What version of YAML is in Kubernetes 1.31?
Kubernetes v1.31.0 utilizes sigs.k8s.io/yaml v1.4.0 to parse and convert incoming YAML manifests into JSON across the API server, kubectl, and kubelet. It unmarshals YAML into Go structs using standard JSON schema tags, while pinning gopkg.in/yaml.v3 v3.0.1 for duplicate key rejection.
🔗 Dependency Relationship
| Package | Version | Relationship | Ingestion Scope | Package URL (PURL) |
|---|---|---|---|---|
| sigs.k8s.io/yaml Target | v1.4.0 | Direct Dependency | ↳ Direct root manifest dependency | pkg:golang/sigs.k8s.io/yaml@v1.4.0 |
| gopkg.in/yaml.v3 | v3.0.1 | Direct Dependency | ↳ Imported transitively by 2 sub-dependencies | pkg:golang/gopkg.in/yaml.v3@v3.0.1 |
| gopkg.in/yaml.v2 | v2.4.0 | Transitive Dependency | ↳ Imported transitively by 14 sub-dependencies | pkg:golang/gopkg.in/yaml.v2@v2.4.0 |
Kubernetes 1.31 resolves YAML parsing through a dual-parser architecture. At the admission control and API boundary, sigs.k8s.io/yaml v1.4.0 acts as a strict bridge by transcoding YAML manifests into intermediate JSON representations before schema deserialization. This enforces YAML 1.2 plain-string semantics and neutralizes the Norway problem. Concurrently, gopkg.in/yaml.v3 v3.0.1 is integrated to provide strict duplicate key rejection, while legacy gopkg.in/yaml.v2 v2.4.0 remains pinned transitively across auxiliary CLI sub-packages, creating subtle parser divergence risks if external CRD operators bypass the standard sigs.k8s.io/yaml pipeline. (source: Kubernetes SIGs) ↗ (source: Go-YAML / Canonical) ↗
SBOM Insights
✓ Upstream SBOM ↗
Deterministic baseline metadata collected on-demand from the upstream Google deps.dev v3 package graph without repository checkout.
Supply Chain Governance
Kubernetes 1.31 is regulated by the following European Union and United States supply chain directives and security frameworks:
| Regulatory Body | Directive / Framework | Official Identifier | Statutory Scope & Classification | Official Directive |
|---|---|---|---|---|
| European Union / European Commission | EU Cyber Resilience Act (CRA) | Regulation (EU) 2024/2847 | Important Product with Digital Elements (Class I / Cloud Infrastructure Control Plane) | Directive Text ↗ |
| ENISA / European Commission | NIS2 Directive | Directive (EU) 2022/2555 | Digital Infrastructure & Cloud Services (Annex I - Essential Entity) | Directive Text ↗ |
| NIST / US CISA | Secure Software Development Framework (SSDF) | NIST SP 800-218 v1.1 | Federal Software Supply Chain Policy & Dependency Provenance | Directive Text ↗ |
Authoritative Verified Facts & Advisories
Authoritative weakness definitions, CVE records, and predictive EPSS weaponization telemetry partitioned by target dependency and host container environment.
Target Package Advisories & Weaknesses: sigs.k8s.io/yaml
5 Verified RecordsImplicit coercion of unquoted country code tokens (e.g. NO) into boolean false in YAML 1.1 parsers.
Shadow key injection where trailing duplicate dictionary keys overwrite earlier security parameters in lax parsers.
Leading-zero octal permission radix interpretation differences in volume mount defaultMode (0755 vs 0o755).
Stack exhaustion / crash during untrusted YAML deserialization when resolving deeply nested anchor aliases.
Excessive memory allocation in legacy yaml.v2 unmarshaler when processing maliciously crafted documents.
Host Application Advisories: Kubernetes v1.31.0
Command injection vulnerability affecting Windows nodes via nodes/proxy subresource allows privileged remote code execution.
GitRepo volume plugin parameter validation flaw permits unauthorized access to local repositories during volume mounting.
Garbage collector weakness allows compromised node identities to cause cascading deletion of arbitrary Node objects.
Half-blind Server-Side Request Forgery vulnerability in kube-controller-manager volume lifecycle controller.
Resource exhaustion flaw in kubelet checkpointing endpoint enables unauthenticated local callers to crash worker node processes.
Race condition in kube-apiserver webhook token authenticator cache triggers transient authorization drops under concurrency.
Lock Down Your Kubernetes Supply Chain with Packablock
Don't guess which dependencies or runtime engines are running in your environment. Packablock creates an immutable cryptographic ledger (`packablock.yaml`) for every dependency lockfile modification.
Start Free Supply Chain Attestation →