[Release-4.15] OCPBUGS-86345: Update grpc-go to v1.64.1-sec.1 to fix CVE-2026-33186 - #208
Conversation
WalkthroughThis PR increases the Go linter configuration timeout from 4m to 10m and updates the Go module dependency graph with multiple version bumps across core libraries and observability packages. It also adds a replace directive to use an OpenShift-maintained fork of gRPC instead of the upstream version. ChangesDependency and configuration updates
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 12✅ Passed checks (12 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 golangci-lint (2.12.2)Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions Comment |
openshift-ci-robot
added
jira/severity-important
|
@MrSanketkumar: This pull request references Jira Issue OCPBUGS-86345, which is valid. The bug has been moved to the POST state. 7 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira (uyendava@redhat.com), skipping review request. The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: MrSanketkumar The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
|
@MrSanketkumar: This pull request references Jira Issue OCPBUGS-86345, which is valid. 7 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira (uyendava@redhat.com), skipping review request. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 90: Update the indirect module version for golang.org/x/oauth2 from
v0.18.0 to a patched release (>= v0.27.0) in go.mod and then run module tooling
to update the lockfiles (e.g., run go get golang.org/x/oauth2@v0.27.0 and go mod
tidy) so the indirect dependency is upgraded and the vulnerability is resolved.
- Line 82: The go.mod currently pins go.opentelemetry.io/otel/sdk at v1.22.0
which is vulnerable; update the dependency entry for
go.opentelemetry.io/otel/sdk to at least v1.43.0 (e.g., change the module
version to v1.43.0 or newer), then run the appropriate Go commands (go get
go.opentelemetry.io/otel/sdk@v1.43.0 and go mod tidy) to refresh go.sum and
ensure the module graph is consistent; finally run your build/tests to verify no
breakages and commit the updated go.mod and go.sum.
- Line 88: The go.mod currently pins golang.org/x/crypto at v0.24.0 which is
vulnerable; update the module to a safe release (>= v0.45.0) by running a module
upgrade (e.g., go get golang.org/x/crypto@v0.45.0 or newer) and then run go mod
tidy to update go.mod/go.sum, ensuring the indirect entry for
golang.org/x/crypto is bumped; finally run your test suite and go vet/build to
verify nothing breaks.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 7d937727-4a96-4905-847e-115c564a3ff9
⛔ Files ignored due to path filters (298)
go.sumis excluded by!**/*.sumvendor/github.com/felixge/httpsnoop/.travis.ymlis excluded by!**/vendor/**,!vendor/**vendor/github.com/felixge/httpsnoop/Makefileis excluded by!**/vendor/**,!vendor/**vendor/github.com/felixge/httpsnoop/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/felixge/httpsnoop/capture_metrics.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/felixge/httpsnoop/wrap_generated_gteq_1.8.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/felixge/httpsnoop/wrap_generated_lt_1.8.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/context.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/context_noslog.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/context_slog.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/funcr/funcr.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/funcr/slogsink.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/logr.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/sloghandler.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/slogr.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/slogsink.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/golang/protobuf/jsonpb/decode.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/golang/protobuf/jsonpb/encode.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/golang/protobuf/jsonpb/json.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/golang/protobuf/ptypes/any.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/uuid/CHANGELOG.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/uuid/CONTRIBUTING.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/uuid/hash.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/uuid/time.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/uuid/uuid.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/uuid/version6.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/uuid/version7.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/prometheus/client_model/go/metrics.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/stoewer/go-strcase/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/stoewer/go-strcase/camel.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/config.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/doc.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/metadata_supplier.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/stats_handler.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/version.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/common.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/config.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/handler.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/semconvutil/httpconv.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/semconvutil/netconv.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/transport.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/version.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/wrap.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/.codespellignoreis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/CHANGELOG.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/CODEOWNERSis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/CONTRIBUTING.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/Makefileis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/README.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/RELEASING.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/set.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/baggage/baggage.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/doc.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/global/meter.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/global/state.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric/noop/noop.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/propagation/trace_context.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/builtin.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/container.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/env.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/process.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/span.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/version.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.20.0/attribute_group.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.20.0/doc.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.20.0/event.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.20.0/exception.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.20.0/http.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.20.0/resource.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.20.0/schema.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.20.0/trace.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.21.0/attribute_group.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.24.0/attribute_group.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.24.0/doc.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.24.0/event.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.24.0/exception.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.24.0/resource.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.24.0/schema.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.24.0/trace.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/tracestate.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/version.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/versions.yamlis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/cryptobyte/asn1.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/internal/alias/alias.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/internal/alias/alias_purego.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/internal/poly1305/bits_compat.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/internal/poly1305/bits_go1.13.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/internal/poly1305/mac_noasm.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/internal/poly1305/sum_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/internal/poly1305/sum_amd64.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/internal/poly1305/sum_generic.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/internal/poly1305/sum_ppc64le.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/internal/poly1305/sum_ppc64le.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/internal/poly1305/sum_s390x.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/internal/poly1305/sum_s390x.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/salsa20/salsa/salsa20_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/salsa20/salsa/salsa20_amd64.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/salsa20/salsa/salsa20_noasm.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/context/go17.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/context/go19.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/context/pre_go17.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/context/pre_go19.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http/httpguts/httplex.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/databuffer.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/frame.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/go111.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/go115.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/go118.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/http2.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/not_go111.