build(deps): bump the k8s group across 1 directory with 4 updates#1376
build(deps): bump the k8s group across 1 directory with 4 updates#1376dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
dependabot
Bot
added
dependencies
WalkthroughGo toolchain upgraded from version 1.24.3 to 1.25.0. Multiple direct and transitive dependencies updated, including golang.org/x/crypto and golang.org/x/term packages, Kubernetes core modules (api, apimachinery, client-go, kubectl), and various transitive dependencies like golang.org/x/net and sigs.k8s.io/kustomize packages. Some transitive requirements removed while others added. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
openshift-ci
Bot
added
the
needs-ok-to-test
|
Hi @dependabot[bot]. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/ok-to-test |
openshift-ci
Bot
added
ok-to-test
r4f4
changed the title
openshift-ci-robot
added
the
jira/valid-reference
|
@dependabot[bot]: This pull request explicitly references no jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/lgtm |
Bumps the k8s group with 4 updates: [k8s.io/api](https://github.com/kubernetes/api), [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery), [k8s.io/client-go](https://github.com/kubernetes/client-go) and [k8s.io/kubectl](https://github.com/kubernetes/kubectl). Updates `k8s.io/api` from 0.33.4 to 0.35.3 - [Commits](kubernetes/api@v0.33.4...v0.35.3) Updates `k8s.io/apimachinery` from 0.33.4 to 0.35.3 - [Commits](kubernetes/apimachinery@v0.33.4...v0.35.3) Updates `k8s.io/client-go` from 0.33.4 to 0.35.3 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](kubernetes/client-go@v0.33.4...v0.35.3) Updates `k8s.io/kubectl` from 0.33.4 to 0.35.3 - [Commits](kubernetes/kubectl@v0.33.4...v0.35.3) --- updated-dependencies: - dependency-name: k8s.io/api dependency-version: 0.35.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: k8s - dependency-name: k8s.io/apimachinery dependency-version: 0.35.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: k8s - dependency-name: k8s.io/client-go dependency-version: 0.35.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: k8s - dependency-name: k8s.io/kubectl dependency-version: 0.35.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: k8s ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/go_modules/k8s-4374b97ac0
branch
from
76d4e8b to
004bb41
Compare
|
New changes are detected. LGTM label has been removed. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@go.mod`:
- Around line 199-210: The go.mod pins google.golang.org/grpc to v1.73.0 which
contains a known authorization-bypass vulnerability; update the
google.golang.org/grpc module reference to a patched release (e.g., the latest
v1.73.x+ or v1.74.0+ that contains the fix), run go get
google.golang.org/grpc@<patched-version> (or update the version string in
go.mod), then run go mod tidy to refresh go.sum and ensure no other indirect
dependencies regress; verify builds and tests pass after the upgrade.
- Line 3: The Dockerfile's GO_VERSION variable is pinned to go1.23.5 and must be
updated to match go.mod's "go 1.25.0"; open the project's root Dockerfile, find
the GO_VERSION definition (symbol: GO_VERSION) and change its value to go1.25.0
(or an appropriate 1.25.x patch) so the build environment aligns with go.mod's
Go version and avoids skew with the other images that already use golang-1.25.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: accade0a-6f99-4c14-92a4-ab2279f9d0ce
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
| module github.com/openshift/oc-mirror/v2 | ||
|
|
||
| go 1.24.3 | ||
| go 1.25.0 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Go directive in go.mod:"
rg -n '^\s*go\s+[0-9]+\.[0-9]+(\.[0-9]+)?' go.mod
echo
echo "Potential pinned Go versions in repo configs/images:"
rg -n --iglob '*Dockerfile*' --iglob '*.yaml' --iglob '*.yml' --iglob '*.md' \
