build(deps): bump the golang group across 1 directory with 7 updates#242
Open
dependabot[bot] wants to merge 1 commit into
Open
build(deps): bump the golang group across 1 directory with 7 updates#242dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the golang group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/Microsoft/hcsshim](https://github.com/Microsoft/hcsshim) | `0.14.0` | `0.14.1` | | [github.com/buger/jsonparser](https://github.com/buger/jsonparser) | `1.1.2` | `1.2.0` | | [github.com/mattn/go-shellwords](https://github.com/mattn/go-shellwords) | `1.0.12` | `1.0.13` | | [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) | `2.28.1` | `2.29.0` | | [github.com/opencontainers/selinux](https://github.com/opencontainers/selinux) | `1.13.1` | `1.15.1` | Updates `github.com/Microsoft/hcsshim` from 0.14.0 to 0.14.1 - [Release notes](https://github.com/Microsoft/hcsshim/releases) - [Commits](microsoft/hcsshim@v0.14.0...v0.14.1) Updates `github.com/buger/jsonparser` from 1.1.2 to 1.2.0 - [Release notes](https://github.com/buger/jsonparser/releases) - [Commits](buger/jsonparser@v1.1.2...v1.2.0) Updates `github.com/mattn/go-shellwords` from 1.0.12 to 1.0.13 - [Commits](mattn/go-shellwords@v1.0.12...v1.0.13) Updates `github.com/onsi/ginkgo/v2` from 2.28.1 to 2.29.0 - [Release notes](https://github.com/onsi/ginkgo/releases) - [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md) - [Commits](onsi/ginkgo@v2.28.1...v2.29.0) Updates `github.com/onsi/gomega` from 1.39.1 to 1.40.0 - [Release notes](https://github.com/onsi/gomega/releases) - [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md) - [Commits](onsi/gomega@v1.39.1...v1.40.0) Updates `github.com/opencontainers/selinux` from 1.13.1 to 1.15.1 - [Release notes](https://github.com/opencontainers/selinux/releases) - [Commits](opencontainers/selinux@v1.13.1...v1.15.1) Updates `golang.org/x/sys` from 0.42.0 to 0.43.0 - [Commits](golang/sys@v0.42.0...v0.43.0) --- updated-dependencies: - dependency-name: github.com/Microsoft/hcsshim dependency-version: 0.14.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: golang - dependency-name: github.com/buger/jsonparser dependency-version: 1.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: golang - dependency-name: github.com/mattn/go-shellwords dependency-version: 1.0.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: golang - dependency-name: github.com/onsi/ginkgo/v2 dependency-version: 2.29.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: golang - dependency-name: github.com/onsi/gomega dependency-version: 1.40.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: golang - dependency-name: github.com/opencontainers/selinux dependency-version: 1.15.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: golang - dependency-name: golang.org/x/sys dependency-version: 0.43.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: golang ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
WalkthroughThis PR updates the Go module dependencies in ChangesDependency Version Upgrades
🎯 2 (Simple) | ⏱️ ~10 minutes Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
needs-ok-to-test
Contributor
|
Hi @dependabot[bot]. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
go.mod (1)
1-59:⚠️ Potential issue | 🟠 MajorAdd/enable SBOM/provenance attestations and artifact signing in release CI
go.modalone can’t satisfy the policy. The current workflows only build and publish tarballs + sha256/sha512 checksums (.github/workflows/release.yaml) and run lint/tests (.github/workflows/test.yaml); there are no steps for SBOM generation (syft/cyclonedx/spdx) and no Sigstore/cosign signing or provenance/attestation tooling (cosign/sigstore/slsa/in-toto/rekor/provenance).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` around lines 1 - 59, The repo is missing SBOM generation and artifact signing/provenance in CI; update the release workflow (referenced as .github/workflows/release.yaml) to run SBOM tooling (e.g., syft to emit CycloneDX and SPDX), attach those SBOM artifacts alongside the tarballs and checksum files, and run cosign to sign both the release artifacts and the SBOMs (and push signatures to Rekor); also add a provenance/attestation step (in-toto/slsa/cosign attest) that produces and uploads provenance metadata, and add any small dev-tool entries (if needed) to go.mod or a tools.go so the build matrix knows required versions—ensure tests workflow (.github/workflows/test.yaml) optionally verifies SBOM and signature validity as part of CI.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Around line 6-8: Update the vulnerable module versions listed in go.mod:
change the golang.org/x/sys entry to v0.44.0 and the golang.org/x/net entry to
v0.55.0, then re-resolve dependencies so go.sum and the module graph are updated
(ensure the new versions are downloaded/validated and any transitive upgrades
applied); reference the module names golang.org/x/sys and golang.org/x/net to
locate the lines to edit and confirm there are no breakages in builds or tests
after the bump.