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/not_go115.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/not_go118.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/pipe.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/server.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/timer.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/transport.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/writesched_priority.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/idna/go118.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/idna/idna10.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/idna/idna9.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/idna/pre_go118.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/idna/tables10.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/idna/tables11.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/idna/tables12.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/idna/tables13.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/idna/tables15.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/idna/tables9.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/idna/trie12.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/idna/trie13.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/websocket/client.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/websocket/dial.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/websocket/hybi.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/websocket/websocket.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/deviceauth.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/internal/token.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/oauth2.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/pkce.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/token.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sync/singleflight/singleflight.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_arm64.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_gc_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_linux_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/aliases.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/asm_zos_s390x.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/bpxsvc_zos.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/bpxsvc_zos.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/epoll_zos.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/fcntl.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/fstatfs_zos.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ioctl_linux.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/mkerrors.shis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/mmap_nomremap.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/pagesize_unix.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/readdirent_getdirentries.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/sockcmsg_zos.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/symaddr_zos_s390x.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/syscall_bsd.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/syscall_darwin_libSystem.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/syscall_freebsd.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/syscall_linux.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/syscall_openbsd.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/syscall_solaris.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/syscall_zos_s390x.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/sysvshm_unix.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/sysvshm_unix_other.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_386.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_arm.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_loong64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mips.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mips64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_ppc.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_s390x.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_zos_s390x.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsymaddr_zos_s390x.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_linux.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_zos_s390x.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_386.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_arm.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_loong64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_mips.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_mips64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_mips64le.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_mipsle.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_ppc.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64le.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_riscv64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_s390x.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_sparc64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_zos_s390x.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_386.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_arm.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_loong64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_mips.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_mips64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_ppc.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_s390x.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_zos_s390x.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/aliases.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/empty.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/env_windows.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/security_windows.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/syscall_windows.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/types_windows.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/zsyscall_windows.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/term/term_unix.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/term/term_unix_bsd.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/term/term_unix_other.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/term/term_unsupported.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/cases/icu.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/cases/tables10.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/cases/tables11.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/cases/tables12.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/cases/tables13.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/cases/tables15.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/cases/tables9.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/secure/bidirule/bidirule10.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/secure/bidirule/bidirule9.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/unicode/bidi/tables10.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/unicode/bidi/tables11.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/unicode/bidi/tables12.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/unicode/bidi/tables13.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/unicode/bidi/tables15.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/unicode/bidi/tables9.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/unicode/norm/tables10.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/unicode/norm/tables11.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/unicode/norm/tables12.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/unicode/norm/tables13.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/unicode/norm/tables15.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/unicode/norm/tables9.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/width/tables10.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/width/tables11.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/width/tables12.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/width/tables13.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/width/tables15.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/width/tables9.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/time/rate/rate.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/appengine/internal/api.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/appengine/internal/api_classic.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/appengine/internal/api_common.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/appengine/internal/identity.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/appengine/internal/identity_classic.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/appengine/internal/identity_flex.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/appengine/internal/identity_vm.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/appengine/internal/main.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/appengine/internal/main_vm.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/appengine/internal/transaction.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/appengine/urlfetch/urlfetch.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/client.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/field_behavior.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/field_info.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/checked.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/eval.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/explain.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/syntax.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/value.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**
📒 Files selected for processing (2)
.golangci.yamlgo.mod
| go.opentelemetry.io/otel/sdk v1.20.0 // indirect | ||
| go.opentelemetry.io/otel/trace v1.20.0 // indirect | ||
| go.opentelemetry.io/otel/metric v1.24.0 // indirect | ||
| go.opentelemetry.io/otel/sdk v1.22.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify vulnerability ranges for the exact module/version via OSV API.
