Bump the kubernetes group across 1 directory with 4 updates#45
Bump the kubernetes group across 1 directory with 4 updates#45dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
area/dependency
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
Summary by CodeRabbit
WalkthroughUpdates the Go directive from 1.24 to 1.26.0 and refreshes direct Kubernetes modules plus many indirect/transitive dependencies in go.mod. ChangesGo Toolchain and Dependency Upgrade
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
Hi @dependabot[bot]. Thanks for your PR. I'm waiting for a openshift-online member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Around line 45-46: The go.mod currently pins vulnerable indirect deps; add
explicit require entries for github.com/golang-jwt/jwt/v4 at v4.5.2 and
github.com/golang/glog at v1.2.4 (or update the parent modules that pull them)
so the module graph resolves to the patched versions; update go.sum by running
go get github.com/golang-jwt/jwt/v4@v4.5.2 and go get
github.com/golang/glog@v1.2.4 (or equivalent) and run go mod tidy to ensure the
new versions are recorded.
- Line 3: The repository's go.mod now sets "go 1.26.0" which conflicts with CI
pinning to "tag: golang-1.24" in your CI configs and missing Go setup in GitHub
Actions; update the CI configurations to use Go 1.26.x by changing the
ci-operator tag from "golang-1.24" to a matching golang-1.26 image and add
explicit Go setup steps in any GitHub Actions workflows (use actions/setup-go or
equivalent) so the runner installs Go 1.26 before builds and tests run.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 5b8ccdcd-26fa-4195-83a1-1f3a3549df04
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
| module github.com/openshift-online/rosa-e2e | ||
|
|
||
| go 1.24 | ||
| go 1.26.0 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Inspect workflow/tooling files for pinned Go versions.
fd -i 'workflow|workflows|dockerfile|makefile|go-version|tool-versions|readme' . \
| xargs -r rg -n -C2 'go-version|setup-go|golang:|GO_VERSION|go 1\.[0-9]+'Repository: openshift-online/rosa-e2e
Length of output: 53
🏁 Script executed:
# First, let's see what workflow and CI-related files exist in the repository
find . -type f \( -name "*.yml" -o -name "*.yaml" -o -name "Dockerfile" -o -name "Makefile" -o -name ".go-version" -o -name ".tool-versions" \) | head -20Repository: openshift-online/rosa-e2e
Length of output: 403
🏁 Script executed:
# Search for go version references in common locations
rg -i "go.*1\.[0-9]+\.[0-9]+" --max-count=20Repository: openshift-online/rosa-e2e
Length of output: 3299
🏁 Script executed:
# Check CI/workflow directory structure
ls -la . | grep -E "workflow|github|ci|\.github"
find .github -type f 2>/dev/null | head -20Repository: openshift-online/rosa-e2e
Length of output: 416
🏁 Script executed:
# Check the GitHub Actions workflows for Go version setup
cat .github/workflows/branch-protection-check.yml
cat .github/workflows/dependabot-auto-merge.ymlRepository: openshift-online/rosa-e2e
Length of output: 11788
🏁 Script executed:
# Check the Makefile for Go version configuration
cat Makefile | head -50Repository: openshift-online/rosa-e2e
Length of output: 1137
🏁 Script executed:
# Check the ci-operator configuration
cat ./ci-operator/openshift-online-rosa-e2e-main.yaml | grep -i "go\|golang" -A 2 -B 2Repository: openshift-online/rosa-e2e
Length of output: 142
CI pipeline will break with Go 1.26.0 — ci-operator is pinned to golang-1.24.
