:wave: maintainers -- been off on other adventures...
# contribute
g
👋 maintainers -- been off on other adventures, but looping back to check on some Flyte work. First q -- is a new version of
flytectl
being cut anytime soon? There a number of Go related vulns popping up there. I can push up some PRs to update the primary concerns (assuming they haven't already been addressed)
h
If you can take a look, that would be great! For vulnerabilities we can cut a release sooner than the next flyte release
g
I just took a look... the primary concerns have been golang-jwt/jwt/v[4|5], glog, x/crypto, mattn/go-sqlite3 and the actual core Go version used to build things. All the libraries are already updated on the head of the repo, but flytectl was last built on Dec 11... and for some reason against Go 1.22.0 https://github.com/flyteorg/flyte/releases/tag/flytectl%2Fv0.9.4 > ❯ strings ./flytectl | grep '@go1\.' > @go1.22.0 > > go version -v flytectl > flytectl: go1.22.0 I would have expected it to be using Go 1.22.12 ... digging in there to see what's going on https://go.dev/doc/devel/release#go1.22.0
@high-accountant-32689 I think you've done a bunch of work on the flytectl release process... and IIRC it uses go-releaser. I think this is where the releases happen? https://github.com/flyteorg/flyte/actions/runs/12282279697
Unfortunately the logs are long gone
I'm not 100% sure that my heuristic is right for checking the patch version of the compiled flytectl binary since I don't have go 1.22 kicking around locally (I think it is) In any event, I pushed this up as a place to discuss https://github.com/flyteorg/flyte/pull/6403 I looked at the goreleaser docs and I don't see why it wouldn't automatically be using
go 1.22.LATEST
h
@gorgeous-waitress-5026, replied in the PR. As for how to release, etc, you're absolutely correct, the release process is described in https://github.com/flyteorg/flyte/blob/master/flytectl/RELEASE.md#release-process.
actually, we're getting the version from the flytectl go.mod now, so no need for another change, just a release. Let me get that out now.
@gorgeous-waitress-5026, I just released flytectl 0.9.5 and confirmed that the go version used to build it was 1.22.12.