[Release-4.21]OCPBUGS-80840,OCPBUGS-80839: Bump google.golang.org/grpc to v1.79.3#713
Open
MrSanketkumar wants to merge 1 commit intoopenshift:release-4.21from
Open
[Release-4.21]OCPBUGS-80840,OCPBUGS-80839: Bump google.golang.org/grpc to v1.79.3#713MrSanketkumar wants to merge 1 commit intoopenshift:release-4.21from
MrSanketkumar wants to merge 1 commit intoopenshift:release-4.21from
Conversation
openshift-ci-robot
added
jira/severity-important
|
@MrSanketkumar: This pull request references Jira Issue OCPBUGS-80840, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this: Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
WalkthroughDependency versions were bumped across multiple module files: core repo ChangesDependency Updates
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 1 warning)
✅ Passed checks (10 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Author
|
/jira refresh |
|
@MrSanketkumar: This pull request references Jira Issue OCPBUGS-80840, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Author
|
@coderabbitai review |
Contributor
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: MrSanketkumar The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
✅ Actions performedReview triggered.
|
|
@MrSanketkumar: This pull request references Jira Issue OCPBUGS-80840, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
MrSanketkumar
force-pushed
the
CVE-2026-33186-4.21
branch
from
933c5ea to
1a5dca5
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 221: The go.mod currently pins a vulnerable opentelemetry SDK (module
go.opentelemetry.io/otel/sdk at v1.39.0); update that dependency to v1.43.0 or
later to remediate the HIGH advisories (GO-2026-4394 / GHSA-9h8m-3fm2-qjrq /
GHSA-hfvc-g4fc-pqhx) and then refresh the module graph (e.g., run go get
go.opentelemetry.io/otel/sdk@v1.43.0 or newer and run go mod tidy) so the
lockfile and transitive deps are updated.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: a96d5dda-89b6-4ec5-824f-cfe0aa972b2b
⛔ Files ignored due to path filters (151)
go.sumis excluded by!**/*.sumvendor/cel.dev/expr/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/MODULE.bazelis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/checked.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/cel.dev/expr/eval.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/cel.dev/expr/explain.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/cel.dev/expr/syntax.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/cel.dev/expr/value.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/id.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/number.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/span.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/status.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/traces.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/value.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/span.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/tracer.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/.codespellignoreis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/.golangci.ymlis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/.lycheeignoreis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/CHANGELOG.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/CONTRIBUTING.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/Makefileis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/README.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/RELEASING.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/VERSIONING.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/encoder.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/set.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/type_string.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/baggage/baggage.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/dependencies.Dockerfileis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/global/meter.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric/config.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/propagation/trace_context.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/internal/env/env.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/internal/x/x.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/builtin.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/container.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/env.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id_bsd.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id_linux.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id_unsupported.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id_windows.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os_release_unix.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os_unix.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os_unsupported.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/process.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/resource.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/batch_span_processor.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/doc.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/id_generator.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/provider.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/sampling.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/simple_span_processor.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/snapshot.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/span.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/span_limits.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/tracer.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/version.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/version.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.34.0/MIGRATION.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.34.0/README.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.34.0/attribute_group.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.34.0/doc.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.34.0/error_type.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.34.0/exception.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.34.0/schema.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/error_type.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/config.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/span.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/version.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/versions.yamlis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/transport.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/trace/events.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sync/errgroup/errgroup.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_arm64.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_gc_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_gccgo_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_netbsd_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_openbsd_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/mkerrors.shis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_386.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_arm.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_loong64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mips.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mips64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_ppc.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_s390x.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_netbsd_arm.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/encoding/unicode/unicode.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/balancer/balancer.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/balancer/pickfirst/internal/internal.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/balancer/pickfirst/pickfirst.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/balancer/pickfirst/pickfirstleaf/pickfirstleaf.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/balancer/roundrobin/roundrobin.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/balancer/subconn.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/balancer_wrapper.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/binarylog/grpc_binarylog_v1/binarylog.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/clientconn.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/credentials/credentials.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/credentials/tls.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/encoding/encoding.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/encoding/gzip/gzip.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/experimental/stats/metricregistry.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/experimental/stats/metrics.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/health/grpc_health_v1/health.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/health/grpc_health_v1/health_grpc.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/interceptor.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/gracefulswitch.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/envconfig/envconfig.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/envconfig/xds.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/experimental.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/idle/idle.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/internal.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/resolver/delegatingresolver/delegatingresolver.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/resolver/dns/dns_resolver.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/stats/metrics_recorder_list.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/client_stream.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/controlbuf.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/flowcontrol.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/handler_server.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/http2_client.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/http2_server.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/http_util.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/server_stream.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/transport.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/mem/buffer_pool.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/mem/buffer_slice.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/mem/buffers.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/preloader.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/resolver/resolver.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/resolver_wrapper.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/rpc_util.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/server.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/stream.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/version.gois excluded by!**/vendor/**,!vendor/**vendor/modules.txtis excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (1)
go.mod
| go.opentelemetry.io/otel/sdk v1.37.0 // indirect | ||
| go.opentelemetry.io/otel/trace v1.38.0 // indirect | ||
| go.opentelemetry.io/otel/metric v1.39.0 // indirect | ||
| go.opentelemetry.io/otel/sdk v1.39.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
`What is the first fixed version of go.opentelemetry.io/otel/sdk for:
- GO-2026-4394
- GHSA-9h8m-3fm2-qjrq
- GHSA-hfvc-g4fc-pqhx
Please include the affected version ranges and patched version ranges from official advisory sources.`
💡 Result:
GO-2026-4394 (GHSA-9h8m-3fm2-qjrq, CVE-2026-24051): First fixed version of go.opentelemetry.io/otel/sdk is v1.40.0. Affected range: Go >=1.21.0 before v1.40.0 [1][2][3]. Patched in v1.40.0 and later [3][4]. GHSA-hfvc-g4fc-pqhx: First fixed version of go.opentelemetry.io/otel/sdk is v1.43.0. Affected range: >= v1.15.0, <= v1.42.0 [5]. Patched in v1.43.0 and later [5][6]. Note: This is an incomplete fix for the prior vulnerability, affecting BSD/Solaris platforms [5]. No separate GO-ID found in pkg.go.dev searches.
Citations:
- 1: https://pkg.go.dev/vuln/GO-2026-4394
- 2: https://osv.dev/vulnerability/GO-2026-4394
- 3: GHSA-9h8m-3fm2-qjrq
- 4: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.40.0
- 5: GHSA-hfvc-g4fc-pqhx
- 6: googleapis/google-cloud-go@b4c40aa
Security blocker: go.opentelemetry.io/otel/sdk v1.39.0 has multiple HIGH advisories
Line 221 pins a vulnerable version (GO-2026-4394, GHSA-9h8m-3fm2-qjrq, GHSA-hfvc-g4fc-pqhx). Bump to v1.43.0 or later to address all reported vulnerabilities and refresh the module graph before merge.
🧰 Tools
🪛 OSV Scanner (2.3.6)
[HIGH] 221-221: go.opentelemetry.io/otel/sdk 1.39.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking in go.opentelemetry.io/otel/sdk
(GO-2026-4394)
[HIGH] 221-221: go.opentelemetry.io/otel/sdk 1.39.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking
[HIGH] 221-221: go.opentelemetry.io/otel/sdk 1.39.0: opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 221, The go.mod currently pins a vulnerable opentelemetry SDK
(module go.opentelemetry.io/otel/sdk at v1.39.0); update that dependency to
v1.43.0 or later to remediate the HIGH advisories (GO-2026-4394 /
GHSA-9h8m-3fm2-qjrq / GHSA-hfvc-g4fc-pqhx) and then refresh the module graph
(e.g., run go get go.opentelemetry.io/otel/sdk@v1.43.0 or newer and run go mod
tidy) so the lockfile and transitive deps are updated.
Author
|
/retest-required |
|
/retitle [Release-4.21]OCPBUGS-80840,OCPBUGS-80839: Bump google.golang.org/grpc to v1.79.3 |
openshift-ci
Bot
changed the title
|
@MrSanketkumar: This pull request references Jira Issue OCPBUGS-80840, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. This pull request references Jira Issue OCPBUGS-80839, which is valid. The bug has been moved to the POST state. 7 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira (ocp-sustaining-admins@redhat.com), skipping review request. The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
MrSanketkumar
force-pushed
the
CVE-2026-33186-4.21
branch
from
1a5dca5 to
cf7df47
Compare
Author
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
|
@MrSanketkumar: This pull request references Jira Issue OCPBUGS-80840, which is invalid:
Comment This pull request references Jira Issue OCPBUGS-80839, which is valid. 7 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira (ocp-sustaining-admins@redhat.com), skipping review request. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
go.mod (1)
217-222:⚠️ Potential issue | 🟠 Major | ⚡ Quick winSecurity blocker: OpenTelemetry core/sdk are pinned to vulnerable versions.
Lines 217–222 pin
go.opentelemetry.io/otel*atv1.39.0, which is affected by high-severity advisories (including GHSA-mh2-q3fh-2475 foroteland GHSA-9h8m-3fm2-qjrq / GHSA-hfvc-g4fc-pqhx forotel/sdk). Please bump the OTel stack to a fixed floor (sdk >= v1.43.0;otel >= v1.41.0).🔧 Suggested patch (aligned family)
- go.opentelemetry.io/otel v1.39.0 // indirect - go.opentelemetry.io/otel/metric v1.39.0 // indirect - go.opentelemetry.io/otel/sdk v1.39.0 // indirect - go.opentelemetry.io/otel/trace v1.39.0 // indirect + go.opentelemetry.io/otel v1.43.0 // indirect + go.opentelemetry.io/otel/metric v1.43.0 // indirect + go.opentelemetry.io/otel/sdk v1.43.0 // indirect + go.opentelemetry.io/otel/trace v1.43.0 // indirect🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` around lines 217 - 222, Update the pinned OpenTelemetry modules in go.mod to non-vulnerable releases: raise go.opentelemetry.io/otel to at least v1.41.0 and go.opentelemetry.io/otel/sdk to at least v1.43.0 (and bump related packages like go.opentelemetry.io/otel/metric, go.opentelemetry.io/otel/trace, and go.opentelemetry.io/otel/exporters/otlp/otlptrace* to matching compatible versions) by editing the version strings for those module entries and then run your Go module update (e.g., go get) and tests to ensure compatibility; target aligned family versions so otel, otel/sdk, otel/metric, otel/trace, and otlptrace packages are mutually compatible.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@openshift/default-catalog-consistency/go.mod`:
- Line 46: The go.mod currently pins the vulnerable dependency
"github.com/go-jose/go-jose/v4 v4.1.3"; update that module to "v4.1.4" (or
newer) in go.mod, then run "go get github.com/go-jose/go-jose/v4@v4.1.4" (or the
desired newer version) and "go mod tidy" to refresh go.sum, and commit the
updated go.mod and go.sum so the CVE-2026-34986 denial-of-service fix is
applied.
---
Duplicate comments:
In `@go.mod`:
- Around line 217-222: Update the pinned OpenTelemetry modules in go.mod to
non-vulnerable releases: raise go.opentelemetry.io/otel to at least v1.41.0 and
go.opentelemetry.io/otel/sdk to at least v1.43.0 (and bump related packages like
go.opentelemetry.io/otel/metric, go.opentelemetry.io/otel/trace, and
go.opentelemetry.io/otel/exporters/otlp/otlptrace* to matching compatible
versions) by editing the version strings for those module entries and then run
your Go module update (e.g., go get) and tests to ensure compatibility; target
aligned family versions so otel, otel/sdk, otel/metric, otel/trace, and
otlptrace packages are mutually compatible.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: c8cba45b-c1bd-43cf-8d54-cbb5438c6498
⛔ Files ignored due to path filters (297)
go.sumis excluded by!**/*.sumopenshift/default-catalog-consistency/go.sumis excluded by!**/*.sumopenshift/default-catalog-consistency/vendor/github.com/go-jose/go-jose/v4/CHANGELOG.mdis excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/github.com/go-jose/go-jose/v4/README.mdis excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/github.com/go-jose/go-jose/v4/crypter.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/github.com/go-jose/go-jose/v4/jwk.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/github.com/go-jose/go-jose/v4/shared.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/github.com/go-jose/go-jose/v4/signing.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/github.com/go-jose/go-jose/v4/symmetric.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/github.com/go-jose/go-jose/v4/symmetric_legacy.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/crypto/openpgp/s2k/s2k.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/crypto/salsa20/salsa/hsalsa20.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/crypto/sha3/doc.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/crypto/sha3/hashes.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/crypto/sha3/hashes_noasm.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/crypto/sha3/keccakf.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/crypto/sha3/keccakf_amd64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/crypto/sha3/keccakf_amd64.sis excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/crypto/sha3/sha3.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/crypto/sha3/sha3_s390x.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/crypto/sha3/sha3_s390x.sis excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/crypto/sha3/shake.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/crypto/sha3/shake_noasm.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/mod/semver/semver.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/context/context.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/html/escape.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/html/parse.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/html/render.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/config.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/config_go124.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/config_pre_go124.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/frame.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/gotrack.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/http2.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/server.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/timer.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/transport.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/writesched.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/writesched_roundrobin.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/internal/httpcommon/request.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/trace/events.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/oauth2/deviceauth.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/oauth2/oauth2.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/oauth2/pkce.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/oauth2/token.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/oauth2/transport.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sync/errgroup/errgroup.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/cpu/cpu_arm64.sis excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/plan9/pwd_go15_plan9.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/plan9/pwd_plan9.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/affinity_linux.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/fdset.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ifreq_linux.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/mkall.shis excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/mkerrors.shis excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/syscall_linux.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/syscall_netbsd.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/syscall_solaris.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_386.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_amd64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_arm.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_arm64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_loong64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_mips.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_mips64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_ppc.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_s390x.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsyscall_linux.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsyscall_solaris_amd64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_netbsd_arm.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/windows/syscall_windows.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/windows/types_windows.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/windows/zsyscall_windows.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/term/terminal.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/text/encoding/japanese/eucjp.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/text/encoding/japanese/iso2022jp.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/text/encoding/japanese/shiftjis.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/text/encoding/korean/euckr.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/text/encoding/simplifiedchinese/gbk.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/text/encoding/simplifiedchinese/hzgb2312.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/text/encoding/traditionalchinese/big5.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/text/encoding/unicode/unicode.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/text/unicode/bidi/core.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/tools/go/ast/inspector/cursor.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/tools/go/packages/golist.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/tools/go/packages/visit.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/tools/go/types/objectpath/objectpath.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/tools/go/types/typeutil/map.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/tools/internal/event/core/event.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/tools/internal/gcimporter/bimport.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/tools/internal/gcimporter/iexport.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/tools/internal/gcimporter/iimport.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/tools/internal/gcimporter/iimport_go122.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/tools/internal/stdlib/deps.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/tools/internal/stdlib/import.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/tools/internal/stdlib/manifest.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/tools/internal/typeparams/normalize.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/tools/internal/typesinternal/element.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/tools/internal/typesinternal/qualifier.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/tools/internal/typesinternal/types.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/tools/internal/typesinternal/varkind.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/tools/internal/typesinternal/zerovalue.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/tools/internal/versions/features.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/CONTRIBUTING.mdis excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/balancer/balancer.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/balancer/pickfirst/internal/internal.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/balancer/pickfirst/pickfirst.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/balancer/pickfirst/pickfirstleaf/pickfirstleaf.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/balancer/roundrobin/roundrobin.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/balancer/subconn.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/balancer_wrapper.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/binarylog/grpc_binarylog_v1/binarylog.pb.gois excluded by!**/*.pb.go,!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/clientconn.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/credentials/credentials.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/credentials/tls.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/encoding/encoding.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/encoding/proto/proto.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/experimental/stats/metricregistry.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/experimental/stats/metrics.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/interceptor.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/gracefulswitch.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/buffer/unbounded.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/channelz/trace.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/envconfig/envconfig.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/envconfig/xds.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/experimental.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/grpcsync/callback_serializer.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/idle/idle.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/internal.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/resolver/delegatingresolver/delegatingresolver.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/resolver/dns/dns_resolver.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/stats/metrics_recorder_list.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/client_stream.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/controlbuf.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/flowcontrol.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/handler_server.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/http2_client.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/http2_server.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/http_util.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/server_stream.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/transport.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/mem/buffer_pool.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/mem/buffer_slice.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/mem/buffers.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/preloader.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/resolver/resolver.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/resolver_wrapper.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/rpc_util.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/server.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/stream.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/version.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/protobuf/internal/editionssupport/editions.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/protobuf/internal/filedesc/desc.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/protobuf/internal/filedesc/desc_init.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/protobuf/internal/filedesc/desc_lazy.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/protobuf/internal/filedesc/editions.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/protobuf/internal/version/version.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/protobuf/reflect/protodesc/desc.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/protobuf/reflect/protodesc/desc_init.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/protobuf/reflect/protodesc/proto.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/modules.txtis excluded by!**/vendor/**openshift/tests-extension/go.sumis excluded by!**/*.sumopenshift/tests-extension/vendor/cel.dev/expr/BUILD.bazelis excluded by!**/vendor/**openshift/tests-extension/vendor/cel.dev/expr/MODULE.bazelis excluded by!**/vendor/**openshift/tests-extension/vendor/cel.dev/expr/checked.pb.gois excluded by!**/*.pb.go,!**/vendor/**openshift/tests-extension/vendor/cel.dev/expr/eval.pb.gois excluded by!**/*.pb.go,!**/vendor/**openshift/tests-extension/vendor/cel.dev/expr/explain.pb.gois excluded by!**/*.pb.go,!**/vendor/**openshift/tests-extension/vendor/cel.dev/expr/syntax.pb.gois excluded by!**/*.pb.go,!**/vendor/**openshift/tests-extension/vendor/cel.dev/expr/value.pb.gois excluded by!**/*.pb.go,!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/id.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/number.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/span.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/status.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/traces.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/value.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/auto/sdk/span.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/auto/sdk/tracer.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/.codespellignoreis excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/.golangci.ymlis excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/.lycheeignoreis excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/CHANGELOG.mdis excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/CODEOWNERSis excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/CONTRIBUTING.mdis excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/LICENSEis excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/Makefileis excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/README.mdis excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/RELEASING.mdis excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/SECURITY-INSIGHTS.ymlis excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/VERSIONING.mdis excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/attribute/encoder.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/attribute/filter.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/attribute/hash.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/attribute/internal/attribute.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/attribute/internal/xxhash/xxhash.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/attribute/iterator.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/attribute/key.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/attribute/kv.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/attribute/set.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/attribute/type_string.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/attribute/value.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/baggage/baggage.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/codes/codes.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/dependencies.Dockerfileis excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/internal/global/internal_logging.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/internal/global/meter.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/internal/global/trace.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/metric.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/metric/LICENSEis excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/metric/config.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/propagation/baggage.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/propagation/propagation.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/propagation/trace_context.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/LICENSEis excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/internal/x/features.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/internal/x/x.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/resource/builtin.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/resource/container.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/resource/env.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/resource/host_id.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/resource/host_id_bsd.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/resource/host_id_linux.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/resource/host_id_unsupported.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/resource/host_id_windows.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/resource/os.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/resource/os_release_unix.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/resource/os_unix.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/resource/os_unsupported.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/resource/process.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/resource/resource.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/trace/batch_span_processor.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/trace/doc.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/trace/id_generator.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/trace/internal/env/env.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/batch_span_processor.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/doc.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/simple_span_processor.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/tracer.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/trace/provider.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/trace/sampling.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/trace/simple_span_processor.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/trace/snapshot.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/trace/span.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/trace/span_limits.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/trace/tracer.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/trace/version.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/sdk/version.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/semconv/v1.34.0/MIGRATION.mdis excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/semconv/v1.34.0/README.mdis excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/semconv/v1.34.0/attribute_group.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/semconv/v1.34.0/doc.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/semconv/v1.34.0/exception.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/semconv/v1.34.0/schema.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/semconv/v1.37.0/MIGRATION.mdis excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/semconv/v1.37.0/README.mdis excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/semconv/v1.37.0/attribute_group.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/semconv/v1.37.0/doc.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/semconv/v1.37.0/error_type.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/semconv/v1.37.0/exception.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/semconv/v1.37.0/otelconv/metric.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/semconv/v1.37.0/schema.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/trace/LICENSEis excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/trace/auto.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/trace/config.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/trace/hex.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/trace/internal/telemetry/attr.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/trace/internal/telemetry/id.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/trace/internal/telemetry/value.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/trace/noop.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/trace/noop/noop.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/trace/span.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/trace/trace.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/trace/tracestate.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/version.gois excluded by!**/vendor/**openshift/tests-extension/vendor/go.opentelemetry.io/otel/versions.yamlis excluded by!**/vendor/**openshift/tests-extension/vendor/golang.org/x/crypto/chacha20/chacha_arm64.sis excluded by!**/vendor/**openshift/tests-extension/vendor/golang.org/x/crypto/curve25519/curve25519.gois excluded by!**/vendor/**openshift/tests-extension/vendor/golang.org/x/crypto/ssh/cipher.gois excluded by!**/vendor/**openshift/tests-extension/vendor/golang.org/x/crypto/ssh/client_auth.gois excluded by!**/vendor/**openshift/tests-extension/vendor/golang.org/x/crypto/ssh/common.gois excluded by!**/vendor/**openshift/tests-extension/vendor/golang.org/x/crypto/ssh/doc.gois excluded by!**/vendor/**openshift/tests-extension/vendor/golang.org/x/crypto/ssh/handshake.gois excluded by!**/vendor/**openshift/tests-extension/vendor/golang.org/x/crypto/ssh/kex.gois excluded by!**/vendor/**openshift/tests-extension/vendor/golang.org/x/crypto/ssh/keys.gois excluded by!**/vendor/**openshift/tests-extension/vendor/golang.org/x/crypto/ssh/mac.gois excluded by!**/vendor/**openshift/tests-extension/vendor/golang.org/x/crypto/ssh/messages.gois excluded by!**/vendor/**openshift/tests-extension/vendor/golang.org/x/crypto/ssh/server.gois excluded by!**/vendor/**openshift/tests-extension/vendor/golang.org/x/crypto/ssh/ssh_gss.gois excluded by!**/vendor/**openshift/tests-extension/vendor/golang.org/x/crypto/ssh/streamlocal.gois excluded by!**/vendor/**openshift/tests-extension/vendor/golang.org/x/crypto/ssh/tcpip.gois excluded by!**/vendor/**
📒 Files selected for processing (3)
go.modopenshift/default-catalog-consistency/go.modopenshift/tests-extension/go.mod
| github.com/go-git/go-billy/v5 v5.6.2 // indirect | ||
| github.com/go-git/go-git/v5 v5.16.2 // indirect | ||
| github.com/go-jose/go-jose/v4 v4.1.1 // indirect | ||
| github.com/go-jose/go-jose/v4 v4.1.3 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
find . -name "go.mod" -path "*openshift/default-catalog-consistency*" -type fRepository: openshift/operator-framework-operator-controller
Length of output: 139
🌐 Web query:
GHSA-78h2-9frx-2jm8 go-jose vulnerability
💡 Result:
GHSA-78h2-9frx-2jm8 is a go-jose (go-jose/go-jose) vulnerability titled “Panic in JWE decryption”, with CVE-2026-34986. It can be triggered during JSON Web Encryption (JWE) decryption, where go-jose may panic (leading to denial of service) if the JWE header’s alg indicates a key wrapping algorithm (ending in “KW”, except the GCMKW variants) and the JWE encrypted_key field is empty. [1] Affected / fixed versions (per the upstream advisory): - github.com/go-jose/go-jose/v3: affected < 3.0.5; fixed in 3.0.5. [1] - github.com/go-jose/go-jose/v4: affected < 4.1.4; fixed in 4.1.4. [1] Reachability / exploitation details (from the advisory): - The panic occurs when cipher.KeyUnwrap() in key_wrap.go attempts to allocate a slice with a zero or negative length derived from the (empty) encrypted_key. [1] - The code path is reachable by parsing a JWE (ParseEncrypted / ParseEncryptedJSON / ParseEncryptedCompact) followed by Decrypt on the resulting object. [1] - A mitigation/workaround is that if the application passes a keyAlgorithms list to the parse functions that does not include key wrapping algorithms (alg values ending in “KW”), then parsing will fail and the application is unaffected. [1] - If you accept JWE Compact Serialization, you can prevalidate that the encrypted_key field (the data between the first and second “.” in the compact form) is non-empty. [1] Practical guidance: 1) Upgrade go-jose to at least the patched versions (v3 >= 3.0.5 or v4 >= 4.1.4). [1] 2) If you can’t upgrade immediately, ensure your accepted key algorithm set excludes *KW algorithms, or add input validation to reject JWE objects with an empty encrypted_key when using key wrapping algs. [1] Additional note from a vendor scan writeup: a product may detect CVE-2026-34986 transitively via a vulnerable go-jose version, but mark the component “not affected” if the vulnerable code path is not reachable in that product’s runtime context. [2]
Citations:
- 1: GHSA-78h2-9frx-2jm8
- 2: https://knowledge.broadcom.com/external/article/435970/cve202634986-ghsa78h29frx2jm8-detected.html
🌐 Web query:
CVE-2026-34986 go-jose
💡 Result:
CVE-2026-34986 is a denial-of-service (panic) vulnerability in the go-jose library’s JWE decryption path. Specifically, in go-jose versions prior to 4.1.4 (v4) and prior to 3.0.5 (v3), decrypting a JWE object can panic when: (1) the JWE header alg indicates a key wrapping algorithm (ends with KW, with exceptions A128GCMKW/A192GCMKW/A256GCMKW), and (2) the JWE encrypted_key field is empty [1][2]. Impact / what happens - The panic occurs because cipher.KeyUnwrap() (in go-jose’s key_wrap.go) attempts to allocate a slice using a zero or negative length derived from the length of encrypted_key [1][2]. - This panic can crash the process, i.e., an attacker may cause a denial of service by sending a crafted JWE object [1][2]. Reachability details - The vulnerable code path is reachable by parsing a JWE (via ParseEncrypted(), ParseEncryptedJSON(), or ParseEncryptedCompact()), followed by calling Decrypt() on the resulting object [1][2]. - If the application configures the parser with a list of accepted key algorithms that does not include any key wrapping algorithms, parsing will fail and the application is unaffected [1][2]. - It can also be triggered by directly calling cipher.KeyUnwrap() with ciphertext shorter than 16 bytes, though this is described as less common [1][2]. Fixed versions / remediation - Upgrade go-jose v4 to 4.1.4 or later, and upgrade go-jose v3 to 3.0.5 or later to fix the JWE decryption panic [1][3][4]. - go-jose’s 4.1.4 release notes explicitly state it “Fixes Panic in JWE decryption” and reference the GHSA advisory for this issue [3]. If you tell me which go-jose major version your application uses (v3 vs v4) and the versions you currently run, I can map that to the exact “affected/unaffected” status and suggest the minimal upgrade target.
Citations:
- 1: https://nvd.nist.gov/vuln/detail/CVE-2026-34986
- 2: GHSA-78h2-9frx-2jm8
- 3: https://github.com/go-jose/go-jose/releases/tag/v4.1.4
- 4: https://osv.dev/vulnerability/GHSA-78h2-9frx-2jm8
🏁 Script executed:
cat -n ./openshift/default-catalog-consistency/go.mod | sed -n '40,52p'Repository: openshift/operator-framework-operator-controller
Length of output: 856
Security blocker: github.com/go-jose/go-jose/v4 v4.1.3 is vulnerable to GHSA-78h2-9frx-2jm8.
Line 46 pins a version affected by CVE-2026-34986, a denial-of-service vulnerability in JWE decryption that can cause a panic when parsing a JWE with an empty encrypted_key field and a key wrapping algorithm. Bump to v4.1.4 or newer to fix.
🔧 Suggested patch
- github.com/go-jose/go-jose/v4 v4.1.3 // indirect
+ github.com/go-jose/go-jose/v4 v4.1.4 // indirect📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| github.com/go-jose/go-jose/v4 v4.1.3 // indirect | |
| github.com/go-jose/go-jose/v4 v4.1.4 // indirect |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@openshift/default-catalog-consistency/go.mod` at line 46, The go.mod
currently pins the vulnerable dependency "github.com/go-jose/go-jose/v4 v4.1.3";
update that module to "v4.1.4" (or newer) in go.mod, then run "go get
github.com/go-jose/go-jose/v4@v4.1.4" (or the desired newer version) and "go mod
tidy" to refresh go.sum, and commit the updated go.mod and go.sum so the
CVE-2026-34986 denial-of-service fix is applied.
MrSanketkumar
force-pushed
the
CVE-2026-33186-4.21
branch
from
cf7df47 to
94e6dcb
Compare
Author
|
/retest-required |
Contributor
|
@MrSanketkumar: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit