OCPBUGS-83941: bump gRPC-Go package#1157
Open
jhadvig wants to merge 1 commit into
Open
Conversation
openshift-ci-robot
added
jira/severity-important
Contributor
|
@jhadvig: This pull request references Jira Issue OCPBUGS-83941, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
WalkthroughThis PR updates module dependency versions in ChangesDependency Version Updates
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 1 warning)
✅ Passed checks (10 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jhadvig The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Around line 85-90: The OpenTelemetry modules in go.mod
(go.opentelemetry.io/otel, go.opentelemetry.io/otel/sdk,
go.opentelemetry.io/otel/metric, go.opentelemetry.io/otel/trace and the
exporters otlptrace and otlptrace/otlptracegrpc) are pinned to vulnerable
v1.34.0–v1.39.0 releases; update all these module versions to v1.43.0 or later
(ensure otlptrace and otlptrace/otlptracegrpc are also bumped from v1.34.0) in
go.mod, then run module resolution (e.g., go get <module>@v1.43.0 and go mod
tidy) and run the build/tests to confirm no regressions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: c1080aa0-85b3-4ab3-a3a6-4ca07c583fc9
⛔ Files ignored due to path filters (230)
go.sumis excluded by!**/*.sumvendor/cel.dev/expr/BUILD.bazelis excluded by!vendor/**,!**/vendor/**vendor/cel.dev/expr/MODULE.bazelis excluded by!vendor/**,!**/vendor/**vendor/cel.dev/expr/checked.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cel.dev/expr/eval.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cel.dev/expr/explain.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cel.dev/expr/syntax.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cel.dev/expr/value.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/id.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/number.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/span.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/status.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/traces.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/value.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/span.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/tracer.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/.clomonitor.ymlis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/.codespellignoreis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/.golangci.ymlis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/.lycheeignoreis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/CODEOWNERSis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/CONTRIBUTING.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/Makefileis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/README.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/RELEASING.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/SECURITY-INSIGHTS.ymlis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/VERSIONING.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/encoder.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/filter.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/hash.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/internal/attribute.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/internal/xxhash/xxhash.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/iterator.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/key.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/kv.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/set.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/type_string.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/value.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/baggage/baggage.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/codes/codes.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/dependencies.Dockerfileis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/internal/global/internal_logging.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/internal/global/meter.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/internal/global/trace.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/metric.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/metric/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/metric/config.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/propagation/baggage.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/propagation/propagation.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/propagation/trace_context.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/internal/x/features.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/internal/x/x.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/builtin.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/container.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/env.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id_bsd.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id_linux.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id_unsupported.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id_windows.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os_release_unix.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os_unix.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os_unsupported.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/process.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/resource.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/batch_span_processor.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/doc.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/id_generator.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/internal/env/env.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/batch_span_processor.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/doc.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/simple_span_processor.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/tracer.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/provider.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/sampling.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/simple_span_processor.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/snapshot.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/span.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/span_limits.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/tracer.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/version.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/version.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/internal/http.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/MIGRATION.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/README.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/attribute_group.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/doc.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/error_type.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/exception.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/otelconv/metric.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/schema.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/auto.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/config.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/hex.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/attr.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/id.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/value.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/noop.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/noop/noop.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/span.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/trace.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/tracestate.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/version.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/versions.yamlis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/transport.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/trace/events.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/oauth2/deviceauth.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/oauth2/oauth2.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/oauth2/pkce.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/oauth2/token.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/oauth2/transport.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_arm64.sis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_gc_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_gccgo_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_netbsd_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_openbsd_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/mkerrors.shis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_386.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_amd64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_arm.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_loong64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mips.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mips64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_ppc.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_s390x.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_netbsd_arm.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/annotations.