Skip to content

build(deps): bump the oc-mirror-v2-security-updates group across 1 directory with 5 updates #1359

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dependabot wants to merge 1 commit into from
Closed

build(deps): bump the oc-mirror-v2-security-updates group across 1 directory with 5 updates #1359

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
81 changes: 41 additions & 40 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,13 @@
module github.com/openshift/oc-mirror/v2

go 1.24.3
go 1.25.0
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Feb 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Read-only check for hard-pinned Go versions in common build/CI files.

fd -HI '(^|/)(\.github/workflows/.*\.ya?ml|Dockerfile(\..*)?|Makefile|.*\.mk|go\.mod)$' . \
| xargs -I{} sh -c 'echo "### {}"; rg -n -C2 "(go-version|golang:|^go[[:space:]]+[0-9]+\.[0-9]+|GO_VERSION|GOVERSION)" "{}" || true'

Repository: openshift/oc-mirror

Length of output: 2056

Update Dockerfile and v1/go.mod to align with Go 1.25.0 before merge.

Verification found hard-pinned Go versions that conflict:

  • Dockerfile (line 28) uses GO_VERSION=go1.23.5
  • v1/go.mod (line 3) requires go 1.24.0
  • Root go.mod now requires go 1.25.0

The build container will run an older Go version than required, causing compilation failures or inconsistent builds. Sync both the Dockerfile and v1/go.mod to Go 1.25.0.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@go.mod` at line 3, Update the hard-pinned Go version to 1.25.0: change the
Dockerfile's GO_VERSION value (the GO_VERSION build ARG) from go1.23.5 to
go1.25.0 and update the v1/go.mod module directive from "go 1.24" to "go 1.25"
so both the build image and the v1 module match the root go.mod's go 1.25.0
requirement.


require (
github.com/Masterminds/semver/v3 v3.4.0
github.com/blang/semver/v4 v4.0.0
github.com/distribution/distribution/v3 v3.0.0
github.com/distribution/reference v0.6.0
github.com/go-jose/go-jose/v4 v4.1.0 // indirect; OCPBUGS-51217 - CVE-2025-27144
github.com/go-jose/go-jose/v4 v4.1.3 // indirect; OCPBUGS-51217 - CVE-2025-27144
github.com/google/go-containerregistry v0.20.8-0.20260114192324-795787c558e1
github.com/google/uuid v1.6.0
github.com/microlib/simple v1.0.2
Expand All @@ -18,18 +18,18 @@ require (
github.com/otiai10/copy v1.14.1
github.com/sherine-k/catalog-filter v0.0.5
github.com/sirupsen/logrus v1.9.3
github.com/spf13/cobra v1.10.1
github.com/spf13/pflag v1.0.9
github.com/spf13/cobra v1.10.2
github.com/spf13/pflag v1.0.10
github.com/stretchr/testify v1.11.1
github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635
github.com/vbauerster/mpb/v8 v8.10.2
go.podman.io/common v0.65.0
go.podman.io/image/v5 v5.37.0
go.podman.io/storage v1.60.0
golang.org/x/crypto v0.41.0
golang.org/x/crypto v0.46.0
golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b // indirect
golang.org/x/sync v0.18.0 // indirect
golang.org/x/term v0.34.0
golang.org/x/sync v0.19.0 // indirect
golang.org/x/term v0.38.0
helm.sh/helm/v3 v3.18.6
k8s.io/api v0.33.4
k8s.io/apimachinery v0.33.4
Expand All @@ -44,6 +44,7 @@ require (
)

