[Release-4.19] OCPBUGS-80485,OCPBUGS-80484: Update grpc to v1.75.1-sec.1 to fix CVE-2026-33186#731
Open
MrSanketkumar wants to merge 1 commit into
Open
Conversation
openshift-ci-robot
added
jira/severity-important
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
WalkthroughThe PR updates indirect Go module versions in the root and openshift/default-catalog-consistency go.mod files and adds a replace directive mapping google.golang.org/grpc to github.com/openshift-sustaining/grpc-go v1.75.1-sec.1. ChangesDependency Version Upgrades and gRPC Override
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (2 errors, 2 warnings)
✅ Passed checks (8 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
@MrSanketkumar: This pull request references Jira Issue OCPBUGS-80485, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. This pull request references Jira Issue OCPBUGS-80484, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Author
|
/jira refresh |
|
@MrSanketkumar: This pull request references Jira Issue OCPBUGS-80485, which is invalid:
Comment This pull request references Jira Issue OCPBUGS-80484, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Author
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 106: Update the pinned module version for github.com/go-jose/go-jose/v4
from v4.1.1 to v4.1.4 (or later) to remediate GHSA-78h2-9frx-2jm8; after
changing the version entry for github.com/go-jose/go-jose/v4, run the Go tooling
(e.g., go get github.com/go-jose/go-jose/v4@v4.1.4 and go mod tidy) to refresh
go.mod and go.sum so the lockfile and transitive deps are updated.
- Line 217: Update the vulnerable OpenTelemetry module versions in go.mod by
bumping the module entries for go.opentelemetry.io/otel and
go.opentelemetry.io/otel/sdk to patched releases; specifically change the
go.opentelemetry.io/otel line to v1.41.0 or later and the
go.opentelemetry.io/otel/sdk line to v1.40.0 or later, then run `go mod
tidy`/`go get` to resolve and verify the updated dependency graph and ensure
builds/tests pass; target the module names "go.opentelemetry.io/otel" and
"go.opentelemetry.io/otel/sdk" when making the edits.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: b071406e-f9ea-4a08-99a6-fdd7750fba3a
⛔ Files ignored due to path filters (236)
go.sumis excluded by!**/*.sumopenshift/default-catalog-consistency/go.sumis excluded by!**/*.sumopenshift/default-catalog-consistency/vendor/github.com/go-jose/go-jose/v4/CHANGELOG.mdis excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/github.com/go-jose/go-jose/v4/jwe.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/github.com/go-jose/go-jose/v4/jwk.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/github.com/go-jose/go-jose/v4/jws.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/github.com/go-jose/go-jose/v4/symmetric.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/github.com/go-logr/logr/.golangci.yamlis excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/github.com/go-logr/logr/funcr/funcr.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/frame.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/trace/events.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/oauth2/internal/doc.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/oauth2/internal/oauth2.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/oauth2/internal/token.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/oauth2/internal/transport.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/oauth2/oauth2.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/oauth2/pkce.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/oauth2/token.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/oauth2/transport.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sync/errgroup/errgroup.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/cpu/cpu.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/cpu/cpu_linux_riscv64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/cpu/cpu_riscv64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/windows/security_windows.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/windows/syscall_windows.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/windows/types_windows.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/windows/zsyscall_windows.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/term/terminal.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/tools/go/ast/inspector/inspector.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/tools/go/ast/inspector/typeof.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/genproto/googleapis/api/annotations/annotations.pb.gois excluded by!**/*.pb.go,!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/genproto/googleapis/api/annotations/client.pb.gois excluded by!**/*.pb.go,!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/genproto/googleapis/api/annotations/field_behavior.pb.gois excluded by!**/*.pb.go,!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/genproto/googleapis/api/annotations/field_info.pb.gois excluded by!**/*.pb.go,!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/genproto/googleapis/api/annotations/http.pb.gois excluded by!**/*.pb.go,!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/genproto/googleapis/api/annotations/resource.pb.gois excluded by!**/*.pb.go,!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/genproto/googleapis/api/annotations/routing.pb.gois excluded by!**/*.pb.go,!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/genproto/googleapis/api/launch_stage.pb.gois excluded by!**/*.pb.go,!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/CONTRIBUTING.mdis excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/MAINTAINERS.mdis excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/README.mdis excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/balancer/balancer.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/balancer/base/balancer.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/balancer/endpointsharding/endpointsharding.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/balancer/pickfirst/pickfirstleaf/pickfirstleaf.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/balancer/roundrobin/roundrobin.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/binarylog/grpc_binarylog_v1/binarylog.pb.gois excluded by!**/*.pb.go,!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/clientconn.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/credentials/credentials.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/credentials/insecure/insecure.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/credentials/tls.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/dialoptions.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/gracefulswitch.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/credentials/credentials.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/envconfig/envconfig.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/envconfig/xds.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/grpcsync/event.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/internal.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/metadata/metadata.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/resolver/delegatingresolver/delegatingresolver.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/resolver/dns/dns_resolver.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/status/status.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/client_stream.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/controlbuf.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/handler_server.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/http2_client.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/http2_server.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/http_util.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/server_stream.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/transport.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/mem/buffer_slice.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/picker_wrapper.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/resolver/map.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/resolver/resolver.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/resolver_wrapper.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/rpc_util.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/server.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/stats/handlers.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/stats/stats.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/stream.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/version.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/modules.txtis excluded by!**/vendor/**vendor/cel.dev/expr/.bazelversionis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/MODULE.bazelis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/README.mdis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/cloudbuild.yamlis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/eval.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/go-jose/go-jose/v4/CHANGELOG.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/go-jose/go-jose/v4/jwe.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-jose/go-jose/v4/jwk.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-jose/go-jose/v4/jws.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-jose/go-jose/v4/symmetric.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/.golangci.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/funcr/funcr.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/.golangci.ymlis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/CHANGELOG.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/CONTRIBUTING.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/Makefileis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/README.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/RELEASING.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/filter.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/value.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/get_main_pkgs.shis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/attribute/attribute.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/gen.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/global/handler.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/global/meter.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/global/trace.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/rawhelpers.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric/asyncfloat64.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric/asyncint64.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric/instrument.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric/meter.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric/noop/noop.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/propagation/baggage.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/propagation/propagation.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/renovate.jsonis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/requirements.txtis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/internal/env/env.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/builtin.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/container.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/env.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os_release_darwin.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/process.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/resource.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/batch_span_processor.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/id_generator.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/provider.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/sampling.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/simple_span_processor.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/span.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/tracer.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/version.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/noop.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/verify_readmes.shis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/version.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/versions.yamlis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/bcrypt/bcrypt.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/mod/modfile/rule.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/mod/modfile/work.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/mod/module/module.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/mod/semver/semver.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/frame.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/trace/events.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/internal/doc.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/internal/oauth2.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/internal/token.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/internal/transport.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/oauth2.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/pkce.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/token.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/transport.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sync/errgroup/errgroup.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_linux_riscv64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_riscv64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/security_windows.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/syscall_windows.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/types_windows.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/zsyscall_windows.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/term/terminal.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/go/ast/inspector/inspector.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/go/ast/inspector/typeof.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/go/packages/golist.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/go/packages/packages.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/go/types/typeutil/callee.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/analysisinternal/analysis.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/astutil/cursor/cursor.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/packagesinternal/packages.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/stdlib/deps.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/stdlib/manifest.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/stdlib/stdlib.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/annotations.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/client.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/field_behavior.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/field_info.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/http.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/resource.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/routing.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/checked.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/eval.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/explain.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/syntax.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/value.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/httpbody/httpbody.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/launch_stage.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/rpc/errdetails/error_details.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/CONTRIBUTING.mdis excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/MAINTAINERS.mdis excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/README.mdis excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/balancer/balancer.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/balancer/base/balancer.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/balancer/endpointsharding/endpointsharding.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/balancer/pickfirst/pickfirstleaf/pickfirstleaf.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/balancer/roundrobin/roundrobin.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/binarylog/grpc_binarylog_v1/binarylog.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/clientconn.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/credentials/credentials.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/credentials/insecure/insecure.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/credentials/tls.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/dialoptions.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/health/grpc_health_v1/health.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/health/grpc_health_v1/health_grpc.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/gracefulswitch.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/credentials/credentials.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/envconfig/envconfig.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/envconfig/xds.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/grpcsync/event.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/internal.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/metadata/metadata.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/resolver/delegatingresolver/delegatingresolver.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/resolver/dns/dns_resolver.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/status/status.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/client_stream.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/controlbuf.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/handler_server.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/http2_client.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/http2_server.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/http_util.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/server_stream.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/transport.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/mem/buffer_slice.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/picker_wrapper.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/resolver/map.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/resolver/resolver.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/resolver_wrapper.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/rpc_util.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/server.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/stats/handlers.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/stats/stats.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/stream.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/version.gois excluded by!**/vendor/**,!vendor/**vendor/modules.txtis excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (2)
go.modopenshift/default-catalog-consistency/go.mod
| github.com/go-git/go-git/v5 v5.13.1 // indirect | ||
| github.com/go-gorp/gorp/v3 v3.1.0 // indirect | ||
| github.com/go-jose/go-jose/v4 v4.0.5 // indirect | ||
| github.com/go-jose/go-jose/v4 v4.1.1 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
What is the first patched version of github.com/go-jose/go-jose/v4 for GHSA-78h2-9frx-2jm8, and is v4.1.1 affected?
💡 Result:
The first patched version of github.com/go-jose/go-jose/v4 for GHSA-78h2-9frx-2jm8 is v4.1.4 [1]. Yes, v4.1.1 is affected (the advisory lists affected versions as < 4.1.4) [1].
Citations:
Bump go-jose to v4.1.4 to address GHSA-78h2-9frx-2jm8.
Line 106 pins github.com/go-jose/go-jose/v4 to v4.1.1, which is vulnerable to GHSA-78h2-9frx-2jm8. Upgrade to v4.1.4 or later before merge.
🧰 Tools
🪛 OSV Scanner (2.3.8)
[HIGH] 106-106: github.com/go-jose/go-jose/v4 4.1.1: Go JOSE Panics in JWE decryption
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 106, Update the pinned module version for
github.com/go-jose/go-jose/v4 from v4.1.1 to v4.1.4 (or later) to remediate
GHSA-78h2-9frx-2jm8; after changing the version entry for
github.com/go-jose/go-jose/v4, run the Go tooling (e.g., go get
github.com/go-jose/go-jose/v4@v4.1.4 and go mod tidy) to refresh go.mod and
go.sum so the lockfile and transitive deps are updated.
| go.opentelemetry.io/auto/sdk v1.1.0 // indirect | ||
| go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 // indirect | ||
| go.opentelemetry.io/otel v1.34.0 // indirect | ||
| go.opentelemetry.io/otel v1.37.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
`What are the first patched versions for:
- GHSA-mh2q-q3fh-2475 in go.opentelemetry.io/otel
- GHSA-9h8m-3fm2-qjrq and GHSA-hfvc-g4fc-pqhx (GO-2026-4394) in go.opentelemetry.io/otel/sdk?
Are versions 1.37.0 affected?`
💡 Result:
- GHSA-mh2q-q3fh-2475 (go.opentelemetry.io/otel) - First patched versions: v1.41.0 for go.opentelemetry.io/otel (advisory lists patched version v1.41.0) [1][2]. - Versions affected: >= v1.36.0, <= v1.40.0 [1]. 2) GHSA-9h8m-3fm2-qjrq and GHSA-hfvc-g4fc-pqhx (GO-2026-4394) (go.opentelemetry.io/otel/sdk) - First patched version: v1.40.0 for go.opentelemetry.io/otel/sdk (pkg.go.dev vuln entry shows affected versions are “from v1.21.0 before v1.40.0”) [3]. - Another corroboration from downstream dependency update indicates sdk@v1.36.0 is replaced with sdk@v1.40.0 to resolve GO-2026-4394 [4]. Are versions 1.37.0 affected? - For GHSA-mh2q-q3fh-2475: yes. The advisory states affected versions are >= v1.36.0 and <= v1.40.0, which includes 1.37.0 [1]. - For GO-2026-4394 (GHSA-9h8m-3fm2-qjrq / GHSA-hfvc-g4fc-pqhx): yes, because affected versions are “from v1.21.0 before v1.40.0”, which includes 1.37.0 [3].
Citations:
- 1: GHSA-mh2q-q3fh-2475
- 2: GHSA-mh2q-q3fh-2475
- 3: https://pkg.go.dev/vuln/GO-2026-4394
- 4: helm/helm@5b26d4f
Upgrade go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk to patched versions.
