k3s/1.31.2.1-r4: cve remediation

[octo-sts]

Remediating this CVE required bumping quic-go, as well as go-libp2p. Similar bumps were made for another go package: #35698.

Additionally, we needed to set grpc to v1.68.0, as there are multiple instances of grpc in this project. It'd fail to bump them when left at v1.67.0 and complain some are already at v1.68.0.

Note k3s image tests may be failing in CI already (unrelated and pre-existing to this update). See here.

---

k3s/1.31.2.1-r4: fix GHSA-px8v-pp82-rcvr

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/k3s.advisories.yaml

[octo-sts]

Gen AI suggestions to solve the build error:

• Detected Error: undefined: http3.StreamCreator and related QUIC version errors

• Error Category: Dependency/Version

• Failure Point: Go build step failing due to incompatible versions between quic-go packages

• Root Cause Analysis: There appears to be a version mismatch between quic-go and its dependent packages. The error indicates that the HTTP/3 and QUIC implementations are not compatible with each other.

• Suggested Fix:

1. Update the go.mod dependencies for quic-go related packages:

  - uses: go/bump
    with:
      deps: |
        github.com/quic-go/[email protected]
        github.com/quic-go/[email protected]
        github.com/libp2p/[email protected]

• Explanation:
The build is failing because of incompatible versions between quic-go packages. The StreamCreator interface and VersionNumber type were likely changed in recent versions. By explicitly setting compatible versions, we ensure all components use the same QUIC protocol implementation.

• Additional Notes:

• QUIC protocol implementations are sensitive to version compatibility
• The libp2p transport layer depends on specific quic-go versions
• You may need to check k3s's upstream dependencies for the correct versions
• Consider pinning these versions until upstream stabilizes their QUIC implementation

• References:

• https://github.com/quic-go/quic-go/releases
• https://github.com/quic-go/webtransport-go/releases
• https://github.com/libp2p/go-libp2p/blob/master/go.mod