chore: update gopkg.in/yaml.v3 to v3.0.1 in tensorboard-controller

[asaadbalum]

Description

Update gopkg.in/yaml.v3 from v3.0.0-20210107192922-496545a6307b to v3.0.1 in the tensorboard-controller to fix security vulnerabilities.

CVEs Fixed:

• ✅ CVE-2022-28948

Related Issue: Closes #781 (PR 5)

---

Changes

Updated dependencies in components/tensorboard-controller/go.mod:

Dependency	Old Version	New Version
gopkg.in/yaml.v3	v3.0.0-20210107192922-496545a6307b	v3.0.1

---

Testing

Local Build & Tests

Test	Result
go mod tidy	✅ Pass
go vet ./...	✅ No issues
make build	✅ Builds cleanly
make test	✅ All tests pass

CVE Verification (Trivy Scan)

• ✅ CVE-2022-28948 - NOT FOUND (FIXED)

---

Acceptance Criteria

• Run go mod tidy to ensure dependencies are clean
• Run make build to build the controller
• Run unit tests to verify functionality
• Verify CVE is fixed via Trivy scan

Signed-off-by: Asaad Balum asaad.balum@gmail.com

[andyatmiami]

@asaadbalum - thanks for raising this! apologies in delay on turning attention to this - can you do the following before I test/approve?

• Rebase this PR on the latest of notebooks-v1 branch so I can test it in conjunction with other dependency updates that have been merged
• Update go.mod to specify 1.24.12 (the latest minor version of 1.24)

⚠️ Please note I am trying to carefully and sequentially review these dependency PRs and as such am making sure to only test one dependency update at a time. If #791 ends up getting a +1 commit pushed that addresses the comments I have made there and I get it merged first - I'll then need to ask for another rebase on this PR (vice versa also applies 😇 ) to ensure when I test a given PR - its being tested against all other dependency updates that have been merged to ensure a realistic test and sure no cross-contamination with dependency interactions (albeit unlikely)

[andyatmiami]

@asaadbalum - thanks for raising this! I realize this is a wildly trivial change - but just to be safe/proper - can you rebase this PR on the latest of notebooks-v1 branch so I can test it in conjunction with other dependency updates that have been merged

ℹ️ Please note you only need to rebase now - as forewarned in this comment - I got another PR merged that updated the go.mod

THANKS!

[asaadbalum]

@asaadbalum - thanks for raising this! I realize this is a wildly trivial change - but just to be safe/proper - can you rebase this PR on the latest of notebooks-v1 branch so I can test it in conjunction with other dependency updates that have been merged

ℹ️ Please note you only need to rebase now - as forewarned in this comment - I got another PR merged that updated the go.mod

THANKS!

Hi @andyatmiami , done! Rebased on the latest notebooks-v1. Ready for your review when you get a chance. Thanks!

[andyatmiami]

/ok-to-test

[andyatmiami]

/lgtm

thanks @asaadbalum for this contribution.

i independently confirmed the verification checks performed by the PR author are reproducible and valid.

furthermore, this is only a patch bump - and the only code change included here was a single bug fix for a very specific "bad input". as such - there is essentially no risk to adopting this code.

also worth noting a similar PR for notebook-controller was previously reviewed and merged.

[thesuperzapper]

/approve

[google-oss-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: thesuperzapper

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [thesuperzapper]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment