[Release-4.20] OCPBUGS-80663,OCPBUGS-80662: Bump google.golang.org/grpc to v1.79.3#727
Open
MrSanketkumar wants to merge 1 commit into
Open
Conversation
WalkthroughThis PR updates Go module dependencies across two go.mod files: the main project module and the openshift/default-catalog-consistency sub-module. Version pins for testify, expression language support, telemetry instrumentation, and core platform libraries are upgraded to newer releases. ChangesDependency Updates
🎯 2 (Simple) | ⏱️ ~10 minutes Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (11 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Author
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 208: The go.mod entry pins vulnerable OpenTelemetry versions
(go.opentelemetry.io/otel v1.39.0 and go.opentelemetry.io/otel/sdk v1.39.0);
update both to their patched releases (bump the versions for
go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk to the non-vulnerable
tags) and then regenerate module metadata (e.g., run the appropriate go get to
fetch the patched versions and run go mod tidy or equivalent) so the go.sum and
module graph are updated before merging.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 50c33632-6b31-4ec1-9feb-a5b74ed3347e
⛔ Files ignored due to path filters (298)
go.sumis excluded by!**/*.sumopenshift/default-catalog-consistency/go.sumis excluded by!**/*.sumopenshift/default-catalog-consistency/vendor/golang.org/x/crypto/openpgp/s2k/s2k.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/crypto/salsa20/salsa/hsalsa20.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/crypto/sha3/doc.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/crypto/sha3/hashes.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/crypto/sha3/hashes_noasm.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/crypto/sha3/keccakf.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/crypto/sha3/keccakf_amd64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/crypto/sha3/keccakf_amd64.sis excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/crypto/sha3/sha3.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/crypto/sha3/sha3_s390x.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/crypto/sha3/sha3_s390x.sis excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/crypto/sha3/shake.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/crypto/sha3/shake_noasm.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/context/context.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/html/escape.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/html/parse.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/html/render.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/config.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/config_go124.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/config_pre_go124.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/frame.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/gotrack.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/http2.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/server.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/timer.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/transport.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/writesched.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/writesched_priority.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/writesched_roundrobin.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/internal/httpcommon/request.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/net/trace/events.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/oauth2/deviceauth.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/oauth2/oauth2.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/oauth2/pkce.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/oauth2/token.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/oauth2/transport.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sync/errgroup/errgroup.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/cpu/cpu_arm64.sis excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/plan9/pwd_go15_plan9.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/plan9/pwd_plan9.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/affinity_linux.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/fdset.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ifreq_linux.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/mkall.shis excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/mkerrors.shis excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/syscall_darwin.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/syscall_linux.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/syscall_netbsd.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/syscall_solaris.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_386.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_amd64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_arm.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_arm64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_loong64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_mips.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_mips64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_ppc.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_s390x.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsyscall_linux.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsyscall_solaris_amd64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsysnum_linux_386.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsysnum_linux_amd64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsysnum_linux_arm.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsysnum_linux_arm64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsysnum_linux_loong64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsysnum_linux_mips.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsysnum_linux_mips64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsysnum_linux_mips64le.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsysnum_linux_mipsle.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64le.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsysnum_linux_riscv64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsysnum_linux_s390x.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsysnum_linux_sparc64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux_386.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux_amd64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux_arm.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux_arm64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux_loong64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux_mips.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux_mips64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux_ppc.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux_s390x.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_netbsd_arm.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/windows/syscall_windows.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/windows/types_windows.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/sys/windows/zsyscall_windows.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/term/term_windows.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/term/terminal.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/text/encoding/japanese/eucjp.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/text/encoding/japanese/iso2022jp.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/text/encoding/japanese/shiftjis.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/text/encoding/korean/euckr.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/text/encoding/simplifiedchinese/gbk.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/text/encoding/simplifiedchinese/hzgb2312.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/text/encoding/traditionalchinese/big5.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/text/encoding/unicode/unicode.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/text/unicode/bidi/core.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/tools/go/ast/inspector/cursor.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/tools/go/ast/inspector/inspector.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/golang.org/x/tools/go/ast/inspector/typeof.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/CONTRIBUTING.mdis excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/MAINTAINERS.mdis excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/balancer/balancer.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/balancer/endpointsharding/endpointsharding.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/balancer/pickfirst/internal/internal.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/balancer/pickfirst/pickfirst.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/balancer/pickfirst/pickfirstleaf/pickfirstleaf.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/balancer/roundrobin/roundrobin.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/balancer/subconn.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/balancer_wrapper.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/binarylog/grpc_binarylog_v1/binarylog.pb.gois excluded by!**/*.pb.go,!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/clientconn.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/credentials/credentials.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/credentials/tls.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/dialoptions.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/encoding/encoding.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/encoding/proto/proto.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/experimental/stats/metricregistry.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/experimental/stats/metrics.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/interceptor.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/gracefulswitch.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/buffer/unbounded.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/channelz/trace.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/envconfig/envconfig.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/envconfig/xds.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/experimental.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/grpcsync/callback_serializer.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/idle/idle.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/internal.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/resolver/delegatingresolver/delegatingresolver.