[release-4.17] OCPBUGS-80063: Bump google.golang.org/grpc to v1.79.3#201
Open
ocp-sustaining-admins wants to merge 2 commits into
Open
Conversation
openshift-ci-robot
added
jira/severity-important
|
@ocp-sustaining-admins: This pull request references Jira Issue OCPBUGS-80063, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
WalkthroughCI linter timeout configuration is increased from 4 minutes to 10 minutes. Go toolchain is bumped from 1.22/1.22.1 to 1.22.0/1.22.12, and multiple dependencies are updated including golang.org/x/text, OpenTelemetry, and Google packages, with a replace directive added for grpc. ChangesCI Linter Configuration
Go Toolchain and Dependencies Update
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes 🚥 Pre-merge checks | ✅ 11 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (11 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 golangci-lint (2.12.2)Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
openshift-ci
Bot
added
the
needs-ok-to-test
Contributor
|
Hi @ocp-sustaining-admins. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/ok-to-test |
openshift-ci
Bot
added
ok-to-test
|
/retest-require |
1 similar comment
|
/retest-require |
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 77: Update the vulnerable dependency versions in go.mod: bump
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc to
v0.46.0, go.opentelemetry.io/otel/sdk to a patched release (e.g., v1.43.0),
golang.org/x/crypto to v0.35.0, and golang.org/x/oauth2 to v0.27.0; then run `go
get`/`go get module@version` (or edit go.mod and run `go mod tidy`) to refresh
go.sum, rebuild and run tests, and re-run the OSV/security scanner to confirm
the vulnerabilities for these modules (otelgrpc, go.opentelemetry.io/otel/sdk,
golang.org/x/crypto, golang.org/x/oauth2) are resolved.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: a2ed8656-8a3c-48a4-ab56-fe25feecd9b0
⛔ Files ignored due to path filters (298)
go.sumis excluded by!**/*.sumvendor/github.com/cespare/xxhash/v2/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/cespare/xxhash/v2/xxhash.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cespare/xxhash/v2/xxhash_asm.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cespare/xxhash/v2/xxhash_other.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cespare/xxhash/v2/xxhash_safe.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cespare/xxhash/v2/xxhash_unsafe.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/context.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/context_noslog.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/context_slog.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/funcr/funcr.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/funcr/slogsink.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/logr.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/sloghandler.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/slogr.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/slogr/slogr.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/slogsink.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/golang/protobuf/jsonpb/decode.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/golang/protobuf/jsonpb/encode.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/golang/protobuf/jsonpb/json.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/uuid/CHANGELOG.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/uuid/CONTRIBUTING.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/uuid/hash.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/uuid/time.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/uuid/uuid.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/uuid/version6.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/uuid/version7.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/CONTRIBUTING.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/VERSIONING.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/doc.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/attr.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/doc.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/id.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/number.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/resource.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/scope.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/span.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/status.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/traces.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/value.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/limit.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/span.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/tracer.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/tracer_provider.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/.codespellignoreis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/.codespellrcis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/.gitmodulesis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/.golangci.ymlis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/CHANGELOG.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/CODEOWNERSis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/CONTRIBUTING.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/Makefileis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/README.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/RELEASING.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/VERSIONING.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/README.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/doc.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/encoder.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/filter.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/iterator.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/key.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/kv.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/set.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/value.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/baggage/README.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/baggage/baggage.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/baggage/context.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/baggage/doc.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/codes/README.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/codes/codes.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/codes/doc.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/doc.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/error_handler.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/get_main_pkgs.shis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/handler.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/attribute/attribute.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/baggage/baggage.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/baggage/context.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/gen.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/global/handler.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/global/instruments.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/global/internal_logging.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/global/meter.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/global/propagator.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/global/state.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/global/trace.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/rawhelpers.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal_logging.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric/README.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric/asyncfloat64.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric/asyncint64.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric/config.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric/doc.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric/embedded/README.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric/embedded/embedded.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric/instrument.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric/meter.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric/syncfloat64.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric/syncint64.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/propagation.