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/client.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/field_behavior.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/field_info.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/http.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/resource.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/routing.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/checked.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/eval.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/explain.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/syntax.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/value.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/genproto/googleapis/api/httpbody/httpbody.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/genproto/googleapis/api/launch_stage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/CONTRIBUTING.mdis excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/MAINTAINERS.mdis excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/README.mdis excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/balancer/balancer.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/balancer/endpointsharding/endpointsharding.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/balancer/pickfirst/internal/internal.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/balancer/pickfirst/pickfirst.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/balancer/pickfirst/pickfirstleaf/pickfirstleaf.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/balancer/roundrobin/roundrobin.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/balancer/subconn.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/balancer_wrapper.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/binarylog/grpc_binarylog_v1/binarylog.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/clientconn.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/credentials/credentials.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/credentials/insecure/insecure.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/credentials/tls.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/dialoptions.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/encoding/encoding.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/encoding/gzip/gzip.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/encoding/internal/internal.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/encoding/proto/proto.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/experimental/stats/metricregistry.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/experimental/stats/metrics.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/health/grpc_health_v1/health.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/health/grpc_health_v1/health_grpc.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/interceptor.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/gracefulswitch.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/balancer/weight/weight.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/buffer/unbounded.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/channelz/trace.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/credentials/credentials.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/envconfig/envconfig.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/envconfig/xds.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/experimental.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/grpcsync/callback_serializer.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/grpcsync/event.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/idle/idle.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/internal.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/resolver/delegatingresolver/delegatingresolver.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/resolver/dns/dns_resolver.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/stats/metrics_recorder_list.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/stats/stats.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/status/status.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/transport/client_stream.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/transport/controlbuf.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/transport/flowcontrol.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/transport/handler_server.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/transport/http2_client.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/transport/http2_server.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/transport/http_util.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/transport/server_stream.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/transport/transport.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/mem/buffer_pool.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/mem/buffer_slice.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/mem/buffers.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/picker_wrapper.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/preloader.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/resolver/resolver.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/resolver_wrapper.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/rpc_util.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/server.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/stats/handlers.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/stats/stats.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/stream.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/version.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/editionssupport/editions.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/filedesc/desc.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/filedesc/desc_init.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/filedesc/desc_lazy.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/filedesc/editions.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/version/version.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/reflect/protodesc/desc.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/reflect/protodesc/desc_init.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/reflect/protodesc/proto.gois excluded by!vendor/**,!**/vendor/**vendor/modules.txtis excluded by!vendor/**,!**/vendor/**
📒 Files selected for processing (1)
go.mod
📜 Review details
🧰 Additional context used
📓 Path-based instructions (2)
**/*.{go,mod,sum}
📄 CodeRabbit inference engine (AGENTS.md)
Use Go version 1.24.0 (toolchain: go1.24.4) for the OpenShift Console Operator project
Files:
go.mod
**/{Makefile,*.mk,go.mod}
📄 CodeRabbit inference engine (AGENTS.md)
Use
GOFLAGS="-mod=vendor"for all builds and tests to ensure vendored dependencies are used
Files:
go.mod
🪛 OSV Scanner (2.3.8)
go.mod
[HIGH] 85-85: go.opentelemetry.io/otel 1.39.0: OpenTelemetry-Go: multi-value baggage header extraction causes excessive allocations (remote dos amplification)
[HIGH] 89-89: go.opentelemetry.io/otel/sdk 1.39.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking in go.opentelemetry.io/otel/sdk
(GO-2026-4394)
[HIGH] 89-89: go.opentelemetry.io/otel/sdk 1.39.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking
[HIGH] 89-89: go.opentelemetry.io/otel/sdk 1.39.0: opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking
🔀 Multi-repo context openshift/console
Findings
openshift/console
- go.mod currently pins google.golang.org/grpc v1.72.2 (indirect). [::openshift/console::go.mod:206]
- vendor/modules.txt and vendor/ show vendored grpc v1.72.2 and many grpc packages under vendor/google.golang.org/grpc/* — indicates grpc is vendored at v1.72.2. [::openshift/console::vendor/modules.txt:970][::openshift/console::vendor/google.golang.org/grpc/README.md:44]
- Generated protobuf gRPC client usage: vendor/github.com/operator-framework/operator-registry/pkg/api/registry_grpc.pb.go imports grpc/codes/status — a consumer of grpc APIs. [::openshift/console::vendor/github.com/operator-framework/operator-registry/pkg/api/registry_grpc.pb.go:11-13]
- Other vendored consumers/reference points to grpc types (examples):
- vendor/github.com/containerd/containerd/errdefs/grpc.go imports grpc codes/status. [::openshift/console::vendor/github.com/containerd/containerd/errdefs/grpc.go:24-25]
- Multiple internal grpc usages in vendored grpc implementation (e.g., internal/transport/http2_server.go) — shows codepaths dealing with HTTP/2 handling are present in vendored grpc. [::openshift/console::vendor/google.golang.org/grpc/internal/transport/http2_server.go:38-55]
- go.opentelemetry.io/otel changelog notes exporter code moved to grpc.NewClient and DialContext deprecation; updates to grpc may affect otel exporters behavior/options. [::openshift/console::vendor/go.opentelemetry.io/otel/CHANGELOG.md:429-431]
Implication: The console repo currently uses vendored grpc v1.72.2; bumping grpc to v1.79.3 (as in the console-operator PR) would update many transitive packages (otel, protobuf, golang.org/x/*) and may require re-vendoring and verifying generated gRPC clients and OTEL exporters for any API/behavior changes (HTTP/2 handling, Dial vs NewClient). Specific files referenced above are direct consumers to review after bump.