require (
cyphar.com/go-pathrs v0.2.1 // indirect
dario.cat/mergo v1.0.2 // indirect
github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
github.com/BurntSushi/toml v1.5.0 // indirect
Expand All @@ -55,7 +56,7 @@ require (
github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/bshuster-repo/logrus-logstash-hook v1.0.2 // indirect
github.com/cenkalti/backoff/v5 v5.0.2 // indirect
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect
github.com/chai2010/gettext-go v1.0.2 // indirect
github.com/containerd/containerd v1.7.29 // indirect
Expand All @@ -68,7 +69,7 @@ require (
github.com/containers/ocicrypt v1.2.1 // indirect
github.com/coreos/go-systemd/v22 v22.6.0 // indirect
github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 // indirect
github.com/cyphar/filepath-securejoin v0.4.1 // indirect
github.com/cyphar/filepath-securejoin v0.6.0 // indirect
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
github.com/docker/distribution v2.8.3+incompatible // indirect
Expand All @@ -86,7 +87,7 @@ require (
github.com/go-errors/errors v1.4.2 // indirect
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
github.com/go-git/go-billy/v5 v5.6.2 // indirect
github.com/go-git/go-git/v5 v5.16.2 // indirect
github.com/go-git/go-git/v5 v5.16.5 // indirect
github.com/go-logr/logr v1.4.3 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-openapi/jsonpointer v0.21.1 // indirect
Expand All @@ -105,7 +106,7 @@ require (
github.com/gorilla/mux v1.8.1 // indirect
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.0 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.4 // indirect
github.com/h2non/filetype v1.1.3 // indirect
github.com/h2non/go-is-svg v0.0.0-20160927212452-35e8c4b0612c // indirect
github.com/hashicorp/errwrap v1.1.0 // indirect
Expand All @@ -120,11 +121,11 @@ require (
github.com/json-iterator/go v1.1.12 // indirect
github.com/klauspost/compress v1.18.1 // indirect
github.com/klauspost/pgzip v1.2.6 // indirect
github.com/letsencrypt/boulder v0.0.0-20250624003606-5ddd5acf990d // indirect
github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
github.com/mailru/easyjson v0.9.0 // indirect
github.com/mattn/go-runewidth v0.0.16 // indirect
github.com/mattn/go-sqlite3 v1.14.32 // indirect
github.com/miekg/dns v1.1.61 // indirect
github.com/miekg/pkcs11 v1.1.1 // indirect
github.com/mistifyio/go-zfs/v3 v3.0.1 // indirect
github.com/mitchellh/copystructure v1.2.0 // indirect
Expand All @@ -143,17 +144,17 @@ require (
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
github.com/opencontainers/runtime-spec v1.2.1 // indirect
github.com/opencontainers/selinux v1.12.0 // indirect
github.com/opencontainers/selinux v1.13.0 // indirect
github.com/openshift/build-machinery-go v0.0.0-20250414185254-3ce8e800ceda // indirect
github.com/operator-framework/api v0.32.0 // indirect
github.com/otiai10/mint v1.6.3 // indirect
github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
github.com/pkg/errors v0.9.1 // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/proglottis/gpgme v0.1.5 // indirect
github.com/prometheus/client_golang v1.22.0 // indirect
github.com/prometheus/client_golang v1.23.2 // indirect
github.com/prometheus/client_model v0.6.2 // indirect
github.com/prometheus/common v0.65.0 // indirect
github.com/prometheus/common v0.67.5 // indirect
github.com/prometheus/procfs v0.16.1 // indirect
github.com/redis/go-redis/extra/rediscmd/v9 v9.10.0 // indirect
github.com/redis/go-redis/extra/redisotel/v9 v9.10.0 // indirect
Expand All @@ -163,54 +164,54 @@ require (
github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
github.com/secure-systems-lab/go-securesystemslib v0.9.1 // indirect
github.com/shopspring/decimal v1.4.0 // indirect
github.com/sigstore/fulcio v1.6.6 // indirect
github.com/sigstore/protobuf-specs v0.4.3 // indirect
github.com/sigstore/sigstore v1.9.5 // indirect
github.com/sigstore/fulcio v1.8.5 // indirect
github.com/sigstore/protobuf-specs v0.5.0 // indirect
github.com/sigstore/sigstore v1.10.3 // indirect
github.com/smallstep/pkcs7 v0.2.1 // indirect
github.com/spf13/cast v1.7.1 // indirect
github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6 // indirect
github.com/stretchr/objx v0.5.2 // indirect
github.com/sylabs/sif/v2 v2.21.1 // indirect
github.com/tchap/go-patricia/v2 v2.3.3 // indirect
github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
github.com/ulikunitz/xz v0.5.15 // indirect
github.com/vbatts/tar-split v0.12.2 // indirect
github.com/x448/float16 v0.8.4 // indirect
github.com/xlab/treeprint v1.2.0 // indirect
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/contrib/bridges/prometheus v0.61.0 // indirect
go.opentelemetry.io/contrib/exporters/autoexport v0.61.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
go.opentelemetry.io/otel v1.36.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect
go.opentelemetry.io/otel v1.38.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.12.2 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.12.2 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.36.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.36.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.36.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.36.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.36.0 // indirect
go.opentelemetry.io/otel/exporters/prometheus v0.58.0 // indirect
go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.12.2 // indirect
go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.36.0 // indirect
go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.36.0 // indirect
go.opentelemetry.io/otel/log v0.12.2 // indirect
go.opentelemetry.io/otel/metric v1.36.0 // indirect
go.opentelemetry.io/otel/sdk v1.36.0 // indirect
go.opentelemetry.io/otel/metric v1.38.0 // indirect
go.opentelemetry.io/otel/sdk v1.38.0 // indirect
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Mar 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
python - <<'PY'
import json, urllib.request

