OCPBUGS-101695: bump golang.org/x/net to v0.56.0 - #10749
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
jira/severity-moderate
|
@sunku5494: This pull request references Jira Issue OCPBUGS-101664, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira (ocp-sustaining-admins@redhat.com), skipping review request. The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
📝 WalkthroughWalkthroughThe pull request updates the indirect ChangesDependency update
Estimated code review effort: 1 (Trivial) | ~2 minutes 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
@sunku5494: This pull request references Jira Issue OCPBUGS-101664, which is valid. 3 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira (ocp-sustaining-admins@redhat.com), skipping review request. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (2)
go.mod (2)
333-333: 🔒 Security & Privacy | 🔵 TrivialConfirm the release supply-chain controls.
The exact dependency version and checksum metadata are present. The supplied change does not show SBOM generation, provenance attestations, or Sigstore/cosign signing for released artifacts. Confirm these controls in the release workflow before merging.
As per path instructions, production dependency updates require SBOM/provenance attestations and signed artifacts.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` at line 333, Confirm the release workflow includes SBOM generation, provenance attestations, and Sigstore/cosign signing for released artifacts associated with the golang.org/x/net dependency update. Add any missing controls before merging while preserving the pinned version and checksum metadata.Source: Path instructions
333-333: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winUpdate
golang.org/x/nettov0.57.0.
v0.57.0requires Go 1.25.0, and this repository uses Go 1.26.0. Run the documentedgo get,go mod tidy, andgo mod vendorworkflow, then commit vendored changes separately.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` at line 333, Update the golang.org/x/net dependency from v0.56.0 to v0.57.0 in the module dependency configuration, then run the documented go get, go mod tidy, and go mod vendor workflow using the repository’s Go 1.26.0 toolchain. Commit the resulting vendored changes separately.Source: MCP tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@go.mod`:
- Line 333: Confirm the release workflow includes SBOM generation, provenance
attestations, and Sigstore/cosign signing for released artifacts associated with
the golang.org/x/net dependency update. Add any missing controls before merging
while preserving the pinned version and checksum metadata.
- Line 333: Update the golang.org/x/net dependency from v0.56.0 to v0.57.0 in
the module dependency configuration, then run the documented go get, go mod
tidy, and go mod vendor workflow using the repository’s Go 1.26.0 toolchain.
Commit the resulting vendored changes separately.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 24207640-eb09-4eb6-bb26-21c15553b421
⛔ Files ignored due to path filters (9)
go.sumis excluded by!**/*.sumvendor/golang.org/x/net/html/entity.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/html/escape.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/html/foreign.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/html/parse.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/html/token.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/server_wrap.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/transport_wrap.gois excluded by!vendor/**,!**/vendor/**vendor/modules.txtis excluded by!vendor/**,!**/vendor/**
📒 Files selected for processing (1)
go.mod
Signed-off-by: Venkata Charan Sunku <vsunku@redhat.com>
fc411b1 to
72c0a9b
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
sunku5494
changed the title
|
@sunku5494: This pull request references Jira Issue OCPBUGS-101695, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira (ocp-sustaining-admins@redhat.com), skipping review request. The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@sunku5494: This pull request references Jira Issue OCPBUGS-101695, which is valid. 3 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira (ocp-sustaining-admins@redhat.com), skipping review request. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Scheduling tests matching the |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: tthvo The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
/verified by CI |
openshift-ci-robot
added
the
verified
|
@sunku5494: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@sunku5494: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
@sunku5494: Jira Issue Verification Checks: Jira Issue OCPBUGS-101695 Jira Issue OCPBUGS-101695 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Fix included in release 5.0.0-0.nightly-2026-08-09-185812 |
4 participants
Updates golang.org/x/net package to v0.56.0 to pull in recent security patches, specifically targeting CVE-2026-42502. While our codebase does not currently use any of the vulnerable symbols identified in the CVE, this update keeps
mainaligned with the latest secure package version as a proactive measure.Summary by CodeRabbit