Skip to content

Upgrade nats to 2.9.x version with new on-disk storage and patch security vulnerabilties #2242

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ddelnano merged 1 commit into from
Jul 23, 2025
+8 −4
Merged

Upgrade nats to 2.9.x version with new on-disk storage and patch security vulnerabilties #2242

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion k8s/cloud_deps/base/nats/statefulset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,7 +158,7 @@ spec:
containers:
- name: pl-nats
# yamllint disable-line rule:line-length
image: gcr.io/pixie-oss/pixie-prod/vizier-deps/nats:2.9.19-scratch@sha256:5de59286eb54ead4d4a9279846098d4097b9c17a3c0588182398a7250cde1af9
image: ghcr.io/pixie-io/nats:2.9.25-scratch@sha256:869605f46ad21b76be1998e89345640671dbe46714105cf67676ddb0b78d3b85
ports:
- containerPort: 4222
name: client
Expand Down
2 changes: 1 addition & 1 deletion k8s/vizier_deps/base/nats/nats_statefulset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,7 +111,7 @@ spec:
containers:
- name: pl-nats
# yamllint disable-line rule:line-length
image: gcr.io/pixie-oss/pixie-prod/vizier-deps/nats:2.9.19-scratch@sha256:5de59286eb54ead4d4a9279846098d4097b9c17a3c0588182398a7250cde1af9
image: ghcr.io/pixie-io/nats:2.9.25-scratch@sha256:869605f46ad21b76be1998e89345640671dbe46714105cf67676ddb0b78d3b85
ports:
- containerPort: 4222
name: client
Expand Down
2 changes: 1 addition & 1 deletion tools/docker/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,7 +116,7 @@ LINUX_HEADERS_ARM64_MERGED_FILE := $(LINUX_HEADER_BUILD_DIR)/linux-headers-merge
LINUX_HEADERS_GS_PATH := gs://pixie-dev-public/linux-headers/$(LINUX_HEADERS_REV)

## NATS image parameters.
NATS_IMAGE_VERSION := 2.9.19
NATS_IMAGE_VERSION := 2.9.25
nats_image_tag := "ghcr.io/pixie-io/nats:$(NATS_IMAGE_VERSION)-scratch"

## Copybara image parameters.
Expand Down
6 changes: 5 additions & 1 deletion tools/docker/nats_image/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,12 +29,16 @@ RUN apk add git

RUN git clone --depth 1 https://github.com/nats-io/nats-server.git
WORKDIR /src/nats-server
RUN git checkout $NATS_VERSION
RUN git fetch --tags && git checkout $NATS_VERSION
Copy link
Member Author

@ddelnano ddelnano Jul 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was needed to avoid the following error:

 => ERROR [linux/amd64 build  7/11] RUN git checkout v2.9.25                                                                                                                                        0.2s
 => ERROR [linux/amd64->arm64 build  7/11] RUN git checkout v2.9.25                                                                                                                                 0.2s
------
 > [linux/amd64 build  7/11] RUN git checkout v2.9.25:
#0 0.215 error: pathspec 'v2.9.25' did not match any file(s) known to git
------
------
 > [linux/amd64->arm64 build  7/11] RUN git checkout v2.9.25:
#0 0.214 error: pathspec 'v2.9.25' did not match any file(s) known to git
------
Dockerfile:32
--------------------


ARG GO111MODULE=on
ARG CGO_ENABLED=0

RUN go mod download
# TODO(ddelnano): Remove once NATS server is updated to have
# vulnerability free upstream deps
RUN go get golang.org/x/crypto@v0.35.0
RUN go get github.com/nats-io/nkeys@v0.4.6
RUN go build -trimpath -ldflags "-X github.com/nats-io/nats-server/v2/server.gitCommit=$(git rev-parse --short HEAD)" -o ./nats-server

FROM scratch
Expand Down
Loading