NO-JIRA: build(deps): bump the github-dependencies group with 23 updates - #9190
NO-JIRA: build(deps): bump the github-dependencies group with 23 updates#9190dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
area/ci-tooling
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
📝 WalkthroughWalkthroughUpdated the Go toolchain requirement from 1.26.0 to 1.26.3. Refreshed direct and indirect dependency versions in Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 11✅ Passed checks (11 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
Hi @dependabot[bot]. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
ac48c04 to
1ad35b6
Compare
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 3: Update the Go toolchain version declared in go.mod from 1.26.3 to
1.26.5 so workflows using go-version-file select the latest required security
release.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| module github.com/openshift/hypershift | ||
|
|
||
| go 1.26.0 | ||
| go 1.26.3 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
printf '%s\n' '--- go.mod ---'
cat -n go.mod | sed -n '1,12p'
printf '%s\n' '--- workflows referencing go-version-file or Go versions ---'
rg -n -C 4 'go-version-file|go-version:|setup-go|1\.26' .github 2>/dev/null || true
printf '%s\n' '--- repository metadata ---'
git status --shortRepository: openshift/hypershift
Length of output: 3981
🌐 Web query:
Go 1.26.3 1.26.4 1.26.5 release dates security fixes official release history
💡 Result:
As of July 31, 2026, the official Go release history for the 1.26.x series is as follows: Go 1.26.3 Release Date: May 7, 2026 [1][2] Security Fixes: Included 11 security fixes, including resolutions for CVE-2026-42501 (cmd/go module proxy bypass), CVE-2026-39836 (net: panic on NUL byte on Windows), CVE-2026-42499 (net/mail DoS), CVE-2026-39826 (html/template XSS bypass), and others [3][4][5]. Go 1.26.4 Release Date: June 2, 2026 [1][2] Security Fixes: Included 3 security fixes addressing CVE-2026-42504 (mime: quadratic complexity in WordDecoder), CVE-2026-42507 (net/textproto: input injection in errors), and CVE-2026-27145 (crypto/x509: hostname verification performance) [6][7]. Go 1.26.5 Release Date: July 7, 2026 [1][2] Security Fixes: Included security fixes to the crypto/tls and os packages, in addition to several bug fixes affecting the compiler, runtime, and the go command [1][2]. Official release information can be tracked via the official Go Release History documentation [1][2].
Citations:
- 1: https://go.dev/doc/devel/release
- 2: https://tip.golang.org/doc/devel/release
- 3: https://groups.google.com/g/golang-nuts/c/QEttt5ZoGrE
- 4: https://seclists.org/oss-sec/2026/q2/454
- 5: https://tracker.debian.org/news/1749837/accepted-golang-126-1263-1-source-into-unstable/
- 6: https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw
- 7: https://osv.dev/vulnerability/SUSE-SU-2026:2327-1
🏁 Script executed:
set -eu
printf '%s\n' '--- official Go release-history references ---'
curl -LfsS https://go.dev/doc/devel/release | \
rg -n -C 3 'go1\.26\.(3|4|5)|1\.26\.(3|4|5)|Released'
printf '%s\n' '--- setup-go documentation references ---'
curl -LfsS https://raw.githubusercontent.com/actions/setup-go/main/README.md | \
rg -n -C 4 'go-version-file|go\.mod|directive'Repository: openshift/hypershift
Length of output: 3757
🌐 Web query:
site:github.com/actions/setup-go go-version-file go.mod go directive patch version behavior
💡 Result:
When using the go-version-file input with a go.mod file in GitHub Actions' setup-go, the action interprets the version specified in the go directive as follows: 1. Specific Patch Version: If the go directive includes a patch version (e.g., go 1.22.1), the action treats this as a pinned requirement and installs exactly that version [1][2]. Even if check-latest is set to true, the action will not automatically upgrade to a newer patch version, as it treats the explicit patch version as a fixed constraint [3]. 2. Major.Minor Version: If the go directive omits the patch version (e.g., go 1.22), the action treats it as a request for the latest available patch release within that major.minor series. It will search for the latest version by checking the local cache, the action's version manifest, and the official Go download site [1][2]. Additionally, if your go.mod file contains a toolchain directive, the setup-go action (starting from v6.0.0) will prioritize that version [4][5][6]. In summary, the presence of a patch version in the go.mod go directive pins the version for the setup-go action, preventing automatic updates, whereas omitting it allows the action to resolve to the latest compatible patch version [1][3][2].
Citations:
- 1: Remove the description of the old go.mod specification actions/setup-go#458
- 2: https://github.com/actions/setup-go/blob/d35c59ab/README.md
- 3:
check-latestdoesn't work forgo.modfile with patch version ingoline actions/setup-go#713 - 4: https://github.com/actions/setup-go/blob/main/README.md
- 5: https://github.com/actions/setup-go
- 6: Support getting go version from
toolchaindirective actions/setup-go#557
🏁 Script executed:
curl -LfsS https://go.dev/doc/devel/release |
sed -n '527,590p'Repository: openshift/hypershift
Length of output: 1993
Update the Go toolchain requirement to go 1.26.5.
The test workflows read go.mod via go-version-file, so go 1.26.3 remains pinned despite later security releases in Go 1.26.4 and 1.26.5.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 3, Update the Go toolchain version declared in go.mod from
1.26.3 to 1.26.5 so workflows using go-version-file select the latest required
security release.
Source: MCP tools
|
rebase DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
openshift-ci
Bot
added
the
needs-rebase
|
/rebase |
|
🤖 Rebasing PR onto main: workflow run |
- aws-sdk-go-v2: 1.42.0 => 1.43.0 - config: 1.32.25 => 1.32.31 - credentials: 1.19.24 => 1.19.30 - transfermanager: 0.2.11 => 0.3.5 - ec2: 1.308.0 => 1.317.0 - elasticloadbalancing: 1.34.6 => 1.36.0 - elasticloadbalancingv2: 1.55.4 => 1.58.1 - iam: 1.54.5 => 1.56.0 - kms: 1.53.4 => 1.55.0 - ram: 1.37.3 => 1.39.0 - resourcegroupstaggingapi: 1.33.3 => 1.35.0 - route53: 1.63.3 => 1.65.2 - s3: 1.104.0 => 1.106.0 - sqs: 1.44.0 => 1.46.0 - sts: 1.43.3 => 1.45.0 - smithy-go: 1.27.2 => 1.27.3 - goproxy: 1.8.4 => 1.8.5 - logr: 1.4.3 => 1.4.4 - cel-go: 0.28.1 => 0.30.0 - api: 0.37.0 => 0.45.0 - monitoring: 0.88.0 => 0.92.1 - client_golang: 1.23.2 => 1.24.1 - common: 0.69.0 => 0.70.1 Signed-off-by: dependabot[bot] <support@github.com>
1ad35b6 to
5ac8b0c
Compare
openshift-ci
Bot
removed
the
needs-rebase
|
/retitle NO-JIRA: build(deps): bump the github-dependencies group with 23 updates |
openshift-ci
Bot
changed the title
openshift-ci-robot
added
the
jira/valid-reference
|
@dependabot[bot]: This pull request explicitly references no jira issue. DetailsIn response to this:
|
openshift-ci-robot
added
the
verified
|
@mgencur: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Scheduling tests matching the |
Test Resultse2e-aws
Failed TestsTotal failed tests: 4
e2e-aks
|
|
rebase DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
openshift-ci
Bot
added
the
needs-rebase
|
@dependabot[bot]: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
3 participants
Bumps the github-dependencies group with 23 updates:
1.42.01.43.01.32.251.32.311.19.241.19.300.2.110.3.51.308.01.317.01.34.61.36.01.55.41.58.11.54.51.56.01.53.41.55.01.37.31.39.01.33.31.35.01.63.31.65.21.104.01.106.01.44.01.46.01.43.31.45.01.27.21.27.31.8.41.8.51.4.31.4.40.28.10.30.00.37.00.45.00.88.00.92.11.23.21.24.10.69.00.70.1Updates
github.com/aws/aws-sdk-go-v2from 1.42.0 to 1.43.0Commits
4fef345Release 2026-07-216275419Regenerated Clientsf859830Update API model278591dAdd an option to clients to disable clock skew (#3483)d132ac7Fix Clock Skew according to internal specification (#3472)03519c9Release 2026-07-20dda3efbRegenerated Clients348cec0Update API modelf4fd272Release 2026-07-178e4cbc8Regenerated ClientsUpdates
github.com/aws/aws-sdk-go-v2/configfrom 1.32.25 to 1.32.31Commits
4fef345Release 2026-07-216275419Regenerated Clientsf859830Update API model278591dAdd an option to clients to disable clock skew (#3483)d132ac7Fix Clock Skew according to internal specification (#3472)03519c9Release 2026-07-20dda3efbRegenerated Clients348cec0Update API modelf4fd272Release 2026-07-178e4cbc8Regenerated ClientsUpdates
github.com/aws/aws-sdk-go-v2/credentialsfrom 1.19.24 to 1.19.30Commits
4fef345Release 2026-07-216275419Regenerated Clientsf859830Update API model278591dAdd an option to clients to disable clock skew (#3483)d132ac7Fix Clock Skew according to internal specification (#3472)03519c9Release 2026-07-20dda3efbRegenerated Clients348cec0Update API modelf4fd272Release 2026-07-178e4cbc8Regenerated ClientsUpdates
