Bump github.com/openshift-online/ocm-sdk-go from 0.1.456 to 0.1.500#30
Conversation
dependabot
Bot
added
dependencies
Summary by CodeRabbit
WalkthroughThis PR updates the Go module manifest ( ChangesGo module manifest updates
Estimated code review effort🎯 2 (Simple) | ⏱️ ~5 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
needs-ok-to-test
|
Hi @dependabot[bot]. Thanks for your PR. I'm waiting for a openshift-online member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Around line 63-64: Update the two ocm-api-model module versions in go.mod from
v0.0.454 to the existing tag v0.0.453: change
github.com/openshift-online/ocm-api-model/clientapi and
github.com/openshift-online/ocm-api-model/model to reference v0.0.453, then run
`go mod tidy` (or equivalent) to refresh the lockfile and verify the build;
ensure no other references still point to v0.0.454.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: b28170df-de23-4f3b-bc86-86cf66530357
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
| github.com/openshift-online/ocm-api-model/clientapi v0.0.454 // indirect | ||
| github.com/openshift-online/ocm-api-model/model v0.0.454 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Verify ocm-api-model dependencies at v0.0.454 exist
echo "=== Checking ocm-api-model/clientapi v0.0.454 ==="
gh api repos/openshift-online/ocm-api-model/tags --jq '.[] | select(.name == "clientapi/v0.0.454") | .name' 2>/dev/null || echo "clientapi v0.0.454 not found as expected tag"
echo -e "\n=== Checking ocm-api-model/model v0.0.454 ==="
gh api repos/openshift-online/ocm-api-model/tags --jq '.[] | select(.name == "model/v0.0.454") | .name' 2>/dev/null || echo "model v0.0.454 not found as expected tag"
# Alternative: Check if they resolve via go
echo -e "\n=== Attempting to resolve via go list ==="
go list -m -versions github.com/openshift-online/ocm-api-model/clientapi@v0.0.454 2>&1
go list -m -versions github.com/openshift-online/ocm-api-model/model@v0.0.454 2>&1Repository: openshift-online/rosa-e2e
Length of output: 1875
🌐 Web query:
ocm-api-model clientapi v0.0.454 release GitHub
💡 Result:
Result: I could not find a GitHub release for openshift-online/ocm-api-model at version v0.0.454. What I found instead (authoritative sources): - The repository’s latest release is v0.0.453, published 2026-03-11, and the releases page lists only up to that version in the data returned by search. [1][2][3] - The tag page I could locate is for v0.0.453 (not v0.0.454). [2] Because I didn’t find any release/tag named v0.0.454 in the repository’s GitHub releases/tag pages via search, there’s no v0.0.454 release information (release notes / CHANGES.md diff / commit) I can cite. If you meant a different repo (e.g., open-cluster-management-io/api, guidewire-oss/ocm-api, or another fork) or a different version string, tell me the exact GitHub owner/repo and version format you expect, and I’ll re-check.
Citations:
- 1: https://github.com/openshift-online/ocm-api-model/releases
- 2: https://github.com/openshift-online/ocm-api-model/releases/tag/v0.0.453
- 3: https://github.com/openshift-online/ocm-api-model
🌐 Web query:
ocm-api-model model v0.0.454 release GitHub
💡 Result:
I couldn’t find any GitHub release/tag for openshift-online/ocm-api-model with version v0.0.454. What I found instead: - The repository’s GitHub Releases page shows the latest release as v0.0.453 (published 2026-03-11). [1][2] - A direct lookup for v0.0.454 on the releases/tag URL didn’t return a matching release page, while v0.0.453 has a release/tag page. [3] If you meant a different repository (for example a fork or a different package name than ocm-api-model), tell me the exact GitHub org/repo (or the correct version string) and I’ll re-run the search.
Citations:
- 1: https://github.com/openshift-online/ocm-api-model/releases
- 2: https://github.com/openshift-online/ocm-api-model
- 3: https://github.com/openshift-online/ocm-api-model/releases/tag/v0.0.453
Update ocm-api-model dependencies to v0.0.453.
Version v0.0.454 does not exist in the openshift-online/ocm-api-model repository. The latest available release is v0.0.453 (published 2026-03-11). Both github.com/openshift-online/ocm-api-model/clientapi and github.com/openshift-online/ocm-api-model/model must be updated to v0.0.453.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` around lines 63 - 64, Update the two ocm-api-model module versions in
go.mod from v0.0.454 to the existing tag v0.0.453: change
github.com/openshift-online/ocm-api-model/clientapi and
github.com/openshift-online/ocm-api-model/model to reference v0.0.453, then run
`go mod tidy` (or equivalent) to refresh the lockfile and verify the build;
ensure no other references still point to v0.0.454.
Bumps [github.com/openshift-online/ocm-sdk-go](https://github.com/openshift-online/ocm-sdk-go) from 0.1.456 to 0.1.500. - [Release notes](https://github.com/openshift-online/ocm-sdk-go/releases) - [Changelog](https://github.com/openshift-online/ocm-sdk-go/blob/main/CHANGES.md) - [Commits](openshift-online/ocm-sdk-go@v0.1.456...v0.1.500) --- updated-dependencies: - dependency-name: github.com/openshift-online/ocm-sdk-go dependency-version: 0.1.500 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/go_modules/github.com/openshift-online/ocm-sdk-go-0.1.500
branch
from
4733aaf to
9acf744
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 74: The dependency golang.org/x/oauth2 is pinned to v0.23.0 which
contains security advisories; update the module declaration for
golang.org/x/oauth2 in go.mod to at least v0.27.0 (preferably v0.36.0) and then
run go get golang.org/x/oauth2@v0.36.0 (or go get golang.org/x/oauth2@v0.27.0)
followed by go mod tidy to update go.sum; verify by rebuilding and running tests
to ensure no breaking changes in any code referencing golang.org/x/oauth2.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: c969a063-ae64-4ce5-b052-8071ec03cb09
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
| github.com/x448/float16 v0.8.4 // indirect | ||
| golang.org/x/net v0.33.0 // indirect | ||
| golang.org/x/net v0.39.0 // indirect | ||
| golang.org/x/oauth2 v0.23.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
What is the first patched golang.org/x/oauth2 version for GO-2025-3488 and GHSA-6v2p-p543-phr9, and what upgrade version is currently recommended?
💡 Result:
For GO-2025-3488 and GHSA-6v2p-p543-phr9 in golang.org/x/oauth2, the first patched version is v0.27.0 (both advisories list 0.27.0 as the fixed/patched version; earlier versions are affected) [1][2]. As of 2026-05-13, the currently recommended upgrade version is the latest golang.org/x/oauth2 release, v0.36.0 [3][4].
Citations:
- 1: GHSA-6v2p-p543-phr9
- 2: https://pkg.go.dev/vuln/GO-2025-3488
- 3: https://go.googlesource.com/oauth2/+/refs/tags/v0.34.0
- 4: https://osv.dev/GO-2025-3488
Upgrade golang.org/x/oauth2 from v0.23.0 to at least v0.27.0 (or preferably the latest v0.36.0) to fix GO-2025-3488 and GHSA-6v2p-p543-phr9.
v0.23.0 has HIGH severity advisories that are resolved in v0.27.0 and later.
🧰 Tools
🪛 OSV Scanner (2.3.8)
[HIGH] 74-74: golang.org/x/oauth2 0.23.0: Unexpected memory consumption during token parsing in golang.org/x/oauth2
(GO-2025-3488)
[HIGH] 74-74: golang.org/x/oauth2 0.23.0: golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 74, The dependency golang.org/x/oauth2 is pinned to v0.23.0
which contains security advisories; update the module declaration for
golang.org/x/oauth2 in go.mod to at least v0.27.0 (preferably v0.36.0) and then
run go get golang.org/x/oauth2@v0.36.0 (or go get golang.org/x/oauth2@v0.27.0)
followed by go mod tidy to update go.sum; verify by rebuilding and running tests
to ensure no breaking changes in any code referencing golang.org/x/oauth2.
|
Superseded by #55. |
dependabot
Bot
deleted the
dependabot/go_modules/github.com/openshift-online/ocm-sdk-go-0.1.500
branch
Bumps github.com/openshift-online/ocm-sdk-go from 0.1.456 to 0.1.500.
Release notes
Sourced from github.com/openshift-online/ocm-sdk-go's releases.
... (truncated)
Changelog
Sourced from github.com/openshift-online/ocm-sdk-go's changelog.
... (truncated)
Commits
529cfd7Merge pull request #1167 from marcolan018/ocm-234434c9e685chore: bump version to 0.1.500585c1b9[OCM-23443](https://redhat.atlassian.net/browse/OCM-23443) | feat: add ZeroEgress into AWSf19f64fMerge pull request #1153 from gurnben/add-makefile-quick-start25c4d91Merge pull request #1152 from gurnben/add-dependaboted7e088Merge pull request #1151 from gurnben/readme-and-docs-improvementsc43e011Merge pull request #1150 from gurnben/agent-readiness-improvements697fd8aAdd one-command build/setup: README.md (Quick Start section)a5482fdAdd Dependabot configuration for dependency security scanning08f46d2Improve README structure: add missing Installation, Usage, and Development se...