---
Outside diff comments:
In `@go.mod`:
- Around line 1-59: The repo is missing SBOM generation and artifact
signing/provenance in CI; update the release workflow (referenced as
.github/workflows/release.yaml) to run SBOM tooling (e.g., syft to emit
CycloneDX and SPDX), attach those SBOM artifacts alongside the tarballs and
checksum files, and run cosign to sign both the release artifacts and the SBOMs
(and push signatures to Rekor); also add a provenance/attestation step
(in-toto/slsa/cosign attest) that produces and uploads provenance metadata, and
add any small dev-tool entries (if needed) to go.mod or a tools.go so the build
matrix knows required versions—ensure tests workflow
(.github/workflows/test.yaml) optionally verifies SBOM and signature validity as
part of CI.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: a54d68f9-4449-4591-8854-c8df029125d4
⛔ Files ignored due to path filters (59)
go.sumis excluded by!**/*.sumvendor/github.com/buger/jsonparser/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/github.com/buger/jsonparser/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/buger/jsonparser/bytes.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/buger/jsonparser/bytes_safe.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/buger/jsonparser/bytes_unsafe.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/buger/jsonparser/escape.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/buger/jsonparser/fuzz.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/buger/jsonparser/parser.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/buger/jsonparser/proof.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/mattn/go-shellwords/shellwords.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/mattn/go-shellwords/util_posix.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/mattn/go-shellwords/util_windows.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/onsi/ginkgo/v2/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/github.com/onsi/ginkgo/v2/CHANGELOG.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/onsi/ginkgo/v2/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo/command/program.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo/main.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo/outline/ginkgo.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo/outline/outline.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo_t_dsl.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/onsi/ginkgo/v2/helpergo_dsl.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/onsi/ginkgo/v2/internal/testingtproxy/testing_t_proxy.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/onsi/ginkgo/v2/types/config.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/onsi/ginkgo/v2/types/flags.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/onsi/ginkgo/v2/types/version.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/onsi/gomega/CHANGELOG.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/onsi/gomega/gomega_dsl.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/opencontainers/selinux/go-selinux/selinux.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/opencontainers/selinux/go-selinux/selinux_linux.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/opencontainers/selinux/go-selinux/selinux_stub.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/opencontainers/selinux/pkg/pwalkdir/pwalkdir.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/html/iter.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/html/node.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/html/nodetype_string.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/dll_windows.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/security_windows.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/go/ast/inspector/cursor.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/go/ast/inspector/inspector.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/go/ast/inspector/iter.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/go/packages/golist.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/go/packages/packages.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/go/types/objectpath/objectpath.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/aliases/aliases.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/aliases/aliases_go122.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/event/core/event.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/event/keys/keys.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/event/label/label.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/gcimporter/iexport.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/gcimporter/iimport.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/gcimporter/ureader.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/gocommand/version.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/pkgbits/version.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/stdlib/deps.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/typeparams/coretype.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/typeparams/free.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/typesinternal/types.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/versions/features.gois excluded by!**/vendor/**,!vendor/**vendor/modules.txtis excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (1)
go.mod
Comment on lines
+6
to
+8
| github.com/Microsoft/hcsshim v0.14.1 | ||
| github.com/alexflint/go-filemutex v1.3.0 | ||
| github.com/buger/jsonparser v1.1.2 | ||
| github.com/buger/jsonparser v1.2.0 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Verify vulnerability status of bumped modules/versions via OSV API (read-only).
mods=(
"github.com/Microsoft/hcsshim@0.14.1"
"github.com/buger/jsonparser@1.2.0"
"github.com/mattn/go-shellwords@1.0.13"
"github.com/onsi/ginkgo/v2@2.29.0"
"github.com/onsi/gomega@1.40.0"
"github.com/opencontainers/selinux@1.15.1"
"golang.org/x/sys@0.43.0"
"github.com/google/pprof@0.0.0-20260402051712-545e8a4df936"
"golang.org/x/mod@0.35.0"
"golang.org/x/net@0.53.0"
"golang.org/x/sync@0.20.0"
"golang.org/x/text@0.36.0"
"golang.org/x/tools@0.44.0"
)
for m in "${mods[@]}"; do
name="${m%@*}"
ver="${m#*@}"
echo "=== $name $ver ==="
payload=$(jq -n --arg n "$name" --arg v "$ver" \
'{package:{ecosystem:"Go",name:$n},version:$v}')
curl -sSf https://api.osv.dev/v1/query -d "$payload" | jq .
doneRepository: openshift/containernetworking-plugins
Length of output: 15814
OSV reports known vulnerabilities in bumped deps; update go.mod before merge
golang.org/x/sys v0.43.0hasGO-2026-5024(aliasCVE-2026-39824); OSV indicates fixed in0.44.0.golang.org/x/net v0.53.0has multiple vulns (GO-2026-5025–GO-2026-5030, e.g.,CVE-2026-42506,CVE-2026-39821,CVE-2026-42502,CVE-2026-25680,CVE-2026-25681,CVE-2026-27136); OSV indicates fixed in0.55.0.