Lines 217 and 221 contain vulnerable versions that are affected by:
- GHSA-mh2q-q3fh-2475 (PATH-hijacking and DoS in go.opentelemetry.io/otel)
- GO-2026-4394 / GHSA-9h8m-3fm2-qjrq / GHSA-hfvc-g4fc-pqhx (go.opentelemetry.io/otel/sdk)
Upgrade to:
go.opentelemetry.io/otel→ v1.41.0 or latergo.opentelemetry.io/otel/sdk→ v1.40.0 or later
🧰 Tools
🪛 OSV Scanner (2.3.8)
[HIGH] 217-217: go.opentelemetry.io/otel 1.37.0: OpenTelemetry-Go: multi-value baggage header extraction causes excessive allocations (remote dos amplification)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 217, Update the vulnerable OpenTelemetry module versions in
go.mod by bumping the module entries for go.opentelemetry.io/otel and
go.opentelemetry.io/otel/sdk to patched releases; specifically change the
go.opentelemetry.io/otel line to v1.41.0 or later and the
go.opentelemetry.io/otel/sdk line to v1.40.0 or later, then run `go mod
tidy`/`go get` to resolve and verify the updated dependency graph and ensure
builds/tests pass; target the module names "go.opentelemetry.io/otel" and
"go.opentelemetry.io/otel/sdk" when making the edits.
MrSanketkumar
changed the title
MrSanketkumar
force-pushed
the
grpc-patch-cve-fix-4.19
branch
from
b848f37 to
360fbb9
Compare
Author
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
|
@MrSanketkumar: This pull request references Jira Issue OCPBUGS-80485, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. This pull request references Jira Issue OCPBUGS-80484, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@openshift/default-catalog-consistency/go.mod`:
- Line 46: Update the vulnerable dependency version in go.mod by bumping the
module github.com/go-jose/go-jose/v4 from v4.1.1 to v4.1.4 (or later); edit the
go.mod entry for github.com/go-jose/go-jose/v4 and then run `go get
github.com/go-jose/go-jose/v4@v4.1.4` (or the chosen patched version) followed
by `go mod tidy` to ensure go.sum is updated and the project builds cleanly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: b8fcfbc3-3574-4969-9ab5-13ec1ed0cd84
⛔ Files ignored due to path filters (259)
go.sumis excluded by!**/*.sumopenshift/default-catalog-consistency/go.sumis excluded by!**/*.sumopenshift/default-catalog-consistency/vendor/github.com/go-jose/go-jose/v4/CHANGELOG.mdis excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/github.com/go-jose/go-jose/v4/jwe.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/github.com/go-jose/go-jose/v4/jwk.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/github.com/go-jose/go-jose/v4/jws.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/github.com/go-jose/go-jose/v4/symmetric.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/github.com/go-jose/go-jose/v4/symmetric_go124.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/github.com/go-jose/go-jose/v4/symmetric_legacy.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/github.com/go-logr/logr/.golangci.yamlis excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/github.com/go-logr/logr/funcr/funcr.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/frame.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/trace/events.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/oauth2/internal/doc.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/oauth2/internal/oauth2.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/oauth2/internal/token.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/oauth2/internal/transport.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/oauth2/oauth2.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/oauth2/pkce.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/oauth2/token.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/oauth2/transport.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sync/errgroup/errgroup.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/cpu/cpu.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/cpu/cpu_linux_riscv64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/cpu/cpu_riscv64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/windows/security_windows.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/windows/syscall_windows.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/windows/types_windows.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/windows/zsyscall_windows.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/term/terminal.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/tools/go/ast/inspector/inspector.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/tools/go/ast/inspector/typeof.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/genproto/googleapis/api/annotations/annotations.pb.gois excluded by!**/*.pb.go,!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/genproto/googleapis/api/annotations/client.pb.gois excluded by!**/*.pb.go,!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/genproto/googleapis/api/annotations/field_behavior.pb.gois excluded by!**/*.pb.go,!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/genproto/googleapis/api/annotations/field_info.pb.gois excluded by!**/*.pb.go,!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/genproto/googleapis/api/annotations/http.pb.gois excluded by!**/*.pb.go,!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/genproto/googleapis/api/annotations/resource.pb.gois excluded by!**/*.pb.go,!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/genproto/googleapis/api/annotations/routing.pb.gois excluded by!**/*.pb.go,!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/genproto/googleapis/api/launch_stage.pb.gois excluded by!**/*.pb.go,!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/CONTRIBUTING.mdis excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/MAINTAINERS.mdis excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/README.mdis excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/balancer/balancer.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/balancer/base/balancer.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/balancer/endpointsharding/endpointsharding.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/balancer/pickfirst/pickfirstleaf/pickfirstleaf.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/balancer/roundrobin/roundrobin.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/binarylog/grpc_binarylog_v1/binarylog.pb.gois excluded by!**/*.pb.go,!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/clientconn.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/credentials/credentials.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/credentials/insecure/insecure.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/credentials/tls.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/dialoptions.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/gracefulswitch.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/credentials/credentials.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/envconfig/envconfig.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/envconfig/xds.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/grpcsync/event.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/internal.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/metadata/metadata.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/resolver/delegatingresolver/delegatingresolver.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/resolver/dns/dns_resolver.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/status/status.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/client_stream.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/controlbuf.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/handler_server.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/http2_client.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/http2_server.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/http_util.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/server_stream.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/transport.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/mem/buffer_slice.