extend go.mod replace rules to workaround present CVEs

[RafalSkolasinski]

Addressed CVEs

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0210
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8559
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040

Introduced change have effect on go.sum:

• removing it and creating again render offended deps not present

Note: this does not seem to affect output of "go mod graph" command

[RafalSkolasinski]

/test integration
/test notebooks

[seldondev]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign rafalskolasinski
You can assign the PR to them by writing /assign @rafalskolasinski in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[seldondev]

Wed Jul 29 09:44:54 UTC 2020
The logs for [lint] [2] will show after the pipeline context has finished.
https://github.com/SeldonIO/seldon-core/blob/gh-pages/jenkins-x/logs/SeldonIO/seldon-core/PR-2211/2.log

impatient try
jx get build logs SeldonIO/seldon-core/PR-2211 --build=2

[seldondev]

Wed Jul 29 09:45:00 UTC 2020
The logs for [pr-build] [1] will show after the pipeline context has finished.
https://github.com/SeldonIO/seldon-core/blob/gh-pages/jenkins-x/logs/SeldonIO/seldon-core/PR-2211/1.log

impatient try
jx get build logs SeldonIO/seldon-core/PR-2211 --build=1

[seldondev]

Wed Jul 29 09:45:10 UTC 2020
The logs for [integration] [4] will show after the pipeline context has finished.
https://github.com/SeldonIO/seldon-core/blob/gh-pages/jenkins-x/logs/SeldonIO/seldon-core/PR-2211/4.log

impatient try
jx get build logs SeldonIO/seldon-core/PR-2211 --build=4

[seldondev]

Wed Jul 29 09:45:13 UTC 2020
The logs for [notebooks] [3] will show after the pipeline context has finished.
https://github.com/SeldonIO/seldon-core/blob/gh-pages/jenkins-x/logs/SeldonIO/seldon-core/PR-2211/3.log

impatient try
jx get build logs SeldonIO/seldon-core/PR-2211 --build=3

[axsaucedo]

Seems the only one to fail was one of the flaky tests, namely test-label-update-1-0-2
/test integration

[seldondev]

Wed Jul 29 11:44:34 UTC 2020
The logs for [integration] [5] will show after the pipeline context has finished.
https://github.com/SeldonIO/seldon-core/blob/gh-pages/jenkins-x/logs/SeldonIO/seldon-core/PR-2211/5.log

impatient try
jx get build logs SeldonIO/seldon-core/PR-2211 --build=5

[RafalSkolasinski]

Now it failed on test_label_update[1.1.0] so same test but different entry.

[RafalSkolasinski]

/test integration

[seldondev]

Wed Jul 29 13:37:58 UTC 2020
The logs for [integration] [6] will show after the pipeline context has finished.
https://github.com/SeldonIO/seldon-core/blob/gh-pages/jenkins-x/logs/SeldonIO/seldon-core/PR-2211/6.log

impatient try
jx get build logs SeldonIO/seldon-core/PR-2211 --build=6

[RafalSkolasinski]

@axsaucedo It seems it was just flakiness

[RafalSkolasinski]

/hold

[axsaucedo]

/hold

[mrowebot]

Does this PR also update the licenses as the dependency tree is now different? Or is that out-of-scope, and we can assume that the licenses cover what we need here?

[axsaucedo]

Closing as discussed, this will be addressed by updating to kubernetes 1.18 and by reaching out to each respective project. For the meantime this is a viable workaround to override these current libraries