build(deps): bump the misc-dependencies group across 1 directory with 9 updates#8161
build(deps): bump the misc-dependencies group across 1 directory with 9 updates#8161dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (182)
📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
📝 WalkthroughWalkthroughThe 🚥 Pre-merge checks | ✅ 10✅ Passed checks (10 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @dependabot[bot]. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@go.mod`:
- Around line 86-90: Replace the incorrect etcd module versions with the
published security-fixed release v3.6.9: update each module line for
go.etcd.io/etcd/api/v3, go.etcd.io/etcd/client/pkg/v3,
go.etcd.io/etcd/client/v3, go.etcd.io/etcd/server/v3 and
go.etcd.io/etcd/tests/v3 to use v3.6.9 (replace any occurrences of v3.6.8 or
v3.6.10 with v3.6.9).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: eff49067-df8f-4533-9b9e-f98347ade3e3
⛔ Files ignored due to path filters (156)
go.sumis excluded by!**/*.sumvendor/github.com/googleapis/gax-go/v2/CHANGES.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/googleapis/gax-go/v2/apierror/internal/proto/custom_error.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**,!**/*.pb.govendor/github.com/googleapis/gax-go/v2/apierror/internal/proto/error.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**,!**/*.pb.govendor/github.com/googleapis/gax-go/v2/call_option.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/googleapis/gax-go/v2/callctx/callctx.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/googleapis/gax-go/v2/content_type.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/googleapis/gax-go/v2/internal/version.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/googleapis/gax-go/v2/invoke.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/googleapis/gax-go/v2/telemetry.gois excluded by!vendor/**,!**/vendor/**vendor/go.etcd.io/etcd/api/v3/version/version.gois excluded by!vendor/**,!**/vendor/**vendor/go.etcd.io/etcd/client/v3/internal/resolver/resolver.gois excluded by!vendor/**,!**/vendor/**vendor/go.etcd.io/etcd/client/v3/retry_interceptor.gois excluded by!vendor/**,!**/vendor/**vendor/go.etcd.io/etcd/etcdctl/v3/ctlv3/command/ep_command.gois excluded by!vendor/**,!**/vendor/**vendor/go.etcd.io/etcd/etcdctl/v3/ctlv3/command/util.gois excluded by!vendor/**,!**/vendor/**vendor/go.etcd.io/etcd/server/v3/etcdserver/api/v3rpc/auth.gois excluded by!vendor/**,!**/vendor/**vendor/go.etcd.io/etcd/server/v3/etcdserver/api/v3rpc/grpc.gois excluded by!vendor/**,!**/vendor/**vendor/go.etcd.io/etcd/server/v3/etcdserver/api/v3rpc/key.gois excluded by!vendor/**,!**/vendor/**vendor/go.etcd.io/etcd/server/v3/etcdserver/api/v3rpc/maintenance.gois excluded by!vendor/**,!**/vendor/**vendor/go.etcd.io/etcd/server/v3/etcdserver/api/v3rpc/member.gois excluded by!vendor/**,!**/vendor/**vendor/go.etcd.io/etcd/server/v3/etcdserver/server.gois excluded by!vendor/**,!**/vendor/**vendor/go.etcd.io/etcd/server/v3/etcdserver/txn/txn.gois excluded by!vendor/**,!**/vendor/**vendor/go.etcd.io/etcd/server/v3/etcdserver/v3_server.gois excluded by!vendor/**,!**/vendor/**vendor/go.etcd.io/etcd/server/v3/storage/mvcc/watchable_store.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/.golangci.ymlis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/CONTRIBUTING.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/Makefileis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/README.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/baggage/baggage.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/dependencies.Dockerfileis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/internal/errorhandler/errorhandler.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/internal/global/handler.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/internal/global/state.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/metric/asyncfloat64.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/metric/asyncint64.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/metric/meter.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/metric/syncfloat64.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/metric/syncint64.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/propagation/baggage.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/propagation/trace_context.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/requirements.txtis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/builtin.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/container.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/env.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id_readfile.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/process.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/batch_span_processor.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/batch_span_processor.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/simple_span_processor.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/tracer.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/provider.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/span.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/version.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.39.0/MIGRATION.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.39.0/README.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.40.0/MIGRATION.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.40.0/README.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.40.0/attribute_group.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.40.0/doc.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.40.0/error_type.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.40.0/exception.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.40.0/otelconv/metric.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.40.0/schema.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/auto.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/trace.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/tracestate.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/version.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/versions.yamlis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/http2.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/server.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/transport.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/writesched.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/writesched_priority_rfc7540.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/writesched_random.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sync/singleflight/singleflight.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/asm_darwin_arm64_gc.sis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_darwin_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_darwin_arm64_other.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_gccgo_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_other_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/syscall_darwin_arm64_gc.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/plan9/syscall_plan9.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/windows/aliases.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/windows/registry/key.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/windows/syscall_windows.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/api/compute/v1/compute-api.jsonis excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/api/compute/v1/compute-gen.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/api/compute/v1/compute2-gen.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/api/compute/v1/compute3-gen.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/api/dns/v1/dns-api.jsonis excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/api/dns/v1/dns-gen.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/api/iam/v1/iam-api.jsonis excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/api/iam/v1/iam-gen.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/api/internal/gensupport/send.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/api/internal/version.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/api/option/internaloption/unsaferesolver.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/attributes/attributes.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/balancer/balancer.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/balancer/base/balancer.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/balancer/endpointsharding/endpointsharding.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/balancer/pickfirst/pickfirst.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/binarylog/grpc_binarylog_v1/binarylog.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**,!**/*.pb.govendor/google.golang.org/grpc/credentials/tls.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/dialoptions.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/health/grpc_health_v1/health.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**,!**/*.pb.govendor/google.golang.org/grpc/health/grpc_health_v1/health_grpc.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**,!**/*.pb.govendor/google.golang.org/grpc/internal/envconfig/envconfig.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/mem/buffer_pool.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/transport/defaults.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/transport/http2_client.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/transport/http2_server.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/interop/grpc_testing/benchmark_service.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**,!**/*.pb.govendor/google.golang.org/grpc/interop/grpc_testing/benchmark_service_grpc.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**,!**/*.pb.govendor/google.golang.org/grpc/interop/grpc_testing/control.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**,!**/*.pb.govendor/google.golang.org/grpc/interop/grpc_testing/core/stats.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**,!**/*.pb.govendor/google.golang.org/grpc/interop/grpc_testing/empty.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**,!**/*.pb.govendor/google.golang.org/grpc/interop/grpc_testing/messages.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**,!**/*.pb.govendor/google.golang.org/grpc/interop/grpc_testing/payloads.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**,!**/*.pb.govendor/google.golang.org/grpc/interop/grpc_testing/report_qps_scenario_service.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**,!**/*.pb.govendor/google.golang.org/grpc/interop/grpc_testing/report_qps_scenario_service_grpc.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**,!**/*.pb.govendor/google.golang.org/grpc/interop/grpc_testing/stats.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**,!**/*.pb.govendor/google.golang.org/grpc/interop/grpc_testing/test.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**,!**/*.pb.govendor/google.golang.org/grpc/interop/grpc_testing/test_grpc.