'GO_VERSION|golang:|go[ ="]1\.[0-9]+(\.[0-9]+)?'Repository: openshift/oc-mirror
Length of output: 344
🏁 Script executed:
# Search for GitHub Actions and other CI workflow files with Go version pins
fd -e yaml -e yml . .github 2>/dev/null | head -20
# Also check for any other build-related configs
rg -n 'go[_-]?version|golang' --iglob '*.json' --iglob '*.yaml' --iglob '*.yml' -t yaml -t jsonRepository: openshift/oc-mirror
Length of output: 50376
🏁 Script executed:
# Search for GitHub Actions workflows with Go versions
find .github/workflows -type f \( -name "*.yml" -o -name "*.yaml" \) 2>/dev/null | while read file; do
echo "=== $file ==="
rg -n 'go-version|go:' "$file" 2>/dev/null || echo "No Go version found"
done
# Also search for any remaining Go 1.23.5 references
echo
echo "=== All references to Go 1.23.5 ==="
rg -r 'go.*1\.23\.5|1\.23\.5' --max-count 20Repository: openshift/oc-mirror
Length of output: 513
🏁 Script executed:
# Search for all Go version references correctly
echo "=== GitHub Actions workflows with Go versions ==="
find .github/workflows -type f \( -name "*.yml" -o -name "*.yaml" \) 2>/dev/null | head -5
echo
echo "=== References to Go 1.23.5 ==="
rg '1\.23\.5' -n
echo
echo "=== References to Go 1.25 ==="
rg '1\.25' -n
echo
echo "=== Any go-version references in CI/workflows ==="
rg 'go.version|go-version|GO_VERSION' -n --max-count 20Repository: openshift/oc-mirror
Length of output: 2266
Update Dockerfile to use Go 1.25.0 to match go.mod requirement
The root Dockerfile pins GO_VERSION=go1.23.5 (line 28), which creates environment skew with the go.mod requirement of go 1.25.0. This will cause build failures when the PR is merged. Update the Dockerfile to use go1.25.0 or the appropriate 1.25.x patch version.
Note: The other Dockerfiles in images/cli/ (Dockerfile.ci, Dockerfile.art, Dockerfile.test) already reference golang-1.25 from their base builder images and do not have this issue.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@go.mod` at line 3, The Dockerfile's GO_VERSION variable is pinned to go1.23.5
and must be updated to match go.mod's "go 1.25.0"; open the project's root
Dockerfile, find the GO_VERSION definition (symbol: GO_VERSION) and change its
value to go1.25.0 (or an appropriate 1.25.x patch) so the build environment
aligns with go.mod's Go version and avoids skew with the other images that
already use golang-1.25.
| go.yaml.in/yaml/v2 v2.4.3 // indirect | ||
| go.yaml.in/yaml/v3 v3.0.4 // indirect | ||
| golang.org/x/net v0.43.0 // indirect | ||
| golang.org/x/net v0.47.0 // indirect | ||
| golang.org/x/oauth2 v0.33.0 // indirect | ||
| golang.org/x/sys v0.38.0 // indirect | ||
| golang.org/x/text v0.28.0 // indirect | ||
| golang.org/x/text v0.31.0 // indirect | ||
| golang.org/x/time v0.12.0 // indirect | ||
| google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 // indirect | ||
| google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect | ||
| google.golang.org/grpc v1.73.0 // indirect | ||
| google.golang.org/protobuf v1.36.8 // indirect | ||
| gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect | ||
| gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "1) Confirm pinned grpc version in go.mod"
rg -n '^\s*google\.golang\.org/grpc\s+v' go.mod
echo
echo "2) Query OSV for this exact version"
curl -s https://api.osv.dev/v1/query -H 'Content-Type: application/json' -d '{
"package": { "ecosystem": "Go", "name": "google.golang.org/grpc" },
"version": "1.73.0"
}' | jq -r '
if (.vulns|length)==0 then "No vulns returned by OSV for 1.73.0"
else .vulns[] | "\(.id): \(.summary // "no summary")"
end
'Repository: openshift/oc-mirror
Length of output: 387
Bump google.golang.org/grpc to a patched version—the current pinned v1.73.0 has critical authorization-bypass vulnerabilities (GHSA-p77j-4mvh-x3m3 / GO-2026-4762 via missing leading slash in :path header validation).