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/resolver/dns/dns_resolver.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/stats/metrics_recorder_list.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/client_stream.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/controlbuf.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/flowcontrol.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/handler_server.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/http2_client.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/http2_server.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/http_util.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/server_stream.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/internal/transport/transport.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/mem/buffer_pool.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/mem/buffer_slice.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/mem/buffers.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/picker_wrapper.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/preloader.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/resolver/resolver.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/resolver_wrapper.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/rpc_util.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/server.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/stats/stats.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/stream.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/grpc/version.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/protobuf/encoding/protowire/wire.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/protobuf/internal/editiondefaults/editions_defaults.binpbis excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/protobuf/internal/editionssupport/editions.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/protobuf/internal/filedesc/desc.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/protobuf/internal/filedesc/desc_init.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/protobuf/internal/filedesc/desc_lazy.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/protobuf/internal/filedesc/editions.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/protobuf/internal/genid/api_gen.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/protobuf/internal/genid/descriptor_gen.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/protobuf/internal/impl/codec_message_opaque.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/protobuf/internal/impl/message_opaque.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/protobuf/internal/impl/presence.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/protobuf/internal/version/version.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/protobuf/reflect/protodesc/desc.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/protobuf/reflect/protodesc/desc_init.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/protobuf/reflect/protodesc/proto.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/protobuf/reflect/protoreflect/source_gen.gois excluded by!**/vendor/**openshift/default-catalog-consistency/vendor/google.golang.org/protobuf/types/descriptorpb/descriptor.pb.gois excluded by!**/*.pb.go,!**/vendor/**openshift/default-catalog-consistency/vendor/modules.txtis excluded by!**/vendor/**vendor/cel.dev/expr/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/MODULE.bazelis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/checked.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/cel.dev/expr/eval.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/cel.dev/expr/explain.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/cel.dev/expr/syntax.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/cel.dev/expr/value.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/stretchr/testify/assert/assertion_compare.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/stretchr/testify/assert/assertion_format.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/stretchr/testify/assert/assertion_forward.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/stretchr/testify/assert/assertion_order.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/stretchr/testify/assert/assertions.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/stretchr/testify/assert/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/stretchr/testify/assert/http_assertions.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/stretchr/testify/assert/yaml/yaml_custom.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/stretchr/testify/assert/yaml/yaml_default.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/stretchr/testify/assert/yaml/yaml_fail.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/stretchr/testify/mock/mock.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/stretchr/testify/require/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/stretchr/testify/require/require.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/stretchr/testify/require/require_forward.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/id.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/number.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/span.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/status.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/traces.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/value.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/span.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/tracer.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/.codespellignoreis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/.golangci.ymlis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/.lycheeignoreis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/CHANGELOG.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/CODEOWNERSis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/CONTRIBUTING.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/Makefileis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/README.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/RELEASING.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/VERSIONING.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/encoder.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/filter.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/internal/attribute.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/iterator.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/key.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/kv.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/set.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/type_string.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/value.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/baggage/baggage.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/codes/codes.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/dependencies.Dockerfileis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/global/internal_logging.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/global/meter.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/global/trace.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric/config.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/propagation/baggage.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/propagation/propagation.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/propagation/trace_context.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/internal/env/env.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/internal/x/x.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/builtin.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/container.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/env.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id_bsd.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id_linux.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id_unsupported.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id_windows.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os_release_unix.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os_unix.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os_unsupported.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/process.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/resource.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/batch_span_processor.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/doc.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/id_generator.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/provider.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/sampling.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/simple_span_processor.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/snapshot.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/span.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/span_limits.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/tracer.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/version.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/version.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/auto.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/config.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/attr.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/id.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/value.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/noop.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/noop/noop.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/span.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/trace.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/tracestate.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/version.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/versions.yamlis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/openpgp/s2k/s2k.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/salsa20/salsa/hsalsa20.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/sha3/doc.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/sha3/hashes.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/sha3/hashes_noasm.gois excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (2)
go.modopenshift/default-catalog-consistency/go.mod
| go.opentelemetry.io/auto/sdk v1.2.1 // indirect | ||
| go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect | ||
| go.opentelemetry.io/otel v1.36.0 // indirect | ||
| go.opentelemetry.io/otel v1.39.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Verify vulnerability status directly against OSV for the exact module@version pairs.