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**,!**/*.pb.govendor/google.golang.org/grpc/interop/grpc_testing/worker_service.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**,!**/*.pb.govendor/google.golang.org/grpc/interop/grpc_testing/worker_service_grpc.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**,!**/*.pb.govendor/google.golang.org/grpc/mem/buffer_pool.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/picker_wrapper.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/reflection/grpc_reflection_v1/reflection.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**,!**/*.pb.govendor/google.golang.org/grpc/reflection/grpc_reflection_v1/reflection_grpc.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**,!**/*.pb.govendor/google.golang.org/grpc/reflection/grpc_reflection_v1alpha/reflection.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**,!**/*.pb.govendor/google.golang.org/grpc/reflection/grpc_reflection_v1alpha/reflection_grpc.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**,!**/*.pb.govendor/google.golang.org/grpc/resolver/map.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/rpc_util.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/server.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/version.gois excluded by!vendor/**,!**/vendor/**vendor/kubevirt.io/api/backup/register.gois excluded by!vendor/**,!**/vendor/**vendor/kubevirt.io/api/backup/v1alpha1/deepcopy_generated.gois excluded by!vendor/**,!**/vendor/**vendor/kubevirt.io/api/backup/v1alpha1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/kubevirt.io/api/backup/v1alpha1/register.gois excluded by!vendor/**,!**/vendor/**vendor/kubevirt.io/api/backup/v1alpha1/types.gois excluded by!vendor/**,!**/vendor/**vendor/kubevirt.io/api/backup/v1alpha1/types_swagger_generated.gois excluded by!vendor/**,!**/vendor/**vendor/kubevirt.io/api/core/v1/deepcopy_generated.gois excluded by!vendor/**,!**/vendor/**vendor/kubevirt.io/api/core/v1/schema.gois excluded by!vendor/**,!**/vendor/**vendor/kubevirt.io/api/core/v1/schema_swagger_generated.gois excluded by!vendor/**,!**/vendor/**vendor/kubevirt.io/api/core/v1/types.gois excluded by!vendor/**,!**/vendor/**vendor/kubevirt.io/api/core/v1/types_swagger_generated.gois excluded by!vendor/**,!**/vendor/**vendor/kubevirt.io/api/core/v1/zz_generated.defaults.gois excluded by!vendor/**,!**/vendor/**,!**/zz_generated*.govendor/kubevirt.io/containerized-data-importer-api/pkg/apis/core/v1beta1/types.gois excluded by!vendor/**,!**/vendor/**vendor/kubevirt.io/containerized-data-importer-api/pkg/apis/core/v1beta1/types_swagger_generated.gois excluded by!vendor/**,!**/vendor/**vendor/kubevirt.io/containerized-data-importer-api/pkg/apis/core/v1beta1/zz_generated.deepcopy.gois excluded by!vendor/**,!**/vendor/**,!**/zz_generated*.govendor/modules.txtis excluded by!vendor/**,!**/vendor/**
📒 Files selected for processing (1)
go.mod
| go.etcd.io/etcd/api/v3 v3.6.10 | ||
| go.etcd.io/etcd/client/pkg/v3 v3.6.10 | ||
| go.etcd.io/etcd/client/v3 v3.6.10 | ||
| go.etcd.io/etcd/server/v3 v3.6.10 | ||
| go.etcd.io/etcd/tests/v3 v3.6.10 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Verify etcd v3.6.10 release exists and check for security advisories
# Check if v3.6.10 tag exists in etcd repository
gh api repos/etcd-io/etcd/git/refs/tags/v3.6.10 --jq '.ref' || echo "Tag not found"
# Check for security advisories affecting etcd v3.6.8
gh api graphql -f query='
{
securityVulnerabilities(first: 10, ecosystem: GO, package: "go.etcd.io/etcd") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'Repository: openshift/hypershift
Length of output: 381
🌐 Web query:
etcd v3.6.10 release information
💡 Result:
etcd v3.6.10 has not been released as of 2026-04-03. It is listed as upcoming in the official CHANGELOG-3.6.md with the change "Fix etcdctl endpoint command regression with option --cluster when auth is enabled", marked as (TBC) meaning "to be confirmed" or "to be released". The latest released version in the 3.6 series is v3.6.9, released on 2026-03-20. No GitHub release page or assets for v3.6.10 were found, and GitHub releases page does not list it. Previous releases follow a pattern of changelog entries updated post-release with dates.
Citations:
- 1: https://github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.6.md
- 2: https://github.com/etcd-io/etcd/releases/tag/v3.6.9
- 3: https://github.com/etcd-io/etcd/releases
- 4: Plan to release v3.6.9 etcd-io/etcd#21439
- 5: https://github.com/coreos/etcd/releases
🌐 Web query:
etcd v3.6.8 security vulnerabilities CVE
💡 Result:
etcd v3.6.8 has two known security vulnerabilities assigned CVEs, both disclosed in March 2026 and fixed in v3.6.9: - CVE-2026-33413: Authorization bypasses in multiple APIs (e.g., MemberList, Alarm, Lease APIs, compaction). Allows unauthorized access to certain functions via gRPC API in clusters with auth enabled. Rated moderate/high severity (CVSS 4.0: 8.8 HIGH by GitHub). Affects etcd <=3.6.8. Kubernetes deployments unaffected. - CVE-2026-33343: Nested etcd transactions bypass RBAC authorization checks. Allows authenticated users with restricted permissions to access entire data store. Rated moderate (CVSS 3.1: 6.5 MEDIUM by NVD). Affects etcd <=3.6.8. Kubernetes unaffected. v3.6.8 itself addressed prior dependency CVEs (e.g., Go toolchain CVEs like CVE-2025-61726) but is vulnerable to these auth issues. Upgrade to v3.6.9 recommended. Mitigations: restrict network access to etcd ports, use mTLS. No other CVEs specific to v3.6.8 found in official sources.