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/picker_wrapper.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/resolver/map.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/resolver/resolver.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/resolver_wrapper.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/rpc_util.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/server.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/stats/handlers.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/stats/stats.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/stream.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/version.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/modules.txtis excluded by!**/vendor/**vendor/cel.dev/expr/.bazelversionis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/MODULE.bazelis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/README.mdis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/cloudbuild.yamlis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/eval.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/go-jose/go-jose/v4/CHANGELOG.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/go-jose/go-jose/v4/jwe.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-jose/go-jose/v4/jwk.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-jose/go-jose/v4/jws.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-jose/go-jose/v4/symmetric.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-jose/go-jose/v4/symmetric_go124.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-jose/go-jose/v4/symmetric_legacy.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/.golangci.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/funcr/funcr.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/.golangci.ymlis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/CHANGELOG.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/CONTRIBUTING.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/Makefileis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/README.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/RELEASING.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/filter.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/internal/attribute.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/rawhelpers.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/value.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/dependencies.Dockerfileis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/get_main_pkgs.shis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/gen.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/global/handler.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/global/meter.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/global/trace.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/rawhelpers.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric/asyncfloat64.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric/asyncint64.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric/instrument.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric/meter.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric/noop/noop.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/propagation/baggage.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/propagation/propagation.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/renovate.jsonis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/requirements.txtis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/internal/env/env.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/builtin.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/container.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/env.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os_release_darwin.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/process.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/resource.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/batch_span_processor.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/id_generator.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/provider.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/sampling.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/simple_span_processor.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/span.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/tracer.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/version.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.34.0/MIGRATION.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.34.0/README.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.34.0/attribute_group.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.34.0/doc.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.34.0/exception.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.34.0/schema.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/auto.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/attr.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/doc.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/id.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/number.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/resource.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/scope.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/span.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/status.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/traces.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/value.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/noop.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/verify_readmes.shis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/version.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/versions.yamlis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/bcrypt/bcrypt.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/mod/modfile/rule.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/mod/modfile/work.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/mod/module/module.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/mod/semver/semver.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/frame.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/trace/events.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/internal/doc.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/internal/oauth2.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/internal/token.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/internal/transport.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/oauth2.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/pkce.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/token.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/transport.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sync/errgroup/errgroup.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_linux_riscv64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_riscv64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/security_windows.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/syscall_windows.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/types_windows.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/zsyscall_windows.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/term/terminal.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/go/ast/inspector/inspector.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/go/ast/inspector/typeof.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/go/packages/golist.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/go/packages/packages.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/go/types/typeutil/callee.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/analysisinternal/analysis.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/astutil/cursor/cursor.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/packagesinternal/packages.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/stdlib/deps.