SANDBOX-1357: update kube & openshift dependencies to 4.19 #491
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -30,6 +30,7 @@ linters: | |
| - testifylint | ||
| - unparam | ||
| - zerologlint | ||
| - copyloopvar | ||
| disable: | ||
| - contextcheck | ||
| - noctx | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,19 +1 @@ | ||
| ignored-vulnerabilities: [] |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -1,43 +1,43 @@ | ||||||
| module github.com/codeready-toolchain/toolchain-common | ||||||
|
|
||||||
| go 1.23.0 | ||||||
|
|
||||||
| toolchain go1.23.12 | ||||||
|
|
||||||
| require ( | ||||||
| github.com/go-logr/logr v1.4.2 | ||||||
| github.com/golang-jwt/jwt/v5 v5.2.2 | ||||||
| github.com/lestrrat-go/jwx v1.2.29 | ||||||
| github.com/magiconair/properties v1.8.5 | ||||||
| // using latest commit from 'github.com/openshift/api branch release-4.19' | ||||||
| github.com/openshift/api v0.0.0-20250903165707-ce7baf0afbc4 | ||||||
| // using latest commit from 'github.com/openshift/library-go branch release-4.19' | ||||||
| github.com/openshift/library-go v0.0.0-20250826065405-6d18d1191f49 | ||||||
| github.com/pkg/errors v0.9.1 | ||||||
| github.com/redhat-cop/operator-utils v1.3.8 | ||||||
| github.com/stretchr/testify v1.10.0 | ||||||
| gopkg.in/go-jose/go-jose.v2 v2.6.3 | ||||||
| gopkg.in/h2non/gock.v1 v1.0.14 | ||||||
| gotest.tools v2.2.0+incompatible | ||||||
| k8s.io/api v0.32.2 | ||||||
| k8s.io/apimachinery v0.32.2 | ||||||
| k8s.io/client-go v0.32.2 | ||||||
| sigs.k8s.io/controller-runtime v0.20.4 | ||||||
| ) | ||||||
coderabbitai[bot] marked this conversation as resolved.
Show resolved
Hide resolved
|
||||||
|
|
||||||
| require ( | ||||||
| github.com/codeready-toolchain/api v0.0.0-20250916082953-4ecb3a4645e6 | ||||||
| github.com/ghodss/yaml v1.0.0 | ||||||
| github.com/google/go-cmp v0.7.0 | ||||||
| github.com/google/go-github/v52 v52.0.0 | ||||||
| github.com/google/uuid v1.6.0 | ||||||
| github.com/migueleliasweb/go-github-mock v0.0.18 | ||||||
| github.com/prometheus/client_golang v1.19.1 | ||||||
| github.com/prometheus/client_model v0.6.1 | ||||||
| golang.org/x/oauth2 v0.23.0 | ||||||
|
There was a problem hiding this comment. 💡 Verification agent 🧩 Analysis chainSecurity: bump golang.org/x/oauth2 to >= v0.27.0 (CVE-2025-22868). v0.23.0 is vulnerable (GO-2025-3488 / GHSA-6v2p-p543-phr9). Fixed in v0.27.0. (pkg.go.dev, go.googlesource.com, osv.dev) - golang.org/x/oauth2 v0.23.0
+ golang.org/x/oauth2 v0.27.0If compatibility concerns exist, I can propose a minimal-changes bump plan. 🏁 Script executed: #!/bin/bash
grep -n "golang.org/x/oauth2" go.modLength of output: 68 Upgrade golang.org/x/oauth2 to v0.27.0 to remediate CVE-2025-22868 The project depends on v0.23.0, which is affected by GO-2025-3488 (CVE-2025-22868) and fixed in v0.27.0 – bump the module accordingly. (pkg.go.dev, advisories.gitlab.com) - golang.org/x/oauth2 v0.23.0
+ golang.org/x/oauth2 v0.27.0📝 Committable suggestion
Suggested change
🧰 Tools🪛 OSV Scanner (2.1.0)[HIGH] 37-37: golang.org/x/oauth2 0.23.0: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (GO-2025-3488) [HIGH] 37-37: golang.org/x/oauth2 0.23.0: golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability 🤖 Prompt for AI Agents |
||||||
| gopkg.in/yaml.v2 v2.4.0 | ||||||
| k8s.io/kubectl v0.32.2 | ||||||
| k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 | ||||||
| ) | ||||||
|
|
||||||
| require ( | ||||||
|
|
@@ -53,19 +53,19 @@ require ( | |||||