# Expected: no "affected" entries for the chosen replacement versions.
for modver in \
"go.opentelemetry.io/otel@1.39.0" \
"go.opentelemetry.io/otel/sdk@1.39.0"
do
mod="${modver%@*}"
ver="${modver#*@}"
echo "=== OSV check: $mod@$ver ==="
curl -sS https://api.osv.dev/v1/query \
-H 'Content-Type: application/json' \
-d "{\"package\":{\"ecosystem\":\"Go\",\"name\":\"$mod\"},\"version\":\"$ver\"}" \
| jq '{vulns: [.vulns[]? | {id: .id, summary: .summary, aliases: .aliases}]}'
echo
doneRepository: openshift/operator-framework-operator-controller
Length of output: 1154
Update OpenTelemetry dependencies; both versions have confirmed critical vulnerabilities.
go.opentelemetry.io/otel v1.39.0has CVE-2026-29181: remote DoS amplification via baggage header extractiongo.opentelemetry.io/otel/sdk v1.39.0has CVE-2026-24051: arbitrary code execution via PATH hijacking
Bump both to patched releases and regenerate module metadata before merge.
🧰 Tools
🪛 OSV Scanner (2.3.8)
[HIGH] 208-208: go.opentelemetry.io/otel 1.39.0: OpenTelemetry-Go: multi-value baggage header extraction causes excessive allocations (remote dos amplification)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 208, The go.mod entry pins vulnerable OpenTelemetry versions
(go.opentelemetry.io/otel v1.39.0 and go.opentelemetry.io/otel/sdk v1.39.0);
update both to their patched releases (bump the versions for
go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk to the non-vulnerable
tags) and then regenerate module metadata (e.g., run the appropriate go get to
fetch the patched versions and run go mod tidy or equivalent) so the go.sum and
module graph are updated before merging.
MrSanketkumar
changed the title
openshift-ci-robot
added
jira/severity-important
|
@MrSanketkumar: This pull request references Jira Issue OCPBUGS-80663, which is valid. The bug has been moved to the POST state. 7 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira (ocp-sustaining-admins@redhat.com), skipping review request. The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
MrSanketkumar
force-pushed
the
grpc-patch-cve-fix-4.20
branch
from
5330012 to
362fcfa
Compare
Author
|
retitle [Release-4.20] OCPBUGS-80663,OCPBUGS-80662: Bump google.golang.org/grpc to v1.79.3 |
Author
|
/retitle [Release-4.20] OCPBUGS-80663,OCPBUGS-80662: Bump google.golang.org/grpc to v1.79.3 |
openshift-ci
Bot
changed the title
openshift-ci-robot
added
jira/invalid-bug
|
@MrSanketkumar: This pull request references Jira Issue OCPBUGS-80663, which is valid. 7 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira (ocp-sustaining-admins@redhat.com), skipping review request. The bug has been updated to refer to the pull request using the external bug tracker. This pull request references Jira Issue OCPBUGS-80662, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Author
|
/jira refresh |
|
@MrSanketkumar: This pull request references Jira Issue OCPBUGS-80663, which is valid. 7 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira (ocp-sustaining-admins@redhat.com), skipping review request. This pull request references Jira Issue OCPBUGS-80662, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Author
|
/jira refresh |
openshift-ci-robot
added
jira/valid-bug
|
@MrSanketkumar: This pull request references Jira Issue OCPBUGS-80663, which is valid. 7 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira (ocp-sustaining-admins@redhat.com), skipping review request. This pull request references Jira Issue OCPBUGS-80662, which is valid. The bug has been moved to the POST state. 7 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira (ocp-sustaining-admins@redhat.com), skipping review request. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Contributor
|
/approve |
Contributor
|
/lgtm |
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: MrSanketkumar, tmshort The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
Contributor
|
Waiting on openshift-e2e-aws before |
Contributor
|
@MrSanketkumar: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/label backport-risk-assessed |
openshift-ci
Bot
added
the
backport-risk-assessed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit