Update dependencies (fix CVE-2021-43784)

Makefile

@@ -2,7 +2,7 @@
 IMG ?= fluxcd/kustomize-controller:latest
 # Produce CRDs that work back to Kubernetes 1.16
 CRD_OPTIONS ?= crd:crdVersions=v1
-SOURCE_VER ?= v0.19.0
+SOURCE_VER ?= v0.19.1
 
 # Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
 ifeq (,$(shell go env GOBIN))

api/go.mod

@@ -3,7 +3,7 @@ module github.com/fluxcd/kustomize-controller/api
 go 1.16
 
 require (
-	github.com/fluxcd/pkg/apis/kustomize v0.2.0
+	github.com/fluxcd/pkg/apis/kustomize v0.3.0
 	github.com/fluxcd/pkg/apis/meta v0.10.1
 	github.com/fluxcd/pkg/runtime v0.12.2
 	k8s.io/apiextensions-apiserver v0.22.2

config/crd/bases/kustomize.toolkit.fluxcd.io_kustomizations.yaml

@@ -145,10 +145,10 @@ spec:
               patches:
                 description: Strategic merge and JSON patches, defined as inline YAML objects, capable of targeting objects based on kind, label and annotation selectors.
                 items:
-                  description: Patch contains either a StrategicMerge or a JSON6902 patch, either a file or inline, and the target the patch should be applied to.
+                  description: Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should be applied to.
                   properties:
                     patch:
-                      description: Patch contains the JSON6902 patch document with an array of operation objects.
+                      description: Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with an array of operation objects.
                       type: string
                     target:
                       description: Target points to the resources that the patch document should be applied to.
@@ -185,11 +185,13 @@ spec:
                     patch:
                       description: Patch contains the JSON6902 patch document with an array of operation objects.
                       items:
-                        description: JSON6902 is a JSON6902 operation object. https://tools.ietf.org/html/rfc6902#section-4
+                        description: JSON6902 is a JSON6902 operation object. https://datatracker.ietf.org/doc/html/rfc6902#section-4
                         properties:
                           from:
+                            description: From contains a JSON-pointer value that references a location within the target document where the operation is performed. The meaning of the value depends on the value of Op, and is NOT taken into account by all operations.
                             type: string
                           op:
+                            description: Op indicates the operation to perform. Its value MUST be one of "add", "remove", "replace", "move", "copy", or "test". https://datatracker.ietf.org/doc/html/rfc6902#section-4
                             enum:
                             - test
                             - remove
@@ -199,8 +201,10 @@ spec:
                             - copy
                             type: string
                           path:
+                            description: Path contains the JSON-pointer value that references a location within the target document where the operation is performed. The meaning of the value depends on the value of Op.
                             type: string
                           value:
+                            description: Value contains a valid JSON structure. The meaning of the value depends on the value of Op, and is NOT taken into account by all operations.
                             x-kubernetes-preserve-unknown-fields: true
                         required:
                         - op
@@ -550,10 +554,10 @@ spec:
               patches:
                 description: Strategic merge and JSON patches, defined as inline YAML objects, capable of targeting objects based on kind, label and annotation selectors.
                 items:
-                  description: Patch contains either a StrategicMerge or a JSON6902 patch, either a file or inline, and the target the patch should be applied to.
+                  description: Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should be applied to.
                   properties:
                     patch:
-                      description: Patch contains the JSON6902 patch document with an array of operation objects.
+                      description: Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with an array of operation objects.
                       type: string
                     target:
                       description: Target points to the resources that the patch document should be applied to.
@@ -590,11 +594,13 @@ spec:
                     patch:
                       description: Patch contains the JSON6902 patch document with an array of operation objects.
                       items:
-                        description: JSON6902 is a JSON6902 operation object. https://tools.ietf.org/html/rfc6902#section-4
+                        description: JSON6902 is a JSON6902 operation object. https://datatracker.ietf.org/doc/html/rfc6902#section-4
                         properties:
                           from:
+                            description: From contains a JSON-pointer value that references a location within the target document where the operation is performed. The meaning of the value depends on the value of Op, and is NOT taken into account by all operations.
                             type: string
                           op:
+                            description: Op indicates the operation to perform. Its value MUST be one of "add", "remove", "replace", "move", "copy", or "test". https://datatracker.ietf.org/doc/html/rfc6902#section-4
                             enum:
                             - test
                             - remove
@@ -604,8 +610,10 @@ spec:
                             - copy
                             type: string
                           path:
+                            description: Path contains the JSON-pointer value that references a location within the target document where the operation is performed. The meaning of the value depends on the value of Op.
                             type: string
                           value:
+                            description: Value contains a valid JSON structure. The meaning of the value depends on the value of Op, and is NOT taken into account by all operations.
                             x-kubernetes-preserve-unknown-fields: true
                         required:
                         - op

