OCPBUGS-85649: bump gRPC-Go package#16442
Conversation
openshift-ci-robot
added
jira/severity-important
|
@jhadvig: This pull request references Jira Issue OCPBUGS-83940, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
added
the
jira/invalid-bug
openshift-ci
Bot
added
the
approved
📝 WalkthroughWalkthroughThis pull request updates the 🚥 Pre-merge checks | ✅ 11 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (11 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Around line 189-191: Update the OpenTelemetry module versions in go.mod for
go.opentelemetry.io/otel, go.opentelemetry.io/otel/metric, and
go.opentelemetry.io/otel/trace from v1.39.0 to v1.41.0 (or later) to remediate
GHSA-mh2q-q3fh-2475; after changing those module lines, run go mod tidy (and
optionally go test / go build) to refresh go.sum and ensure compatibility across
the three packages.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 27d0bf78-f2ab-4614-8964-42a3c51918ee
⛔ Files ignored due to path filters (155)
go.sumis excluded by!**/*.sumvendor/cel.dev/expr/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/MODULE.bazelis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/checked.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/cel.dev/expr/eval.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/cel.dev/expr/explain.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/cel.dev/expr/syntax.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/cel.dev/expr/value.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/id.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/number.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/span.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/status.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/traces.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/value.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/span.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/auto/sdk/tracer.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/.clomonitor.ymlis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/.codespellignoreis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/.golangci.ymlis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/.lycheeignoreis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/CHANGELOG.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/CODEOWNERSis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/CONTRIBUTING.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/Makefileis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/README.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/RELEASING.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/SECURITY-INSIGHTS.ymlis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/VERSIONING.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/encoder.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/filter.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/hash.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/internal/attribute.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/internal/xxhash/xxhash.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/iterator.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/key.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/kv.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/set.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/type_string.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/attribute/value.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/baggage/baggage.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/codes/codes.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/dependencies.Dockerfileis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/global/internal_logging.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/global/meter.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/internal/global/trace.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/metric/config.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/propagation/baggage.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/propagation/propagation.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/propagation/trace_context.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/MIGRATION.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/README.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/attribute_group.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/doc.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/error_type.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/exception.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/schema.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/auto.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/config.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/hex.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/attr.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/id.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/value.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/noop.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/noop/noop.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/span.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/trace.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/trace/tracestate.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/version.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/versions.yamlis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/deviceauth.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/oauth2.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/pkce.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/token.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/transport.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/checked.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/eval.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/explain.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/syntax.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/expr/v1alpha1/value.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/CONTRIBUTING.mdis excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/MAINTAINERS.mdis excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/README.mdis excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/balancer/balancer.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/balancer/endpointsharding/endpointsharding.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/balancer/pickfirst/internal/internal.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/balancer/pickfirst/pickfirst.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/balancer/pickfirst/pickfirstleaf/pickfirstleaf.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/balancer/roundrobin/roundrobin.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/balancer/subconn.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/balancer_wrapper.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/binarylog/grpc_binarylog_v1/binarylog.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/clientconn.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/credentials/credentials.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/credentials/insecure/insecure.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/credentials/tls.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/dialoptions.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/encoding/encoding.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/encoding/internal/internal.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/encoding/proto/proto.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/experimental/stats/metricregistry.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/experimental/stats/metrics.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/interceptor.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/gracefulswitch.