OCM-00000 | ci: Update module golang.org/x/text to v0.38.0#3291
Open
red-hat-konflux[bot] wants to merge 1 commit into
Open
OCM-00000 | ci: Update module golang.org/x/text to v0.38.0#3291red-hat-konflux[bot] wants to merge 1 commit into
red-hat-konflux[bot] wants to merge 1 commit into
Conversation
red-hat-konflux
Bot
added
the
ok-to-test
📝 WalkthroughWalkthroughgo.mod updates several golang.org/x dependency versions in two require blocks. golang.org/x/oauth2 remains unchanged. 🚥 Pre-merge checks | ✅ 14 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (14 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Contributor
|
Hi @red-hat-konflux[bot]. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Around line 120-121: Update the golang.org/x/* dependency pins in go.mod so
they are at or above the first fixed releases; specifically raise
golang.org/x/crypto from v0.51.0 to v0.52.0+ and golang.org/x/net from v0.54.0
to v0.55.0+, keeping the existing indirect marker if applicable. Use the go.mod
dependency entries for these modules to locate and adjust the versions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: a7c85073-39e5-4ab6-b688-38ab00e82f7f
⛔ Files ignored due to path filters (109)
go.sumis excluded by!**/*.sumvendor/golang.org/x/crypto/ssh/cipher.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/ssh/client_auth.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/html/iter.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/html/node.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/html/nodetype_string.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/README.mdis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/client_conn_pool.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/client_priority_go126.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/client_priority_go127.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/clientconn.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/config.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/frame.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/h2c/h2c.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/http2.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/server.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/server_common.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/server_wrap.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/transport.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/transport_common.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/transport_wrap.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/writesched.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/writesched_common.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/writesched_priority_rfc7540.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/writesched_priority_rfc9218.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/writesched_random.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/writesched_roundrobin.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/idna/go118.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/idna/idna.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/idna/idna9.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/idna/pre_go118.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/idna/punycode.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/idna/tables10.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/idna/tables11.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/idna/tables12.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/idna/tables13.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/idna/tables15.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/idna/tables17.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/idna/tables9.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/idna/trie12.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/idna/trie13.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/internal/httpcommon/request.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/internal/httpsfv/httpsfv.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/asm_darwin_arm64_gc.sis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_darwin_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_darwin_arm64_other.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_gccgo_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_other_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_windows.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_windows_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_x86.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/syscall_darwin_arm64_gc.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/zcpu_windows.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/plan9/syscall_plan9.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/affinity_linux.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ioctl_signed.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ioctl_unsigned.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/mkall.shis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/syscall_linux.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/syscall_linux_arm.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/syscall_linux_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/syscall_linux_loong64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/syscall_linux_riscv64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/syscall_solaris.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/syscall_unix.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsyscall_linux.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/windows/aliases.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/windows/dll_windows.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/windows/security_windows.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/windows/syscall_windows.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/windows/types_windows.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/windows/zsyscall_windows.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/term/terminal.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/cases/tables10.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/cases/tables11.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/cases/tables12.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/cases/tables15.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/cases/tables17.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/cases/tables9.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/secure/bidirule/bidirule.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/secure/bidirule/bidirule10.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/secure/bidirule/bidirule9.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/unicode/bidi/tables10.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/unicode/bidi/tables11.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/unicode/bidi/tables12.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/unicode/bidi/tables13.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/unicode/bidi/tables15.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/unicode/bidi/tables17.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/unicode/bidi/tables9.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/unicode/norm/forminfo.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/unicode/norm/tables10.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/unicode/norm/tables11.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/unicode/norm/tables12.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/unicode/norm/tables15.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/unicode/norm/tables17.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/unicode/norm/tables9.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/width/tables10.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/width/tables11.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/width/tables12.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/width/tables15.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/width/tables17.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/width/tables9.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/tools/go/ast/edge/edge.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/tools/go/ast/inspector/cursor.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/tools/go/ast/inspector/inspector.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/tools/go/ast/inspector/iter.gois excluded by!vendor/**,!**/vendor/**vendor/modules.txtis excluded by!vendor/**,!**/vendor/**
📒 Files selected for processing (1)
go.mod
Comment on lines
+120
to
+121
| golang.org/x/crypto v0.51.0 | ||
| golang.org/x/net v0.54.0 // indirect |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n --type=go 'golang.org/x/(crypto/ssh|net/html)' . || trueRepository: openshift/rosa
Length of output: 2395
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- go.mod require lines ---'
sed -n '110,130p' go.mod
echo
echo '--- repo imports outside vendor ---'
rg -n --glob '!vendor/**' --type=go 'golang.org/x/(crypto/ssh|net/html|crypto/bcrypt|text/cases)' .