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/propagation/README.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/propagation/baggage.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/propagation/doc.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/propagation/propagation.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/propagation/trace_context.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/renovate.jsonis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/requirements.txtis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/README.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/instrumentation/README.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/instrumentation/doc.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/instrumentation/library.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/instrumentation/scope.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/internal/env/env.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/internal/gen.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/internal/internal.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/internal/x/README.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/internal/x/x.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/README.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/auto.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/builtin.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/config.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/container.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/doc.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/env.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id_bsd.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id_darwin.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id_exec.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id_linux.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id_readfile.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id_unsupported.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id_windows.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os_release_darwin.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os_release_unix.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os_unix.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os_unsupported.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os_windows.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/process.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/resource.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/README.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/batch_span_processor.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/doc.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/event.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/evictedqueue.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/id_generator.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/link.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/provider.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/sampler_env.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/sampling.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/simple_span_processor.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/snapshot.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/span.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/span_exporter.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/span_limits.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/span_processor.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/tracer.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/version.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/sdk/version.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/internal/http.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.12.0/README.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.12.0/doc.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.12.0/exception.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.12.0/http.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.12.0/resource.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.12.0/schema.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.12.0/trace.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.17.0/README.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.17.0/doc.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.17.0/event.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.17.0/exception.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.17.0/http.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.17.0/resource.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.17.0/schema.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.17.0/trace.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.21.0/attribute_group.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.21.0/doc.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.21.0/event.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.21.0/exception.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.21.0/resource.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.21.0/schema.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.21.0/trace.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.26.0/README.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.26.0/attribute_group.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.26.0/doc.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.26.0/exception.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.26.0/metric.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.26.0/schema.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/README.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/config.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/context.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/doc.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/embedded/README.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/embedded/embedded.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/nonrecording.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/noop.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/noop/README.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/noop/noop.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/provider.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/span.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/trace.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/tracer.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/tracestate.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/verify_examples.shis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/verify_readmes.shis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/verify_released_changelog.shis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/version.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/versions.yamlis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/cryptobyte/asn1/asn1.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/cryptobyte/string.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/hkdf/hkdf.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/internal/poly1305/bits_compat.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/internal/poly1305/bits_go1.13.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/internal/poly1305/mac_noasm.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/internal/poly1305/sum_amd64.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/internal/poly1305/sum_generic.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/internal/poly1305/sum_ppc64x.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/internal/poly1305/sum_ppc64x.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/nacl/secretbox/secretbox.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/salsa20/salsa/hsalsa20.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/salsa20/salsa/salsa20_amd64.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http/httpguts/httplex.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/client_conn_pool.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/config.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/config_go124.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/config_pre_go124.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/frame.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/http2.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/pipe.