LOG-8992: update dependencies to match OCP v4.22#3275
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@jcantrill: This pull request references LOG-8992 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the sub-task to target the "4.8.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (4)
💤 Files with no reviewable changes (1)
✅ Files skipped from review due to trivial changes (1)
WalkthroughUpdates build image/workdir and runtime Docker copy paths, bumps Go to 1.25 and refreshes module pins, removes Elasticsearch API registration from the controller manager scheme, and adjusts tests to stop expecting ChangesBuild image, context paths, and runtime image wiring
Dependency graph and toolchain
Controller manager scheme change
Test expectation updates
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes 🚥 Pre-merge checks | ✅ 11 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (11 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
openshift-ci
Bot
added
the
midstream/Dockerfile
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jcantrill The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Dockerfile`:
- Line 9: The RUN conditional in the Dockerfile uses an unquoted variable in the
shell test ([ -n $CACHE_DEPS ]), which can mis-evaluate when CACHE_DEPS is
empty; update the test to quote the variable (e.g. [ -n "$CACHE_DEPS" ]) so the
condition is evaluated correctly and the go mod download step only runs when
CACHE_DEPS is set.
In `@go.mod`:
- Line 124: The go.mod currently pins google.golang.org/grpc to v1.72.2 which
contains a critical auth bypass; update the grpc module requirement to v1.79.3
or later (replace the line referencing google.golang.org/grpc v1.72.2) and then
run go get google.golang.org/grpc@v1.79.3 (or newer) followed by go mod tidy to
refresh indirect dependencies; ensure the module entry for
google.golang.org/grpc in go.mod and go.sum are updated accordingly and run
tests to validate no breakage.
- Line 107: Update the vulnerable dependency go.opentelemetry.io/otel/sdk from
v1.36.0 to v1.40.0 or later in go.mod (the module name is
go.opentelemetry.io/otel/sdk) and re-resolve the module graph so transitive OTel
modules are upgraded as well; after changing the version run your project’s Go
module resolution (e.g., re-fetch and tidy modules) to ensure the new version is
recorded and the lockfile / go.sum are updated.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: cd1b40f5-1409-45d6-9370-44bab0de27fe
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (3)
Dockerfilecmd/main.gogo.mod
💤 Files with no reviewable changes (1)
- cmd/main.go
|
/label tide/merge-method-squash |
openshift-ci
Bot
added
the
tide/merge-method-squash
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Dockerfile`:
- Line 9: The RUN conditional currently tests only for a non-empty CACHE_DEPS
which treats "false" as true; change the test to an explicit boolean equality
check against the intended truthy value (e.g., test CACHE_DEPS = "true" or =
"1") so go mod download only runs when CACHE_DEPS is explicitly enabled; update
the RUN line that references CACHE_DEPS and runs go mod download accordingly and
ensure any documentation or CI that sets CACHE_DEPS uses the chosen true value.
In `@go.mod`:
- Around line 103-108: The go.mod pins vulnerable OpenTelemetry modules
(go.opentelemetry.io/otel, go.opentelemetry.io/otel/sdk and related packages) at
v1.40.0; update the affected module versions in go.mod so they use patched
releases (e.g., set go.opentelemetry.io/otel to v1.41.0 and
go.opentelemetry.io/otel/sdk to v1.43.0, and align related
exporters/metric/trace modules to compatible patched versions such as v1.41.0+
or v1.43.0+), then run `go get`/`go mod tidy` to resolve and verify the
dependency graph and ensure no breakages in functions that initialize or use
OpenTelemetry components (look for code referencing go.opentelemetry.io/otel,
go.opentelemetry.io/otel/sdk, go.opentelemetry.io/otel/metric,
go.opentelemetry.io/otel/trace, and
go.opentelemetry.io/otel/exporters/otlp/otlptrace).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: e366fcf3-7137-43a7-9d81-d72e86a781ce
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (4)
Dockerfilego.modinternal/auth/rbac_test.gotest/helpers_test.go
💤 Files with no reviewable changes (1)
- internal/auth/rbac_test.go
| go.opentelemetry.io/otel v1.40.0 // indirect | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 // indirect | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0 // indirect | ||
| go.opentelemetry.io/otel/metric v1.40.0 // indirect | ||
| go.opentelemetry.io/otel/sdk v1.40.0 // indirect | ||
| go.opentelemetry.io/otel/trace v1.40.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Pinned OTel modules in go.mod:"
rg -n '^\s*go\.opentelemetry\.io/otel($|/)' go.mod
echo
echo "If available, run dependency vulnerability checks:"
if command -v osv-scanner >/dev/null 2>&1; then
osv-scanner --lockfile=go.mod
else
echo "osv-scanner not found: install and run -> osv-scanner --lockfile=go.mod"
fi
if command -v govulncheck >/dev/null 2>&1; then
govulncheck ./...
else
echo "govulncheck not found: install and run -> govulncheck ./..."
fiRepository: openshift/cluster-logging-operator
Length of output: 5526
Upgrade OTel modules: v1.40.0 has confirmed high-severity vulnerabilities
Lines 106–108 pin go.opentelemetry.io/otel packages to v1.40.0, which are flagged by current vulnerability advisories:
go.opentelemetry.io/otelv1.40.0: GHSA-mh2q-q3fh-2475 (CVSS 7.5) → upgrade to v1.41.0go.opentelemetry.io/otel/sdkv1.40.0: GHSA-hfvc-g4fc-pqhx (CVSS 7.3) → upgrade to v1.43.0
Patches are available; please bump these dependencies.
🧰 Tools
🪛 OSV Scanner (2.3.8)
[HIGH] 103-103: go.opentelemetry.io/otel 1.40.0: OpenTelemetry-Go: multi-value baggage header extraction causes excessive allocations (remote dos amplification)
[HIGH] 107-107: go.opentelemetry.io/otel/sdk 1.40.0: opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` around lines 103 - 108, The go.mod pins vulnerable OpenTelemetry
modules (go.opentelemetry.io/otel, go.opentelemetry.io/otel/sdk and related
packages) at v1.40.0; update the affected module versions in go.mod so they use
patched releases (e.g., set go.opentelemetry.io/otel to v1.41.0 and
go.opentelemetry.io/otel/sdk to v1.43.0, and align related
exporters/metric/trace modules to compatible patched versions such as v1.41.0+
or v1.43.0+), then run `go get`/`go mod tidy` to resolve and verify the
dependency graph and ensure no breakages in functions that initialize or use
OpenTelemetry components (look for code referencing go.opentelemetry.io/otel,
go.opentelemetry.io/otel/sdk, go.opentelemetry.io/otel/metric,
go.opentelemetry.io/otel/trace, and
go.opentelemetry.io/otel/exporters/otlp/otlptrace).
|
/test e2e-target |
|
@jcantrill: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
Description
This PR:
Links
cc @vparfonov @Clee2691
Summary by CodeRabbit
Chores
Behavioral Change
Tests