chore(deps): update dependency kubernetes/kubernetes to v1.30.0

[uniget-bot]

This PR contains the following updates:

Package	Update	Change
kubernetes/kubernetes	minor	1.29.4 -> 1.30.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

kubernetes/kubernetes (kubernetes/kubernetes)

v1.30.0: Kubernetes v1.30.0

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[nicholasdille-bot]

Auto-approved because label type/renovate is present.

[github-actions]

🔍 Vulnerabilities of ghcr.io/uniget-org/tools/kube-scheduler:1.30.0

📦 Image Reference ghcr.io/uniget-org/tools/kube-scheduler:1.30.0

digest	sha256:0566f473447eadd48de635db5dfc76c6acb262f7a8089371122034b462f14c88
vulnerabilities
platform	linux/amd64
size	18 MB
packages	106

go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc 0.42.0 (golang) pkg:golang/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@0.42.0 Allocation of Resources Without Limits or Throttling Affected range <0.46.0 Fixed version 0.46.0 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description Summary The grpc Unary Server Interceptor opentelemetry-go-contrib/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go // UnaryServerInterceptor returns a grpc.UnaryServerInterceptor suitable // for use in a grpc.NewServer call. func UnaryServerInterceptor(opts ...Option) grpc.UnaryServerInterceptor { out of the box adds labels net.peer.sock.addr net.peer.sock.port that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. Details An attacker can easily flood the peer address and port for requests. PoC Apply the attached patch to the example and run the client multiple times. Observe how each request will create a unique histogram and how the memory consumption increases during it. Impact In order to be affected, the program has to configure a metrics pipeline, use UnaryServerInterceptor, and does not filter any client IP address and ports via middleware or proxies, etc. Others It is similar to already reported vulnerabilities. GHSA-rcjv-mgp8-qvmr (open-telemetry/opentelemetry-go-contrib) GHSA-5r5m-65gx-7vrh (open-telemetry/opentelemetry-go-contrib) GHSA-cg3q-j54f-5p7p (prometheus/client_golang) Workaround for affected versions As a workaround to stop being affected, a view removing the attributes can be used. The other possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider. Solution provided by upgrading In PR #4322, to be released with v0.46.0, the attributes were removed. References #4322

[github-actions]

Attempting automerge. See https://github.com/uniget-org/tools/actions/runs/8731031349.

[github-actions]

PR is clean and can be merged. See https://github.com/uniget-org/tools/actions/runs/8731031349.