echo
echo '--- modules.txt mentions ---'
rg -n '^golang\.org/x/(crypto|net|text) ' vendor/modules.txt || trueRepository: openshift/rosa
Length of output: 1341
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- go.mod require lines ---'
sed -n '110,130p' go.mod
echo
echo '--- repo imports outside vendor ---'
rg -n --glob '!vendor/**' --type=go 'golang.org/x/(crypto/ssh|net/html|crypto/bcrypt|text/cases)' .
echo
echo '--- modules.txt mentions ---'
rg -n '^golang\.org/x/(crypto|net|text) ' vendor/modules.txt || trueRepository: openshift/rosa
Length of output: 1341
Bump the golang.org/x/* pins past the fixed releases
golang.org/x/crypto v0.51.0 and golang.org/x/net v0.54.0 are still below the first fixed releases (v0.52.0 and v0.55.0). This repo pulls in golang.org/x/crypto/bcrypt, and vendored dependencies use golang.org/x/crypto/ssh and golang.org/x/net/html, so these pins should be raised.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` around lines 120 - 121, Update the golang.org/x/* dependency pins in
go.mod so they are at or above the first fixed releases; specifically raise
golang.org/x/crypto from v0.51.0 to v0.52.0+ and golang.org/x/net from v0.54.0
to v0.55.0+, keeping the existing indirect marker if applicable. Use the go.mod
dependency entries for these modules to locate and adjust the versions.
Source: Path instructions
Contributor
|
@red-hat-konflux[bot]: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #3291 +/- ##
=======================================
Coverage 26.17% 26.17%
=======================================
Files 334 334
Lines 36704 36704
=======================================
Hits 9608 9608
Misses 26359 26359
Partials 737 737 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/master/golang.org-x-text-0.x
branch
from
1bdeebf to
fd2c3a2
Compare
Contributor
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
There was a problem hiding this comment.
♻️ Duplicate comments (1)
go.mod (1)
124-125: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winKeep the
x/cryptoandx/netpins above the fixed releases.These pins still match the earlier security finding; OSV lists fixes at
v0.52.0forgolang.org/x/cryptoandv0.55.0forgolang.org/x/net, so the gap remains open. (test.osv.dev)🔍 Verification
#!/bin/bash set -euo pipefail grep -nE 'golang.org/x/(crypto|net)' go.mod🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` around lines 124 - 125, The dependency pins for golang.org/x/crypto and golang.org/x/net are still below the fixed releases, so update the versions in go.mod to at least the patched levels noted in the review. Keep the existing module entries for these two dependencies, but bump x/crypto to a release at or above v0.52.0 and x/net to a release at or above v0.55.0 so the security gap is closed.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@go.mod`:
- Around line 124-125: The dependency pins for golang.org/x/crypto and
golang.org/x/net are still below the fixed releases, so update the versions in
go.mod to at least the patched levels noted in the review. Keep the existing
module entries for these two dependencies, but bump x/crypto to a release at or
above v0.52.0 and x/net to a release at or above v0.55.0 so the security gap is
closed.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 2ead268c-e522-4f78-9277-7f1bcf98a5b3
⛔ Files ignored due to path filters (9)
go.sumis excluded by!**/*.sumvendor/golang.org/x/crypto/ssh/cipher.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/ssh/client_auth.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/html/iter.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/html/node.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/html/nodetype_string.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/README.mdis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/client_conn_pool.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/client_priority_go126.gois excluded by!vendor/**,!**/vendor/**
📒 Files selected for processing (1)
go.mod
Contributor
|
/approve |
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: amandahla, red-hat-konflux[bot] The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
Contributor
|
/rebase |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.32.0→v0.38.0Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.