chore(deps): update kube-apiserver to v1.37.0

[uniget-bot]

This PR contains the following updates:

Package	Update	Change
kube-apiserver	minor	1.36.3 → 1.37.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

kubernetes/kubernetes (kube-apiserver)

v1.37.0

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.36.4

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[nicholasdille-bot]

Auto-approved because label type/renovate is present.

[github-actions]

🔍 Vulnerabilities of ghcr.io/uniget-org/tools/kube-apiserver:1.37.0

📦 Image Reference ghcr.io/uniget-org/tools/kube-apiserver:1.37.0

digest	sha256:472eb8230370c860bc1d39c936eb113438f0e29ef51a4f3b5815750c435b8a6d
vulnerabilities
platform	linux/amd64
size	28 MB
packages	165

golang.org/x/crypto 0.54.0 (golang) pkg:golang/golang.org/x/crypto@0.54.0 Affected range <0.56.0 Fixed version 0.56.0 Description Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection. Affected range <0.56.0 Fixed version 0.56.0 Description Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking. Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.325% EPSS Percentile 25th percentile Description The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback. Affected range >=0 Fixed version Not Fixed Description The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.

google.golang.org/grpc 1.82.1 (golang) pkg:golang/google.golang.org/grpc@1.82.1 Uncontrolled Resource Consumption Affected range <=1.83.0 Fixed version 1.83.1 CVSS Score 8.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.415% EPSS Percentile 35th percentile Description Impact An unauthenticated remote attacker can initiate a gRPC stream and purposefully fragment their payload into millions of tiny (e.g., 1-byte) HTTP/2 DATA frames. Even if the total payload volume falls within the configured connection and stream flow-control windows, each independent fragment incurs memory overhead due to internal tracking structures and queue allocation. Repeated fragmentation massively inflates the heap space consumed by the stream. An attacker multiplexing multiple concurrent streams can exhaust the memory bounds of the runtime, forcing a runtime panic or OutOfMemory condition and leading to a remote Denial of Service (DoS). Patches The change to fix this issue is merged in master and a patch release, 1.83.1, has been published that contains this fix. Workarounds This vulnerability is mitigated by implementing receive buffer compaction. Consecutive small data buffers are automatically coalesced into larger buffers from a shared pool once the overhead is perceived to be excessive relative to actual payload data, drastically minimizing per-frame memory overheads. This behavior is enabled by default. A temporary escape hatch is provided via the environment variable GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION=false to disable the feature if unforeseen issues arise, but it will be removed in a future release.

go.etcd.io/etcd/client/pkg/v3 3.7.0 (golang) pkg:golang/go.etcd.io/etcd/client/pkg/v3@3.7.0 Affected range >=3.7.0-alpha.0 <3.7.1 Fixed version 3.7.1 EPSS Score 0.396% EPSS Percentile 33rd percentile Description In go.etcd.io/etcd/client/pkg/v3 before 3.5.33, 3.6.14, and 3.7.1, TLS handshakes on listeners created by NewTLSListener do not enforce a handshake deadline. An unauthenticated network attacker who connects to an etcd TLS listener without sending a ClientHello causes a goroutine and a tracking map entry to block indefinitely. Opening many such connections exhausts memory, leading to a denial of service.

go.etcd.io/etcd/client/pkg/v3 3.7.0 (golang) pkg:golang/go.etcd.io/etcd/client@3.7.0#pkg/v3 Affected range >=3.7.0-alpha.0 <3.7.1 Fixed version 3.7.1 EPSS Score 0.396% EPSS Percentile 33rd percentile Description In go.etcd.io/etcd/client/pkg/v3 before 3.5.33, 3.6.14, and 3.7.1, TLS handshakes on listeners created by NewTLSListener do not enforce a handshake deadline. An unauthenticated network attacker who connects to an etcd TLS listener without sending a ClientHello causes a goroutine and a tracking map entry to block indefinitely. Opening many such connections exhausts memory, leading to a denial of service.

k8s.io/kubernetes 1.37.0 (golang) pkg:golang/k8s.io/kubernetes@1.37.0 Affected range >=0 Fixed version Not Fixed EPSS Score 0.543% EPSS Percentile 44th percentile Description Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes Affected range >=1.3.0 Fixed version Not Fixed EPSS Score 0.314% EPSS Percentile 24th percentile Description Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes

github.com/google/cel-go 0.29.2 (golang) pkg:golang/github.com/google/cel-go@0.29.2 Affected range >=0.22.0 <0.30.0 Fixed version 0.30.0 Description JSON private fields exposed via NativeTypes and ParseStructTag in github.com/google/cel-go

[github-actions]

Attempting automerge. See https://github.com/uniget-org/tools/actions/runs/33801090235.

[github-actions]

PR is clean and can be merged. See https://github.com/uniget-org/tools/actions/runs/33801090235.