| github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect | ||||||
| github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 // indirect | ||||||
| github.com/emicklei/go-restful/v3 v3.11.0 // indirect | ||||||
| github.com/evanphx/json-patch/v5 v5.9.11 // indirect | ||||||
| github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f // indirect | ||||||
| github.com/fsnotify/fsnotify v1.7.0 // indirect | ||||||
| github.com/fxamacker/cbor/v2 v2.7.0 // indirect | ||||||
| github.com/go-errors/errors v1.4.2 // indirect | ||||||
| github.com/go-logr/zapr v1.3.0 // indirect | ||||||
| github.com/go-openapi/jsonpointer v0.21.0 // indirect | ||||||
| github.com/go-openapi/jsonreference v0.20.2 // indirect | ||||||
| github.com/go-openapi/swag v0.23.0 // indirect | ||||||
| github.com/goccy/go-json v0.10.2 // indirect | ||||||
| github.com/gogo/protobuf v1.3.2 // indirect | ||||||
| github.com/golang/protobuf v1.5.4 // indirect | ||||||
| github.com/google/btree v1.1.3 // indirect | ||||||
| github.com/google/gnostic-models v0.6.8 // indirect | ||||||
| github.com/google/go-querystring v1.1.0 // indirect | ||||||
| github.com/google/gofuzz v1.2.0 // indirect | ||||||
|
|
@@ -88,39 +88,37 @@ require ( | |||||
| github.com/modern-go/reflect2 v1.0.2 // indirect | ||||||
| github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect | ||||||
| github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect | ||||||
| github.com/onsi/ginkgo/v2 v2.22.1 // indirect | ||||||
| github.com/onsi/gomega v1.36.2 // indirect | ||||||
| github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect | ||||||
| github.com/prometheus/common v0.55.0 // indirect | ||||||
| github.com/prometheus/procfs v0.15.1 // indirect | ||||||
| github.com/shopspring/decimal v1.2.0 // indirect | ||||||
| github.com/spf13/cast v1.3.1 // indirect | ||||||
| github.com/spf13/pflag v1.0.6 // indirect | ||||||
| github.com/x448/float16 v0.8.4 // indirect | ||||||
| github.com/xlab/treeprint v1.2.0 // indirect | ||||||
| go.uber.org/multierr v1.11.0 // indirect | ||||||
| go.uber.org/zap v1.27.0 // indirect | ||||||
| golang.org/x/crypto v0.36.0 // indirect | ||||||
| golang.org/x/net v0.38.0 // indirect | ||||||
| golang.org/x/sync v0.12.0 // indirect | ||||||
| golang.org/x/sys v0.31.0 // indirect | ||||||
| golang.org/x/term v0.30.0 // indirect | ||||||
| golang.org/x/text v0.23.0 // indirect | ||||||
| golang.org/x/time v0.7.0 // indirect | ||||||
| gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect | ||||||
| google.golang.org/protobuf v1.36.1 // indirect | ||||||
| gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect | ||||||
| gopkg.in/inf.v0 v0.9.1 // indirect | ||||||
| gopkg.in/yaml.v3 v3.0.1 // indirect | ||||||
| k8s.io/apiextensions-apiserver v0.32.2 // indirect | ||||||
| k8s.io/cli-runtime v0.32.2 // indirect | ||||||
| k8s.io/klog/v2 v2.130.1 // indirect | ||||||
| k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f // indirect | ||||||
| sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect | ||||||
| sigs.k8s.io/kustomize/api v0.18.0 // indirect | ||||||
| sigs.k8s.io/kustomize/kyaml v0.18.1 // indirect | ||||||
| sigs.k8s.io/structured-merge-diff/v4 v4.4.2 // indirect | ||||||
| sigs.k8s.io/yaml v1.4.0 // indirect | ||||||
| ) | ||||||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Fix invalid
godirective format.go.modonly accepts major.minor (e.g.,go 1.23). Using1.23.0will error.📝 Committable suggestion
🤖 Prompt for AI Agents