github.com/aws/aws-sdk-go-v2/feature/s3/transfermanagerfrom 0.2.11 to 0.3.5Commits
4fef345Release 2026-07-216275419Regenerated Clientsf859830Update API model278591dAdd an option to clients to disable clock skew (#3483)d132ac7Fix Clock Skew according to internal specification (#3472)03519c9Release 2026-07-20dda3efbRegenerated Clients348cec0Update API modelf4fd272Release 2026-07-178e4cbc8Regenerated ClientsUpdates
github.com/aws/aws-sdk-go-v2/service/ec2from 1.308.0 to 1.317.0Commits
4fef345Release 2026-07-216275419Regenerated Clientsf859830Update API model278591dAdd an option to clients to disable clock skew (#3483)d132ac7Fix Clock Skew according to internal specification (#3472)03519c9Release 2026-07-20dda3efbRegenerated Clients348cec0Update API modelf4fd272Release 2026-07-178e4cbc8Regenerated ClientsUpdates
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingfrom 1.34.6 to 1.36.0Commits
e2e9697Release 2025-01-316576a09Regenerated Clientsf762573Update API modelc94df29add transfer manager doc header (#2990)880543crevert the revert on the transfer manager beta (#2993)8da49e5switch to code-generated waiters for remaining services (#2994)c7c6865Release 2025-01-3070f736cRegenerated Clients28731c2Update endpoints model3505e4bUpdate API modelUpdates
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2from 1.55.4 to 1.58.1Commits
383fd26Release 2024-07-104a055f9Regenerated Clientse345795Update endpoints model52a10acUpdate API modeladab0deremove unused jmespath dependency from main module (#2707)0e07cc8Release 2024-07-095e35834Regenerated Clientsa2a28a1Update endpoints modelf548973Update API modele7aad56Release 2024-07-08Updates
github.com/aws/aws-sdk-go-v2/service/iamfrom 1.54.5 to 1.56.0Commits
077df5dRelease 2024-06-183320b13Regenerated Clients1315201Update API model8dddc9cadd SDK-specific feature tracking (#2682)54f11c0Release 2024-06-17d5c4ad0Regenerated Clientse7057a6Update API model374440dMerge pull request #2490 from aws/feat-aid-endpoints3133994fix changelog5ceabb7merge from mainUpdates
github.com/aws/aws-sdk-go-v2/service/kmsfrom 1.53.4 to 1.55.0Commits
54e19dfRelease 2024-06-050402b49Regenerated Clientsa185f3bUpdate endpoints modelfb6840bUpdate API model882127dadd codec option to use encoding.Text/Binary(Un)Marshaler when present (#2666)5b30240add s3 protocol tests (#2667)4b0b7efRelease 2024-06-04de2612eRegenerated Clientscea73deUpdate endpoints modela17e5c4Update API modelUpdates
github.com/aws/aws-sdk-go-v2/service/ramfrom 1.37.3 to 1.39.0Commits
648027eRelease 2025-09-08a3b9b7bRegenerated Clients67dad83Update endpoints model2bfe86aUpdate API model59e7410add businessmetrics feature ID for env-based bearer token (#3182)1cdc158Patching override s3expire shape (#3180)1745edeRelease 2025-09-05f84de53Regenerated Clients7cdaa31Update API model498b5c4remove service/sms (#3177)Updates
github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapifrom 1.33.3 to 1.35.0Commits
c7c6865Release 2025-01-3070f736cRegenerated Clients28731c2Update endpoints model3505e4bUpdate API model0b4f636don't sign transfer-encoding header (#2991)b820c57Release 2025-01-2940ddb76Regenerated Clients2b4adaeUpdate API model78c2be4Revert "beta: feature/s3/transfermanager (S3 transfer manager v2) (#2988)"5c9d67cbeta: feature/s3/transfermanager (S3 transfer manager v2) (#2988)Updates
github.com/aws/aws-sdk-go-v2/service/route53from 1.63.3 to 1.65.2Commits
0cbb5aaRelease 2024-10-0854c1dd6Regenerated Clients2cde144Update endpoints model67fbd35Update API modelaa04330Allow non-nil but empty headers (#2826)5a4e5bbadd feature tracking for cbor protocol (#2821)183987cadd annotations to deprecated services and introduce codegen integration for ...b737dc9Release 2024-10-077279a51Regenerated Clientsa1b1f5aUpdate endpoints modelUpdates
github.com/aws/aws-sdk-go-v2/service/s3from 1.104.0 to 1.106.0Commits