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/stdlib/manifest.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/stdlib/stdlib.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/annotations.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/client.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/field_behavior.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/field_info.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/http.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/resource.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/annotations/routing.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/checked.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/eval.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/explain.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/syntax.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/value.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/httpbody/httpbody.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/launch_stage.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/rpc/errdetails/error_details.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/CONTRIBUTING.mdis excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/MAINTAINERS.mdis excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/README.mdis excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/balancer/balancer.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/balancer/base/balancer.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/balancer/endpointsharding/endpointsharding.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/balancer/pickfirst/pickfirstleaf/pickfirstleaf.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/balancer/roundrobin/roundrobin.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/binarylog/grpc_binarylog_v1/binarylog.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/clientconn.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/credentials/credentials.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/credentials/insecure/insecure.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/credentials/tls.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/dialoptions.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/health/grpc_health_v1/health.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/health/grpc_health_v1/health_grpc.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/gracefulswitch.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/credentials/credentials.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/envconfig/envconfig.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/envconfig/xds.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/grpcsync/event.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/internal.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/metadata/metadata.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/resolver/delegatingresolver/delegatingresolver.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/resolver/dns/dns_resolver.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/status/status.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/client_stream.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/controlbuf.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/handler_server.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/http2_client.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/http2_server.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/http_util.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/server_stream.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/transport.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/mem/buffer_slice.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/picker_wrapper.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/resolver/map.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/resolver/resolver.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/resolver_wrapper.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/rpc_util.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/server.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/stats/handlers.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/stats/stats.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/stream.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/version.gois excluded by!**/vendor/**,!vendor/**vendor/modules.txtis excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (2)
go.modopenshift/default-catalog-consistency/go.mod
| github.com/go-git/go-git/v5 v5.16.0 // indirect | ||
| github.com/go-jose/go-jose/v4 v4.0.5 // indirect | ||
| github.com/go-logr/logr v1.4.2 // indirect | ||
| github.com/go-jose/go-jose/v4 v4.1.1 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
What is the first patched version for GHSA-78h2-9frx-2jm8 in github.com/go-jose/go-jose/v4, and is v4.1.1 affected?
💡 Result:
First patched version for GHSA-78h2-9frx-2jm8 in github.com/go-jose/go-jose/v4 is v4.1.4, and v4.1.1 is affected (because the advisory states all versions < 4.1.4 are affected, and 4.1.4 is the first patched/fixed version). [1] Conclusion on v4.1.1: Yes, v4.1.1 is affected; it falls under the advisory’s affected range “< 4.1.4”, and the patched versions list starts at “4.1.4”. [1]
Citations:
Upgrade github.com/go-jose/go-jose/v4 to a patched version.
Line 46 pins github.com/go-jose/go-jose/v4 to v4.1.1, which is affected by GHSA-78h2-9frx-2jm8. Bump to v4.1.4 or later before merge.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@openshift/default-catalog-consistency/go.mod` at line 46, Update the
vulnerable dependency version in go.mod by bumping the module
github.com/go-jose/go-jose/v4 from v4.1.1 to v4.1.4 (or later); edit the go.mod
entry for github.com/go-jose/go-jose/v4 and then run `go get
github.com/go-jose/go-jose/v4@v4.1.4` (or the chosen patched version) followed
by `go mod tidy` to ensure go.sum is updated and the project builds cleanly.
Author
|
/retest |
Author
|
/test verify-deps |
MrSanketkumar
force-pushed
the
grpc-patch-cve-fix-4.19
branch
from
360fbb9 to
f163619
Compare
MrSanketkumar
force-pushed
the
grpc-patch-cve-fix-4.19
branch
from
f163619 to
7d69a9b
Compare
Contributor
|
@MrSanketkumar: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Author
|
/jira refresh |
|
@MrSanketkumar: This pull request references Jira Issue OCPBUGS-80485, which is invalid:
Comment This pull request references Jira Issue OCPBUGS-80484, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Contributor
|
/lgtm |
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: MrSanketkumar, tmshort The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
Author
|
/jira refresh |
|
@MrSanketkumar: This pull request references Jira Issue OCPBUGS-80485, which is invalid:
Comment This pull request references Jira Issue OCPBUGS-80484, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Author
|
/jira refresh |
|
@MrSanketkumar: This pull request references Jira Issue OCPBUGS-80485, which is invalid:
Comment This pull request references Jira Issue OCPBUGS-80484, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Contributor
|
/verified by tmshort This is a dependency bump and all CI passed. |
openshift-ci-robot
added
the
verified
|
@tmshort: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Author
|
/jira refresh |
openshift-ci-robot
added
jira/valid-bug
|
@MrSanketkumar: This pull request references Jira Issue OCPBUGS-80485, which is valid. The bug has been moved to the POST state. 7 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira (ocp-sustaining-admins@redhat.com), skipping review request. This pull request references Jira Issue OCPBUGS-80484, which is valid. The bug has been moved to the POST state. 7 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira (ocp-sustaining-admins@redhat.com), skipping review request. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes CVE-2026-33186 by updating grpc to patched version v1.75.1-sec.1 from openshift-sustaining fork.
Changes
Summary by CodeRabbit