Bump the go_modules group across 2 directories with 13 updates - #1488
Open
dependabot[bot] wants to merge 1 commit into
Open
Bump the go_modules group across 2 directories with 13 updates#1488dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the go_modules group with 10 updates in the /tests/e2e directory: | Package | From | To | | --- | --- | --- | | [github.com/cloudflare/circl](https://github.com/cloudflare/circl) | `1.6.0` | `1.6.3` | | [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) | `4.1.1` | `4.1.4` | | [github.com/google/cel-go](https://github.com/google/cel-go) | `0.26.1` | `0.29.0` | | [github.com/microsoft/kiota-http-go](https://github.com/microsoft/kiota-http-go) | `1.5.2` | `1.5.5` | | [github.com/moby/spdystream](https://github.com/moby/spdystream) | `0.5.0` | `0.5.1` | | [go.mongodb.org/mongo-driver](https://github.com/mongodb/mongo-go-driver) | `1.17.3` | `1.17.7` | | [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | `1.37.0` | `1.41.0` | | [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) | `1.37.0` | `1.43.0` | | [golang.org/x/crypto](https://github.com/golang/crypto) | `0.47.0` | `0.52.0` | | [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.75.1` | `1.82.1` | Bumps the go_modules group with 5 updates in the /tests/integration directory: | Package | From | To | | --- | --- | --- | | [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) | `1.42.0` | `1.43.0` | | [golang.org/x/crypto](https://github.com/golang/crypto) | `0.48.0` | `0.52.0` | | [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.79.3` | `1.82.1` | | [github.com/go-git/go-billy/v5](https://github.com/go-git/go-billy) | `5.6.1` | `5.9.0` | | [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `5.13.1` | `5.19.1` | Updates `github.com/cloudflare/circl` from 1.6.0 to 1.6.3 - [Release notes](https://github.com/cloudflare/circl/releases) - [Commits](cloudflare/circl@v1.6.0...v1.6.3) Updates `github.com/go-jose/go-jose/v4` from 4.1.1 to 4.1.4 - [Release notes](https://github.com/go-jose/go-jose/releases) - [Commits](go-jose/go-jose@v4.1.1...v4.1.4) Updates `github.com/google/cel-go` from 0.26.1 to 0.29.0 - [Release notes](https://github.com/google/cel-go/releases) - [Commits](cel-expr/cel-go@v0.26.1...v0.29.0) Updates `github.com/microsoft/kiota-http-go` from 1.5.2 to 1.5.5 - [Release notes](https://github.com/microsoft/kiota-http-go/releases) - [Changelog](https://github.com/microsoft/kiota-http-go/blob/main/CHANGELOG.md) - [Commits](microsoft/kiota-http-go@v1.5.2...v1.5.5) Updates `github.com/moby/spdystream` from 0.5.0 to 0.5.1 - [Release notes](https://github.com/moby/spdystream/releases) - [Commits](moby/spdystream@v0.5.0...v0.5.1) Updates `go.mongodb.org/mongo-driver` from 1.17.3 to 1.17.7 - [Release notes](https://github.com/mongodb/mongo-go-driver/releases) - [Commits](mongodb/mongo-go-driver@v1.17.3...v1.17.7) Updates `go.opentelemetry.io/otel` from 1.37.0 to 1.41.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.37.0...v1.41.0) Updates `go.opentelemetry.io/otel/sdk` from 1.37.0 to 1.43.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.37.0...v1.43.0) Updates `golang.org/x/crypto` from 0.47.0 to 0.52.0 - [Commits](golang/crypto@v0.47.0...v0.52.0) Updates `golang.org/x/net` from 0.49.0 to 0.54.0 - [Commits](golang/net@v0.49.0...v0.54.0) Updates `google.golang.org/grpc` from 1.75.1 to 1.82.1 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.75.1...v1.82.1) Updates `go.opentelemetry.io/otel` from 1.37.0 to 1.43.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.37.0...v1.41.0) Updates `go.opentelemetry.io/otel/sdk` from 1.37.0 to 1.43.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.37.0...v1.43.0) Updates `golang.org/x/crypto` from 0.47.0 to 0.52.0 - [Commits](golang/crypto@v0.47.0...v0.52.0) Updates `golang.org/x/net` from 0.49.0 to 0.54.0 - [Commits](golang/net@v0.49.0...v0.54.0) Updates `google.golang.org/grpc` from 1.75.1 to 1.82.1 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.75.1...v1.82.1) Updates `go.opentelemetry.io/otel/sdk` from 1.42.0 to 1.43.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.37.0...v1.43.0) Updates `golang.org/x/crypto` from 0.48.0 to 0.52.0 - [Commits](golang/crypto@v0.47.0...v0.52.0) Updates `golang.org/x/net` from 0.51.0 to 0.54.0 - [Commits](golang/net@v0.49.0...v0.54.0) Updates `google.golang.org/grpc` from 1.79.3 to 1.82.1 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.75.1...v1.82.1) Updates `github.com/go-git/go-billy/v5` from 5.6.1 to 5.9.0 - [Release notes](https://github.com/go-git/go-billy/releases) - [Commits](go-git/go-billy@v5.6.1...v5.9.0) Updates `github.com/go-git/go-git/v5` from 5.13.1 to 5.19.1 - [Release notes](https://github.com/go-git/go-git/releases) - [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md) - [Commits](go-git/go-git@v5.13.1...v5.19.1) Updates `go.opentelemetry.io/otel/sdk` from 1.42.0 to 1.43.