Bump these modules to the OSV-fixed versions (or provide a clear justification/mitigation for staying on the vulnerable versions).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` around lines 6 - 8, Update the vulnerable module versions listed in
go.mod: change the golang.org/x/sys entry to v0.44.0 and the golang.org/x/net
entry to v0.55.0, then re-resolve dependencies so go.sum and the module graph
are updated (ensure the new versions are downloaded/validated and any transitive
upgrades applied); reference the module names golang.org/x/sys and
golang.org/x/net to locate the lines to edit and confirm there are no breakages
in builds or tests after the bump.
Source: Coding guidelines
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the golang group with 5 updates in the / directory:
0.14.00.14.11.1.21.2.01.0.121.0.132.28.12.29.01.13.11.15.1Updates
github.com/Microsoft/hcsshimfrom 0.14.0 to 0.14.1Release notes
Sourced from github.com/Microsoft/hcsshim's releases.
Commits
fb5aa2eupgrade dependencies to fix CI9a434d6shim: skip SandboxPlatform validation when platform is not explicitly set (#2...98d74bbWCOW: restore support for client-mounted roots (#2595)Updates
github.com/buger/jsonparserfrom 1.1.2 to 1.2.0Release notes
Sourced from github.com/buger/jsonparser's releases.
Commits
c172c16Merge pull request #269 from buger/tinygo680cd2eMerge pull request #281 from buger/reqproof-assurance-hardening9dce61cMigrate review storage from reviews/ folder to per-requirement timestampsc03b9effeat: add property-based obligation classes with 24 new SYS-REQs9c46110chore: fix spec lint warnings — remove stale parent field, set review metadata8bbb8a8Close coverage gaps: SYS-REQ-007/008/010 fuzz harness coverage to 100%552e93bInstall Z3 via apt before audit98133b4Remove manual Z3 pre-download, now handled by proof-action1b70eadDebug Z3 pre-download: remove output suppressionaac1fbcPre-download Z3 solver before auditUpdates
github.com/mattn/go-shellwordsfrom 1.0.12 to 1.0.13Commits
fd1aa6cRun gofmt: add missing //go:build directives and trailing newlinese73986eTreat bare ')' as syntax error regardless of ParseBacktick9a78803Merge pull request #60 from scumfrog/security-fix-cveb074fa0fix: preserve parser compatibility for unmatched ')' handling735b5e8Implement tests for shellwords parser functionalitye2951fcFix dollarQuote state management in shellwords.go551a1d0Update CI: Go 1.25/1.26 and latest GitHub Actionsf3bbb6fMerge pull request #53 from ndeloof/masterf6737feparse\tas TAB, not escapedtUpdates
github.com/onsi/ginkgo/v2from 2.28.1 to 2.29.0Release notes
Sourced from github.com/onsi/ginkgo/v2's releases.
Changelog
Sourced from github.com/onsi/ginkgo/v2's changelog.
Commits
04b5bcbv2.29.0124232adocs: GinkgoHelperGoad9cee8feat: GinkgoHelperGo, with integration tests9e56a0achore: refactor devcontainer for better maintenance3d235a9chore: ignore internal/tmp_*/ integration suite temporary dirs782666afeat: devcontainer configuration with local pkgsite and GH pages009dd04Support DescribeTableSubtree in ginkgo outline5de9c15v2.28.37e2fa19bump dependencies1a81912v2.28.2Updates
github.com/onsi/gomegafrom 1.39.1 to 1.40.0Release notes
Sourced from github.com/onsi/gomega's releases.
Changelog
Sourced from github.com/onsi/gomega's changelog.
Commits
87ee9d3v1.40.0ea66027v1.40.0 (full)e3fd789update docs to reflect new versioning strategy7d4ee30first push to master-litee4a82d1Bump github/codeql-action from 3 to 4 (#875)af62723Bump rexml from 3.4.0 to 3.4.2 in /docs (#870)e164221Bump github.com/onsi/ginkgo/v2 from 2.28.0 to 2.28.1 (#895)334a282Bump faraday from 2.12.2 to 2.14.1 in /docs (#896)Updates
github.com/opencontainers/selinuxfrom 1.13.1 to 1.15.1Release notes
Sourced from github.com/opencontainers/selinux's releases.
... (truncated)
Commits
9801d53Merge pull request #272 from kolyshkin/add-mcs-nitcf4e440ReserveLabelV2: ignore labels without MCS84683a6Merge pull request #271 from kolyshkin/change-type8889f6eAdd SetProcessKindfb9b5b2Merge pull request #269 from kolyshkin/init-labels-opt74873e2label.InitLabels: optimizec8bf19eMerge pull request #270 from kolyshkin/timeouta55d914ci: set timeout for vm jobs89b039bMerge pull request #267 from kolyshkin/damage-control8c517efMerge pull request #268 from kolyshkin/readmeUpdates
golang.org/x/sysfrom 0.42.0 to 0.43.0Commits
f33a730windows: support nil security descriptor on GetNamedSecurityInfo493d172cpu: add runtime import in cpu_darwin_arm64_other.go2c2be75windows: use syscall.SyscallN in Proc.Calla76ec62cpu: roll back "use IsProcessorFeaturePresent to calculate ARM64 on windows"Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsSummary by CodeRabbit