Bump github.com/openshift-online/ocm-sdk-go from 0.1.456 to 0.1.504 in the ocm-sdk group across 1 directory#55
Conversation
dependabot
Bot
added
area/dependency
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughThe ChangesDependency version upgrades
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 1 warning)
✅ Passed checks (9 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
Hi @dependabot[bot]. Thanks for your PR. I'm waiting for a openshift-online member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 74: The go.mod currently pins golang.org/x/oauth2 at v0.23.0 which is
vulnerable (CVE-2025-22868); update the dependency to v0.27.0 or later by
changing the module version in go.mod (golang.org/x/oauth2) and then run `go get
golang.org/x/oauth2@v0.27.0` or `go mod tidy` to ensure the new version is
recorded and modules are re-resolved; verify builds and tests (imports
referencing oauth2) succeed after the upgrade.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: b6e4dbba-fa8f-4c87-8782-4f4dcff3f97c
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
| github.com/x448/float16 v0.8.4 // indirect | ||
| golang.org/x/net v0.33.0 // indirect | ||
| golang.org/x/net v0.39.0 // indirect | ||
| golang.org/x/oauth2 v0.23.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Check for available security patches and usage of oauth2.
# Check which dependency requires oauth2
go mod graph | grep 'golang.org/x/oauth2'
# Search for direct usage of oauth2 in the codebase
rg -n --type=go 'golang.org/x/oauth2|"oauth2"' -C 2Repository: openshift-online/rosa-e2e
Length of output: 6685
🏁 Script executed:
# Check the actual go.mod file to see the context of line 74
head -n 80 go.mod | tail -n 15Repository: openshift-online/rosa-e2e
Length of output: 770
🌐 Web query:
GO-2025-3488 golang.org/x/oauth2 vulnerability
💡 Result:
GO-2025-3488 is a security vulnerability identified in the golang.org/x/oauth2 package, specifically within the golang.org/x/oauth2/jws sub-package [1][2][3]. It is also tracked as CVE-2025-22868 and GHSA-6v2p-p543-phr9 [1][4]. The vulnerability involves improper validation of the syntactic correctness of input tokens [5]. An attacker can exploit this by passing a malicious, malformed token to the application, which causes unexpected memory consumption during the parsing process [1][2][3]. This can lead to a denial of service (DoS) condition, where the application consumes excessive resources, potentially delaying or denying service to legitimate users [5]. The issue was addressed in version 0.27.0 of the golang.org/x/oauth2 package [1][2][3]. Users are advised to update to version 0.27.0 or later to mitigate this risk [5]. The vulnerability was publicly disclosed on February 26, 2025 [1][2][4].
Citations:
- 1: https://osv.dev/GO-2025-3488
- 2: https://pkg.go.dev/vuln/GO-2025-3488
- 3: https://groups.google.com/g/golang-announce/c/wImnF7NFhJE
- 4: https://nvd.nist.gov/vuln/detail/CVE-2025-22868
- 5: https://vulert.com/vuln-db/go-golang-org-x-oauth2-195815
🌐 Web query:
GHSA-6v2p-p543-phr9 golang.org/x/oauth2 vulnerability
💡 Result:
GHSA-6v2p-p543-phr9 is a high-severity security vulnerability (CVSS 7.5) affecting the golang.org/x/oauth2 module [1]. It is also tracked as CVE-2025-22868 [1][2]. The vulnerability is described as an "Improper Validation of Syntactic Correctness of Input" [1]. Specifically, an attacker can provide a maliciously malformed token that causes the application to consume unexpected amounts of memory during the parsing process, potentially leading to a denial-of-service condition [1][2]. While the advisory is filed under the golang.org/x/oauth2 module, technical discussions indicate that the underlying issue resides within the golang.org/x/oauth2/jws package [3]. Users are advised to update to version 0.27.0 or later to mitigate this vulnerability [1][2]. It is important to note that some projects may include the main oauth2 module without including the vulnerable jws package; in such cases, those projects would not be susceptible to this specific vulnerability [3].
Citations:
- 1: https://osv.dev/vulnerability/GHSA-6v2p-p543-phr9
- 2: x/vulndb: potential Go vuln in golang.org/x/oauth2: GHSA-6v2p-p543-phr9 golang/vulndb#3813
- 3: [GHSA-6v2p-p543-phr9] golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability github/advisory-database#5995
🏁 Script executed:
# Check if jws or token parsing is actually used in the codebase
rg 'oauth2/jws|ParseToken|ParseJWT' --type=goRepository: openshift-online/rosa-e2e
Length of output: 51
🏁 Script executed:
# Check if oauth2 is used directly in the code
rg 'oauth2\.' --type=go -m 5Repository: openshift-online/rosa-e2e
Length of output: 51
Upgrade golang.org/x/oauth2 to address HIGH severity security vulnerability.