config/default/kustomization.yaml

@@ -2,8 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: kustomize-system
 resources:
-- https://github.com/fluxcd/source-controller/releases/download/v0.19.0/source-controller.crds.yaml
-- https://github.com/fluxcd/source-controller/releases/download/v0.19.0/source-controller.deployment.yaml
+- https://github.com/fluxcd/source-controller/releases/download/v0.19.1/source-controller.crds.yaml
+- https://github.com/fluxcd/source-controller/releases/download/v0.19.1/source-controller.deployment.yaml
 - ../crd
 - ../rbac
 - ../manager

go.mod

@@ -10,13 +10,13 @@ require (
 	github.com/cyphar/filepath-securejoin v0.2.2
 	github.com/drone/envsubst v1.0.3-0.20200804185402-58bc65f69603
 	github.com/fluxcd/kustomize-controller/api v0.18.1
-	github.com/fluxcd/pkg/apis/kustomize v0.2.0
+	github.com/fluxcd/pkg/apis/kustomize v0.3.0
 	github.com/fluxcd/pkg/apis/meta v0.10.1
 	github.com/fluxcd/pkg/runtime v0.12.2
-	github.com/fluxcd/pkg/ssa v0.3.1
+	github.com/fluxcd/pkg/ssa v0.6.0
 	github.com/fluxcd/pkg/testserver v0.1.0
 	github.com/fluxcd/pkg/untar v0.1.0
-	github.com/fluxcd/source-controller/api v0.19.0
+	github.com/fluxcd/source-controller/api v0.19.1
 	github.com/go-logr/logr v0.4.0
 	github.com/hashicorp/go-retryablehttp v0.7.0
 	github.com/onsi/gomega v1.15.0
@@ -43,7 +43,8 @@ replace (
 )
 
 // fix CVE-2021-30465
-replace github.com/opencontainers/runc => github.com/opencontainers/runc v1.0.2
+// fix CVE-2021-43784
+replace github.com/opencontainers/runc => github.com/opencontainers/runc v1.0.3
 
 // fix CVE-2021-41190
 replace github.com/opencontainers/image-spec => github.com/opencontainers/image-spec v1.0.2