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/balancer/weight/weight.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/buffer/unbounded.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/channelz/trace.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/credentials/credentials.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/envconfig/envconfig.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/envconfig/xds.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/experimental.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/grpcsync/callback_serializer.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/grpcsync/event.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/idle/idle.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/internal.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/resolver/delegatingresolver/delegatingresolver.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/resolver/dns/dns_resolver.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/stats/metrics_recorder_list.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/stats/stats.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/status/status.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/client_stream.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/controlbuf.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/flowcontrol.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/handler_server.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/http2_client.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/http2_server.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/http_util.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/server_stream.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/internal/transport/transport.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/mem/buffer_pool.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/mem/buffer_slice.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/mem/buffers.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/picker_wrapper.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/preloader.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/resolver/resolver.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/resolver_wrapper.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/rpc_util.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/server.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/stats/handlers.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/stats/stats.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/stream.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/grpc/version.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/protobuf/internal/editionssupport/editions.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/protobuf/internal/filedesc/desc.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/protobuf/internal/filedesc/desc_init.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/protobuf/internal/filedesc/desc_lazy.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/protobuf/internal/filedesc/editions.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/protobuf/internal/version/version.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/protobuf/reflect/protodesc/desc.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/protobuf/reflect/protodesc/desc_init.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/protobuf/reflect/protodesc/proto.gois excluded by!**/vendor/**,!vendor/**vendor/modules.txtis excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (1)
go.mod
📜 Review details
🧰 Additional context used
📓 Path-based instructions (2)
**/*
📄 CodeRabbit inference engine (STYLEGUIDE.md)
Use lowercase dash-separated names for all files (to avoid git issues with case-insensitive file systems)
Files:
go.mod
go.mod
📄 CodeRabbit inference engine (README.md)
go.mod: Pin backend dependencies to an exact semver, sha, or git tag with no caret (^) operator
When updating backend dependencies, commit dependency changes separately from code changes with two commits: first code changes, then vendor changes
Files:
go.mod
🪛 OSV Scanner (2.3.8)
go.mod
[HIGH] 189-189: go.opentelemetry.io/otel 1.39.0: OpenTelemetry-Go: multi-value baggage header extraction causes excessive allocations (remote dos amplification)
🔀 Multi-repo context openshift/console-operator
openshift/console-operator findings
-
go.mod references indirect upgraded modules:
- cel.dev/expr v0.24.0 // indirect — go.mod:31 [::openshift/console-operator::go.mod:31]
- go.opentelemetry.io/auto/sdk v1.1.0 // indirect — go.mod:82 [::openshift/console-operator::go.mod:82]
- go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 // indirect — go.mod:83 [::openshift/console-operator::go.mod:83]
- go.opentelemetry.io/otel v1.36.0 // indirect — go.mod:85 [::openshift/console-operator::go.mod:85]
- golang.org/x/oauth2 v0.30.0 // indirect — go.mod:98 [::openshift/console-operator::go.mod:98]
- google.golang.org/grpc v1.72.2 // indirect — go.mod:106 [::openshift/console-operator::go.mod:106]
- google.golang.org/protobuf v1.36.8 // indirect — go.mod:107 [::openshift/console-operator::go.mod:107]
-
go.sum contains entries for the older versions (pre-bump) of these modules (examples):
- cel.dev/expr v0.24.0 — go.sum:1 [::openshift/console-operator::go.sum:1]
- go.opentelemetry.io/auto/sdk v1.1.0 — go.sum:224 [::openshift/console-operator::go.sum:224]
- go.opentelemetry.io/otel v1.36.0 — go.sum:230 [::openshift/console-operator::go.sum:230]
- golang.org/x/oauth2 v0.30.0 — go.sum:273 [::openshift/console-operator::go.sum:273]
- google.golang.org/grpc v1.72.2 — go.sum:311 [::openshift/console-operator::go.sum:311]
- google.golang.org/protobuf v1.36.8 — go.sum:313 [::openshift/console-operator::go.sum:313]
-
Vendored code (vendor/) pulls in grpc usage across dependencies (shows consumers/transitive users):
- sigs.k8s.io/apiserver-network-proxy konnectivity-client uses google.golang.org/grpc — vendor/sigs.k8s.io/apiserver-network-proxy/konnectivity-client/pkg/client/client.go:30 [::openshift/console-operator::vendor/sigs.k8s.io/apiserver-network-proxy/konnectivity-client/pkg/client/client.go:30]
- Generated gRPC stubs reference grpc in multiple vendored pb files (example): vendor/sigs.k8s.io/apiserver-network-proxy/.../client_grpc.pb.go:26 [::openshift/console-operator::vendor/sigs.k8s.io/apiserver-network-proxy/konnectivity-client/proto/client/client_grpc.pb.go:26]
- k8s.io kms API generated gRPC files reference grpc — vendor/k8s.io/kms/apis/v1beta1/api_grpc.pb.go:44 and vendor/k8s.io/kms/apis/v2/api_grpc.pb.go:44 [::openshift/console-operator::vendor/k8s.io/kms/apis/v1beta1/api_grpc.pb.go:44] [::openshift/console-operator::vendor/k8s.io/kms/apis/v2/api_grpc.pb.go:44]
- k8s.io apiserver packages import grpc (eg. apiserver/pkg/server/egressselector/egress_selector.go:34) — vendor/k8s.io/apiserver/pkg/server/egressselector/egress_selector.go:34 [::openshift/console-operator::vendor/k8s.io/apiserver/pkg/server/egressselector/egress_selector.go:34]
- etcd client imports grpc — vendor/go.etcd.io/etcd/client/v3/client.go:27 [::openshift/console-operator::vendor/go.etcd.io/etcd/client/v3/client.go:27]
- grpc-related instrumentation and otel packages present in vendor (examples: vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc listed in vendor/modules.txt) — vendor/modules.txt:448-451 [::openshift/console-operator::vendor/modules.txt:448-451]
Quick interpretation (observed facts only): the repository currently vendors grpc and many transitive packages that import/use google.golang.org/grpc (k8s libs, etcd, apiserver-network-proxy, generated pb files, grpc-ecosystem libs, otel instrumentation). The PR updates the indirect google.golang.org/grpc (and related transitive modules) in go.mod/go.sum/vendor to a fixed newer version; no direct source-level grpc server code in console-operator root was detected in the search results.
