Bump the kubernetes group across 1 directory with 3 updates#69
Bump the kubernetes group across 1 directory with 3 updates#69dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
area/dependency
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: openshift-online/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughThis PR updates the Go module dependencies for the rosa-e2e project. The Go toolchain is bumped from 1.24 to 1.26.0, direct Kubernetes client libraries are upgraded to v0.36.2, and transitive dependencies are coordinated to compatible newer versions with composition changes to the indirect dependency set. ChangesGo Module Dependencies Update
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (10 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 3: The go.mod module directive was bumped to "go 1.26.0" but CI is still
using the "golang-1.24" image tag; update the CI operator configuration to use a
Go 1.26 image (replace "golang-1.24" with the matching "golang-1.26" or
equivalent image tag) so the CI runtime matches the go 1.26 requirement and
avoids build failures.
- Around line 13-16: go.mod was bumped to k8s.io client libs v0.36.1 which
contains breaking changes; inspect the codebase for uses of removed/changed APIs
(search for imports or symbols like client-go/tools/bootstrap, util/cert/triple,
any cert generation functions that return *rsa.PrivateKey or expect x509 key
pairs, usages of crypto.Signer vs concrete keys, scale client types/methods
(scale.Interface, Scale subresource calls), and watch helpers like
watchtools.Until or watch.Until) and either migrate those callsites to the new
APIs (replace bootstrap usage with the new bootstrap helpers, switch cert key
handling to crypto.Signer-based APIs, adapt scale client calls to the new scale
client interfaces, and migrate watch tool usage to the updated Until semantics)
or pin go.mod back to the previous known-good client-go version; update imports
and call signatures accordingly and run `go build`/`go test` to validate.
- Line 45: The go.mod currently resolves transitive github.com/golang-jwt/jwt/v4
v4.4.1 and github.com/golang/glog v1.0.0 which are vulnerable; update go.mod to
pin safe minimum versions by adding explicit require directives for
github.com/golang-jwt/jwt/v4 at v4.5.2 (or later) and github.com/golang/glog at
v1.2.4 (or later), then run module tidy/resolve (e.g., go get
github.com/golang-jwt/jwt/v4@v4.5.2 && go get github.com/golang/glog@v1.2.4 &&
go mod tidy) so the transitive graph uses the patched versions.
- Line 46: go.mod currently pins the indirect module github.com/golang/glog at
v1.0.0 which is vulnerable; update the dependency chain so
github.com/golang/glog is at least v1.2.4 by either bumping the upstream
module(s) that pull it (e.g., update github.com/openshift-online/ocm-sdk-go and
any rosa-e2e/pkg/framework dependency versions) or directly forcing the version
in your go.mod (add an explicit require for github.com/golang/glog v1.2.4 or
later), then run go get / go mod tidy to refresh go.sum and verify builds/tests
pass; reference modules: github.com/golang/glog,
github.com/openshift-online/ocm-sdk-go, rosa-e2e/pkg/framework.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: e3b3b994-dccf-4c30-9736-1902329f79b8
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
| module github.com/openshift-online/rosa-e2e | ||
|
|
||
| go 1.24 | ||
| go 1.26.0 |
There was a problem hiding this comment.
CI configuration mismatch will break builds.
The go.mod now requires Go 1.26.0, but the CI operator configuration at ci-operator/openshift-online-rosa-e2e-main.yaml lines 4-9 is still pinned to golang-1.24 image tag. This mismatch will cause build failures when CI attempts to build the project with Go 1.24 while the module requires 1.26.0.
🔧 Required CI config update
Update ci-operator/openshift-online-rosa-e2e-main.yaml:
build_root:
image_stream_tag:
name: release
namespace: openshift
- tag: golang-1.24
+ tag: golang-1.26🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 3, The go.mod module directive was bumped to "go 1.26.0" but
CI is still using the "golang-1.24" image tag; update the CI operator
configuration to use a Go 1.26 image (replace "golang-1.24" with the matching
"golang-1.26" or equivalent image tag) so the CI runtime matches the go 1.26
requirement and avoids build failures.
| github.com/go-openapi/swag v0.23.0 // indirect | ||
| github.com/go-task/slim-sprig/v3 v3.0.0 // indirect | ||
| github.com/gogo/protobuf v1.3.2 // indirect | ||
| github.com/golang-jwt/jwt/v4 v4.4.1 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Find which direct dependency brings in golang-jwt/jwt
go mod why github.com/golang-jwt/jwt/v4
# Check for available updates
gh api graphql -f query='
{
securityVulnerabilities(first: 10, ecosystem: GO, package: "github.com/golang-jwt/jwt/v4") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'Repository: openshift-online/rosa-e2e
Length of output: 2164
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Find which direct dependency brings in glog
go mod why github.com/golang/glog
# Query GitHub advisories for glog
gh api graphql -f query='
{
securityVulnerabilities(first: 20, ecosystem: GO, package: "github.com/golang/glog") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion { identifier }
}
}
}'Repository: openshift-online/rosa-e2e
Length of output: 524
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the relevant section of go.mod around the reported lines
nl -ba go.mod | sed -n '35,60p'Repository: openshift-online/rosa-e2e
Length of output: 112
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show relevant section of go.mod around lines 45-55
awk 'NR>=35 && NR<=60 {printf "%d:%s\n", NR, $0}' go.modRepository: openshift-online/rosa-e2e
Length of output: 1586
Fix vulnerable jwt-go and glog versions in go.mod
go.mod pins transitive github.com/golang-jwt/jwt/v4 v4.4.1 and github.com/golang/glog v1.0.0 with security advisories:
jwt/v4: HIGH — excessive memory allocation during header parsing (< 4.5.2; first patched 4.5.2); LOW — error-handling documentation inParseWithClaims(< 4.5.1; first patched 4.5.1)glog: MODERATE — insecure temporary file usage (< 1.2.4; first patched 1.2.4)
Update the dependency graph (or add a targeted require override) so transitive resolution uses at least jwt/v4 >= 4.5.2 and glog >= 1.2.4.
🧰 Tools
🪛 OSV Scanner (2.3.8)
[HIGH] 45-45: github.com/golang-jwt/jwt/v4 4.4.1: Improper error handling in ParseWithClaims and bad documentation may cause dangerous situations in github.com/golang-jwt/jwt
(GO-2024-3250)
[HIGH] 45-45: github.com/golang-jwt/jwt/v4 4.4.1: Excessive memory allocation during header parsing in github.com/golang-jwt/jwt
(GO-2025-3553)
[HIGH] 45-45: github.com/golang-jwt/jwt/v4 4.4.1: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations
[HIGH] 45-45: github.com/golang-jwt/jwt/v4 4.4.1: jwt-go allows excessive memory allocation during header parsing
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 45, The go.mod currently resolves transitive
github.com/golang-jwt/jwt/v4 v4.4.1 and github.com/golang/glog v1.0.0 which are
vulnerable; update go.mod to pin safe minimum versions by adding explicit
require directives for github.com/golang-jwt/jwt/v4 at v4.5.2 (or later) and
github.com/golang/glog at v1.2.4 (or later), then run module tidy/resolve (e.g.,
go get github.com/golang-jwt/jwt/v4@v4.5.2 && go get
github.com/golang/glog@v1.2.4 && go mod tidy) so the transitive graph uses the
patched versions.
Source: Linters/SAST tools
|
/retest |
1 similar comment
|
/retest |
dependabot
Bot
force-pushed
the
dependabot/go_modules/kubernetes-fe08b70ac6
branch
from
450ff12 to
80c3a17
Compare
|
/retest |
1 similar comment
|
/retest |
Bumps the kubernetes group with 2 updates in the / directory: [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) and [k8s.io/client-go](https://github.com/kubernetes/client-go). Updates `k8s.io/apimachinery` from 0.32.1 to 0.36.2 - [Commits](kubernetes/apimachinery@v0.32.1...v0.36.2) Updates `k8s.io/client-go` from 0.32.1 to 0.36.2 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](kubernetes/client-go@v0.32.1...v0.36.2) Updates `k8s.io/utils` from 0.0.0-20241104100929-3ea5e8cea738 to 0.0.0-20260210185600-b8788abfbbc2 - [Commits](https://github.com/kubernetes/utils/commits) --- updated-dependencies: - dependency-name: k8s.io/apimachinery dependency-version: 0.36.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: kubernetes - dependency-name: k8s.io/client-go dependency-version: 0.36.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: kubernetes - dependency-name: k8s.io/utils dependency-version: 0.0.0-20260210185600-b8788abfbbc2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: kubernetes ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/go_modules/kubernetes-fe08b70ac6
branch
from
80c3a17 to
b662898
Compare
|
/retest |
1 similar comment
|
/retest |
|
@dependabot[bot]: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Bumps the kubernetes group with 2 updates in the / directory: k8s.io/apimachinery and k8s.io/client-go.
Updates
k8s.io/apimachineryfrom 0.32.1 to 0.36.2Commits
ae3f98eUpdate dependencies to v0.36.2 tag2ec982dMerge pull request #139508lalitc375/automated-cherry-pick-of-#1394806a88102Fix wrong marking of errorsefb7f26Merge remote-tracking branch 'origin/master' into release-1.36d966e56Update github.com/moby/spdystream from v0.5.0 to v0.5.179b3632Merge pull request #137864 from yongruilin/dv-dra-mismatcha8822f7Add slice and map union member support with tests7dba2d0Use IsZero instead of IsNil for union ratcheting checkd95710fFix union validation ratcheting when oldObj is nil729062dMerge pull request #137849 from bryantbiggs/deps/update-kube-openapiUpdates
k8s.io/client-gofrom 0.32.1 to 0.36.2Commits
877f535Update dependencies to v0.36.2 tagf22a53eMerge remote-tracking branch 'origin/master' into release-1.36a948641Update github.com/moby/spdystream from v0.5.0 to v0.5.17e44ffcAdd Workload-Aware Preemption fields to Workload and PodGroup APIsdf2d882Merge pull request #136989 from nojnhuh/podgroup-resourceclaim4eece52Workload API: PodGroup ResourceClaims (KEP-5729)3d35c51Merge pull request #137190 from everpeace/KEP-5491-alpha0434117Merge pull request #137028 from nmn3m/feature/dra-resource-pool-statusba785beDrop CSR analogy, mark ObjectMeta +required,reduce limits (maxItems=500, maxL...4a9c878Add ResourcePoolStatusRequest API types and generated codeUpdates
k8s.io/utilsfrom 0.0.0-20241104100929-3ea5e8cea738 to 0.0.0-20260210185600-b8788abfbbc2Commits
Summary by CodeRabbit