Citations:
- 1: https://nvd.nist.gov/vuln/detail/CVE-2026-33413
- 2: https://groups.google.com/g/etcd-dev/c/jNGxYo6ICUA
- 3: https://etcd.io/blog/2026/mar20-patch-release/
- 4: https://github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.6.md
- 5: GHSA-q8m4-xhhv-38mg
- 6: https://nvd.nist.gov/vuln/detail/CVE-2026-33343
🌐 Web query:
etcd changelog v3.6.8 to v3.6.10
💡 Result:
etcd v3.6.8 to v3.6.10 changelog (as of 2026-04-03): v3.6.10 (TBC, not yet released): - etcdctl: Fix etcdctl endpoint command regression with option --cluster when auth is enabled. v3.6.9 (2026-03-20): etcd server: - Ensure the metrics interceptor runs before other interceptors so that metrics remain up to date. - Fix Race between read index and leader change. - Fix Stale reads caused by process pausing. - Guard unauthenticated endpoints with auth checks to fix Authorization bypasses in multiple APIs (CVE-2026-33413). - [other security fix] (CVE-2026-33343). Package clientv3: - Print the endpoint the grpc request was actually sent to in unary interceptor. etcd grpc-proxy: - server/etcdmain: fix startup deadlock in grpcproxy. etcdctl: [unspecified changes]. Dependencies: - Bump go.opentelemetry.io/otel/sdk to v1.40.0 to resolve GO-2026-4394. - Compile binaries using go 1.25.8. - Bump golang.org/x/net to v0.51.0 to resolve GO-2026-4559. - Bump google.golang.org/grpc to 1.79.3 to resolve CVE-2026-33186. v3.6.8 (2026-02-13): etcd server: - Postpone removal of the --max-snapshots flag from v3.7 to v3.8. - Revoke the deprecation of the --snapshot-count flag. Dependencies: - Compile binaries using go 1.24.10. - Bump golang.org/x/crypto to 0.45.0 to address CVE-2025-47914, and CVE-2025-58181. - Compile binaries using go 1.24.13. This addresses CVE-2025-61726, CVE-2025-61731. Full details in official CHANGELOG-3.6.md. No breaking changes noted in these patch releases. Always read the upgrade guide before upgrading.
Citations:
- 1: https://github.com/etcd-io/etcd/releases
- 2: Plan to release v3.6.8 etcd-io/etcd#21226
- 3: https://github.com/etcd-io/etcd/releases/tag/v3.6.9
- 4: Plan to release v3.6.9 etcd-io/etcd#21439
- 5: https://github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.6.md
etcd v3.6.10 does not exist; use v3.6.9 instead.
The etcd v3.6.10 release has not been published. As of April 3, 2026, the latest available version in the 3.6 series is v3.6.9 (released March 20, 2026). Update all five etcd modules (api/v3, client/pkg/v3, client/v3, server/v3, tests/v3) from v3.6.8 to v3.6.9.
This change is critical: v3.6.8 contains two security vulnerabilities (CVE-2026-33413 and CVE-2026-33343) affecting authorization that are resolved in v3.6.9. Upgrading is recommended for security.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@go.mod` around lines 86 - 90, Replace the incorrect etcd module versions with
the published security-fixed release v3.6.9: update each module line for
go.etcd.io/etcd/api/v3, go.etcd.io/etcd/client/pkg/v3,
go.etcd.io/etcd/client/v3, go.etcd.io/etcd/server/v3 and
go.etcd.io/etcd/tests/v3 to use v3.6.9 (replace any occurrences of v3.6.8 or
v3.6.10 with v3.6.9).