query = {
  "package": {"ecosystem": "Go", "name": "go.opentelemetry.io/otel/sdk"},
  "version": "1.38.0"
}

req = urllib.request.Request(
  "https://api.osv.dev/v1/query",
  data=json.dumps(query).encode(),
  headers={"Content-Type": "application/json"},
  method="POST",
)

try:
    with urllib.request.urlopen(req) as r:
        data = json.load(r)
    print(json.dumps(data, indent=2))
except Exception as e:
    print(f"Error: {e}")
PY

Repository: openshift/oc-mirror

Length of output: 197

🏁 Script executed:

git ls-files | grep -E 'go\.mod$'

Repository: openshift/oc-mirror

Length of output: 174

🌐 Web query:

go.opentelemetry.io/otel/sdk v1.38.0 vulnerability PATH-hijacking RCE

💡 Result:

go.opentelemetry.io/otel/sdk v1.38.0 is affected by CVE-2026-24051 / GHSA-9h8m-3fm2-qjrq (Arbitrary Code Execution via local PATH hijacking) on macOS/Darwin. The issue is in sdk/resource/host_id.go (the WithHostID detector): it executes ioreg by name (searching PATH), so a local attacker who can influence PATH can cause execution of a malicious ioreg binary and get code execution in the app’s context. [1][2][3]

Fix: upgrade to v1.40.0+, which changes the call to use the absolute path /usr/sbin/ioreg. [1][2]
Example: go get go.opentelemetry.io/otel/sdk@v1.40.0 (and/or .../sdk/resource@v1.40.0). [1][3]

Scope note: this is local exploitation (depends on attacker control of environment/PATH), and only impacts macOS/Darwin. [1][3]

Sources: [1] GitHub Security Advisory GHSA-9h8m-3fm2-qjrq, [2] fix commit d45961b, [3] Snyk entry for CVE-2026-24051.

