build(deps): bump the oc-mirror-v2-security-updates group across 1 directory with 5 updates#1359
Conversation
dependabot
bot
added
dependencies
WalkthroughGo toolchain bumped from 1.24.3 to 1.25.0 and numerous direct and indirect Go module versions were updated in Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 golangci-lint (2.5.0)Error: can't load config: can't unmarshal config by viper (flags, file): 1 error(s) decoding:
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
needs-ok-to-test
|
Hi @dependabot[bot]. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@go.mod`:
- Line 3: Update the hard-pinned Go version to 1.25.0: change the Dockerfile's
GO_VERSION value (the GO_VERSION build ARG) from go1.23.5 to go1.25.0 and update
the v1/go.mod module directive from "go 1.24" to "go 1.25" so both the build
image and the v1 module match the root go.mod's go 1.25.0 requirement.
ℹ️ Review info
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to data retention organization setting
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
| module github.com/openshift/oc-mirror/v2 | ||
|
|
||
| go 1.24.3 | ||
| go 1.25.0 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Read-only check for hard-pinned Go versions in common build/CI files.
fd -HI '(^|/)(\.github/workflows/.*\.ya?ml|Dockerfile(\..*)?|Makefile|.*\.mk|go\.mod)$' . \
| xargs -I{} sh -c 'echo "### {}"; rg -n -C2 "(go-version|golang:|^go[[:space:]]+[0-9]+\.[0-9]+|GO_VERSION|GOVERSION)" "{}" || true'Repository: openshift/oc-mirror
Length of output: 2056
Update Dockerfile and v1/go.mod to align with Go 1.25.0 before merge.
Verification found hard-pinned Go versions that conflict:
Dockerfile(line 28) usesGO_VERSION=go1.23.5v1/go.mod(line 3) requiresgo 1.24.0- Root
go.modnow requiresgo 1.25.0
The build container will run an older Go version than required, causing compilation failures or inconsistent builds. Sync both the Dockerfile and v1/go.mod to Go 1.25.0.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@go.mod` at line 3, Update the hard-pinned Go version to 1.25.0: change the
Dockerfile's GO_VERSION value (the GO_VERSION build ARG) from go1.23.5 to
go1.25.0 and update the v1/go.mod module directive from "go 1.24" to "go 1.25"
so both the build image and the v1 module match the root go.mod's go 1.25.0
requirement.
|
/ok-to-test |
openshift-ci
bot
added
ok-to-test
…rectory with 5 updates Bumps the oc-mirror-v2-security-updates group with 3 updates in the / directory: [golang.org/x/crypto](https://github.com/golang/crypto), [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) and [github.com/sigstore/fulcio](https://github.com/sigstore/fulcio). Updates `golang.org/x/crypto` from 0.41.0 to 0.45.0 - [Commits](golang/crypto@v0.41.0...v0.45.0) Updates `github.com/go-git/go-git/v5` from 5.16.2 to 5.16.5 - [Release notes](https://github.com/go-git/go-git/releases) - [Commits](go-git/go-git@v5.16.2...v5.16.5) Updates `github.com/opencontainers/selinux` from 1.12.0 to 1.13.1 - [Release notes](https://github.com/opencontainers/selinux/releases) - [Commits](opencontainers/selinux@v1.12.0...v1.13.1) Updates `github.com/sigstore/fulcio` from 1.6.6 to 1.8.5 - [Release notes](https://github.com/sigstore/fulcio/releases) - [Changelog](https://github.com/sigstore/fulcio/blob/main/CHANGELOG.md) - [Commits](sigstore/fulcio@v1.6.6...v1.8.5) Updates `github.com/sigstore/sigstore` from 1.9.5 to 1.10.3 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.9.5...v1.10.3) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.45.0 dependency-type: direct:production dependency-group: oc-mirror-v2-security-updates - dependency-name: github.com/go-git/go-git/v5 dependency-version: 5.16.5 dependency-type: indirect dependency-group: oc-mirror-v2-security-updates - dependency-name: github.com/opencontainers/selinux dependency-version: 1.13.1 dependency-type: indirect dependency-group: oc-mirror-v2-security-updates - dependency-name: github.com/sigstore/fulcio dependency-version: 1.8.5 dependency-type: indirect dependency-group: oc-mirror-v2-security-updates - dependency-name: github.com/sigstore/sigstore dependency-version: 1.10.3 dependency-type: indirect dependency-group: oc-mirror-v2-security-updates ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
force-pushed
the
dependabot/go_modules/oc-mirror-v2-security-updates-05c22a6b9b
branch
from
2b10850 to
823a720
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
go.mod (1)
3-3:⚠️ Potential issue | 🔴 CriticalAlign all pinned Go versions with
go 1.25.0before merge.Line 3 updates root
go.modto Go 1.25.0, but this was already flagged earlier as potentially conflicting with other pinned versions (Dockerfile,v1/go.mod). If still mismatched, builds can fail or become inconsistent.#!/bin/bash # Read-only verification of Go version pins across common build/module files. fd -HI '(^|/)(go\.mod|Dockerfile(\..*)?|Makefile|.*\.mk|\.github/workflows/.*\.ya?ml)$' . \ | xargs -I{} sh -c 'echo "### {}"; rg -n -C2 "(^go[[:space:]]+[0-9]+\.[0-9]+(\.[0-9]+)?$|go-version:|GO_VERSION|golang:)" "{}" || true'Expected: root
go.mod,v1/go.mod, and build image/tooling pins all target Go 1.25.x.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@go.mod` at line 3, Update all Go version pins to match go 1.25.0: find and change any occurrences of module/go version declarations (root go.mod and v1/go.mod's "go" directive), CI/workflow golang/golang-version or go-version entries, Dockerfile image tags or ARGs (e.g., GO_VERSION), Makefile or *.mk GO_VERSION variables, and any other build/tooling pins so they consistently specify 1.25.0 (or 1.25.x as agreed). Ensure the "go" directive in both go.mod files is 1.25.0 and that Dockerfile base images and CI variables reference the same version, then run the verification script from the comment to confirm no mismatches remain.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@go.mod`:
- Line 198: Update the dependency go.opentelemetry.io/otel/sdk to v1.40.0 or
later in go.mod to address CVE-2026-24051: change the module version for
go.opentelemetry.io/otel/sdk to at least v1.40.0 (for example by running a
module upgrade such as go get go.opentelemetry.io/otel/sdk@v1.40.0), then run go
mod tidy and re-run tests/build to ensure the new version resolves correctly;
verify no other modules pin the older v1.38.0 version.
---
Duplicate comments:
In `@go.mod`:
- Line 3: Update all Go version pins to match go 1.25.0: find and change any
occurrences of module/go version declarations (root go.mod and v1/go.mod's "go"
directive), CI/workflow golang/golang-version or go-version entries, Dockerfile
image tags or ARGs (e.g., GO_VERSION), Makefile or *.mk GO_VERSION variables,
and any other build/tooling pins so they consistently specify 1.25.0 (or 1.25.x
as agreed). Ensure the "go" directive in both go.mod files is 1.25.0 and that
Dockerfile base images and CI variables reference the same version, then run the
verification script from the comment to confirm no mismatches remain.
ℹ️ Review info
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to data retention organization setting
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
| go.opentelemetry.io/otel/metric v1.36.0 // indirect | ||
| go.opentelemetry.io/otel/sdk v1.36.0 // indirect | ||
| go.opentelemetry.io/otel/metric v1.38.0 // indirect | ||
| go.opentelemetry.io/otel/sdk v1.38.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
python - <<'PY'
import json, urllib.request
query = {
"package": {"ecosystem": "Go", "name": "go.opentelemetry.io/otel/sdk"},
"version": "1.38.0"
}
req = urllib.request.Request(
"https://api.osv.dev/v1/query",
data=json.dumps(query).encode(),
headers={"Content-Type": "application/json"},
method="POST",
)
try:
with urllib.request.urlopen(req) as r:
data = json.load(r)
print(json.dumps(data, indent=2))
except Exception as e:
print(f"Error: {e}")
PYRepository: openshift/oc-mirror
Length of output: 197
🏁 Script executed:
git ls-files | grep -E 'go\.mod$'Repository: openshift/oc-mirror
Length of output: 174
🌐 Web query:
go.opentelemetry.io/otel/sdk v1.38.0 vulnerability PATH-hijacking RCE
💡 Result:
go.opentelemetry.io/otel/sdk v1.38.0 is affected by CVE-2026-24051 / GHSA-9h8m-3fm2-qjrq (Arbitrary Code Execution via local PATH hijacking) on macOS/Darwin. The issue is in sdk/resource/host_id.go (the WithHostID detector): it executes ioreg by name (searching PATH), so a local attacker who can influence PATH can cause execution of a malicious ioreg binary and get code execution in the app’s context. [1][2][3]
Fix: upgrade to v1.40.0+, which changes the call to use the absolute path /usr/sbin/ioreg. [1][2]
Example: go get go.opentelemetry.io/otel/sdk@v1.40.0 (and/or .../sdk/resource@v1.40.0). [1][3]
Scope note: this is local exploitation (depends on attacker control of environment/PATH), and only impacts macOS/Darwin. [1][3]
Sources: [1] GitHub Security Advisory GHSA-9h8m-3fm2-qjrq, [2] fix commit d45961b, [3] Snyk entry for CVE-2026-24051.
🌐 Web query:
go.opentelemetry.io/otel/sdk security advisory 2024 2025
💡 Result:
For go.opentelemetry.io/otel/sdk (OpenTelemetry-Go SDK), there were no published GitHub Security Advisories in 2024 or 2025. The repo’s advisories list shows a single published advisory, dated February 2, 2026 (GHSA-9h8m-3fm2-qjrq). [1]
The first published advisory (not 2024/2025, but relevant to the module) is:
- GHSA-9h8m-3fm2-qjrq / CVE-2026-24051 — Arbitrary Code Execution via local PATH hijacking on macOS/Darwin, affecting v1.20.0–v1.39.0 (fixed in v1.40.0). [1][2]
Related but not a code vulnerability in the SDK: OpenTelemetry documented a Sep 25, 2025 incident where the go.opentelemetry.io SSL certificate expired, temporarily preventing downloads from that module domain. [3]
Sources: [1] [2] [3]
🏁 Script executed:
sed -n '195,201p' go.modRepository: openshift/oc-mirror
Length of output: 453
Upgrade go.opentelemetry.io/otel/sdk from v1.38.0 to v1.40.0 or later to fix CVE-2026-24051.
go.opentelemetry.io/otel/sdk v1.38.0 is affected by CVE-2026-24051 (GHSA-9h8m-3fm2-qjrq), a local arbitrary code execution vulnerability via PATH hijacking on macOS. The WithHostID detector executes ioreg by name instead of the absolute path, allowing local attackers to hijack the binary via PATH manipulation. Fixed in v1.40.0, which uses the absolute path /usr/sbin/ioreg.
🧰 Tools
🪛 OSV Scanner (2.3.3)
[HIGH] 198-198: go.opentelemetry.io/otel/sdk 1.38.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking in go.opentelemetry.io/otel/sdk
(GO-2026-4394)
[HIGH] 198-198: go.opentelemetry.io/otel/sdk 1.38.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@go.mod` at line 198, Update the dependency go.opentelemetry.io/otel/sdk to
v1.40.0 or later in go.mod to address CVE-2026-24051: change the module version
for go.opentelemetry.io/otel/sdk to at least v1.40.0 (for example by running a
module upgrade such as go get go.opentelemetry.io/otel/sdk@v1.40.0), then run go
mod tidy and re-run tests/build to ensure the new version resolves correctly;
verify no other modules pin the older v1.38.0 version.
|
@dependabot[bot]: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
Bumps the oc-mirror-v2-security-updates group with 3 updates in the / directory: golang.org/x/crypto, github.com/go-git/go-git/v5 and github.com/sigstore/fulcio.
Updates
golang.org/x/cryptofrom 0.41.0 to 0.45.0Commits
4e0068cgo.mod: update golang.org/x dependenciese79546essh: curb GSSAPI DoS risk by limiting number of specified OIDsf91f7a7ssh/agent: prevent panic on malformed constraint2df4153acme/autocert: let automatic renewal work with short lifetime certsbcf6a84acme: pass context to requestb4f2b62ssh: fix error message on unsupported cipher79ec3a5ssh: allow to bind to a hostname in remote forwarding122a78fgo.mod: update golang.org/x dependenciesc0531f9all: eliminate vet diagnostics0997000all: fix some commentsUpdates
github.com/go-git/go-git/v5from 5.16.2 to 5.16.5Release notes
Sourced from github.com/go-git/go-git/v5's releases.
Commits
48a1ae0Merge pull request #1836 from go-git/check-v542bdf1fstorage: filesystem, Verify idx matches pack file4146a56plumbing: format/idxfile, Verify idxfile's checksum63d78ecplumbing: format/packfile, Add new ErrMalformedPackFile25f1624Merge pull request #1800 from Ch00k/no-delete-untracked-v5600fb13git: worktree, Don't delete local untracked files when resetting worktree390a569Merge pull request #1746 from pjbgf/bump-go61c8b85build: Bump Go test versions to 1.23-1.25 (v5)e5a05ecMerge pull request #1744 from go-git/renovate/releases/v5.x-go-golang.org-x-c...1495930plumbing: Remove use of non-constant format stringsUpdates
github.com/opencontainers/selinuxfrom 1.12.0 to 1.13.1Release notes
Sourced from github.com/opencontainers/selinux's releases.
Commits
5647f06Merge pull request #242 from Luap99/securejoin69a52b8downgrade github.com/cyphar/filepath-securejoin to v0.5.16950c32Merge pull request #240 from opencontainers/dependabot/github_actions/golangc...9a88c88build(deps): bump golangci/golangci-lint-action from 8 to 94be9937Merge pull request #237 from cyphar/selinux-safe-procfsc8cfa6fselinux: migrate to pathrs-lite procfs APIf2424d8Merge pull request #236 from kolyshkin/modernize-ci648ce7fci: add go 1.25916cab9ci: bump golangci-lint to v2.5b42e5c8all: format sources with latest gofumptUpdates
github.com/sigstore/fulciofrom 1.6.6 to 1.8.5Release notes
Sourced from github.com/sigstore/fulcio's releases.
... (truncated)
Changelog
Sourced from github.com/sigstore/fulcio's changelog.
... (truncated)
Commits
eaae2f2Add anchors when matching meta issuer regexp (GHSA-59jp-pj84-45mr) (#2263)9325775Update changelog for v1.8.5 (#2264)b23705dbuild(deps): bump google.golang.org/api from 0.258.0 to 0.259.0 (#2260)9e8841dbuild(deps): bump golang froma22b2e6to36b4f45(#2251)5c13588build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#2253)4c823aebuild(deps): bump the all group across 1 directory with 4 updates (#2259)c15246abuild(deps): bump google.golang.org/api from 0.257.0 to 0.258.0 (#2252)f2e48e1Use transparency-dev tesseract image (#2250)9e26cb4Add read service for CT log (#2258)7bff3d6Switch to go.yaml.in/yaml/v3 (#2257)Updates
github.com/sigstore/sigstorefrom 1.9.5 to 1.10.3Release notes
Sourced from github.com/sigstore/sigstore's releases.
... (truncated)
Commits
72f0ed7build(deps): Bump github.com/aws/aws-sdk-go-v2/config (#2230)b257168build(deps): Bump github.com/aws/aws-sdk-go-v2 in /pkg/signature/kms/aws (#2226)84f57b8build(deps): Bump github.com/sigstore/sigstore (#2221)bdc1a86build(deps): Bump actions/checkout from 5.0.1 to 6.0.0 (#2220)11dfe81build(deps): Bump golang.org/x/crypto in /pkg/signature/kms/aws (#2236)0214948Add back ValidatePubKey as a deprecated, minimal function (#2235)cc26bb8build(deps): Bump localstack/localstack in /test/e2e in the all group (#2227)63ab8d8build(deps): Bump github.com/aws/aws-sdk-go-v2/service/kms (#2229)9e629f0build(deps): Bump the all group with 2 updates (#2219)234b99dbuild(deps): Bump github.com/coreos/go-oidc/v3 from 3.16.0 to 3.17.0 (#2223)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.
Summary by CodeRabbit