ab534f0 to
45ad508
Compare
… 9 updates Bumps the misc-dependencies group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [go.etcd.io/etcd/api/v3](https://github.com/etcd-io/etcd) | `3.6.8` | `3.6.10` | | [go.etcd.io/etcd/client/pkg/v3](https://github.com/etcd-io/etcd) | `3.6.8` | `3.6.10` | | [go.etcd.io/etcd/client/v3](https://github.com/etcd-io/etcd) | `3.6.8` | `3.6.10` | | [go.etcd.io/etcd/server/v3](https://github.com/etcd-io/etcd) | `3.6.8` | `3.6.10` | | [go.etcd.io/etcd/tests/v3](https://github.com/etcd-io/etcd) | `3.6.8` | `3.6.10` | | [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.269.0` | `0.274.0` | | [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.79.3` | `1.80.0` | | [kubevirt.io/api](https://github.com/kubevirt/api) | `1.7.1` | `1.8.1` | | [kubevirt.io/containerized-data-importer-api](https://github.com/kubevirt/containerized-data-importer-api) | `1.64.0` | `1.65.0` | Updates `go.etcd.io/etcd/api/v3` from 3.6.8 to 3.6.10 - [Release notes](https://github.com/etcd-io/etcd/releases) - [Commits](etcd-io/etcd@v3.6.8...v3.6.10) Updates `go.etcd.io/etcd/client/pkg/v3` from 3.6.8 to 3.6.10 - [Release notes](https://github.com/etcd-io/etcd/releases) - [Commits](etcd-io/etcd@v3.6.8...v3.6.10) Updates `go.etcd.io/etcd/client/v3` from 3.6.8 to 3.6.10 - [Release notes](https://github.com/etcd-io/etcd/releases) - [Commits](etcd-io/etcd@v3.6.8...v3.6.10) Updates `go.etcd.io/etcd/server/v3` from 3.6.8 to 3.6.10 - [Release notes](https://github.com/etcd-io/etcd/releases) - [Commits](etcd-io/etcd@v3.6.8...v3.6.10) Updates `go.etcd.io/etcd/tests/v3` from 3.6.8 to 3.6.10 - [Release notes](https://github.com/etcd-io/etcd/releases) - [Commits](etcd-io/etcd@v3.6.8...v3.6.10) Updates `google.golang.org/api` from 0.269.0 to 0.274.0 - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.269.0...v0.274.0) Updates `google.golang.org/grpc` from 1.79.3 to 1.80.0 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.79.3...v1.80.0) Updates `kubevirt.io/api` from 1.7.1 to 1.8.1 - [Commits](kubevirt/api@v1.7.1...v1.8.1) Updates `kubevirt.io/containerized-data-importer-api` from 1.64.0 to 1.65.0 - [Commits](kubevirt/containerized-data-importer-api@v1.64.0...v1.65.0) --- updated-dependencies: - dependency-name: go.etcd.io/etcd/api/v3 dependency-version: 3.6.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: misc-dependencies - dependency-name: go.etcd.io/etcd/client/pkg/v3 dependency-version: 3.6.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: misc-dependencies - dependency-name: go.etcd.io/etcd/client/v3 dependency-version: 3.6.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: misc-dependencies - dependency-name: go.etcd.io/etcd/server/v3 dependency-version: 3.6.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: misc-dependencies - dependency-name: go.etcd.io/etcd/tests/v3 dependency-version: 3.6.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: misc-dependencies - dependency-name: google.golang.org/api dependency-version: 0.274.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: misc-dependencies - dependency-name: google.golang.org/grpc dependency-version: 1.80.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: misc-dependencies - dependency-name: kubevirt.io/api dependency-version: 1.8.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: misc-dependencies - dependency-name: kubevirt.io/containerized-data-importer-api dependency-version: 1.65.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: misc-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
45ad508 to
31f2abd
Compare
Test Failure Analysis CompleteJob Information
Test Failure AnalysisErrorSummaryThe Dependabot PR bumped 9 dependencies in the root Root CauseDependabot is configured to bump dependencies in the root Go module ( When Dependabot bumped the The 7 mismatched packages and their version deltas are:
This is a known limitation of Dependabot with multi-module Go repositories — it does not traverse nested modules. Recommendations
Evidence
|
|
@dependabot[bot]: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Bumps the misc-dependencies group with 9 updates in the / directory:
3.6.83.6.103.6.83.6.103.6.83.6.103.6.83.6.103.6.83.6.100.269.00.274.01.79.31.80.01.7.11.8.11.64.01.65.0Updates
go.etcd.io/etcd/api/v3from 3.6.8 to 3.6.10Release notes
Sourced from go.etcd.io/etcd/api/v3's releases.