Comment on lines
+85
to
+90
| go.opentelemetry.io/otel v1.39.0 // indirect | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 // indirect | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0 // indirect | ||
| go.opentelemetry.io/otel/metric v1.36.0 // indirect | ||
| go.opentelemetry.io/otel/sdk v1.36.0 // indirect | ||
| go.opentelemetry.io/otel/trace v1.36.0 // indirect | ||
| go.opentelemetry.io/otel/metric v1.39.0 // indirect | ||
| go.opentelemetry.io/otel/sdk v1.39.0 // indirect | ||
| go.opentelemetry.io/otel/trace v1.39.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Querying OSV for go.opentelemetry.io/otel@v1.39.0 and go.opentelemetry.io/otel/sdk@v1.39.0"
curl -s https://api.osv.dev/v1/querybatch \
-H 'Content-Type: application/json' \
-d '{
"queries": [
{"package":{"name":"go.opentelemetry.io/otel","ecosystem":"Go"},"version":"1.39.0"},
{"package":{"name":"go.opentelemetry.io/otel/sdk","ecosystem":"Go"},"version":"1.39.0"}
]
}' | jq '.results[]?.vulns[] | {id, summary, affected: .affected}'Repository: openshift/console-operator
Length of output: 446
🏁 Script executed (no clone):
#!/bin/bash
# Get detailed information about the flagged vulnerabilities
for vuln_id in "GHSA-mh2q-q3fh-2475" "GHSA-9h8m-3fm2-qjrq" "GHSA-hfvc-g4fc-pqhx" "GO-2026-4394"; do
echo "=== Checking $vuln_id ==="
curl -s "https://api.osv.dev/v1/query" \
-H 'Content-Type: application/json' \
-d "{\"query\": \"$vuln_id\"}" | jq '.vulns[0] | {id, summary, affected: .affected}' 2>/dev/null || echo "Error fetching $vuln_id"
echo ""
done
Length of output: 400
🏁 Script executed:
#!/bin/bash
# Check the actual go.mod file at the lines mentioned in the review
echo "=== Checking go.mod lines 85-90 ==="
sed -n '80,95p' go.mod | cat -n
echo ""
echo "=== Full go.mod to see context ==="
head -110 go.mod | tail -30Repository: openshift/console-operator
Length of output: 2711
🏁 Script executed (no clone):
#!/bin/bash
# Try alternative OSV query format and check Go's official vulnerability database
echo "=== Trying different OSV query format ==="
curl -s "https://api.osv.dev/v1/query" \
-H 'Content-Type: application/json' \
-d '{"package":{"name":"go.opentelemetry.io/otel","ecosystem":"Go"}}' | jq '.vulns[] | {id, summary}' 2>/dev/null | head -20
echo ""
echo "=== Checking for known advisories via web ==="
# Search for otel v1.39.0 vulnerabilities more broadly
curl -s "https://vuln.go.dev/?q=go.opentelemetry.io/otel" 2>/dev/null | head -100
Length of output: 1809
🏁 Script executed:
#!/bin/bash
# Check what versions the console repo uses for comparison
echo "=== OpenTelemetry versions in openshift/console ==="
grep -A 2 "go.opentelemetry.io/otel" go.mod 2>/dev/null | head -20
echo ""
echo "=== Check if there are vendor advisories or security notes ==="
if [ -f "vendor/modules.txt" ]; then
grep "go.opentelemetry.io/otel" vendor/modules.txt | head -10
fiRepository: openshift/console
Length of output: 771
🏁 Script executed (no clone):
#!/bin/bash
# Get detailed vulnerability information with affected ranges
echo "=== Detailed vulnerability info ==="
curl -s "https://api.osv.dev/v1/query" \
-H 'Content-Type: application/json' \
-d '{"package":{"name":"go.opentelemetry.io/otel","ecosystem":"Go"}}' | jq '.vulns[] | {id, summary, affected_ranges: .affected[].ranges}' 2>/dev/null
echo ""
echo "=== Check v1.39.0 specifically against known CVEs ==="
# Try to get json data on these specific IDs from GitHub Advisory API
for vuln in "GHSA-mh2q-q3fh-2475" "GHSA-9h8m-3fm2-qjrq" "GHSA-hfvc-g4fc-pqhx" "GO-2026-4394"; do
echo "Checking $vuln..."
