[release-1.5] Adjust go version staging

[Dominik Holler]

Hi,

I wonder if adjusting the golang version in staging to the golang version in the root like in https://github.com/kubevirt/kubevirt/pull/15600 is a good or a bad idea.

On one hand, this PR would enable other PRs like https://github.com/kubevirt/kubevirt/pull/15571 and https://github.com/kubevirt/kubevirt/pull/15572 .

On  the other hand, the change could introduce regressions and if an external project vendors in KubeVirt 1.5 and builds itself using the golang 1.22 (even golang 1.22 is unsupported in upstream), the updated kubevirt client and api could be not consumed.

What do you think?

Thanks for sharing your thoughts on this!

Dominik

[Felix Matouschek]

Hi,

I already commented on the PR.

In my opinion this is acceptable if we want to support release-1.5 and this is the only way to fix potential security issues / CVEs.

Thanks,

Felix

--
You received this message because you are subscribed to the Google Groups "kubevirt-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to kubevirt-dev...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/kubevirt-dev/CABKismURupS%3DF_tS8a%2BydrvgCX2oTZsuaDr3hDuWkPCT0p2zbA%40mail.gmail.com.

)

[Dominik Holler]

Thanks @enp0s3 for your courage to make a final decision about https://github.com/kubevirt/kubevirt/pull/15600!

Now https://github.com/kubevirt/kubevirt/pull/15572 and https://github.com/kubevirt/kubevirt/pull/15571 could be merged, if the maintainers consider this a good idea.

According to my limited golang understanding, https://github.com/kubevirt/kubevirt/pull/15572 is pure cosmetics, but might help to convince nervous security scanners.

https://github.com/kubevirt/kubevirt/pull/15571 is more likely to introduce regressions, but also more likely to fix CVEs.