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.37.0...v1.43.0) Updates `golang.org/x/crypto` from 0.48.0 to 0.52.0 - [Commits](golang/crypto@v0.47.0...v0.52.0) Updates `golang.org/x/net` from 0.51.0 to 0.54.0 - [Commits](golang/net@v0.49.0...v0.54.0) Updates `google.golang.org/grpc` from 1.79.3 to 1.82.1 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.75.1...v1.82.1) --- updated-dependencies: - dependency-name: github.com/cloudflare/circl dependency-version: 1.6.3 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/go-jose/go-jose/v4 dependency-version: 4.1.4 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/google/cel-go dependency-version: 0.29.0 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/microsoft/kiota-http-go dependency-version: 1.5.5 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/moby/spdystream dependency-version: 0.5.1 dependency-type: indirect dependency-group: go_modules - dependency-name: go.mongodb.org/mongo-driver dependency-version: 1.17.7 dependency-type: indirect dependency-group: go_modules - dependency-name: go.opentelemetry.io/otel dependency-version: 1.41.0 dependency-type: indirect dependency-group: go_modules - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.43.0 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/crypto dependency-version: 0.52.0 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/net dependency-version: 0.54.0 dependency-type: indirect dependency-group: go_modules - dependency-name: google.golang.org/grpc dependency-version: 1.82.1 dependency-type: indirect dependency-group: go_modules - dependency-name: go.opentelemetry.io/otel dependency-version: 1.43.0 dependency-type: indirect dependency-group: go_modules - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.43.0 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/crypto dependency-version: 0.52.0 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/net dependency-version: 0.54.0 dependency-type: indirect dependency-group: go_modules - dependency-name: google.golang.org/grpc dependency-version: 1.82.1 dependency-type: indirect dependency-group: go_modules - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.43.0 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/crypto dependency-version: 0.52.0 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/net dependency-version: 0.54.0 dependency-type: indirect dependency-group: go_modules - dependency-name: google.golang.org/grpc dependency-version: 1.82.1 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/go-git/go-billy/v5 dependency-version: 5.9.0 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/go-git/go-git/v5 dependency-version: 5.19.1 dependency-type: indirect dependency-group: go_modules - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.43.0 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/crypto dependency-version: 0.52.0 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/net dependency-version: 0.54.0 dependency-type: indirect dependency-group: go_modules - dependency-name: google.golang.org/grpc dependency-version: 1.82.1 dependency-type: indirect dependency-group: go_modules ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Contributor
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci
Bot
added
the
needs-ok-to-test
|
Hi @dependabot[bot]. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
WalkthroughChangesTest module dependency refresh
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (2)
tests/e2e/go.mod (2)
3-3: 🔒 Security & Privacy | 🔵 TrivialPin a patched Go toolchain for end-to-end builds.
Dockerfile.tests-extensionuses Go1.24withGOTOOLCHAIN=auto, which can select unpatched Go1.25.0.hack/e2e.shusesDockerfile, which installs Go1.23.5. Pin each end-to-end builder to a patched Go1.25.xor newer release and verify the downloaded archive hash.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/e2e/go.mod` at line 3, Update the end-to-end builders referenced by Dockerfile.tests-extension and hack/e2e.sh/Dockerfile to use a patched Go 1.25.x or newer release instead of vulnerable versions, and set matching toolchain metadata in tests/e2e/go.mod. Verify every downloaded Go archive against its official checksum before installation.
