c1fa bump up kopia 
Signed-off-by: Lyndon-Li <lyonghui@vmware.com>
 2025-01-23 16:01:12 +08:00
Tiger Kaovilai 8cb04bba33 CVE-2024-45337 CVE-2024-45338 
Replaces #8514

Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
 2024-12-21 00:59:48 +07:00
Lyndon-Li 3cd85f5b43 ping kopia to 0.18.2 
Signed-off-by: Lyndon-Li <lyonghui@vmware.com>
 2024-12-03 13:06:26 +08:00
Wenkai Yin(尹文开)andGitHub 8320df44fd Merge pull request #8275 from ywk253100/241008_discovery 
Bump up version of client-go and controller-runtime
 2024-10-28 13:51:17 +08:00
Lyndon-Li 9d5bb455a6 bump up kopia for 1.15 
Signed-off-by: Lyndon-Li <lyonghui@vmware.com>
 2024-10-16 15:45:05 +08:00
Wenkai Yin(尹文开) 0a4e417aab Bump up version of client-go and controller-runtime 
Bump up version of client-go to v0.30.5
Bump up version of controller-runtime to v0.18.5

Fixes #8274

Signed-off-by: Wenkai Yin(尹文开) <yinw@vmware.com>
 2024-10-08 18:53:12 +08:00
Xun Jiang/Bruce JiangandGitHub bf6215c894 Merge pull request #7793 from kaovilai/upgrade_robfig/cron/v3 
Upgrade to robfig/cron/v3 to support time zone specification
 2024-09-11 14:02:58 +08:00
Lyndon-Li a80c9359bf bump up kopia 
Signed-off-by: Lyndon-Li <lyonghui@vmware.com>
 2024-08-29 13:10:08 +08:00
Xun Jiang 7a3b947961 Bump Ginkgo to v2. 
Signed-off-by: Xun Jiang <blackpigletbruce@gmail.com>
 2024-07-17 15:31:23 +08:00
Tiger Kaovilai 6c8d051269 Upgrade to robfig/cron/v3 to support time zone specification 
Breaking change (can be mitigated if needed in the future):  v1 branch accepted an optional seconds field at the beginning of the cron spec. This is non-standard and has led to a lot of confusion. The new default parser conforms to the standard as described by [the Cron wikipedia page.](https://en.wikipedia.org/wiki/Cron). It is unlikely that this affects us per https://github.com/vmware-tanzu/velero/pull/31

Other notes:
> CRON_TZ is now the recommended way to specify the timezone of a single schedule, which is sanctioned by the specification. The legacy "TZ=" prefix will continue to be supported since it is unambiguous and easy to do so.

References: https://pkg.go.dev/github.com/robfig/cron/v3#readme-upgrading-to-v3-june-2019
Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
 2024-07-12 00:08:42 -04:00
dependabot[bot]andGitHub 04f52beee0 Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity 
Bumps [github.com/Azure/azure-sdk-for-go/sdk/azidentity](https://github.com/Azure/azure-sdk-for-go) from 1.5.2 to 1.6.0.
- [Release notes](https://github.com/Azure/azure-sdk-for-go/releases)
- [Changelog](https://github.com/Azure/azure-sdk-for-go/blob/main/documentation/release.md)
- [Commits](https://github.com/Azure/azure-sdk-for-go/compare/sdk/internal/v1.5.2...sdk/azcore/v1.6.0)

---
updated-dependencies:
- dependency-name: github.com/Azure/azure-sdk-for-go/sdk/azidentity
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-06-11 20:21:24 +00:00
Matthieu MOREL 14e98b89ad Migrate from github.com/Azure/azure-storage-blob-go to github.com/Azure/azure-sdk-for-go/sdk/storage/azblob 
Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>
 2024-05-10 09:24:35 +00:00
Lyndon-Li 45b1b87055 pin kopia to 0.17.0 
Signed-off-by: Lyndon-Li <lyonghui@vmware.com>
 2024-04-17 13:15:38 +08:00
Matthieu MORELandGitHub facfb9552f migrating to sdk/resourcemanager/**/arm** from services/**/mgmt/** (#7596) 
Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>
 2024-04-15 09:55:52 -04:00
Lyndon-Li 0392e31c3d pin kopia to the latest commit 
Signed-off-by: Lyndon-Li <lyonghui@vmware.com>
 2024-04-03 11:01:52 +08:00
Lyndon-Li 18976c0a62 kopia: index compaction during maintenance 
Signed-off-by: Lyndon-Li <lyonghui@vmware.com>
 2024-03-29 15:24:47 +08:00
Lyndon-Li 5d48e36b55 open kopia with no index change 
Signed-off-by: Lyndon-Li <lyonghui@vmware.com>
 2024-03-25 18:14:43 +08:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		b3a53ee8df Bump google.golang.org/protobuf from 1.31.0 to 1.33.0 (#7518) 
Bumps google.golang.org/protobuf from 1.31.0 to 1.33.0.

---
updated-dependencies:
- dependency-name: google.golang.org/protobuf
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-03-14 11:10:39 -04:00
Wenkai Yin(尹文开) 8752c3a820 Bump up the versions of severel Kubernetes-related libs 
Bump up the versions of severel Kubernetes-related libs

Signed-off-by: Wenkai Yin(尹文开) <yinw@vmware.com>
 2024-03-05 13:09:38 +08:00
Wenkai Yin(尹文开)andGitHub b509df5172 Upgrade the version of go plugin related libs/tools (#7373) 
Upgrade the version of go plugin related libs/tools

Signed-off-by: Wenkai Yin(尹文开) <yinw@vmware.com>
 2024-02-01 13:02:42 -05:00
Guillaume Delacour 373b24e2c1 Upgrade AWS SDK 
Signed-off-by: Guillaume Delacour <delacoug@amazon.com>
 2024-01-16 23:35:33 +01:00
dependabot[bot]andGitHub ddb4889301 Bump golang.org/x/crypto from 0.14.0 to 0.17.0 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.14.0 to 0.17.0.
- [Commits](https://github.com/golang/crypto/compare/v0.14.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-12-18 23:36:41 +00:00
Wenkai Yin(尹文开)andGitHub 73c948d6bd Merge pull request #6917 from 27149chen/rm-improvement 
support JSON Merge Patch and Strategic Merge Patch in Resource Modifiers
 2023-11-02 10:36:40 +08:00
dependabot[bot]andGitHub 8be1f4beff Bump google.golang.org/grpc from 1.58.2 to 1.58.3 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.58.2 to 1.58.3.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.58.2...v1.58.3)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-10-25 21:43:35 +00:00