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/server.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/timer.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/transport.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/unencrypted.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/write.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/writesched_priority.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/websocket/client.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/websocket/dial.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/websocket/hybi.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/websocket/websocket.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/README.mdis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/deviceauth.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/internal/client_appengine.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/internal/token.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/internal/transport.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/oauth2.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/pkce.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/token.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sync/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sync/singleflight/singleflight.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/asm_darwin_x86_gc.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_arm64.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_darwin_x86.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_gc_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_gc_x86.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_gc_x86.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_gccgo_x86.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_linux_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_linux_noinit.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_linux_riscv64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_other_x86.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_riscv64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_x86.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/syscall_darwin_x86_gc.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/README.mdis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/aliases.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/asm_zos_s390x.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/bpxsvc_zos.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/bpxsvc_zos.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/epoll_zos.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/fstatfs_zos.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ioctl_linux.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/mkerrors.shis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/mmap_nomremap.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/mremap.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/pagesize_unix.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/readdirent_getdirentries.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/sockcmsg_zos.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/symaddr_zos_s390x.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/syscall_aix.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/syscall_darwin.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/syscall_darwin_libSystem.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/syscall_dragonfly.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/syscall_freebsd.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/syscall_hurd.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/syscall_linux.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/syscall_linux_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/syscall_linux_loong64.gois excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (2)
.golangci.yamlgo.mod
| go.etcd.io/etcd/client/pkg/v3 v3.5.10 // indirect | ||
| go.etcd.io/etcd/client/v3 v3.5.10 // indirect | ||
| go.opentelemetry.io/auto/sdk v1.1.0 // indirect | ||
| go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.44.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Check for security advisories and newer versions of flagged dependencies
echo "=== Checking for OpenTelemetry otelgrpc updates ==="
gh api graphql -f query='
{
securityVulnerabilities(first: 5, ecosystem: GO, package: "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'
echo -e "\n=== Checking for OpenTelemetry SDK updates ==="
gh api graphql -f query='
{
securityVulnerabilities(first: 5, ecosystem: GO, package: "go.opentelemetry.io/otel/sdk") {
nodes {
advisory {
summary
severity
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'
echo -e "\n=== Checking for golang.org/x/crypto updates ==="
gh api graphql -f query='
{
securityVulnerabilities(first: 5, ecosystem: GO, package: "golang.org/x/crypto") {
nodes {
advisory {
summary
severity
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'
echo -e "\n=== Checking for golang.org/x/oauth2 updates ==="
gh api graphql -f query='
{
securityVulnerabilities(first: 5, ecosystem: GO, package: "golang.org/x/oauth2") {
nodes {
advisory {
summary
severity
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'Repository: openshift/cluster-olm-operator
Length of output: 2517
🏁 Script executed:
head -95 go.mod | tail -25Repository: openshift/cluster-olm-operator
Length of output: 1370
Update multiple HIGH severity vulnerabilities in dependencies.
OSV Scanner has identified 5 HIGH severity vulnerabilities in the current dependency versions:
-
Line 77 -
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.44.0:- DoS vulnerability due to unbound cardinality metrics (patched in v0.46.0)
-
Line 83 -
go.opentelemetry.io/otel/sdk v1.34.0:- Arbitrary Code Execution via PATH hijacking (patched in v1.40.0 or v1.43.0)
-
Line 89 -
golang.org/x/crypto v0.32.0:- DoS via slow or incomplete key exchange (patched in v0.35.0)
-
Line 92 -
golang.org/x/oauth2 v0.25.0:- Improper validation vulnerability (patched in v0.27.0)
All flagged versions are within vulnerable ranges. Consider updating these dependencies to their respective patched versions, either in this PR or as a follow-up security update.
🧰 Tools
🪛 OSV Scanner (2.3.8)
[HIGH] 77-77: go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc 0.44.0: Denial of service in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc
(GO-2023-2331)
[HIGH] 77-77: go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc 0.44.0: otelgrpc DoS vulnerability due to unbound cardinality metrics
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 77, Update the vulnerable dependency versions in go.mod: bump
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc to
v0.46.0, go.opentelemetry.io/otel/sdk to a patched release (e.g., v1.43.0),
golang.org/x/crypto to v0.35.0, and golang.org/x/oauth2 to v0.27.0; then run `go
get`/`go get module@version` (or edit go.mod and run `go mod tidy`) to refresh
go.sum, rebuild and run tests, and re-run the OSV/security scanner to confirm
the vulnerabilities for these modules (otelgrpc, go.opentelemetry.io/otel/sdk,
golang.org/x/crypto, golang.org/x/oauth2) are resolved.
tmshort
reviewed
May 13, 2026
| sigs.k8s.io/yaml v1.3.0 // indirect | ||
| ) | ||
|
|
||
| replace google.golang.org/grpc => github.com/openshift-sustaining/grpc-go v1.71.3-sec.1 |
Contributor
There was a problem hiding this comment.
This is v1.71.3, whereas the fix is looking for v1.79.3; does this contain the proper fix?
There was a problem hiding this comment.
Yes, this version includes the gRPC CVE fix (v1.79.3). We have created patched versions based on the Go version used by each component, so the fix is already included and compatible.
|
/test lint |
Contributor
|
/lgtm I looked at the go.mod/go.sum files. The replacement line ought to contain the patch; as the recommended fix requires upgrading to a more recent version of golang. |
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ocp-sustaining-admins, tmshort The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
Contributor
|
@ocp-sustaining-admins: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is an automated PR from the ARC system.
Go version used:
go1.22.12Patch applied:
github.com/openshift-sustaining/grpc-go@v1.71.3-sec.1Modules affected:
.The commands used to generate this PR were:
A member of the Red Hat Openshift Sustaining Team will review the PR and take appropriate action.
Summary by CodeRabbit