🌐 Web query:

go.opentelemetry.io/otel/sdk security advisory 2024 2025

💡 Result:

For go.opentelemetry.io/otel/sdk (OpenTelemetry-Go SDK), there were no published GitHub Security Advisories in 2024 or 2025. The repo’s advisories list shows a single published advisory, dated February 2, 2026 (GHSA-9h8m-3fm2-qjrq). [1]

The first published advisory (not 2024/2025, but relevant to the module) is:

Related but not a code vulnerability in the SDK: OpenTelemetry documented a Sep 25, 2025 incident where the go.opentelemetry.io SSL certificate expired, temporarily preventing downloads from that module domain. [3]

Sources: [1] [2] [3]

🏁 Script executed:

sed -n '195,201p' go.mod

Repository: openshift/oc-mirror

Length of output: 453

Upgrade go.opentelemetry.io/otel/sdk from v1.38.0 to v1.40.0 or later to fix CVE-2026-24051.

go.opentelemetry.io/otel/sdk v1.38.0 is affected by CVE-2026-24051 (GHSA-9h8m-3fm2-qjrq), a local arbitrary code execution vulnerability via PATH hijacking on macOS. The WithHostID detector executes ioreg by name instead of the absolute path, allowing local attackers to hijack the binary via PATH manipulation. Fixed in v1.40.0, which uses the absolute path /usr/sbin/ioreg.

🧰 Tools
🪛 OSV Scanner (2.3.3)

[HIGH] 198-198: go.opentelemetry.io/otel/sdk 1.38.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking in go.opentelemetry.io/otel/sdk

(GO-2026-4394)

[HIGH] 198-198: go.opentelemetry.io/otel/sdk 1.38.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking

(GHSA-9h8m-3fm2-qjrq)

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@go.mod` at line 198, Update the dependency go.opentelemetry.io/otel/sdk to
v1.40.0 or later in go.mod to address CVE-2026-24051: change the module version
for go.opentelemetry.io/otel/sdk to at least v1.40.0 (for example by running a
module upgrade such as go get go.opentelemetry.io/otel/sdk@v1.40.0), then run go
mod tidy and re-run tests/build to ensure the new version resolves correctly;
verify no other modules pin the older v1.38.0 version.

go.opentelemetry.io/otel/sdk/log v0.12.2 // indirect
go.opentelemetry.io/otel/sdk/metric v1.36.0 // indirect
go.opentelemetry.io/otel/trace v1.36.0 // indirect
go.opentelemetry.io/proto/otlp v1.7.0 // indirect
go.yaml.in/yaml/v2 v2.4.2 // indirect
go.opentelemetry.io/otel/sdk/metric v1.38.0 // indirect
go.opentelemetry.io/otel/trace v1.38.0 // indirect
go.opentelemetry.io/proto/otlp v1.7.1 // indirect
go.yaml.in/yaml/v2 v2.4.3 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect
golang.org/x/net v0.43.0 // indirect
golang.org/x/oauth2 v0.33.0 // indirect
golang.org/x/sys v0.38.0 // indirect
golang.org/x/text v0.28.0 // indirect
golang.org/x/time v0.12.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect
google.golang.org/grpc v1.73.0 // indirect
google.golang.org/protobuf v1.36.8 // indirect
golang.org/x/net v0.48.0 // indirect
golang.org/x/oauth2 v0.34.0 // indirect
golang.org/x/sys v0.39.0 // indirect
golang.org/x/text v0.32.0 // indirect
golang.org/x/time v0.14.0 // indirect
golang.org/x/tools v0.40.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20251222181119-0a764e51fe1b // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b // indirect
google.golang.org/grpc v1.78.0 // indirect
google.golang.org/protobuf v1.36.11 // indirect
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/warnings.v0 v0.1.2 // indirect
Expand All @@ -221,7 +222,7 @@ require (
k8s.io/component-base v0.33.4 // indirect
k8s.io/klog/v2 v2.130.1 // indirect
k8s.io/kube-openapi v0.0.0-20250610211856-8b98d1ed966a // indirect
k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect
k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d // indirect
oras.land/oras-go/v2 v2.6.0 // indirect
sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
sigs.k8s.io/kustomize/api v0.19.0 // indirect
Expand Down
Loading