17-21: 🔒 Security & Privacy | 🔵 TrivialComplete supply-chain validation for the module graph.
go mod tidy -diffandgo mod verifypass, and the five updated modules have exactgo.sumhashes with no OSV findings. Full scanning is blocked becausego list -m -json allfails onk8s.io/externaljwt@v0.0.0(unknown revision), andgovulncheckis unavailable. Resolve this graph error, run the complete scan, and add or document CI controls for SBOM generation, provenance attestations, and Sigstore/cosign signing.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/e2e/go.mod` around lines 17 - 21, Resolve the invalid k8s.io/externaljwt@v0.0.0 module reference so go list -m -json all succeeds, then run the complete supply-chain validation including OSV scanning. Add or document CI controls covering SBOM generation, provenance attestations, and Sigstore/cosign signing, while preserving the validated module hashes.Sources: Path instructions, Learnings
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@tests/e2e/go.mod`:
- Line 3: Update the end-to-end builders referenced by
Dockerfile.tests-extension and hack/e2e.sh/Dockerfile to use a patched Go 1.25.x
or newer release instead of vulnerable versions, and set matching toolchain
metadata in tests/e2e/go.mod. Verify every downloaded Go archive against its
official checksum before installation.
- Around line 17-21: Resolve the invalid k8s.io/externaljwt@v0.0.0 module
reference so go list -m -json all succeeds, then run the complete supply-chain
validation including OSV scanning. Add or document CI controls covering SBOM
generation, provenance attestations, and Sigstore/cosign signing, while
preserving the validated module hashes.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 32ca8deb-e2d0-47bc-9f6b-0dc1771abcf0
⛔ Files ignored due to path filters (2)
tests/e2e/go.sumis excluded by!**/*.sumtests/integration/go.sumis excluded by!**/*.sum
📒 Files selected for processing (2)
tests/e2e/go.modtests/integration/go.mod
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the go_modules group with 10 updates in the /tests/e2e directory:
1.6.01.6.34.1.14.1.40.26.10.29.01.5.21.5.50.5.00.5.11.17.31.17.71.37.01.41.01.37.01.43.00.47.00.52.01.75.11.82.1Bumps the go_modules group with 5 updates in the /tests/integration directory:
1.42.01.43.00.48.00.52.01.79.31.82.15.6.15.9.05.13.15.19.1Updates
github.com/cloudflare/circlfrom 1.6.0 to 1.6.3Release notes
Sourced from github.com/cloudflare/circl's releases.
... (truncated)
Commits
24ae53cRelease CIRCL v1.6.3581020bRename method to oddMultiplesProjective.12209a4Removing unused cmov for jacobian points.fcba359ecc/p384: use of complete projective formulas for scalar multiplication.5e1bae8ecc/p384: handle point doubling in point addition with Jacobian coordinates.3416046Check opts for nil value.a763d47Release CIRCL v1.6.23c70bf9Bump x/crypto x/sys dependencies.3f0f15bRevert to using package-declared HPKE errors for shortkem instead of standard...23491bdAdding generic Power2Round method.Updates
github.com/go-jose/go-jose/v4from 4.1.1 to 4.1.4Release notes
Sourced from github.com/go-jose/go-jose/v4's releases.
Commits
0e59876Merge commit from forkddffdbcBump actions/checkout from 5 to 6 (#213)5348b9aReject JWS with an unprotected critical b64 header (#210)9153a5eBump actions/setup-python from 5 to 6 (#208)2126e17Bump actions/setup-go from 5 to 6 (#209)9860c65Bump actions/checkout from 4 to 5 (#206)14239fdRemove Go 1.23 support (#205)a16e158Update CI to run on Go 1.24 and 1.25 (#204)a1565a4testutils/assert: remove True, Nil, NotNil (#202)3a80e13jwe: accept non-pointer JSONWebKey in Recipient (#200)Updates
github.com/google/cel-gofrom 0.26.1 to 0.29.0Release notes
Sourced from github.com/google/cel-go's releases.
... (truncated)
Commits
fa16799avoid repeated construction of cost tracker (#1357)ea3d5c0feat(ext): add json encoder (#1340)a4d0d64startsWith / endsWith runtime cost agreement with checked cost (#1351)d4efa77Ensure receiver and global matches cost estimates agree (#1350)13cff33ext/lists: add max size check to genRange() to prevent OOM (#1310)f0ffa7eExecution frame integration with updated IntepretableV2 (#1344)f1ec2f6guard int32/uint32 map key narrowing in qualifyInternal (#1337)258e7c8Managed execution frame with async call foundations (#1316)14f6746validate offset on empty-string path in indexOf and lastIndexOf (#1335)783267dreject out-of-range minutes in timezone offset parsing (#1336)Updates
github.com/microsoft/kiota-http-gofrom 1.5.2 to 1.5.5Release notes
Sourced from github.com/microsoft/kiota-http-go's releases.
Changelog
Sourced from github.com/microsoft/kiota-http-go's changelog.
Commits
c6133feMerge pull request #223 from microsoft/release-please--branches--main--compon...cb68231chore(main): release 1.5.5fba6ba4Merge pull request #221 from microsoft/cobando/fix-redirect-vulnerability39fa46cupdating scrub func to use 2 instead of 3 paramsce4f0dcadding port conditione68b9e1adding senstive headers scrub functionf950250Merge pull request #220 from microsoft/ci/release-please-dispatch849a4eeci: adds workflow dispatch to release please7bdff1cMerge pull request #218 from microsoft/dependabot/github_actions/dependabot/f...85d1657chore(deps): bump dependabot/fetch-metadata from 2.4.0 to 2.5.0Updates
github.com/moby/spdystreamfrom 0.5.0 to 0.5.1Release notes
Sourced from github.com/moby/spdystream's releases.
Commits
c59e5d7Merge pull request #109 from thaJeztah/use_ioutil2fd0155use ioutil.Discard for go1.13 compatibilityef6121fMerge commit from fork241cec9compare with signed Int for 32-bit Arm21c3864Add options to customize limitsacf9b45spdy: update godoc for MaxDataLengtheb63605spdy: limit header-size and header-count2f21da4spdy: fix header block byte accounting5976b66spdy: enforce 24-bit frame length limitscf0ec5dGuard against oversized SPDY framesUpdates
go.mongodb.org/mongo-driverfrom 1.17.3 to 1.17.7Release notes
Sourced from go.mongodb.org/mongo-driver's releases.
... (truncated)
Commits
eb01e7eBUMP v1.17.73c55093GODRIVER-3766 Remove deprecation notice forMergeClientOptions(#2294)f6163bfGODRIVER-3770 Remove libasan from gssapi tests in CI (#2293)6798963GODRIVER-3770 Fix buffer handling in GSSAPI error description and username fu...c1e9575Add more visible deprecation banner to the 1.17 readme (#2233)d2fa0abBUMP v1.17.6f1d540bBUMP v1.17.5b879028GODRIVER-3654 Don't test v1 branches against latest server. (#2188)21f47d4Allow ignore-for-release label to satisfy label checker (#2203)8708ca8Disable merge-up from release/1.17 (#2202)Updates
go.opentelemetry.io/otelfrom 1.37.0 to 1.41.0Changelog
Sourced from go.opentelemetry.io/otel's changelog.
... (truncated)
Commits
4575a97Release 1.41.0/0.63.0/0.17.0/0.0.15 (#7977)66fc10dfix: add error handling for insecure HTTP endpoints with TLS client configura...76e6eecchore(deps): update github/codeql-action action to v4.32.5 (#7980)0d50f90Revert "Generate semconv/v1.40.0" (#7978)c38a4a5Generate semconv/v1.40.0 (#7929)0f1a224chore(deps): update module github.com/securego/gosec/v2 to v2.23.0 (#7899)c79ebf4chore(deps): update module github.com/daixiang0/gci to v0.14.0 (#7973)f758157chore(deps): update module github.com/sonatard/noctx to v0.5.0 (#7968)92a1164fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to d566b...3cd7c27chore(deps): update module github.com/protonmail/go-crypto to v1.4.0 (#7969)Updates
go.opentelemetry.io/otel/sdkfrom 1.37.0 to 1.43.0Changelog
Sourced from go.opentelemetry.io/otel/sdk's changelog.
... (truncated)
Commits
9276201Release v1.43.0 / v0.65.0 / v0.19.0 (#8128)61b8c94chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 (#8131)97a086echore(deps): update github.com/golangci/dupl digest to c99c5cf (#8122)5e363delimit response body size for OTLP HTTP exporters (#8108)35214b6Use an absolute path when calling bsd kenv (#8113)290024cfix(deps): update module google.golang.org/grpc to v1.80.0 (#8121)e70658efix: support getBody in otelploghttp (...Description has been truncated
Summary by CodeRabbit