OCPBUGS-76594: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.12]

[rissh]

Bump github.com/sirupsen/logrus to v1.9.3 to fix GHSA-4f99-4q7p-p3gh (DoS in logrus). Direct dependency update only; library-go is unchanged to avoid k8s version drift (per approach on openshift/openshift-apiserver#609).

Changes
Bumped github.com/sirupsen/logrus from v1.9.0 to v1.9.3

CVE
GHSA-4f99-4q7p-p3gh | High (CVSS 7.5) | Fixed in v1.9.3

[openshift-ci-robot]

@rissh: This pull request references Jira Issue OCPBUGS-76594, which is invalid:

• release note text must be set and not match the template OR release note type must be set to "Release Note Not Required". For more information you can reference the OpenShift Bug Process.
• expected dependent Jira Issue OCPBUGS-76595 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is ASSIGNED instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Bump github.com/sirupsen/logrus to v1.9.3 to fix GHSA-4f99-4q7p-p3gh (DoS in logrus). Direct dependency update only; library-go is unchanged to avoid k8s version drift (per approach on openshift/openshift-apiserver#609).

Changes
Bumped github.com/sirupsen/logrus from v1.9.0 to v1.9.3

CVE
GHSA-4f99-4q7p-p3gh | High (CVSS 7.5) | Fixed in v1.9.3

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@rissh: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[p0lyn0mial]

could we update to 1.8.3 which also addresses the issue but make the diff even smaller ?

[rissh]

Thanks for calling this out, @p0lyn0mial .

You’re right that v1.9.1 and v1.8.3 include the CVE fix, but they also introduce a separate issue that can lead to a “too many empty tokens without progressing” panic in some scenarios.

Because of that regression, we preferred not to move to those versions and instead keep this targeted fix.

[p0lyn0mial]

ok, thanks for the info.

[p0lyn0mial]

xref: openshift/openshift-apiserver#609 (comment)

/lgtm
/label backport-risk-assessed

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: p0lyn0mial, rissh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [p0lyn0mial]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[rissh]

/verified by ci

[openshift-ci-robot]

@rissh: This PR has been marked as verified by ci.

Details

In response to this:

/verified by ci

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.