🔇 Additional comments (1)
go.mod (1)
34-34: LGTM!Also applies to: 50-50, 187-187, 204-207
| go.opentelemetry.io/otel v1.39.0 // indirect | ||
| go.opentelemetry.io/otel/metric v1.39.0 // indirect | ||
| go.opentelemetry.io/otel/trace v1.39.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Fetching GHSA details from OSV..."
curl -s https://api.osv.dev/v1/vulns/GHSA-mh2q-q3fh-2475 | jq '{
id,
summary,
aliases,
affected: [.affected[] | {
module: .package.name,
ecosystem: .package.ecosystem,
ranges: .ranges
}]
}'
echo
echo "Checking whether go.opentelemetry.io/otel@v1.39.0 is reported as affected..."
curl -s https://api.osv.dev/v1/query -H "Content-Type: application/json" \
-d '{"package":{"name":"go.opentelemetry.io/otel","ecosystem":"Go"},"version":"1.39.0"}' \
| jq '{vulns: [.vulns[]?.id]}'Repository: openshift/console
Length of output: 2033
🏁 Script executed (no clone):
#!/bin/bash
set -euo pipefail
echo "Fetching GHSA-mh2q-q3fh-2475 details from OSV..."
curl -s https://api.osv.dev/v1/vulns/GHSA-mh2q-q3fh-2475 | jq '{
id,
summary,
aliases,
affected: [.affected[] | {
module: .package.name,
ecosystem: .package.ecosystem,
ranges: .ranges
}]
}'
echo
echo "Checking whether go.opentelemetry.io/otel@v1.39.0 is reported as affected..."
curl -s https://api.osv.dev/v1/query -H "Content-Type: application/json" \
-d '{"package":{"name":"go.opentelemetry.io/otel","ecosystem":"Go"},"version":"1.39.0"}' \
| jq '{vulns: [.vulns[]?.id]}'
Length of output: 746
🏁 Script executed:
#!/bin/bash
# Check the exact versions of otel-related packages in go.mod
grep -A 2 "go.opentelemetry.io/otel" go.mod | head -20Repository: openshift/console
Length of output: 291
Upgrade OpenTelemetry packages to fix DoS vulnerability (GHSA-mh2q-q3fh-2475).
go.opentelemetry.io/otel v1.39.0 is affected by a remote DoS amplification vulnerability through multi-value baggage header extraction. Affected versions: 1.36.0 to <1.41.0. Upgrade otel, otel/metric, and otel/trace to v1.41.0 or later together.
🧰 Tools
🪛 OSV Scanner (2.3.8)
[HIGH] 189-189: go.opentelemetry.io/otel 1.39.0: OpenTelemetry-Go: multi-value baggage header extraction causes excessive allocations (remote dos amplification)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` around lines 189 - 191, Update the OpenTelemetry module versions in
go.mod for go.opentelemetry.io/otel, go.opentelemetry.io/otel/metric, and
go.opentelemetry.io/otel/trace from v1.39.0 to v1.41.0 (or later) to remediate
GHSA-mh2q-q3fh-2475; after changing those module lines, run go mod tidy (and
optionally go test / go build) to refresh go.sum and ensure compatibility across
the three packages.
jhadvig
changed the title
openshift-ci-robot
added
jira/valid-bug
|
@jhadvig: This pull request references Jira Issue OCPBUGS-85649, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@jhadvig: This pull request references Jira Issue OCPBUGS-85649, which is valid. 3 validation(s) were run on this bug
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Verified locally against a live OCP 4.23.0 (main) nightly cluster with clusterbot:
/lgtm |
openshift-ci-robot
added
the
verified
|
@Leo6Leo: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jhadvig, Leo6Leo The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@jhadvig: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
3 participants
Analysis / Root cause:
CVE-2026-33186 (OCPBUGS-83940) — gRPC-Go versions
prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2
:pathpseudo-header. The gRPC-Go server accepts requests where:pathomits the mandatory leadingslash, causing path-based authorization interceptors (including
grpc/authz) to fail matching denyrules.
The console backend uses gRPC-Go v1.72.2 as an indirect (transitive) dependency — it does not run a
gRPC server or use gRPC authorization interceptors, so the vulnerability is not exploitable in
practice. However, the dependency must be bumped to satisfy security scanners and compliance
requirements.
Solution description:
Bump
google.golang.org/grpcfrom v1.72.2 to v1.79.3 viago get,go mod tidy, andgo mod vendor.This also pulls in minor transitive dependency updates:
cel.dev/exprv0.24.0 → v0.25.1go.opentelemetry.io/auto/sdkv1.1.0 → v1.2.1go.opentelemetry.io/otelv1.36.0 → v1.39.0golang.org/x/oauth2v0.30.0 → v0.34.0google.golang.org/genproto/googleapis/apiand/rpcupdatedgoogle.golang.org/protobufv1.36.8 → v1.36.10No Go source code changes — only
go.mod,go.sum, andvendor/are modified.Screenshots / screen recording:
N/A — backend dependency bump, no UI changes.
Test setup:
No special setup required.
Test cases:
./build-backend.sh)./test-backend.sh)Browser conformance:
N/A — no frontend changes.
Additional info:
google.golang.org/grpcin anypkg/orcmd/Go files. It is pulled in transitively by
k8s.io/apiserver,helm.sh/helm/v3,operator-framework/*, and other upstream modules. The console runs a pure HTTP/HTTPS server — no gRPCserver, no gRPC authorization interceptors.
Reviewers and assignees:
/assign @jon
Summary by CodeRabbit