Security vulnerability in KubernetesClient version < 17.0.4

[sandy-wang]

The current version used by ApplicationInsights-Kubernetes is https://www.nuget.org/packages/KubernetesClient/16.0.2, it has vulnerability with moderate severity.
GHSA-w7r3-mgwf-4mqq

Kubernetes project has implemented a fix and published version 17.0.14.
https://www.nuget.org/packages/KubernetesClient/17.0.14
Please update the package version.

[orbus-jmyron]

@xiaomi7732 , will there be a public release on the 7.x branch for this fix?

While the bug is fixed in code, without a public release, the issue doesn't feel like it's fixed for consumers.

[xiaomi7732]

Let me open this issue for tracking. @orbus-jmyron, is it possible for you to pick up 8.x? 7.x is on the way to deprecating once 8.x is released. But I want to understand if there's any blockers on the road.

[orbus-jmyron]

We wouldn't be able to pick up 8 until it's officially released. Would you be able to share the release plans / timelines for that?

[xiaomi7732]

Hi @orbus-jmyron Thanks for the ask. Considering it has been months since 8.0.0-beta1, and there's no push back for functionalities, I think we are in a good position to release a stable version in 2 weeks if not sooner. Will that work for you?

[orbus-jmyron]

Thanks for the update @xiaomi7732. A release of 8.x in the next few weeks works for us.

I don't speak on behalf of others who may be monitoring this issue though.

[sandy-wang]

Thanks, in our case, it would be great to have a release with the fix in one or two weeks.

[xiaomi7732]

Please check out the new package: https://www.nuget.org/packages/Microsoft.ApplicationInsights.Kubernetes/8.0.0