Skip to content

[release-4.16] OCPBUGS-86414: Bump google.golang.org/grpc to v1.79.3 - #207

Closed
ocp-sustaining-admins wants to merge 2 commits into
openshift:release-4.16from
openshift-sustaining:release-4.16_CVE-2026-33186
Closed

ocp-sustaining-admins wants to merge 2 commits into
openshift:release-4.16from
openshift-sustaining:release-4.16_CVE-2026-33186

Conversation

@ocp-sustaining-admins

@ocp-sustaining-admins ocp-sustaining-admins commented May 21, 2026

Copy link
Copy Markdown

This is an automated PR from the ARC system.

Go version used: go1.21.13

Modules affected: .

The commands used to generate this PR were:

go get google.golang.org/grpc@v1.79.3
go mod tidy
go mod vendor

A member of the Red Hat Openshift Sustaining Team will review the PR and take appropriate action.

Summary by CodeRabbit

  • Chores
    • Updated indirect dependencies to the latest available versions.

@openshift-ci-robot openshift-ci-robot added jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels May 21, 2026
@openshift-ci-robot

Copy link
Copy Markdown

@ocp-sustaining-admins: This pull request references Jira Issue OCPBUGS-86414, which is invalid:

  • release note text must be set and not match the template OR release note type must be set to "Release Note Not Required". For more information you can reference the OpenShift Bug Process.
  • expected Jira Issue OCPBUGS-86414 to depend on a bug targeting a version in 4.17.0, 4.17.z and in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

This is an automated PR from the ARC system.

Go version used: go1.21.13

Modules affected: .

The commands used to generate this PR were:

go get google.golang.org/grpc@v1.79.3
go mod tidy
go mod vendor

A member of the Red Hat Openshift Sustaining Team will review the PR and take appropriate action.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@coderabbitai

coderabbitai Bot commented May 21, 2026

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: c8657fcc-6b5f-4bb7-8a5e-67f9db6cbf59

📥 Commits

Reviewing files that changed from the base of the PR and between 822ed16 and 7e23cad.

⛔ Files ignored due to path filters (1)
  • vendor/modules.txt is excluded by !**/vendor/**, !vendor/**
📒 Files selected for processing (1)
  • go.mod

Walkthrough

This PR updates the indirect google.golang.org/grpc dependency from v1.64.1 to v1.79.3 in go.mod. The existing replace directive for gRPC remains unchanged.

Changes

Dependency Update

Layer / File(s) Summary
gRPC version bump
go.mod
Indirect google.golang.org/grpc version increased from v1.64.1 to v1.79.3 in the require block, with the existing gRPC replace directive unchanged.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

Suggested labels

lgtm, backport-risk-assessed, ok-to-test

Suggested reviewers

  • joelanford
  • perdasilva
🚥 Pre-merge checks | ✅ 11 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Topology-Aware Scheduling Compatibility ⚠️ Warning The deployment manifest uses nodeSelector: node-role.kubernetes.io/master without topology awareness checks. On HyperShift, no control-plane nodes exist, causing pods to remain Pending indefinitely. Implement topology-aware scheduling via manifest hooks to detect infrastructure.Status.ControlPlaneTopology and adjust nodeSelectors/replicas accordingly for SNO, TNF, TNA, and HyperShift deployments.
✅ Passed checks (11 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and specifically describes the main change: bumping google.golang.org/grpc to v1.79.3, which matches the core change in the go.mod file.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed No Ginkgo tests found in the PR. The only test file added (builder_test.go) uses standard Go testing with t.Run(), not Ginkgo framework.
Test Structure And Quality ✅ Passed The custom check for Ginkgo test quality is not applicable to this PR. The repository uses standard Go testing, not Ginkgo, and the test file added uses only standard Go testing (testing.T).
Microshift Test Compatibility ✅ Passed No Ginkgo e2e tests were added. The added test file (builder_test.go) is a standard Go unit test using testing.T, not Ginkgo, so the check does not apply.
Single Node Openshift (Sno) Test Compatibility ✅ Passed PR only updates go.mod dependency (google.golang.org/grpc v1.64.1 → v1.79.3); no Ginkgo e2e tests added, so SNO compatibility check not applicable.
Ote Binary Stdout Contract ✅ Passed This PR is for cluster-olm-operator, an OpenShift operator service, not an OTE test binary. The check is not applicable—OTE binaries specifically communicate with openshift-tests via stdout JSON.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed No Ginkgo e2e tests are added in this PR. This is a dependency update to google.golang.org/grpc v1.79.3, not a new test addition. The check is not applicable.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions
The command is terminated due to an error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@openshift-ci
openshift-ci Bot requested review from grokspawn and joelanford May 21, 2026 20:24
@openshift-ci