set -euo pipefail
curl -s 'https://api.osv.dev/v1/query' \
-H 'Content-Type: application/json' \
-d '{
"package": {"name":"go.opentelemetry.io/otel/sdk","ecosystem":"Go"},
"version":"1.22.0"
}' | jq .Repository: openshift/cluster-olm-operator
Length of output: 8537
Update go.opentelemetry.io/otel/sdk to v1.43.0+ (PATH-hijacking ACE/RCE) in go.mod.
go.opentelemetry.io/otel/sdk v1.22.0 (go.mod line 82) is flagged by OSV as affected by:
GHSA-9h8m-3fm2-qjrq(CVE-2026-24051): fixed inv1.40.0(affectedv1.21.0–v1.39.0)GHSA-hfvc-g4fc-pqhx(CVE-2026-39883): fixed inv1.43.0(affected<= v1.42.0)
Raise the version to at leastv1.43.0before merge.
🧰 Tools
🪛 OSV Scanner (2.3.8)
[HIGH] 82-82: go.opentelemetry.io/otel/sdk 1.22.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking in go.opentelemetry.io/otel/sdk
(GO-2026-4394)
[HIGH] 82-82: go.opentelemetry.io/otel/sdk 1.22.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking
[HIGH] 82-82: go.opentelemetry.io/otel/sdk 1.22.0: opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 82, The go.mod currently pins go.opentelemetry.io/otel/sdk at
v1.22.0 which is vulnerable; update the dependency entry for
go.opentelemetry.io/otel/sdk to at least v1.43.0 (e.g., change the module
version to v1.43.0 or newer), then run the appropriate Go commands (go get
go.opentelemetry.io/otel/sdk@v1.43.0 and go mod tidy) to refresh go.sum and
ensure the module graph is consistent; finally run your build/tests to verify no
breakages and commit the updated go.mod and go.sum.
| google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d // indirect | ||
| google.golang.org/grpc v1.59.0 // indirect | ||
| google.golang.org/protobuf v1.31.0 // indirect | ||
| golang.org/x/crypto v0.24.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify whether x/crypto@v0.24.0 is affected and inspect affected ranges.
set -euo pipefail
curl -s 'https://api.osv.dev/v1/query' \
-H 'Content-Type: application/json' \
-d '{
"package": {"name":"golang.org/x/crypto","ecosystem":"Go"},
"version":"0.24.0"
}' | jq .Repository: openshift/cluster-olm-operator
Length of output: 50386
Upgrade golang.org/x/crypto off v0.24.0 (CRITICAL SSH authorization bypass).
In go.mod, golang.org/x/crypto v0.24.0 // indirect is affected by GO-2024-3321 / GHSA-v778-237x-gjrc (authorization bypass, fixed in v0.31.0), plus additional SSH DoS (fixed in v0.35.0) and panic/out-of-bounds read (fixed in v0.45.0). Move to a non-affected x/crypto version in this PR (e.g., v0.45.0+).