The go.mod change to go 1.26.0 conflicts with the ci-operator configuration at ci-operator/openshift-online-rosa-e2e-main.yaml, which specifies tag: golang-1.24. GitHub Actions workflows also lack explicit Go version setup. Update ci-operator and workflows to target Go 1.26.x before merging.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 3, The repository's go.mod now sets "go 1.26.0" which
conflicts with CI pinning to "tag: golang-1.24" in your CI configs and missing
Go setup in GitHub Actions; update the CI configurations to use Go 1.26.x by
changing the ci-operator tag from "golang-1.24" to a matching golang-1.26 image
and add explicit Go setup steps in any GitHub Actions workflows (use
actions/setup-go or equivalent) so the runner installs Go 1.26 before builds and
tests run.
| github.com/golang-jwt/jwt/v4 v4.4.1 // indirect | ||
| github.com/golang/glog v1.0.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
`What are the first patched versions for:
- GO-2024-3250 and GO-2025-3553 in github.com/golang-jwt/jwt/v4
- GO-2025-3372 in github.com/golang/glog
Please include official sources (Go vulnerability database or GHSA pages).`
💡 Result:
GO-2024-3250 in github.com/golang-jwt/jwt/v4: v4.5.1 [1][2][3] GO-2025-3553 in github.com/golang-jwt/jwt/v4: v4.5.2 [4][5] GO-2025-3372 in github.com/golang/glog: v1.2.4 [6][7][8][9]
Citations:
- 1: https://pkg.go.dev/vuln/GO-2024-3250
- 2: GHSA-29wx-vh33-7x7r
- 3: https://github.com/golang-jwt/jwt/releases/tag/v4.5.1
- 4: https://pkg.go.dev/vuln/GO-2025-3553
- 5: golang-jwt/jwt@v4.5.0...v4.5.2
- 6: https://pkg.go.dev/vuln/GO-2025-3372
- 7: fix(backend): glog updated to 1.2.4 to fix CVE GO-2025-3372 kubeflow/pipelines#11583
- 8: GHSA-6wxm-mpqj-6jpf
- 9: https://github.com/golang/glog
🏁 Script executed:
#!/bin/bash
# Verify where these vulnerable modules are currently constrained.
rg -n -C2 'github.com/golang-jwt/jwt/v4|github.com/golang/glog' go.mod go.sum
# Check whether any replace directives already pin safer versions.
rg -n -C2 '^\s*replace\s+' go.modRepository: openshift-online/rosa-e2e
Length of output: 1395
Upgrade indirect dependencies to patch known high-severity vulnerabilities.
Lines 45–46 pin vulnerable versions:
github.com/golang-jwt/jwt/v4 v4.4.1is affected by GO-2024-3250 and GO-2025-3553; upgrade to v4.5.2github.com/golang/glog v1.0.0is affected by GO-2025-3372; upgrade to v1.2.4
Since these are indirect dependencies, either add direct require statements with the patched versions or bump the parent modules that depend on them.
🧰 Tools
🪛 OSV Scanner (2.3.8)
[HIGH] 45-45: github.com/golang-jwt/jwt/v4 4.4.1: Improper error handling in ParseWithClaims and bad documentation may cause dangerous situations in github.com/golang-jwt/jwt
(GO-2024-3250)
[HIGH] 45-45: github.com/golang-jwt/jwt/v4 4.4.1: Excessive memory allocation during header parsing in github.com/golang-jwt/jwt
(GO-2025-3553)
[HIGH] 45-45: github.com/golang-jwt/jwt/v4 4.4.1: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations
[HIGH] 45-45: github.com/golang-jwt/jwt/v4 4.4.1: jwt-go allows excessive memory allocation during header parsing
[HIGH] 46-46: github.com/golang/glog 1.0.0: Vulnerability when creating log files in github.com/golang/glog
(GO-2025-3372)
[HIGH] 46-46: github.com/golang/glog 1.0.0: Insecure Temporary File usage in github.com/golang/glog
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` around lines 45 - 46, The go.mod currently pins vulnerable indirect
deps; add explicit require entries for github.com/golang-jwt/jwt/v4 at v4.5.2
and github.com/golang/glog at v1.2.4 (or update the parent modules that pull
them) so the module graph resolves to the patched versions; update go.sum by
running go get github.com/golang-jwt/jwt/v4@v4.5.2 and go get
github.com/golang/glog@v1.2.4 (or equivalent) and run go mod tidy to ensure the
new versions are recorded.