... (truncated)
Commits
db8d13aversion: bump up to 3.6.1083bb20dMerge pull request #21549 from etcd-io/cherry-pick-36/allow-non-admin-user-to...c99cf0cetcdserver: allow non-admin to fetch member list and alarms8a1830cMerge pull request #21530 from k8s-infra-cherrypick-robot/cherry-pick-21528-t...e841e10Merge pull request #21531 from ahrtr/20260327_depf2173cdBump golang.org/x/image to v0.38.0 to resolve GO-2026-4815e0f7af4Fix etcdctl endpoint command with option --cluster when auth is enabled85651faversion: bump up to 3.6.9d2fd011Merge pull request #21501 from ivanvc/release-3.6-grpc-go-1.79.32a8cd59Merge pull request #21497 from fuweid/3.6-weifu-donotreviewUpdates
go.etcd.io/etcd/client/pkg/v3from 3.6.8 to 3.6.10Release notes
Sourced from go.etcd.io/etcd/client/pkg/v3's releases.
... (truncated)
Commits
db8d13aversion: bump up to 3.6.1083bb20dMerge pull request #21549 from etcd-io/cherry-pick-36/allow-non-admin-user-to...c99cf0cetcdserver: allow non-admin to fetch member list and alarms8a1830cMerge pull request #21530 from k8s-infra-cherrypick-robot/cherry-pick-21528-t...e841e10Merge pull request #21531 from ahrtr/20260327_depf2173cdBump golang.org/x/image to v0.38.0 to resolve GO-2026-4815e0f7af4Fix etcdctl endpoint command with option --cluster when auth is enabled85651faversion: bump up to 3.6.9d2fd011Merge pull request #21501 from ivanvc/release-3.6-grpc-go-1.79.32a8cd59Merge pull request #21497 from fuweid/3.6-weifu-donotreviewUpdates
go.etcd.io/etcd/client/v3from 3.6.8 to 3.6.10Release notes
Sourced from go.etcd.io/etcd/client/v3's releases.
... (truncated)
Commits
db8d13aversion: bump up to 3.6.1083bb20dMerge pull request #21549 from etcd-io/cherry-pick-36/allow-non-admin-user-to...c99cf0cetcdserver: allow non-admin to fetch member list and alarms8a1830cMerge pull request #21530 from k8s-infra-cherrypick-robot/cherry-pick-21528-t...e841e10Merge pull request #21531 from ahrtr/20260327_depf2173cdBump golang.org/x/image to v0.38.0 to resolve GO-2026-4815e0f7af4Fix etcdctl endpoint command with option --cluster when auth is enabled85651faversion: bump up to 3.6.9d2fd011Merge pull request #21501 from ivanvc/release-3.6-grpc-go-1.79.32a8cd59Merge pull request #21497 from fuweid/3.6-weifu-donotreviewUpdates
go.etcd.io/etcd/server/v3from 3.6.8 to 3.6.10Release notes
Sourced from go.etcd.io/etcd/server/v3's releases.
... (truncated)
Commits
db8d13aversion: bump up to 3.6.1083bb20dMerge pull request #21549 from etcd-io/cherry-pick-36/allow-non-admin-user-to...c99cf0cetcdserver: allow non-admin to fetch member list and alarms8a1830cMerge pull request #21530 from k8s-infra-cherrypick-robot/cherry-pick-21528-t...e841e10Merge pull request #21531 from ahrtr/20260327_depf2173cdBump golang.org/x/image to v0.38.0 to resolve GO-2026-4815e0f7af4Fix etcdctl endpoint command with option --cluster when auth is enabled85651faversion: bump up to 3.6.9d2fd011Merge pull request #21501 from ivanvc/release-3.6-grpc-go-1.79.32a8cd59Merge pull request #21497 from fuweid/3.6-weifu-donotreviewUpdates
go.etcd.io/etcd/tests/v3from 3.6.8 to 3.6.10Release notes
Sourced from go.etcd.io/etcd/tests/v3's releases.