🧰 Tools
🪛 OSV Scanner (2.3.8)
[CRITICAL] 88-88: golang.org/x/crypto 0.24.0: Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
(GO-2024-3321)
[CRITICAL] 88-88: golang.org/x/crypto 0.24.0: Potential denial of service in golang.org/x/crypto
(GO-2025-3487)
[CRITICAL] 88-88: golang.org/x/crypto 0.24.0: Potential denial of service in golang.org/x/crypto/ssh/agent
(GO-2025-4116)
[CRITICAL] 88-88: golang.org/x/crypto 0.24.0: Unbounded memory consumption in golang.org/x/crypto/ssh
(GO-2025-4134)
[CRITICAL] 88-88: golang.org/x/crypto 0.24.0: Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent
(GO-2025-4135)
[CRITICAL] 88-88: golang.org/x/crypto 0.24.0: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
(GO-2026-5005)
[CRITICAL] 88-88: golang.org/x/crypto 0.24.0: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
(GO-2026-5006)
[CRITICAL] 88-88: golang.org/x/crypto 0.24.0: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
(GO-2026-5013)
[CRITICAL] 88-88: golang.org/x/crypto 0.24.0: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
(GO-2026-5014)
[CRITICAL] 88-88: golang.org/x/crypto 0.24.0: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh
(GO-2026-5015)
[CRITICAL] 88-88: golang.org/x/crypto 0.24.0: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh
(GO-2026-5016)
[CRITICAL] 88-88: golang.org/x/crypto 0.24.0: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
(GO-2026-5017)
[CRITICAL] 88-88: golang.org/x/crypto 0.24.0: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh
(GO-2026-5018)
[CRITICAL] 88-88: golang.org/x/crypto 0.24.0: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
(GO-2026-5019)
[CRITICAL] 88-88: golang.org/x/crypto 0.24.0: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
(GO-2026-5020)
[CRITICAL] 88-88: golang.org/x/crypto 0.24.0: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
(GO-2026-5021)
[CRITICAL] 88-88: golang.org/x/crypto 0.24.0: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
(GO-2026-5023)
[CRITICAL] 88-88: golang.org/x/crypto 0.24.0: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent
(GO-2026-5033)
[CRITICAL] 88-88: golang.org/x/crypto 0.24.0: golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read
[CRITICAL] 88-88: golang.org/x/crypto 0.24.0: golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange
[CRITICAL] 88-88: golang.org/x/crypto 0.24.0: golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption
[CRITICAL] 88-88: golang.org/x/crypto 0.24.0: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 88, The go.mod currently pins golang.org/x/crypto at v0.24.0
which is vulnerable; update the module to a safe release (>= v0.45.0) by running
a module upgrade (e.g., go get golang.org/x/crypto@v0.45.0 or newer) and then
run go mod tidy to update go.mod/go.sum, ensuring the indirect entry for
golang.org/x/crypto is bumped; finally run your test suite and go vet/build to
verify nothing breaks.
| google.golang.org/protobuf v1.31.0 // indirect | ||
| golang.org/x/crypto v0.24.0 // indirect | ||
| golang.org/x/net v0.26.0 // indirect | ||
| golang.org/x/oauth2 v0.18.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify advisory coverage for oauth2@v0.18.0.
set -euo pipefail
curl -s 'https://api.osv.dev/v1/query' \
-H 'Content-Type: application/json' \
-d '{
"package": {"name":"golang.org/x/oauth2","ecosystem":"Go"},
"version":"0.18.0"
}' | jq .Repository: openshift/cluster-olm-operator
Length of output: 4070
Bump golang.org/x/oauth2 to a patched release (>= v0.27.0)
golang.org/x/oauth2 v0.18.0 is affected by HIGH-severity vulnerabilities (CVE-2025-22868 / GO-2025-3488); OSV lists the fix at v0.27.0. Update the indirect dependency in go.mod accordingly.
🧰 Tools
🪛 OSV Scanner (2.3.8)
[HIGH] 90-90: golang.org/x/oauth2 0.18.0: Unexpected memory consumption during token parsing in golang.org/x/oauth2
(GO-2025-3488)
[HIGH] 90-90: golang.org/x/oauth2 0.18.0: golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 90, Update the indirect module version for
golang.org/x/oauth2 from v0.18.0 to a patched release (>= v0.27.0) in go.mod and
then run module tooling to update the lockfiles (e.g., run go get
golang.org/x/oauth2@v0.27.0 and go mod tidy) so the indirect dependency is
upgraded and the vulnerability is resolved.
|
/test openshift-e2e-aws-techpreview |
|
@MrSanketkumar: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/verified by ci |
|
/lgtm |
openshift-ci-robot
added
the
verified
|
@rissh: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
added
lgtm
|
@prabhapa: The label(s) DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/label approved |
openshift-ci
Bot
added
the
approved
0a67131
into
openshift:release-4.15
|
@MrSanketkumar: Jira Issue Verification Checks: Jira Issue OCPBUGS-86345 Jira Issue OCPBUGS-86345 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Fix included in release 4.15.0-0.nightly-2026-05-25-213816 |
6 participants
Summary
Fixes CVE-2026-33186 by updating grpc to patched version v1.64.1-sec.1 from openshift-sustaining fork.
Changes
Summary by CodeRabbit