4fef345Release 2026-07-216275419Regenerated Clientsf859830Update API model278591dAdd an option to clients to disable clock skew (#3483)d132ac7Fix Clock Skew according to internal specification (#3472)03519c9Release 2026-07-20dda3efbRegenerated Clients348cec0Update API modelf4fd272Release 2026-07-178e4cbc8Regenerated ClientsUpdates
github.com/aws/aws-sdk-go-v2/service/sqsfrom 1.44.0 to 1.46.0Commits
4aeeb0dRelease 2023-11-28.2e09e153Regenerated Clients8293e2cUpdate endpoints model713fb0fUpdate API model830202dMerge customizations for service s32de0027Release 2023-11-28f0c890cRegenerated Clientse032d9eUpdate endpoints model507661fUpdate API model4128360fix: respect functional option modifications to RetryMaxAttempts (#2390)Updates
github.com/aws/aws-sdk-go-v2/service/stsfrom 1.43.3 to 1.45.0Commits
13546abRelease 2023-11-2759ce389Regenerated Clients8257e83Update endpoints model8ef931cUpdate API model6afe528Release 2023-11-22769b1e0Regenerated Clientsb6c7699Update API model57f3065breakfix: convert public access block config fields to nilable like s3 (#2385)fa3ee1aRelease 2023-11-216e0c553Regenerated ClientsUpdates
github.com/aws/smithy-gofrom 1.27.2 to 1.27.3Changelog
Sourced from github.com/aws/smithy-go's changelog.
... (truncated)
Commits
9445927Release 2026-06-267617c7eadd prefix/suffix hyphen rejection for host label validation based on rfc1123...49402bdFix document.Number serialization and BigDecimal negative zero sign loss (#681)648e8adfeat: move common middlewares to shared addCommonMiddlewares (#674)Updates
github.com/elazarl/goproxyfrom 1.8.4 to 1.8.5Release notes
Sourced from github.com/elazarl/goproxy's releases.
Commits
d435b12Fix headers overwrite when there are no trailers (#791)5497631Remove redundant certificate Leaf set starting from Go 1.23 (#789)5ba11e8fix(https): coalesce the MITM response head into a single write (#787)Updates
github.com/go-logr/logrfrom 1.4.3 to 1.4.4Release notes
Sourced from github.com/go-logr/logr's releases.
Commits
96a9abaFix lint51c6302Better implementation of pointer recursion checkingc667114funcr: Handle and test recursive valuesf7ffadbAdd benchmark for pointer argse2a3c8efuncr: bound slog.Group nesting depth to prevent stack overflow2886d2bbuild(deps): bump actions/setup-go from 6.5.0 to 7.0.00b40896build(deps): bump github/codeql-action/upload-sarif77f671bBump to Go 1.26cce283fbuild(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.03832a11build(deps): bump github/codeql-action/upload-sarifUpdates
github.com/google/cel-gofrom 0.28.1 to 0.30.0Release notes
Sourced from github.com/google/cel-go's releases.
... (truncated)
Commits
a492a70Expression node limits for parser and checker (#1386)b85d3bcAdd cost tracking to ext/math.go (#1353)6f3625dAllow validators to be reconfigured (#1379)e15d3caIntroduce cel.bind nesting limit (#1378)36ff97dcopy operands in Bytes.Add to avoid aliasing the receiver (#1381)af38f75Fix unsound constant folding ofx in [x]for NaN values (#1374)0175dbbEnsure logical operator fold expressions are bool (#1380)7ff0141Add runnable examples for all expressions in celbyexample.com (#1373)270df17async: Introduce Timeout and Retry wrappers (#1367)94b0cceConcurrent Eval with context.Context bound functions (#1369)Updates
github.com/operator-framework/apifrom 0.37.0 to 0.45.0Release notes
Sourced from github.com/operator-framework/api's releases.
... (truncated)
Commits
72d46e1Bump actions/setup-go from 6 to 7 (#506)c4902deBump github.com/google/cel-go from 0.29.1 to 0.29.2 (#505)132f449Bump github.com/google/cel-go from 0.28.1 to 0.29.1 (#504)23c932aBump golang.org/x/net from 0.54.0 to 0.55.0 (#503)3c29466Bump actions/cache from 5 to 6 (#502)492d6bapkg/manifests: fix dropped walk errors (#495)2b39c44Bump actions/checkout from 6 to 7 (#501)5adf634Bump the k8s-dependencies group with 4 updates (#500)887f161Bump the k8s-dependencies group across 1 directory with 5 updates (#498)52c4c32Bump codecov/codecov-action from 6 to 7 (#499)Updates
github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoringfrom 0.88.0 to 0.92.1Release notes
Sourced from github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring's releases.