Bump the oc-mirror-v2-version-updates group with 6 updates - #1487
Bump the oc-mirror-v2-version-updates group with 6 updates#1487dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the oc-mirror-v2-version-updates group with 6 updates: | Package | From | To | | --- | --- | --- | | [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) | `0.21.1` | `0.21.7` | | [github.com/operator-framework/operator-registry](https://github.com/operator-framework/operator-registry) | `1.72.1-0.20260714064125-6a6d88276641` | `1.73.0` | | [github.com/vbauerster/mpb/v8](https://github.com/vbauerster/mpb) | `8.12.0` | `8.14.0` | | [golang.org/x/crypto](https://github.com/golang/crypto) | `0.53.0` | `0.54.0` | | [golang.org/x/term](https://github.com/golang/term) | `0.44.0` | `0.45.0` | | [github.com/docker/cli](https://github.com/docker/cli) | `29.6.1+incompatible` | `29.6.2+incompatible` | Updates `github.com/google/go-containerregistry` from 0.21.1 to 0.21.7 - [Release notes](https://github.com/google/go-containerregistry/releases) - [Commits](google/go-containerregistry@v0.21.1...v0.21.7) Updates `github.com/operator-framework/operator-registry` from 1.72.1-0.20260714064125-6a6d88276641 to 1.73.0 - [Release notes](https://github.com/operator-framework/operator-registry/releases) - [Commits](https://github.com/operator-framework/operator-registry/commits/v1.73.0) Updates `github.com/vbauerster/mpb/v8` from 8.12.0 to 8.14.0 - [Release notes](https://github.com/vbauerster/mpb/releases) - [Commits](vbauerster/mpb@v8.12.0...v8.14.0) Updates `golang.org/x/crypto` from 0.53.0 to 0.54.0 - [Commits](golang/crypto@v0.53.0...v0.54.0) Updates `golang.org/x/term` from 0.44.0 to 0.45.0 - [Commits](golang/term@v0.44.0...v0.45.0) Updates `github.com/docker/cli` from 29.6.1+incompatible to 29.6.2+incompatible - [Commits](docker/cli@v29.6.1...v29.6.2) --- updated-dependencies: - dependency-name: github.com/google/go-containerregistry dependency-version: 0.21.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: oc-mirror-v2-version-updates - dependency-name: github.com/operator-framework/operator-registry dependency-version: 1.73.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: oc-mirror-v2-version-updates - dependency-name: github.com/vbauerster/mpb/v8 dependency-version: 8.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: oc-mirror-v2-version-updates - dependency-name: golang.org/x/crypto dependency-version: 0.54.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: oc-mirror-v2-version-updates - dependency-name: golang.org/x/term dependency-version: 0.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: oc-mirror-v2-version-updates - dependency-name: github.com/docker/cli dependency-version: 29.6.2+incompatible dependency-type: direct:production update-type: version-update:semver-patch dependency-group: oc-mirror-v2-version-updates ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
needs-ok-to-test
|
Hi @dependabot[bot]. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
WalkthroughThe pull request updates direct and indirect Go module dependencies in ChangesGo dependency refresh
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
go.mod (1)
11-32: 🔒 Security & Privacy | 🔵 TrivialComplete dependency verification for every Go module.
Root
go mod tidy -diffandgo mod verifypass. Do not treat thefilippo.io/edwards25519OSV result as reachable; it is absent from the root production and test package graphs. Repeat checks for everygo.mod, document the newcupwriterdependency and license compatibility, and provide SBOM, provenance, and Sigstore signing evidence.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` around lines 11 - 32, Complete dependency verification for every repository go.mod, not only the root module: run go mod tidy -diff and go mod verify for each, and confirm the filippo.io/edwards25519 finding is not reachable from production or test package graphs. Document the new cupwriter dependency and its license compatibility, and add SBOM, provenance, and Sigstore signing evidence. Preserve the existing dependency declarations in the module files.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 29: Replace the OpenPGP dependency currently provided by
golang.org/x/crypto in go.mod with github.com/ProtonMail/go-crypto, and update
imports and usage in signature.go to use the replacement openpgp package while
preserving existing release-signing behavior.
---
Nitpick comments:
In `@go.mod`:
- Around line 11-32: Complete dependency verification for every repository
go.mod, not only the root module: run go mod tidy -diff and go mod verify for
each, and confirm the filippo.io/edwards25519 finding is not reachable from
production or test package graphs. Document the new cupwriter dependency and its
license compatibility, and add SBOM, provenance, and Sigstore signing evidence.
Preserve the existing dependency declarations in the module files.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 0912a481-1780-4836-9790-52b3ec569a49
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
| go.podman.io/image/v5 v5.40.0 | ||
| go.podman.io/storage v1.63.0 | ||
| golang.org/x/crypto v0.53.0 | ||
| golang.org/x/crypto v0.54.0 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
rg -n 'golang\.org/x/crypto/openpgp' --glob '*.go'Repository: openshift/oc-mirror
Length of output: 157
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- go.mod ---'
cat -n go.mod | sed -n '1,90p'
printf '%s\n' '--- OpenPGP references in Go sources ---'
rg -n -i '(^|[^[:alnum:]_])golang\.org/x/crypto/openpgp([/"]|$)|openpgp' --glob '*.go' . || true
printf '%s\n' '--- x/crypto entries ---'
rg -n '^golang\.org/x/crypto\b' go.mod go.sum || true
printf '%s\n' '--- OSV advisory ---'
curl -fsSL 'https://api.osv.dev/v1/vulns/GO-2026-5932' | jq '{id,summary,details,aliases,affected,fixed_versions}'Repository: openshift/oc-mirror
Length of output: 8086
Replace the unsafe OpenPGP package
internal/pkg/release/signature.go imports and uses golang.org/x/crypto/openpgp. golang.org/x/crypto v0.54.0 remains affected by GO-2026-5932, which has no fixed version. Replace it with github.com/ProtonMail/go-crypto/openpgp or remove OpenPGP support before merging.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 29, Replace the OpenPGP dependency currently provided by
golang.org/x/crypto in go.mod with github.com/ProtonMail/go-crypto, and update
imports and usage in signature.go to use the replacement openpgp package while
preserving existing release-signing behavior.
|
/ok-to-test |
openshift-ci
Bot
added
ok-to-test
|
@dependabot[bot]: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
Bumps the oc-mirror-v2-version-updates group with 6 updates:
0.21.10.21.71.72.1-0.20260714064125-6a6d882766411.73.08.12.08.14.00.53.00.54.00.44.00.45.029.6.1+incompatible29.6.2+incompatibleUpdates
github.com/google/go-containerregistryfrom 0.21.1 to 0.21.7Release notes
Sourced from github.com/google/go-containerregistry's releases.
... (truncated)
Commits
c68d899Bump go version to 1.26.4 (#2350)da61d86transport: do not re-attach bearer token after cross-host redirect (#2349)09fe1e5fix(tarball): normalize paths when matching files (#2334)5baa399build(deps): bump the go-deps group across 3 directories with 4 updates (#2348)97a8a17fix(transport): apply refreshed bearer token after cross-host redirect (#2337)e963497internal/gzip: fix goroutine leak in ReadCloserLevel (#2347)02649eafix: prevent SSRF in google.List() pagination (#2332)7204b40build(deps): bump the actions group across 1 directory with 2 updates (#2344)4cfaa93build(deps): bump the go-deps group across 1 directory with 2 updates (#2343)6849394pkg/registry: export RedirectError (#2177)Updates
github.com/operator-framework/operator-registryfrom 1.72.1-0.20260714064125-6a6d88276641 to 1.73.0Release notes
Sourced from github.com/operator-framework/operator-registry's releases.
Commits
Updates
github.com/vbauerster/mpb/v8from 8.12.0 to 8.14.0Release notes
Sourced from github.com/vbauerster/mpb/v8's releases.
Commits
e13fde3v8.14.0c7c2416minor: clarify when BarRemoveOnComplete is nop82c08bfrefactoring: (*pState).onShutdown9607218minor: !IsTerminal check before SetTermFd9ac03bcminor: queueBar example upd6c69484minor: internal comment upd200a595minor: explicit mpb.WithAutoRefresh in tests0ea4157minor: b.cancel first7fe52a9refactoring: (*Progress).autoRefresh -> (*Progress).refreshEnabledb047e29minor: p.bwg.Add(1) in (*Progress).makeBarUpdates
golang.org/x/cryptofrom 0.53.0 to 0.54.0Commits
cdce021go.mod: update golang.org/x dependenciesd9474ccopenpgp: make the deprecation message more explicit7626c50ssh: verify declared key type matches decoded key in authorized_keys0471e79ssh/agent: enforce strict limits on DSA key parameters6435c37ssh: sanitize client disconnect messages7d695dassh/agent: drain channel stderr in agent forwarders5b7f841acme/autocert: fix data race in Manager.createCert0b316e7argon2: update RFC 9106 parameter recommendations55aec0ax509roots/fallback: update bundle5f2de1ainternal: remove wycheproof testsUpdates
golang.org/x/termfrom 0.44.0 to 0.45.0Commits
9f69229go.mod: update golang.org/x dependenciesUpdates
github.com/docker/clifrom 29.6.1+incompatible to 29.6.2+incompatibleCommits
dfc4efbMerge pull request #7109 from vvoland/update-dockerdba8675Bump to 29.6.2d9aefe5Merge tag 'v29.6.1' into 29.x9182b35Merge tag 'v29.6.0' into 29.x0ae55a3Merge tag 'v29.5.3' into 29.x029a4b2Merge tag 'v29.5.2' into 29.xe596feaMerge tag 'v29.5.1' into 29.x0c72f45Merge tag 'v29.5.0' into 29.x26f2736Merge tag 'v29.4.1' into 29.xac4c4dfMerge tag 'v29.4.0' into 29.xDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsSummary by CodeRabbit