🧰 Tools
🪛 OSV Scanner (2.3.5)
[CRITICAL] 208-208: google.golang.org/grpc 1.73.0: Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc
(GO-2026-4762)
[CRITICAL] 208-208: google.golang.org/grpc 1.73.0: gRPC-Go has an authorization bypass via missing leading slash in :path
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@go.mod` around lines 199 - 210, The go.mod pins google.golang.org/grpc to
v1.73.0 which contains a known authorization-bypass vulnerability; update the
google.golang.org/grpc module reference to a patched release (e.g., the latest
v1.73.x+ or v1.74.0+ that contains the fix), run go get
google.golang.org/grpc@<patched-version> (or update the version string in
go.mod), then run go mod tidy to refresh go.sum and ensure no other indirect
dependencies regress; verify builds and tests pass after the upgrade.
|
@dependabot[bot]: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/test integration |
3 participants
Bumps the k8s group with 3 updates in the / directory: k8s.io/api, k8s.io/client-go and k8s.io/kubectl.
Updates
k8s.io/apifrom 0.33.4 to 0.35.3Commits
3897036Update dependencies to v0.35.3 tagbbcbaa8Merge remote-tracking branch 'origin/master' into release-1.355bced61Bump golang.org/x/crypto to v0.45.039e2e26Merge pull request #135131 from Dev1622/sig-storage/mock-expand-flake-fixc22b4a1vendor: update vendor and license metadata after replacing BeTrue usage in cs...e3b1f3dResolve lint restriction on BeTrue by introducing Succeed() with contextual e...3da327cUpdate vendored dependenciesc764b44Merge pull request #132919 from ndixita/pod-level-in-place-pod-resizeaced136Generated files from API changes02d790dAdding Resources and AllocatedResoures fields to the list of expected fields ...Updates
k8s.io/apimachineryfrom 0.33.4 to 0.35.3Commits
72d71eaMerge remote-tracking branch 'origin/master' into release-1.35e2a2dbcBump golang.org/x/crypto to v0.45.02e9c228Merge pull request #135131 from Dev1622/sig-storage/mock-expand-flake-fixf274aacvendor: update vendor and license metadata after replacing BeTrue usage in cs...9445443Resolve lint restriction on BeTrue by introducing Succeed() with contextual e...52154f7Update vendored dependencies5a348c5KEP-5471: Extend tolerations operators (#134665)6f89492Merge pull request #133648 from richabanker/merged-discoveryc77dde2util/sort: Add MergePreservingRelativeOrder for topological sorting729c13dMerge pull request #134624 from yt2985/podcertificates-betaUpdates
k8s.io/client-gofrom 0.33.4 to 0.35.3Commits
4f1f0a2Update dependencies to v0.35.3 tagf80003cMerge pull request #136903pohly/automated-cherry-pick-of-#1364558b41556fake client-go: un-deprecate NewSimpleClientset2d83546Merge remote-tracking branch 'origin/master' into release-1.3556b4af2Merge pull request #135591 from p0lyn0mial/upstream-watchlist-reflector-log-f...891f94cMerge remote-tracking branch 'origin/master' into release-1.3565ffe04Merge pull request #135580 from serathius/client-go-transformer2fe4ac2downgrade reflector watchlist fallback log to V(4)97256a6Bump golang.org/x/crypto to v0.45.046360b5Merge pull request #135131 from Dev1622/sig-storage/mock-expand-flake-fixUpdates
k8s.io/kubectlfrom 0.33.4 to 0.35.3Commits
ba77272Update dependencies to v0.35.3 tag093dc66Merge pull request #136280 from seekskyworld/automated-cherry-pick-of-#135918...6b218ddkubectl: Fix panic in exec terminal size queue817cfc8Merge remote-tracking branch 'origin/master' into release-1.35aeaf9d6Bump golang.org/x/crypto to v0.45.0a319be8Merge pull request #135131 from Dev1622/sig-storage/mock-expand-flake-fixe39563avendor: update vendor and license metadata after replacing BeTrue usage in cs...579bcf1Resolve lint restriction on BeTrue by introducing Succeed() with contextual e...d13f830Update vendored dependencies9f47eddMerge pull request #134870 from pmengelbert/pmengelbert/kuberc/4