The current version v0.23.0 contains CVE-2025-22868 (GO-2025-3488), a vulnerability involving improper validation of token syntax that can cause unexpected memory consumption and lead to denial of service. Upgrade to v0.27.0 or later to resolve this issue.
🧰 Tools
🪛 OSV Scanner (2.3.8)
[HIGH] 74-74: golang.org/x/oauth2 0.23.0: Unexpected memory consumption during token parsing in golang.org/x/oauth2
(GO-2025-3488)
[HIGH] 74-74: golang.org/x/oauth2 0.23.0: golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 74, The go.mod currently pins golang.org/x/oauth2 at v0.23.0
which is vulnerable (CVE-2025-22868); update the dependency to v0.27.0 or later
by changing the module version in go.mod (golang.org/x/oauth2) and then run `go
get golang.org/x/oauth2@v0.27.0` or `go mod tidy` to ensure the new version is
recorded and modules are re-resolved; verify builds and tests (imports
referencing oauth2) succeed after the upgrade.
|
/retest |
1 similar comment
|
/retest |
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/go_modules/ocm-sdk-f6f7f28218
branch
from
926ea43 to
ea799eb
Compare
|
/retest |
1 similar comment
|
/retest |
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/go_modules/ocm-sdk-f6f7f28218
branch
from
ea799eb to
9ce15e8
Compare
|
/retest |
1 similar comment
|
/retest |
dependabot
Bot
force-pushed
the
dependabot/go_modules/ocm-sdk-f6f7f28218
branch
from
9ce15e8 to
a6782e2
Compare
There was a problem hiding this comment.
♻️ Duplicate comments (1)
go.mod (1)
74-74:⚠️ Potential issue | 🔴 Critical | ⚡ Quick winCritical oauth2 vulnerability remains unresolved.
This line is unchanged in the current PR, but golang.org/x/oauth2 v0.23.0 contains CVE-2025-22868 (GO-2025-3488), a HIGH severity vulnerability that can cause denial of service through memory exhaustion. This issue was previously flagged and remains unresolved. Upgrade to v0.27.0 or later to address this vulnerability.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` at line 74, The go.mod currently pins golang.org/x/oauth2 to v0.23.0 which contains a HIGH-severity CVE; update the dependency to v0.27.0 or later by changing the module version in go.mod (golang.org/x/oauth2 -> v0.27.0+) and then run `go get golang.org/x/oauth2@v0.27.0` (or higher) followed by `go mod tidy` (and `go test ./...`) to refresh go.sum and verify nothing breaks; ensure any usages of oauth2 types/functions compile against the updated package and adjust import code in the codebase if any API changes surface.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@go.mod`:
- Line 74: The go.mod currently pins golang.org/x/oauth2 to v0.23.0 which
contains a HIGH-severity CVE; update the dependency to v0.27.0 or later by
changing the module version in go.mod (golang.org/x/oauth2 -> v0.27.0+) and then
run `go get golang.org/x/oauth2@v0.27.0` (or higher) followed by `go mod tidy`
(and `go test ./...`) to refresh go.sum and verify nothing breaks; ensure any
usages of oauth2 types/functions compile against the updated package and adjust
import code in the codebase if any API changes surface.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 00e95fbc-eea6-44c4-9d77-c892614523a6
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
|
Dependabot Auto-Merge Status This PR meets the criteria for auto-merge but could not be automatically merged due to repository permissions.
Please review and merge manually if appropriate. |
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/go_modules/ocm-sdk-f6f7f28218
branch
from
a6782e2 to
639896f
Compare
There was a problem hiding this comment.
♻️ Duplicate comments (1)
go.mod (1)
74-74:⚠️ Potential issue | 🔴 Critical | ⚡ Quick winUnresolved: HIGH severity vulnerability in golang.org/x/oauth2 persists.
The golang.org/x/oauth2 v0.23.0 dependency contains CVE-2025-22868 (GO-2025-3488)—improper token validation allowing DoS via unexpected memory consumption. A previous review flagged this, but it remains unpatched in this PR. Even though most of the dependency tree is being updated (ocm-sdk-go 0.1.456→0.1.503), oauth2 was not bumped to v0.27.0 or later.