Bumps the kubernetes group with 2 updates in the / directory: [k8s.io/api](https://github.com/kubernetes/api) and [k8s.io/client-go](https://github.com/kubernetes/client-go). Updates `k8s.io/api` from 0.32.1 to 0.36.1 - [Commits](kubernetes/api@v0.32.1...v0.36.1) Updates `k8s.io/apimachinery` from 0.32.1 to 0.36.1 - [Commits](kubernetes/apimachinery@v0.32.1...v0.36.1) Updates `k8s.io/client-go` from 0.32.1 to 0.36.1 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](kubernetes/client-go@v0.32.1...v0.36.1) Updates `k8s.io/utils` from 0.0.0-20241104100929-3ea5e8cea738 to 0.0.0-20260210185600-b8788abfbbc2 - [Commits](https://github.com/kubernetes/utils/commits) --- updated-dependencies: - dependency-name: k8s.io/api dependency-version: 0.36.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: kubernetes - dependency-name: k8s.io/apimachinery dependency-version: 0.36.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: kubernetes - dependency-name: k8s.io/client-go dependency-version: 0.36.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: kubernetes - dependency-name: k8s.io/utils dependency-version: 0.0.0-20260210185600-b8788abfbbc2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: kubernetes ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/go_modules/kubernetes-cb17614c17
branch
from
a2c3b68 to
2cec764
Compare
|
/retest |
1 similar comment
|
/retest |
|
@dependabot[bot]: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Bumps the kubernetes group with 2 updates in the / directory: k8s.io/api and k8s.io/client-go.
Updates
k8s.io/apifrom 0.32.1 to 0.36.1Commits
25001c8Update dependencies to v0.36.1 tag879d396Merge remote-tracking branch 'origin/master' into release-1.36030d81fUpdate github.com/moby/spdystream from v0.5.0 to v0.5.1aef6eb6Add granular authorization for DRA ResourceClaim status updates91061eaMerge pull request #136589 from tosi3k/preemption-modee6b81e2Add Workload-Aware Preemption fields to Workload and PodGroup APIsf8fce2eMerge pull request #136989 from nojnhuh/podgroup-resourceclaimb928f5eWorkload API: PodGroup ResourceClaims (KEP-5729)61bd78eMerge pull request #137190 from everpeace/KEP-5491-alpha6bf46ebMerge pull request #137028 from nmn3m/feature/dra-resource-pool-statusUpdates
k8s.io/apimachineryfrom 0.32.1 to 0.36.1Commits
7af103aUpdate dependencies to v0.36.1 tagefb7f26Merge remote-tracking branch 'origin/master' into release-1.36d966e56Update github.com/moby/spdystream from v0.5.0 to v0.5.179b3632Merge pull request #137864 from yongruilin/dv-dra-mismatcha8822f7Add slice and map union member support with tests7dba2d0Use IsZero instead of IsNil for union ratcheting checkd95710fFix union validation ratcheting when oldObj is nil729062dMerge pull request #137849 from bryantbiggs/deps/update-kube-openapi13b12e6dependencies: bump kube-openapi to drop ginkgo/gomega indirect deps27f4670Merge pull request #136657 from Jefftree/sharding-testUpdates
k8s.io/client-gofrom 0.32.1 to 0.36.1Commits
55ef15aUpdate dependencies to v0.36.1 tagf22a53eMerge remote-tracking branch 'origin/master' into release-1.36a948641Update github.com/moby/spdystream from v0.5.0 to v0.5.17e44ffcAdd Workload-Aware Preemption fields to Workload and PodGroup APIsdf2d882Merge pull request #136989 from nojnhuh/podgroup-resourceclaim4eece52Workload API: PodGroup ResourceClaims (KEP-5729)3d35c51Merge pull request #137190 from everpeace/KEP-5491-alpha0434117Merge pull request #137028 from nmn3m/feature/dra-resource-pool-statusba785beDrop CSR analogy, mark ObjectMeta +required,reduce limits (maxItems=500, maxL...4a9c878Add ResourcePoolStatusRequest API types and generated codeUpdates
k8s.io/utilsfrom 0.0.0-20241104100929-3ea5e8cea738 to 0.0.0-20260210185600-b8788abfbbc2Commits