[release-4.15] OCPBUGS-79889: Bump google.golang.org/grpc to v1.79.3#531
Open
ocp-sustaining-admins wants to merge 1 commit into
Open
Conversation
openshift-ci-robot
added
jira/severity-important
Contributor
|
@ocp-sustaining-admins: This pull request references Jira Issue OCPBUGS-79889, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
added
the
needs-ok-to-test
Contributor
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: ocp-sustaining-admins The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
Contributor
|
Hi @ocp-sustaining-admins. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Tip We noticed you've done this a few times! Consider joining the org to skip this step and gain Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
WalkthroughUpdates Go module dependencies in ChangesDependency Version Bumps and Fork Redirect
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 11 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (11 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Member
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Around line 118-121: Update the vulnerable indirect module pins in go.mod for
golang.org/x/crypto and golang.org/x/oauth2 to patched releases: replace the
current versions for the symbols golang.org/x/crypto and golang.org/x/oauth2
with the latest security-patched tags, run go get <module>@<patched-version> and
go mod tidy to update go.sum, then run your test suite and static analyses; if
you cannot upgrade, add a documented suppression with reachability evidence and
justification referencing those exact module symbols.
- Line 127: The go.mod currently uses a replace directive pointing to
github.com/openshift-sustaining/grpc-go v1.64.1-sec.1 (a fork based on v1.64.1)
while the PR title claims v1.79.3; inspect the replace entry in go.mod and
verify whether that fork backports the CVE-2026-33186 fix from upstream
v1.79.3—if it does, update the PR title/description to state the actual forked
version and include proof (commit hash or changelog); if it does not, either
switch the dependency to upstream google.golang.org/grpc v1.79.3 or vendor a
proper patched fork that contains the fix, then update the go.mod
replace/directive and PR metadata accordingly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: d98d2c9a-52cd-47e7-b38b-b2dd85296bc3
⛔ Files ignored due to path filters (261)
go.sumis excluded by!**/*.sumvendor/github.com/go-logr/logr/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/context.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/context_noslog.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/context_slog.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/logr.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/sloghandler.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/slogr.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/slogsink.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/golang/protobuf/jsonpb/decode.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/golang/protobuf/jsonpb/encode.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/golang/protobuf/jsonpb/json.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/golang/protobuf/ptypes/any.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/uuid/CHANGELOG.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/uuid/hash.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/uuid/time.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/uuid/uuid.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/uuid/version6.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/uuid/version7.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/chacha20/chacha_ppc64le.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/internal/poly1305/sum_ppc64le.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/ocsp/ocsp.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/sha3/hashes.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/sha3/hashes_generic.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/sha3/hashes_noasm.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/sha3/sha3.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/sha3/sha3_s390x.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/sha3/shake.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/sha3/shake_generic.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/sha3/shake_noasm.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/sha3/xor.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/sha3/xor_generic.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/sha3/xor_unaligned.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/ssh/client_auth.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/ssh/keys.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/ssh/server.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/mod/modfile/read.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/mod/modfile/rule.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http/httpguts/httplex.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/frame.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/http2.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/pipe.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/server.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/timer.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/transport.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/writesched_priority.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/proxy/per_host.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sync/errgroup/errgroup.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sync/semaphore/semaphore.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_arm64.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_gc_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_linux_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/execabs/execabs.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/execabs/execabs_go118.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/execabs/execabs_go119.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/aliases.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/asm_zos_s390x.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/bpxsvc_zos.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/bpxsvc_zos.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/epoll_zos.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/fstatfs_zos.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/mkerrors.shis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/mmap_nomremap.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/pagesize_unix.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/readdirent_getdirentries.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/sockcmsg_zos.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/symaddr_zos_s390x.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/syscall_darwin_libSystem.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/syscall_freebsd.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/syscall_linux.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/syscall_zos_s390x.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/sysvshm_unix.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/sysvshm_unix_other.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_386.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_zos_s390x.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsymaddr_zos_s390x.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_linux.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_zos_s390x.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_386.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_arm.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_loong64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_mips.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_mips64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_mips64le.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_mipsle.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_ppc.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64le.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_riscv64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_s390x.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_sparc64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_zos_s390x.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_386.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_arm.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_loong64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_mips.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_mips64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_ppc.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_s390x.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_zos_s390x.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/aliases.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/empty.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/security_windows.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/syscall_windows.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/types_windows.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/zsyscall_windows.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/time/rate/rate.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/go/gcexportdata/gcexportdata.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/go/internal/packagesdriver/sizes.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/go/packages/doc.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/go/packages/external.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/go/packages/golist.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/go/packages/golist_overlay.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/go/packages/packages.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/go/types/objectpath/objectpath.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/aliases/aliases.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/aliases/aliases_go121.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/aliases/aliases_go122.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/event/keys/util.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/event/tag/tag.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/gcimporter/gcimporter.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/gcimporter/iexport.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/gcimporter/iimport.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/gcimporter/support_go117.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/gcimporter/support_go118.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/gcimporter/unified_no.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/gcimporter/unified_yes.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/gcimporter/ureader_no.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/gcimporter/ureader_yes.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/gocommand/invoke.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/gocommand/vendor.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/packagesinternal/packages.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/pkgbits/decoder.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/stdlib/manifest.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/stdlib/stdlib.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/tokeninternal/tokeninternal.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/typeparams/common.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/typeparams/coretype.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/typeparams/enabled_go117.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/typeparams/enabled_go118.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/typeparams/normalize.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/typeparams/termlist.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/typeparams/typeparams_go117.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/typeparams/typeparams_go118.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/typeparams/typeterm.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/typesinternal/errorcode.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/typesinternal/objectpath.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/typesinternal/recv.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/typesinternal/toonew.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/typesinternal/types.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/typesinternal/types_118.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/versions/features.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/versions/gover.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/versions/toolchain.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/versions/toolchain_go119.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/versions/toolchain_go120.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/versions/toolchain_go121.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/versions/types.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/versions/types_go121.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/versions/types_go122.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/versions/versions.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/CONTRIBUTING.mdis excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/MAINTAINERS.mdis excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/Makefileis excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/README.mdis excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/attributes/attributes.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/balancer/balancer.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/balancer_conn_wrappers.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/balancer_wrapper.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/binarylog/grpc_binarylog_v1/binarylog.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/clientconn.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/codegen.shis excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/codes/codes.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/credentials/credentials.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/credentials/tls.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/dialoptions.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/encoding/encoding.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/encoding/proto/proto.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/backoff/backoff.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/config.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/gracefulswitch.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/binarylog/method_logger.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/binarylog/sink.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/buffer/unbounded.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/channelz/channel.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/channelz/channelmap.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/channelz/funcs.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/channelz/id.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/channelz/logging.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/channelz/server.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/channelz/socket.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/channelz/subchannel.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/channelz/syscall_linux.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/channelz/syscall_nonlinux.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/channelz/trace.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/channelz/types.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/envconfig/envconfig.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/envconfig/xds.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/experimental.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/grpcrand/grpcrand.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/grpcrand/grpcrand_go1.21.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/grpcsync/callback_serializer.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/grpcutil/compressor.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/idle/idle.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/internal.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/pretty/pretty.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/resolver/dns/dns_resolver.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/resolver/dns/internal/internal.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/resolver/unix/unix.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/status/status.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/tcp_keepalive_others.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/tcp_keepalive_unix.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/tcp_keepalive_windows.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/controlbuf.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/handler_server.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/http2_client.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/http2_server.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/http_util.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/proxy.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/transport.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/xds_handshake_cluster.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/metadata/metadata.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/peer/peer.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/picker_wrapper.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/pickfirst.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/regenerate.shis excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/resolver/dns/dns_resolver.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/resolver/map.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/resolver/resolver.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/resolver_conn_wrapper.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/resolver_wrapper.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/rpc_util.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/server.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/service_config.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/stats/stats.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/stream.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/stream_interfaces.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/tap/tap.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/trace.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/trace_notrace.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/trace_withtrace.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/version.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/vet.shis excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/protobuf/protoadapt/convert.gois excluded by!**/vendor/**,!vendor/**vendor/modules.txtis excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (1)
go.mod
Comment on lines
+118
to
+121
| golang.org/x/crypto v0.24.0 // indirect | ||
| golang.org/x/mod v0.17.0 // indirect | ||
| golang.org/x/net v0.26.0 // indirect | ||
| golang.org/x/oauth2 v0.18.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify currently pinned versions in go.mod and query OSV for known vulns.
set -euo pipefail
echo "Pinned versions:"
rg -n '^\s*golang\.org/x/crypto\s+|^\s*golang\.org/x/oauth2\s+' go.mod
echo
echo "OSV query: golang.org/x/[email protected]"
curl -s https://api.osv.dev/v1/query -H 'Content-Type: application/json' \
-d '{"package":{"ecosystem":"Go","name":"golang.org/x/crypto"},"version":"v0.24.0"}' | jq '.vulns[]?.id'
echo
echo "OSV query: golang.org/x/[email protected]"
curl -s https://api.osv.dev/v1/query -H 'Content-Type: application/json' \
-d '{"package":{"ecosystem":"Go","name":"golang.org/x/oauth2"},"version":"v0.18.0"}' | jq '.vulns[]?.id'Repository: openshift/builder
Length of output: 448
Bump vulnerable dependencies to patched versions before merge.
Lines 118 and 121 pin versions with known security advisories:
golang.org/x/crypto v0.24.0has 9 known vulnerabilities (GHSA-f6x5-jh6r-wrfv, GHSA-hcg3-q754-cr77, GHSA-j5w8-q4qc-rx2x, GHSA-v778-237x-gjrc, and others)golang.org/x/oauth2 v0.18.0has 2 known vulnerabilities (GHSA-6v2p-p543-phr9, GO-2025-3488)
Update to patched releases or document a justified suppression with reachability evidence.
🧰 Tools
🪛 OSV Scanner (2.3.8)
[CRITICAL] 118-118: golang.org/x/crypto 0.24.0: Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
(GO-2024-3321)
[CRITICAL] 118-118: golang.org/x/crypto 0.24.0: Potential denial of service in golang.org/x/crypto
(GO-2025-3487)
[CRITICAL] 118-118: golang.org/x/crypto 0.24.0: Potential denial of service in golang.org/x/crypto/ssh/agent
(GO-2025-4116)
[CRITICAL] 118-118: golang.org/x/crypto 0.24.0: Unbounded memory consumption in golang.org/x/crypto/ssh
(GO-2025-4134)
[CRITICAL] 118-118: golang.org/x/crypto 0.24.0: Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent
(GO-2025-4135)
[CRITICAL] 118-118: golang.org/x/crypto 0.24.0: golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read
[CRITICAL] 118-118: golang.org/x/crypto 0.24.0: golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange
[CRITICAL] 118-118: golang.org/x/crypto 0.24.0: golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption
[CRITICAL] 118-118: golang.org/x/crypto 0.24.0: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
[HIGH] 121-121: golang.org/x/oauth2 0.18.0: Unexpected memory consumption during token parsing in golang.org/x/oauth2
(GO-2025-3488)
[HIGH] 121-121: golang.org/x/oauth2 0.18.0: golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` around lines 118 - 121, Update the vulnerable indirect module pins in
go.mod for golang.org/x/crypto and golang.org/x/oauth2 to patched releases:
replace the current versions for the symbols golang.org/x/crypto and
golang.org/x/oauth2 with the latest security-patched tags, run go get
<module>@<patched-version> and go mod tidy to update go.sum, then run your test
suite and static analyses; if you cannot upgrade, add a documented suppression
with reachability evidence and justification referencing those exact module
symbols.
| golang.org/x/time v0.5.0 // indirect | ||
| google.golang.org/appengine v1.6.8 // indirect | ||
| google.golang.org/grpc v1.58.3 // indirect | ||
| google.golang.org/grpc v1.62.1 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Show grpc require+replace entries proving effective dependency mapping.
set -euo pipefail
rg -n 'google\.golang\.org/grpc|openshift-sustaining/grpc-go' go.modRepository: openshift/builder
Length of output: 201
🌐 Web query:
Does github.com/openshift-sustaining/grpc-go tag v1.64.1-sec.1 include the fix for CVE-2026-33186, and what upstream grpc-go base version does it map to?
💡 Result:
No definitive evidence was found that the tag github.com/openshift-sustaining/grpc-go v1.64.1-sec.1 includes the specific fix for CVE-2026-33186, nor what upstream google.golang.org/grpc version that tag maps to. What the sources do show: CVE-2026-33186 is fixed in google.golang.org/grpc v1.79.3 [1][2]. Multiple OpenShift Sustaining changes that remediate the CVE do so by bumping google.golang.org/grpc to v1.79.3 [3][4]. However, none of the retrieved sources contains information mapping the specific OpenShift Sustaining fork/tag v1.64.1-sec.1 to an upstream grpc-go base version, or confirms that that particular tag contains the CVE-2026-33186 patch.
Citations:
- 1: https://www.suse.com/security/cve/CVE-2026-33186.html
- 2: https://nvd.nist.gov/vuln/detail/CVE-2026-33186
- 3: OCPBUGS-80847,OCPBUGS-80848,OCPBUGS-80849: Bump google.golang.org/grpc to v1.79.3 for CVE-2026-33186[Release-4.21] operator-framework-olm#1289
- 4: OCPBUGS-81554: CVE-2026-33186 - bump google.golang.org/grpc to v1.79.3 cluster-monitoring-operator#2872
🏁 Script executed:
# Check if there's any documentation or reference in the repository about this fork
rg -n 'v1\.64\.1-sec|openshift-sustaining|CVE-2026-33186' --type-list | head -5
rg -n 'v1\.64\.1-sec|openshift-sustaining|CVE-2026-33186' -iRepository: openshift/builder
Length of output: 1022
🌐 Web query:
What is the github.com/openshift-sustaining/grpc-go v1.64.1-sec.1 fork and what upstream gRPC version does it patch?
💡 Result:
The repository github.com/openshift-sustaining/grpc-go (example tag v1.64.1-sec.1) is an OpenShift Sustaining-Team fork of the upstream gRPC Go implementation, used to carry security/patch changes while OpenShift is not yet ready to move to the corresponding upstream gRPC release train. However, in the sources I found, I could not locate a definitive upstream-version mapping specifically for tag v1.64.1-sec.1. What I can say with source-backed evidence: - OpenShift has used the openshift-sustaining/grpc-go fork in place of google.golang.org/grpc for CVE-related fixes (example PRs) [1]. - OpenShift PRs that reference “openshift-sustaining/grpc-go … sec” show the fork is used to avoid bumping to a newer upstream version immediately (example: “Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go … to avoid go version bump and fix CVE-2026-33186”) [1]. But the specific question you asked—“what upstream gRPC version does v1.64.1-sec.1 patch?”—requires a direct statement from the fork (tag release notes/README/changelog) or from a PR that explicitly states the upstream base version. The sources I retrieved did not include such a statement for v1.64.1-sec.1. If you want, I can do another targeted search specifically for the tag/release notes for v1.64.1-sec.1 inside openshift-sustaining/grpc-go, or look for an OpenShift PR that mentions exactly “v1.64.1-sec.1” and names the upstream base version.
Citations:
🌐 Web query:
OpenShift sustaining grpc-go v1.64.1-sec.1 CVE-2026-33186 security patch details
💡 Result:
CVE-2026-33186 is a critical authorization bypass vulnerability (CVSS 9.1) in google.golang.org/grpc versions prior to 1.79.3, caused by improper validation of the HTTP/2:path pseudo-header lacking a leading slash (e.g., "Service/Method" instead of "/Service/Method"). This allows bypassing path-based authorization interceptors like grpc/authz when deny rules use canonical paths and a fallback allow exists[1][2]. The official fix rejects non-slash paths with codes.Unimplemented[1].
Citations:
- 1: https://nvd.nist.gov/vuln/detail/CVE-2026-33186
- 2: security: CVE-2026-33186 — google.golang.org/grpc Authorization Bypass (CVSS 9.1 Critical) DataDog/datadog-agent#48151
Version mismatch: PR title claims v1.79.3, but go.mod deploys v1.64.1-sec.1 fork.
The replace directive (line 240) points to github.com/openshift-sustaining/grpc-go v1.64.1-sec.1, a patched fork apparently based on upstream v1.64.1 (not v1.79.3 where CVE-2026-33186 is officially fixed). Confirm that this fork includes the intended security fix and update PR metadata to reflect the actual shipped version lineage.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 127, The go.mod currently uses a replace directive pointing
to github.com/openshift-sustaining/grpc-go v1.64.1-sec.1 (a fork based on
v1.64.1) while the PR title claims v1.79.3; inspect the replace entry in go.mod
and verify whether that fork backports the CVE-2026-33186 fix from upstream
v1.79.3—if it does, update the PR title/description to state the actual forked
version and include proof (commit hash or changelog); if it does not, either
switch the dependency to upstream google.golang.org/grpc v1.79.3 or vendor a
proper patched fork that contains the fix, then update the go.mod
replace/directive and PR metadata accordingly.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is an automated PR from the ARC system.
Go version used:
go1.20.14Patch applied:
github.com/openshift-sustaining/[email protected]Modules affected:
.The commands used to generate this PR were:
A member of the Red Hat Openshift Sustaining Team will review the PR and take appropriate action.
Summary by CodeRabbit