... (truncated)
Commits
db8d13aversion: bump up to 3.6.1083bb20dMerge pull request #21549 from etcd-io/cherry-pick-36/allow-non-admin-user-to...c99cf0cetcdserver: allow non-admin to fetch member list and alarms8a1830cMerge pull request #21530 from k8s-infra-cherrypick-robot/cherry-pick-21528-t...e841e10Merge pull request #21531 from ahrtr/20260327_depf2173cdBump golang.org/x/image to v0.38.0 to resolve GO-2026-4815e0f7af4Fix etcdctl endpoint command with option --cluster when auth is enabled85651faversion: bump up to 3.6.9d2fd011Merge pull request #21501 from ivanvc/release-3.6-grpc-go-1.79.32a8cd59Merge pull request #21497 from fuweid/3.6-weifu-donotreviewUpdates
google.golang.org/apifrom 0.269.0 to 0.274.0Release notes
Sourced from google.golang.org/api's releases.
... (truncated)
Changelog
Sourced from google.golang.org/api's changelog.
... (truncated)
Commits
6c759a2chore(main): release 0.274.0 (#3556)0e634aefeat(all): auto-regenerate discovery clients (#3555)0f75259chore: embargo aiplatform:v1beta1 temporarily (#3554)550f00cchore(main): release 0.273.1 (#3551)da01f6achore(deps): bump github.com/go-git/go-git/v5 (#3552)2008108fix: merge duplicate x-goog-request-params header (#3547)2e86962chore(main): release 0.273.0 (#3545)50ea74cchore(google-api-go-generator): restore aiplatform:v1beta1 (#3549)0cacfa8feat(all): auto-regenerate discovery clients (#3546)d38a129chore(all): update all (#3548)Updates
google.golang.org/grpcfrom 1.79.3 to 1.80.0Release notes
Sourced from google.golang.org/grpc's releases.
Commits
397e45eChange version to 1.80.0 (#8948)64ebf0aCherry-pick #8997 to v1.80.x (#9027)e45ed24xds/rbac: add additional handling for addresses with ports (#8990) (#9022)c78d26eCherry-pick #8957 to v1.80.x (#9007)bd7cd3cgrpc: enforce strict path checking for incoming requests on the server (#8987)b6597b3xds/clusterimpl: use xdsConfig for updates and remove redundant fields from L...1d4fa8axds: change cdsbalancer to use update from dependency manager (#8907)8f47d36attributes: Replace internal map with linked list (#8933)22e1ee8xds: add panic recovery in xdsclient resource unmarshalling. (#8895)7136e99credentials/alts: Pool write buffers (#8919)Updates
kubevirt.io/apifrom 1.7.1 to 1.8.1Commits
015302capi update by KubeVirt Prow build 2038518105730191360e1f0279api update by KubeVirt Prow build 2037334441394704384c71383fapi update by KubeVirt Prow build 2037261570177765376be4758eapi update by KubeVirt Prow build 20372616291203194887bcdf62api update by KubeVirt Prow build 2037261535738335232cba20b7api update by KubeVirt Prow build 2037261662020440064f852221api update by KubeVirt Prow build 2033871810008715264d8a6d86api update by KubeVirt Prow build 203236753174167961625a94ffapi update by KubeVirt Prow build 20310475251625533441a8527bapi update by KubeVirt Prow build 2029836056332865536Updates
kubevirt.io/containerized-data-importer-apifrom 1.64.0 to 1.65.0Commits
9827e95containerized-data-importer-api update by KubeVirt Prow build 203902605866513...18a5d1fcontainerized-data-importer-api update by KubeVirt Prow build 203469373313542...e03152ccontainerized-data-importer-api update by KubeVirt Prow build 203246576458111...0e3694ccontainerized-data-importer-api update by KubeVirt Prow build 203133743240996...9080750containerized-data-importer-api update by KubeVirt Prow build 200396036716783...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsSummary by CodeRabbit