Next steps:
- Verify whether ocm-sdk-go v0.1.503 permits oauth2 ≥v0.27.0 or mandates v0.23.0
- If permitted, upgrade oauth2 immediately before merge
🔍 Verification script
#!/bin/bash # Check which versions of oauth2 are compatible with ocm-sdk-go v0.1.503 # Fetch go.mod of ocm-sdk-go v0.1.503 to see its oauth2 requirement curl -s "https://raw.githubusercontent.com/openshift-online/ocm-sdk-go/v0.1.503/go.mod" | grep -A 2 'oauth2' # Check if oauth2 v0.27.0 is available go list -m -json golang.org/x/oauth2@v0.27.0 2>&1 | head -20🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` at line 74, The golang.org/x/oauth2 dependency at version v0.23.0 contains a HIGH severity vulnerability (CVE-2025-22868) that must be resolved before merging. First, verify whether ocm-sdk-go v0.1.503 allows oauth2 versions >= v0.27.0 by checking the go.mod file of ocm-sdk-go v0.1.503 (you can fetch this from the official repository or use go get commands to test compatibility). If v0.27.0 or later is permitted, update the golang.org/x/oauth2 dependency in the go.mod file from v0.23.0 to v0.27.0 or a newer patched version to resolve the vulnerability. If the newer version is not compatible with ocm-sdk-go v0.1.503, investigate whether ocm-sdk-go itself needs to be updated to a version that supports the patched oauth2 release.Sources: Coding guidelines, Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@go.mod`:
- Line 74: The golang.org/x/oauth2 dependency at version v0.23.0 contains a HIGH
severity vulnerability (CVE-2025-22868) that must be resolved before merging.
First, verify whether ocm-sdk-go v0.1.503 allows oauth2 versions >= v0.27.0 by
checking the go.mod file of ocm-sdk-go v0.1.503 (you can fetch this from the
official repository or use go get commands to test compatibility). If v0.27.0 or
later is permitted, update the golang.org/x/oauth2 dependency in the go.mod file
from v0.23.0 to v0.27.0 or a newer patched version to resolve the vulnerability.
If the newer version is not compatible with ocm-sdk-go v0.1.503, investigate
whether ocm-sdk-go itself needs to be updated to a version that supports the
patched oauth2 release.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift-online/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: b6f2253d-02c0-4370-aed4-1db3082cedcb
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
|
/retest |
1 similar comment
|
/retest |
|
Dependabot Auto-Merge Status This PR meets the criteria for auto-merge but could not be automatically merged due to repository permissions.
Please review and merge manually if appropriate. |
Bumps the ocm-sdk group with 1 update in the / directory: [github.com/openshift-online/ocm-sdk-go](https://github.com/openshift-online/ocm-sdk-go). Updates `github.com/openshift-online/ocm-sdk-go` from 0.1.456 to 0.1.504 - [Release notes](https://github.com/openshift-online/ocm-sdk-go/releases) - [Changelog](https://github.com/openshift-online/ocm-sdk-go/blob/main/CHANGES.md) - [Commits](openshift-online/ocm-sdk-go@v0.1.456...v0.1.504) --- updated-dependencies: - dependency-name: github.com/openshift-online/ocm-sdk-go dependency-version: 0.1.501 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ocm-sdk ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/go_modules/ocm-sdk-f6f7f28218
branch
from
639896f to
17957d8
Compare
|
Dependabot Auto-Merge Status This PR meets the criteria for auto-merge but could not be automatically merged due to repository permissions.
Please review and merge manually if appropriate. |
|
@dependabot[bot]: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Bumps the ocm-sdk group with 1 update in the / directory: github.com/openshift-online/ocm-sdk-go.
Updates
github.com/openshift-online/ocm-sdk-gofrom 0.1.456 to 0.1.504Release notes
Sourced from github.com/openshift-online/ocm-sdk-go's releases.
... (truncated)
Changelog
Sourced from github.com/openshift-online/ocm-sdk-go's changelog.
... (truncated)
Commits
142b4cfMerge pull request #1177 from openshift-online/sync-model/v0.0.45914bc981chore: bump ocm-api-model to v0.0.459acb82a5Merge pull request #1175 from openshift-online/sync-model/v0.0.4571960dc0chore: bump ocm-api-model to v0.0.457787223bMerge pull request #1174 from vkareh/automated-release-pipelinee62dcdbci: add automated release pipeline739df3eMerge pull request #1173 from openshift-online/ocm-24592-release-prepa459c93[OCM-24592](https://redhat.atlassian.net/browse/OCM-24592) | chore: release ocm-sdk-go v0.1.501a207e5d[OCM-24592](https://redhat.atlassian.net/browse/OCM-24592) | chore: release preparation for v0.0.456529cfd7Merge pull request #1167 from marcolan018/ocm-23443