curl -s "https://api.github.com/advisories/$vuln" 2>/dev/null | jq '{id: .ghsa_id, summary: .summary, affected: .vulnerabilities[0].vulnerable_version_range, patched: .vulnerabilities[0].patched_versions}' 2>/dev/null | head -5
echo ""
done
Length of output: 603
🏁 Script executed:
#!/bin/bash
# Check if there's any documentation or changelog about these updates
echo "=== Check for CHANGELOG or release notes about otel bump ==="
find . -iname "CHANGELOG*" -o -iname "CHANGES*" -o -iname "release*" | head -5
echo ""
echo "=== Check git history for context on this otel bump ==="
git log --oneline -20 -- go.mod 2>/dev/null | head -10Repository: openshift/console-operator
Length of output: 481
🏁 Script executed (no clone):
#!/bin/bash
# Check all otel packages for vulnerabilities
echo "=== Querying all go.opentelemetry.io packages ==="
for pkg in "go.opentelemetry.io/otel" "go.opentelemetry.io/otel/sdk" "go.opentelemetry.io/otel/metric" "go.opentelemetry.io/otel/trace"; do
echo "Package: $pkg"
curl -s "https://api.osv.dev/v1/query" \
-H 'Content-Type: application/json' \
-d "{\"package\":{\"name\":\"$pkg\",\"ecosystem\":\"Go\"}}" | jq '.vulns[] | {id, summary, fixed_in: .affected[0].ranges[0].events[] | select(.fixed) | .fixed}' 2>/dev/null
echo ""
done
Length of output: 913
🏁 Script executed:
#!/bin/bash
# Confirm all the otel versions in the PR
echo "=== All OpenTelemetry versions in this PR's go.mod ==="
grep "go.opentelemetry.io" go.modRepository: openshift/console-operator
Length of output: 762
Bump OpenTelemetry to v1.43.0+ to avoid introducing multiple vulnerabilities.
Lines 85, 88-90 introduce go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk at v1.39.0, which contain multiple high-severity vulnerabilities:
- GHSA-mh2q-q3fh-2475: Remote DoS amplification via multi-value baggage header extraction (fixed in v1.41.0)
- GHSA-9h8m-3fm2-qjrq & GO-2026-4394: Arbitrary code execution via PATH hijacking (fixed in v1.40.0)
- GHSA-hfvc-g4fc-pqhx: BSD kenv command not using absolute path (fixed in v1.43.0)
Bump all OpenTelemetry packages to v1.43.0+ to resolve these before merge. Note: Line 87 (otlptrace v1.34.0) may also need verification against the same advisories.
🧰 Tools
🪛 OSV Scanner (2.3.8)
[HIGH] 85-85: go.opentelemetry.io/otel 1.39.0: OpenTelemetry-Go: multi-value baggage header extraction causes excessive allocations (remote dos amplification)
[HIGH] 89-89: go.opentelemetry.io/otel/sdk 1.39.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking in go.opentelemetry.io/otel/sdk
(GO-2026-4394)
[HIGH] 89-89: go.opentelemetry.io/otel/sdk 1.39.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking
[HIGH] 89-89: go.opentelemetry.io/otel/sdk 1.39.0: opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` around lines 85 - 90, The OpenTelemetry modules in go.mod
(go.opentelemetry.io/otel, go.opentelemetry.io/otel/sdk,
go.opentelemetry.io/otel/metric, go.opentelemetry.io/otel/trace and the
exporters otlptrace and otlptrace/otlptracegrpc) are pinned to vulnerable
v1.34.0–v1.39.0 releases; update all these module versions to v1.43.0 or later
(ensure otlptrace and otlptrace/otlptracegrpc are also bumped from v1.34.0) in
go.mod, then run module resolution (e.g., go get <module>@v1.43.0 and go mod
tidy) and run the build/tests to confirm no regressions.
Contributor
|
The target branch should be release-4.22 instead of main. |
Contributor
|
@jhadvig: This pull request references Jira Issue OCPBUGS-83941, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
jhadvig
added
jira/valid-bug
Member
Author
|
/retest |
Contributor
|
@jhadvig: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Analysis / Root cause:
CVE-2026-33186 — gRPC-Go versions prior to v1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2
:pathpseudo-header. Requests with a non-canonical path (missing the leading
/) bypass "deny" rules in path-based authorization interceptors. Theconsole-operator does not directly use gRPC (it's an indirect dependency via library-go/apiserver), so the practical risk is low, but the dependency
must be bumped per Red Hat security tracking requirements.
Solution description:
Bump
google.golang.org/grpcfrom v1.72.2 to v1.79.3 and re-vendor. This also upgrades transitive dependencies (otel, protobuf,golang.org/x/*packages) as required by the new gRPC version.
Test setup:
No special setup required.
Test cases:
make test-unit— all tests passgofmtcheck — cleangovetcheck — cleanBrowser conformance:
N/A — no UI changes.
Additional info:
/assign @Leo6Leo
Summary by CodeRabbit