Package
grafana-11.5
Component
github.com/openfga/openfga
Latest update
5.0
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
We are unable to bump github.com/openfga/openfga to v1.14.0 (the fixed version) because it transitively requires sigs.k8s.io/controller-runtime v0.23.1, which requires k8s.io/apiserver v0.35.0. k8s.io/apiserver v0.35.0 uses sigs.k8s.io/structured-merge-diff/v6, but grafana-11.5 uses sigs.k8s.io/structured-merge-diff/v4 in its own code. This is a compile-time incompatibility that cannot be resolved with version pins. The migration from smd/v4 to smd/v6 in Grafana happened upstream in v12.2; grafana-11.x and grafana-12.0/12.1 version streams have not received this migration and cannot take openfga v1.14.0 until they do.
Status
Impact
This package is no longer supported upstream and has reached its end of life. A version upgrade is required to fix this vulnerability.
Status