go.sum

@@ -221,20 +221,20 @@ github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga
 github.com/felixge/httpsnoop v1.0.1/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/fluxcd/pkg/apis/acl v0.0.1 h1:biCgZMjpDSv3Q4mZPikUJILx3t2MuNXR4Oa5jRQxaNQ=
 github.com/fluxcd/pkg/apis/acl v0.0.1/go.mod h1:y3qOXUFObVWk7jzOjubMnr/u18j1kCeSi6olycnxr/E=
-github.com/fluxcd/pkg/apis/kustomize v0.2.0 h1:jhu2QHvs+j3Zo9rR6w8hkO3LSC6h3M37zY5ejufOmxY=
-github.com/fluxcd/pkg/apis/kustomize v0.2.0/go.mod h1:gEl+W5cVykCC3RfrCaqe+Pz+j4lKl2aeR4dxsom/zII=
+github.com/fluxcd/pkg/apis/kustomize v0.3.0 h1:o7o8hHIWh+1kyx/E21b2tZpCD4tX8NRijbGioAZXSBU=
+github.com/fluxcd/pkg/apis/kustomize v0.3.0/go.mod h1:bkeOkDpm2PQamZT+RLs20ZOt3TgOdLKWmi9kVxmcdmM=
 github.com/fluxcd/pkg/apis/meta v0.10.1 h1:zISenRlqNG7WK8TP3HxZTvv+1Z7JZOUIQvZrOr6pQ2w=
 github.com/fluxcd/pkg/apis/meta v0.10.1/go.mod h1:yUblM2vg+X8TE3A2VvJfdhkGmg+uqBlSPkLk7dxi0UM=
 github.com/fluxcd/pkg/runtime v0.12.2 h1:4iOpx2j/w15kNemDOnZrF6ugJ/rhSmRu7aI+xn23+BI=
 github.com/fluxcd/pkg/runtime v0.12.2/go.mod h1:tuWdqpWPhgjQvYrSnojdZ4plyU8DRU1NDzsfOhnzl2g=
-github.com/fluxcd/pkg/ssa v0.3.1 h1:lKjTRQmSWFEXpKJadK9Fu0GSLL8lv0k5muIcc+7hZIs=
-github.com/fluxcd/pkg/ssa v0.3.1/go.mod h1:rFhWBX9/TfNwSFR+5NHOGnpl9OsWdaQrG5CggN+74EQ=
+github.com/fluxcd/pkg/ssa v0.6.0 h1:c/1RW3PffvDqx57zrMU/pDUwE45/x9yQszarXp2uWCA=
+github.com/fluxcd/pkg/ssa v0.6.0/go.mod h1:rFhWBX9/TfNwSFR+5NHOGnpl9OsWdaQrG5CggN+74EQ=
 github.com/fluxcd/pkg/testserver v0.1.0 h1:nOYgM1HYFZNNSUFykuWDmrsxj4jQxUCvmLHWOQeqmyA=
 github.com/fluxcd/pkg/testserver v0.1.0/go.mod h1:fvt8BHhXw6c1+CLw1QFZxcQprlcXzsrL4rzXaiGM+Iw=
 github.com/fluxcd/pkg/untar v0.1.0 h1:k97V/xV5hFrAkIkVPuv5AVhyxh1ZzzAKba/lbDfGo6o=
 github.com/fluxcd/pkg/untar v0.1.0/go.mod h1:aGswNyzB1mlz/T/kpOS58mITBMxMKc9tlJBH037A2HY=
-github.com/fluxcd/source-controller/api v0.19.0 h1:D4hc/ROhcl7iJdgeVhmM6B7WkDqwtQKnvpl04n+LcNg=
-github.com/fluxcd/source-controller/api v0.19.0/go.mod h1:rUqw0LmoCyGUoElmtLqHc8O35WAQUd8LdgdyDA+kNs4=
+github.com/fluxcd/source-controller/api v0.19.1 h1:M+D4JceEmCVsTmIHE/ACvIQ5lx1mScjE6a5/yIEPE+Y=
+github.com/fluxcd/source-controller/api v0.19.1/go.mod h1:rUqw0LmoCyGUoElmtLqHc8O35WAQUd8LdgdyDA+kNs4=
 github.com/form3tech-oss/jwt-go v3.2.2+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
 github.com/form3tech-oss/jwt-go v3.2.3+incompatible h1:7ZaBxOI7TMoYBfyA3cQHErNNyAWIKUMIwqxEtgHOs5c=
 github.com/form3tech-oss/jwt-go v3.2.3+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
@@ -586,8 +586,8 @@ github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.0.2 h1:9yCKha/T5XdGtO0q9Q9a6T5NUCsTn/DrBg0D7ufOcFM=
 github.com/opencontainers/image-spec v1.0.2/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
-github.com/opencontainers/runc v1.0.2 h1:opHZMaswlyxz1OuGpBE53Dwe4/xF7EZTY0A2L/FpCOg=
-github.com/opencontainers/runc v1.0.2/go.mod h1:aTaHFFwQXuA71CiyxOdFFIorAoemI04suvGRQFzWTD0=
+github.com/opencontainers/runc v1.0.3 h1:1hbqejyQWCJBvtKAfdO0b1FmaEf2z/bxnjqbARass5k=
+github.com/opencontainers/runc v1.0.3/go.mod h1:aTaHFFwQXuA71CiyxOdFFIorAoemI04suvGRQFzWTD0=
 github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/selinux v1.8.2/go.mod h1:MUIHuUEvKB1wtJjQdOyYRgOnLD2xAPP8dBsCoU0KuF8=
 github.com/opentracing-contrib/go-observer v0.0.0-20170622124052-a52f23424492/go.mod h1:Ngi6UdF0k5OKD5t5wlmGhe/EDKPoUM3BXZSSfIuJbis=