Merge pull request #1887 from andyzhangx/CVE-2025-22870

[release-1.24] fix: CVE-2025-22870

Author: andyzhangx

deploy/example/nginx-pod-blob.yaml

@@ -4,6 +4,10 @@ apiVersion: v1
 metadata:
   name: nginx-blob
 spec:
+  securityContext:  # optional just to make sure user is non-root
+    runAsUser: 0
+    runAsGroup: 0
+    fsGroup: 0
   nodeSelector:
     "kubernetes.io/os": linux
   containers:
@@ -20,4 +24,4 @@ spec:
   volumes:
     - name: blob01
       persistentVolumeClaim:
-        claimName: pvc-blob
+        claimName: persistent-storage-statefulset-blob-nonroot-nfs-0

go.mod

@@ -23,7 +23,7 @@ require (
 	github.com/satori/go.uuid v1.2.0
 	github.com/stretchr/testify v1.9.0
 	go.uber.org/mock v0.4.0
-	golang.org/x/net v0.33.0
+	golang.org/x/net v0.37.0
 	google.golang.org/grpc v1.65.0
 	google.golang.org/protobuf v1.34.2
 	k8s.io/api v0.30.3
@@ -123,13 +123,13 @@ require (
 	go.opentelemetry.io/proto/otlp v1.3.1 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.26.0 // indirect
-	golang.org/x/crypto v0.31.0 // indirect
+	golang.org/x/crypto v0.36.0 // indirect
 	golang.org/x/exp v0.0.0-20230905200255-921286631fa9 // indirect
 	golang.org/x/oauth2 v0.20.0 // indirect
-	golang.org/x/sync v0.10.0
-	golang.org/x/sys v0.28.0 // indirect
-	golang.org/x/term v0.27.0 // indirect
-	golang.org/x/text v0.21.0 // indirect
+	golang.org/x/sync v0.12.0
+	golang.org/x/sys v0.31.0 // indirect
+	golang.org/x/term v0.30.0 // indirect
+	golang.org/x/text v0.23.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
 	golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
 	google.golang.org/genproto v0.0.0-20231030173426-d783a09b4405 // indirect