openshift-ci Bot commented May 21, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ocp-sustaining-admins
Once this PR has been reviewed and has the lgtm label, please assign oceanc80 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label May 21, 2026
@openshift-ci

openshift-ci Bot commented May 21, 2026

Copy link
Copy Markdown
Contributor

Hi @ocp-sustaining-admins. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@MrSanketkumar

Copy link
Copy Markdown

@coderabbitai review

@coderabbitai

coderabbitai Bot commented May 22, 2026

Copy link
Copy Markdown
✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@MrSanketkumar

Copy link
Copy Markdown

/ok-to-test

@openshift-ci openshift-ci Bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels May 22, 2026
@openshift-ci-robot

Copy link
Copy Markdown

@ocp-sustaining-admins: This pull request references Jira Issue OCPBUGS-86414, which is invalid:

  • expected Jira Issue OCPBUGS-86414 to depend on a bug targeting a version in 4.17.0, 4.17.z and in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

This is an automated PR from the ARC system.

Go version used: go1.21.13

Modules affected: .

The commands used to generate this PR were:

go get google.golang.org/grpc@v1.79.3
go mod tidy
go mod vendor

A member of the Red Hat Openshift Sustaining Team will review the PR and take appropriate action.

Summary by CodeRabbit

  • Chores
  • Updated indirect dependencies to the latest available versions.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci

openshift-ci Bot commented May 22, 2026

Copy link
Copy Markdown
Contributor

@ocp-sustaining-admins: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@MrSanketkumar

MrSanketkumar commented May 25, 2026

Copy link
Copy Markdown

/hold The pkg is already fixed

@openshift-ci openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label May 25, 2026
@MrSanketkumar

Copy link
Copy Markdown

/close as the issue has already been addressed.

@MrSanketkumar

Copy link
Copy Markdown

/close

@MrSanketkumar

Copy link
Copy Markdown

/unhold

@openshift-ci openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label May 25, 2026
@MrSanketkumar

Copy link
Copy Markdown

/close

@openshift-ci openshift-ci Bot closed this May 25, 2026
@openshift-ci-robot

Copy link
Copy Markdown

@ocp-sustaining-admins: This pull request references Jira Issue OCPBUGS-86414. The bug has been updated to no longer refer to the pull request using the external bug tracker.

Details

In response to this:

This is an automated PR from the ARC system.

Go version used: go1.21.13

Modules affected: .

The commands used to generate this PR were:

go get google.golang.org/grpc@v1.79.3
go mod tidy
go mod vendor

A member of the Red Hat Openshift Sustaining Team will review the PR and take appropriate action.

Summary by CodeRabbit

  • Chores
  • Updated indirect dependencies to the latest available versions.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci

openshift-ci Bot commented May 25, 2026

Copy link
Copy Markdown
Contributor

@MrSanketkumar: Closed this PR.

Details

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-ci

openshift-ci Bot commented May 25, 2026

Copy link
Copy Markdown
Contributor

@MrSanketkumar: Closed this PR.

Details

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. ok-to-test Indicates a non-member PR verified by an org member that is safe to test.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants