OCPBUGS-85650: bump gRPC-Go package#1156
Conversation
openshift-ci-robot
added
jira/severity-important
|
@jhadvig: This pull request references Jira Issue OCPBUGS-83941, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
WalkthroughThis PR updates the Go module manifest to bump indirect dependencies across multiple libraries: CEL expressions from v0.24.0 to v0.25.1, OpenTelemetry SDK and auto-instrumentation to v1.2.1 and v1.39.0 respectively, standard library extensions (crypto, net, oauth2, sync, sys, term, text), and Google Cloud/gRPC packages including grpc to v1.79.3 and protobuf to v1.36.10. ChangesDependency Version Updates
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 1 warning)
✅ Passed checks (10 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Comment |
openshift-ci
Bot
added
the
approved
|
/assign @TheRealJon |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
go.mod (1)
106-107: Cross-repository version coordination needed.The linked repository
openshift/consolestill vendorsgoogle.golang.org/grpcat v1.72.2 andgoogle.golang.org/protobufat v1.36.8 (the pre-patch versions). Consider coordinating this security fix across related OpenShift repositories to ensure consistent vulnerability remediation.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` around lines 106 - 107, The go.mod bump updated google.golang.org/grpc to v1.79.3 and google.golang.org/protobuf to v1.36.10 to address security fixes, but related repo openshift/console still vendors grpc@v1.72.2 and protobuf@v1.36.8; update the corresponding go.mod and vendor state in the openshift/console repository (and any other dependent OpenShift repos) so they require google.golang.org/grpc v1.79.3 and google.golang.org/protobuf v1.36.10 (or a consistent patched version), run module tidy/vendor refresh to propagate changes, and ensure CI passes to verify the coordinated vulnerability remediation for the symbols google.golang.org/grpc and google.golang.org/protobuf.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 85: The go.mod currently pins go.opentelemetry.io/otel at v1.39.0 which
has multiple HIGH severity vulnerabilities; update the module versions in go.mod
so that go.opentelemetry.io/otel is bumped to at least v1.41.0 and
go.opentelemetry.io/otel/sdk is bumped to at least v1.43.0 (or later), then run
go mod tidy to refresh the sum file and vendor if used; ensure imports
referencing go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk compile
cleanly and run tests to verify no breaking API changes.
---
Nitpick comments:
In `@go.mod`:
- Around line 106-107: The go.mod bump updated google.golang.org/grpc to v1.79.3
and google.golang.org/protobuf to v1.36.10 to address security fixes, but
related repo openshift/console still vendors grpc@v1.72.2 and protobuf@v1.36.8;
update the corresponding go.mod and vendor state in the openshift/console
repository (and any other dependent OpenShift repos) so they require
google.golang.org/grpc v1.79.3 and google.golang.org/protobuf v1.36.10 (or a
consistent patched version), run module tidy/vendor refresh to propagate
changes, and ensure CI passes to verify the coordinated vulnerability
remediation for the symbols google.golang.org/grpc and
google.golang.org/protobuf.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 985514c2-6e80-4c70-8171-d14a053f699f
⛔ Files ignored due to path filters (230)
go.sumis excluded by!**/*.sumvendor/cel.dev/expr/BUILD.bazelis excluded by!vendor/**,!**/vendor/**vendor/cel.dev/expr/MODULE.bazelis excluded by!vendor/**,!**/vendor/**vendor/cel.dev/expr/checked.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cel.dev/expr/eval.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cel.dev/expr/explain.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cel.dev/expr/syntax.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cel.dev/expr/value.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/id.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/number.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/span.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/status.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/traces.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/value.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/span.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/tracer.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/.clomonitor.ymlis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/.codespellignoreis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/.golangci.ymlis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/.lycheeignoreis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/CODEOWNERSis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/CONTRIBUTING.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/Makefileis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/README.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/RELEASING.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/SECURITY-INSIGHTS.ymlis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/VERSIONING.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/encoder.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/filter.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/hash.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/internal/attribute.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/internal/xxhash/xxhash.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/iterator.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/key.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/kv.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/set.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/type_string.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/value.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/baggage/baggage.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/codes/codes.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/dependencies.Dockerfileis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/internal/global/internal_logging.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/internal/global/meter.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/internal/global/trace.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/metric.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/metric/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/metric/config.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/propagation/baggage.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/propagation/propagation.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/propagation/trace_context.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/internal/x/features.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/internal/x/x.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/builtin.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/container.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/env.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id_bsd.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id_linux.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id_unsupported.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id_windows.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os_release_unix.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os_unix.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os_unsupported.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/process.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/resource.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/batch_span_processor.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/doc.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/id_generator.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/internal/env/env.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/batch_span_processor.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/doc.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/simple_span_processor.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/tracer.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/provider.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/sampling.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/simple_span_processor.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/snapshot.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/span.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/span_limits.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/tracer.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/version.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/version.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/internal/http.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/MIGRATION.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/README.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/attribute_group.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/doc.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/error_type.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/exception.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/otelconv/metric.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/schema.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/auto.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/config.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/hex.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/attr.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/id.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/value.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/noop.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/noop/noop.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/span.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/trace.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/tracestate.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/version.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/versions.yamlis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/transport.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/trace/events.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/oauth2/deviceauth.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/oauth2/oauth2.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/oauth2/pkce.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/oauth2/token.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/oauth2/transport.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_arm64.sis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_gc_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_gccgo_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_netbsd_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_openbsd_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/mkerrors.shis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_386.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_amd64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_arm.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_loong64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mips.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mips64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_ppc.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_s390x.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_netbsd_arm.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/annotations.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/client.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/field_behavior.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/field_info.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/http.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/resource.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/routing.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/checked.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/eval.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/explain.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/syntax.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/value.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/genproto/googleapis/api/httpbody/httpbody.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/genproto/googleapis/api/launch_stage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/CONTRIBUTING.mdis excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/MAINTAINERS.mdis excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/README.mdis excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/balancer/balancer.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/balancer/endpointsharding/endpointsharding.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/balancer/pickfirst/internal/internal.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/balancer/pickfirst/pickfirst.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/balancer/pickfirst/pickfirstleaf/pickfirstleaf.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/balancer/roundrobin/roundrobin.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/balancer/subconn.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/balancer_wrapper.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/binarylog/grpc_binarylog_v1/binarylog.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/clientconn.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/credentials/credentials.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/credentials/insecure/insecure.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/credentials/tls.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/dialoptions.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/encoding/encoding.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/encoding/gzip/gzip.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/encoding/internal/internal.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/encoding/proto/proto.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/experimental/stats/metricregistry.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/experimental/stats/metrics.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/health/grpc_health_v1/health.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/health/grpc_health_v1/health_grpc.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/interceptor.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/gracefulswitch.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/balancer/weight/weight.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/buffer/unbounded.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/channelz/trace.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/credentials/credentials.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/envconfig/envconfig.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/envconfig/xds.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/experimental.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/grpcsync/callback_serializer.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/grpcsync/event.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/idle/idle.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/internal.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/resolver/delegatingresolver/delegatingresolver.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/resolver/dns/dns_resolver.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/stats/metrics_recorder_list.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/stats/stats.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/status/status.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/transport/client_stream.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/transport/controlbuf.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/transport/flowcontrol.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/transport/handler_server.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/transport/http2_client.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/transport/http2_server.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/transport/http_util.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/transport/server_stream.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/transport/transport.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/mem/buffer_pool.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/mem/buffer_slice.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/mem/buffers.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/picker_wrapper.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/preloader.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/resolver/resolver.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/resolver_wrapper.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/rpc_util.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/server.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/stats/handlers.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/stats/stats.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/stream.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/version.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/editionssupport/editions.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/filedesc/desc.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/filedesc/desc_init.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/filedesc/desc_lazy.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/filedesc/editions.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/version/version.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/reflect/protodesc/desc.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/reflect/protodesc/desc_init.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/reflect/protodesc/proto.gois excluded by!vendor/**,!**/vendor/**vendor/modules.txtis excluded by!vendor/**,!**/vendor/**
📒 Files selected for processing (1)
go.mod
📜 Review details
🧰 Additional context used
📓 Path-based instructions (2)
**/*.{go,mod,sum}
📄 CodeRabbit inference engine (AGENTS.md)
Use Go version 1.24.0 (toolchain: go1.24.4) for the OpenShift Console Operator project
Files:
go.mod
**/{Makefile,*.mk,go.mod}
📄 CodeRabbit inference engine (AGENTS.md)
Use
GOFLAGS="-mod=vendor"for all builds and tests to ensure vendored dependencies are used
Files:
go.mod
🪛 OSV Scanner (2.3.8)
go.mod
[HIGH] 85-85: go.opentelemetry.io/otel 1.39.0: OpenTelemetry-Go: multi-value baggage header extraction causes excessive allocations (remote dos amplification)
[HIGH] 89-89: go.opentelemetry.io/otel/sdk 1.39.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking in go.opentelemetry.io/otel/sdk
(GO-2026-4394)
[HIGH] 89-89: go.opentelemetry.io/otel/sdk 1.39.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking
[HIGH] 89-89: go.opentelemetry.io/otel/sdk 1.39.0: opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking
🔀 Multi-repo context openshift/console
[::openshift/console::] vendor/modules.txt — lists google.golang.org/grpc at v1.72.2 (entries around lines ~970–1032) and google.golang.org/protobuf at v1.36.8 (entries around lines ~1032–1075).
[::openshift/console::] vendor/google.golang.org/grpc/internal/transport/http2_server.go — imports google.golang.org/grpc/internal/grpcutil and google.golang.org/protobuf/proto (shows vendored gRPC/HTTP2 server transport code).
[::openshift/console::] vendor/google.golang.org/grpc/server.go — gRPC server implementation present in vendor.
[::openshift/console::] vendor/google.golang.org/grpc/clientconn.go — gRPC client connection code present in vendor.
[::openshift/console::] vendor/google.golang.org/genproto/googleapis/rpc/status/status.pb.go and vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/*.pb.go — generated protobuf code referencing google.golang.org/protobuf types.
Reflection: the repository contains vendored gRPC and protobuf modules (currently older versions), plus generated protos under vendor. These files indicate consumers/build artifacts that would be affected if a dependency like google.golang.org/grpc or google.golang.org/protobuf is upgraded in a related repo — but I did not find non-vendor direct references outside vendor to grpc (search results are from vendor). All findings above are from the openshift/console vendor tree.
🔇 Additional comments (2)
go.mod (2)
31-31: LGTM!Also applies to: 82-82, 88-88, 90-90, 96-102, 104-105, 107-107
106-106: gRPC version v1.79.3 correctly addresses CVE-2026-33186.The authorization bypass vulnerability (improper validation of HTTP/2 :path pseudo-header) is fixed in v1.79.3, which rejects non-canonical paths missing the leading slash.
| go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 // indirect | ||
| go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect | ||
| go.opentelemetry.io/otel v1.36.0 // indirect | ||
| go.opentelemetry.io/otel v1.39.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check for security advisories and latest versions of OpenTelemetry packages
echo "=== Checking go.opentelemetry.io/otel ==="
gh api graphql -f query='
{
securityVulnerabilities(first: 10, ecosystem: GO, package: "go.opentelemetry.io/otel") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'
echo ""
echo "=== Checking go.opentelemetry.io/otel/sdk ==="
gh api graphql -f query='
{
securityVulnerabilities(first: 10, ecosystem: GO, package: "go.opentelemetry.io/otel/sdk") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'Repository: openshift/console-operator
Length of output: 1057
🌐 Web query:
OpenTelemetry Go GHSA-mh2q-q3fh-2475 GHSA-9h8m-3fm2-qjrq patched versions
💡 Result:
Patched (fixed) OpenTelemetry Go versions for the two GHSA advisories: 1) GHSA-9h8m-3fm2-qjrq (CVE-2026-24051, PATH hijacking on macOS/Darwin) - Vulnerable range: >= 1.21.0, <= 1.39.0. - Patched in: v1.40.0 (introduced with patch commit d45961b). [1] 2) GHSA-mh2q-q3fh-2475 (multi-value baggage header extraction causing excessive allocations / remote DoS amplification) - Vulnerable range: >= v1.36.0, <= v1.40.0. - Patched in: v1.41.0 and later. [2] Recommendation: upgrade to at least v1.40.0 for the PATH hijacking issue and to at least v1.41.0 if you want to be safe against both issues simultaneously. [1][2]
Citations:
🏁 Script executed:
#!/bin/bash
# Check the actual go.mod file for OpenTelemetry versions
sed -n '80,95p' go.modRepository: openshift/console-operator
Length of output: 960
Upgrade OpenTelemetry packages to address HIGH severity vulnerabilities.
The current versions (v1.39.0) contain multiple HIGH severity vulnerabilities:
- GHSA-mh2q-q3fh-2475: Remote DoS amplification via multi-value
baggageheader extraction — patched in v1.41.0 - PATH hijacking (GO-2026-4394 / GHSA-9h8m-3fm2-qjrq): Arbitrary Code Execution via unsafe PATH handling in SDK — patched in v1.40.0
- GHSA-hfvc-g4fc-pqhx: BSD kenv command PATH hijacking enabling code execution — patched in v1.43.0
Upgrade go.opentelemetry.io/otel to v1.41.0 or later and go.opentelemetry.io/otel/sdk to v1.43.0 or later to address all issues.
🧰 Tools
🪛 OSV Scanner (2.3.8)
[HIGH] 85-85: go.opentelemetry.io/otel 1.39.0: OpenTelemetry-Go: multi-value baggage header extraction causes excessive allocations (remote dos amplification)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 85, The go.mod currently pins go.opentelemetry.io/otel at
v1.39.0 which has multiple HIGH severity vulnerabilities; update the module
versions in go.mod so that go.opentelemetry.io/otel is bumped to at least
v1.41.0 and go.opentelemetry.io/otel/sdk is bumped to at least v1.43.0 (or
later), then run go mod tidy to refresh the sum file and vendor if used; ensure
imports referencing go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk
compile cleanly and run tests to verify no breaking API changes.
jhadvig
changed the title
openshift-ci-robot
added
jira/valid-bug
|
@jhadvig: This pull request references Jira Issue OCPBUGS-85650, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
The description hasn't been updated, the correct Jira issue should be: The old link is pointing to 4.22 |
|
@jhadvig: This pull request references Jira Issue OCPBUGS-85650, which is valid. 3 validation(s) were run on this bug
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@Leo6Leo updated 🫡 |
|
Verified on OCP 4.23 nightly (4.23.0-0.nightly-2026-05-14-045943):
/lgtm |
openshift-ci-robot
added
the
verified
|
@Leo6Leo: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jhadvig, Leo6Leo The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@jhadvig: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
4 participants
Analysis / Root cause:
CVE-2026-33186 — gRPC-Go versions prior to v1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2
:pathpseudo-header. Requests with a non-canonical path (missing theleading
/) bypass "deny" rules in path-based authorization interceptors. The console-operator does not directly use gRPC (it's an indirect dependency via library-go/apiserver), so the practical risk is low, butthe dependency must be bumped per Red Hat security tracking requirements.
Solution description:
Bump
google.golang.org/grpcfrom v1.72.2 to v1.79.3 and re-vendor. This also upgrades transitive dependencies (otel, protobuf, golang.org/x/* packages) as required by the new gRPC version.Test setup:
No special setup required.
Test cases:
make test-unit— all tests passgofmtcheck — cleangovetcheck — cleanBrowser conformance:
N/A — no UI changes.
Additional info: