Bump the oc-mirror-v1-security-updates group across 1 directory with 11 updates#1423
Conversation
…11 updates Bumps the oc-mirror-v1-security-updates group with 7 updates in the /v1 directory: | Package | From | To | | --- | --- | --- | | [github.com/containerd/containerd](https://github.com/containerd/containerd) | `1.7.27` | `1.7.32` | | [github.com/docker/cli](https://github.com/docker/cli) | `27.5.0+incompatible` | `29.2.0+incompatible` | | [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `5.14.0` | `5.19.1` | | [helm.sh/helm/v3](https://github.com/helm/helm) | `3.18.4` | `3.20.2` | | [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) | `4.0.5` | `4.1.4` | | [github.com/sigstore/fulcio](https://github.com/sigstore/fulcio) | `1.6.4` | `1.8.5` | | [github.com/sigstore/rekor](https://github.com/sigstore/rekor) | `1.3.6` | `1.5.0` | Updates `github.com/containerd/containerd` from 1.7.27 to 1.7.32 - [Release notes](https://github.com/containerd/containerd/releases) - [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md) - [Commits](containerd/containerd@v1.7.27...v1.7.32) Updates `github.com/docker/cli` from 27.5.0+incompatible to 29.2.0+incompatible - [Commits](docker/cli@v27.5.0...v29.2.0) Updates `github.com/go-git/go-git/v5` from 5.14.0 to 5.19.1 - [Release notes](https://github.com/go-git/go-git/releases) - [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md) - [Commits](go-git/go-git@v5.14.0...v5.19.1) Updates `helm.sh/helm/v3` from 3.18.4 to 3.20.2 - [Release notes](https://github.com/helm/helm/releases) - [Commits](helm/helm@v3.18.4...v3.20.2) Updates `github.com/go-git/go-billy/v5` from 5.6.2 to 5.9.0 - [Release notes](https://github.com/go-git/go-billy/releases) - [Commits](go-git/go-billy@v5.6.2...v5.9.0) Updates `github.com/go-jose/go-jose/v4` from 4.0.5 to 4.1.4 - [Release notes](https://github.com/go-jose/go-jose/releases) - [Commits](go-jose/go-jose@v4.0.5...v4.1.4) Updates `github.com/sigstore/fulcio` from 1.6.4 to 1.8.5 - [Release notes](https://github.com/sigstore/fulcio/releases) - [Changelog](https://github.com/sigstore/fulcio/blob/main/CHANGELOG.md) - [Commits](sigstore/fulcio@v1.6.4...v1.8.5) Updates `github.com/sigstore/rekor` from 1.3.6 to 1.5.0 - [Release notes](https://github.com/sigstore/rekor/releases) - [Changelog](https://github.com/sigstore/rekor/blob/main/CHANGELOG.md) - [Commits](sigstore/rekor@v1.3.6...v1.5.0) Updates `github.com/sigstore/sigstore` from 1.8.9 to 1.10.3 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.8.9...v1.10.3) Updates `go.opentelemetry.io/otel/sdk` from 1.33.0 to 1.38.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.33.0...v1.38.0) Updates `google.golang.org/grpc` from 1.68.1 to 1.78.0 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.68.1...v1.78.0) --- updated-dependencies: - dependency-name: github.com/containerd/containerd dependency-version: 1.7.32 dependency-type: direct:production dependency-group: oc-mirror-v1-security-updates - dependency-name: github.com/docker/cli dependency-version: 29.2.0+incompatible dependency-type: direct:production dependency-group: oc-mirror-v1-security-updates - dependency-name: github.com/go-git/go-git/v5 dependency-version: 5.19.1 dependency-type: indirect dependency-group: oc-mirror-v1-security-updates - dependency-name: helm.sh/helm/v3 dependency-version: 3.20.2 dependency-type: direct:production dependency-group: oc-mirror-v1-security-updates - dependency-name: github.com/go-git/go-billy/v5 dependency-version: 5.9.0 dependency-type: indirect dependency-group: oc-mirror-v1-security-updates - dependency-name: github.com/go-jose/go-jose/v4 dependency-version: 4.1.4 dependency-type: indirect dependency-group: oc-mirror-v1-security-updates - dependency-name: github.com/sigstore/fulcio dependency-version: 1.8.5 dependency-type: indirect dependency-group: oc-mirror-v1-security-updates - dependency-name: github.com/sigstore/rekor dependency-version: 1.5.0 dependency-type: indirect dependency-group: oc-mirror-v1-security-updates - dependency-name: github.com/sigstore/sigstore dependency-version: 1.10.3 dependency-type: indirect dependency-group: oc-mirror-v1-security-updates - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.38.0 dependency-type: indirect dependency-group: oc-mirror-v1-security-updates - dependency-name: google.golang.org/grpc dependency-version: 1.78.0 dependency-type: indirect dependency-group: oc-mirror-v1-security-updates ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
WalkthroughThe PR updates ChangesGo 1.25 and Dependency Refresh
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
openshift-ci
Bot
added
the
needs-ok-to-test
|
Hi @dependabot[bot]. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@v1/go.mod`:
- Around line 235-240: The OpenTelemetry modules (go.opentelemetry.io/otel,
go.opentelemetry.io/otel/exporters/otlp/otlptrace,
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc,
go.opentelemetry.io/otel/metric, go.opentelemetry.io/otel/sdk,
go.opentelemetry.io/otel/trace) are pinned at v1.38.0 and contain known
vulnerabilities; update all of these module versions to at least v1.43.0 (prefer
exact newer tags such as v1.43.0 or later) in the go.mod entries and regenerate
your dependency metadata (go.sum) so the files contain the correct checksums,
ensuring you pin exact versions/hashes per supply-chain guidelines. Ensure the
version bumps include both the core otel module (go.opentelemetry.io/otel) and
its sdk/exporter/metric/trace submodules (otlptrace, otlptracegrpc, metric, sdk,
trace).
- Line 98: The go.mod pins an insecure indirect dependency
github.com/docker/docker v28.5.2+incompatible; update the module requirement for
github.com/docker/docker to a patched release (minimum v29.3.1) in v1/go.mod,
then run your Go module update/resolve steps (e.g., go get or go mod tidy) to
refresh go.sum and ensure the new version is selected; after updating, re-run
your OSS/vulnerability scan (OSV) to confirm the advisories are resolved.
- Line 253: The dependency google.golang.org/grpc is pinned to v1.78.0 (the
vulnerable version); update the grpc module to a fixed release (>= v1.79.3) by
changing the grpc version entry in the go.mod that currently lists
google.golang.org/grpc v1.78.0 to v1.79.3 (or newer), then run go get
google.golang.org/grpc@v1.79.3 and go mod tidy to refresh go.sum and module
graph and run the project's tests/build to ensure no breakage; ensure any CI
workflows pick up the updated go.mod.
- Line 3: The module declares Go 1.25.0 but the Dockerfile installs
GO_VERSION=go1.23.5, causing a toolchain mismatch; update the Dockerfile's
GO_VERSION variable and any download URL or references to use go1.25.0 (or the
equivalent go1.25.x token you intend) so it matches the module directive in
v1/go.mod, and verify any CI/build scripts that reference GO_VERSION are updated
as well.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: ef74815c-fd50-4426-8917-31502eb2f176
⛔ Files ignored due to path filters (1)
v1/go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
v1/go.mod
| module github.com/openshift/oc-mirror | ||
|
|
||
| go 1.24.0 | ||
| go 1.25.0 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "go.mod directive:"
rg -n '^go\s+[0-9]+\.[0-9]+' v1/go.mod
echo
echo "Dockerfile Go version references:"
rg -n 'GO_VERSION=go[0-9]+\.[0-9]+(\.[0-9]+)?|/usr/local/go/bin/go version|golang.org/dl/' DockerfileRepository: openshift/oc-mirror
Length of output: 383
Toolchain mismatch: v1/go.mod requires Go 1.25.0 but Dockerfile installs go1.23.5
v1/go.mod sets go 1.25.0 (line 3), while the Dockerfile sets GO_VERSION=go1.23.5 and downloads that toolchain from golang.org/dl/. Align the Dockerfile Go version with the module directive to prevent CI/release build/test failures.
go 1.25.0🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@v1/go.mod` at line 3, The module declares Go 1.25.0 but the Dockerfile
installs GO_VERSION=go1.23.5, causing a toolchain mismatch; update the
Dockerfile's GO_VERSION variable and any download URL or references to use
go1.25.0 (or the equivalent go1.25.x token you intend) so it matches the module
directive in v1/go.mod, and verify any CI/build scripts that reference
GO_VERSION are updated as well.
| github.com/docker/distribution v2.8.3+incompatible // indirect | ||
| github.com/docker/docker v27.5.0+incompatible // indirect | ||
| github.com/docker/docker-credential-helpers v0.8.2 // indirect | ||
| github.com/docker/docker v28.5.2+incompatible // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Verify advisories for docker module version from osv.dev
curl -s https://api.osv.dev/v1/query \
-H 'Content-Type: application/json' \
-d '{
"package": {"name":"github.com/docker/docker","ecosystem":"Go"},
"version":"28.5.2+incompatible"
}' | jq '{vuln_ids: [.vulns[]?.id], count: (.vulns|length)}'Repository: openshift/oc-mirror
Length of output: 275
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Confirm the dependency/version actually exists at the referenced location
echo "== v1/go.mod: line 90-110 =="
nl -ba v1/go.mod | sed -n '90,110p'
echo
echo "== rg occurrences =="
rg -n "github.com/docker/docker" v1/go.modRepository: openshift/oc-mirror
Length of output: 153
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== v1/go.mod: lines 90-110 =="
awk 'NR>=90 && NR<=110 {printf "%d:%s\n", NR, $0}' v1/go.mod
echo
echo "== rg occurrences in v1/go.mod =="
rg -n "github.com/docker/docker" v1/go.modRepository: openshift/oc-mirror
Length of output: 1620
🏁 Script executed:
#!/bin/bash
set -euo pipefail
curl -s https://api.osv.dev/v1/query \
-H 'Content-Type: application/json' \
-d '{
"package": {"name":"github.com/docker/docker","ecosystem":"Go"},
"version":"28.5.2+incompatible"
}' | jq '
{count:(.vulns|length),
vulns:(.vulns[] | {
id,
severity,
source: .aliases[0]? // empty,
cvss: (.cvss // .severity?.score? // empty)
})}'Repository: openshift/oc-mirror
Length of output: 252
🏁 Script executed:
#!/bin/bash
set -euo pipefail
resp="$(curl -s https://api.osv.dev/v1/query \
-H 'Content-Type: application/json' \
-d '{
"package": {"name":"github.com/docker/docker","ecosystem":"Go"},
"version":"28.5.2+incompatible"
}')"
echo "== OSV response vuln count =="
echo "$resp" | jq '.vulns | length'
echo
echo "== OSV response first vuln object (structure) =="
echo "$resp" | jq '.vulns[0]'Repository: openshift/oc-mirror
Length of output: 5001
🏁 Script executed:
#!/bin/bash
set -euo pipefail
curl -s https://api.osv.dev/v1/query \
-H 'Content-Type: application/json' \
-d '{
"package": {"name":"github.com/docker/docker","ecosystem":"Go"},
"version":"28.5.2+incompatible"
}' | jq -r '
.vulns[] | [
.id,
(.database_specific.severity // "UNKNOWN"),
(.severity? // empty),
(.aliases // [] | join(","))] | `@tsv`
'Repository: openshift/oc-mirror
Length of output: 138
🏁 Script executed:
#!/bin/bash
set -euo pipefail
curl -s https://api.osv.dev/v1/query \
-H 'Content-Type: application/json' \
-d '{
"package": {"name":"github.com/docker/docker","ecosystem":"Go"},
"version":"28.5.2+incompatible"
}' | jq '
{count:(.vulns|length),
vulns:[.vulns[] | {id, db_severity:(.database_specific.severity//"UNKNOWN"), cvss:(.severity//[])}]}'Repository: openshift/oc-mirror
Length of output: 1365
🏁 Script executed:
#!/bin/bash
set -euo pipefail
resp="$(curl -s https://api.osv.dev/v1/query \
-H 'Content-Type: application/json' \
-d '{
"package": {"name":"github.com/docker/docker","ecosystem":"Go"},
"version":"28.5.2+incompatible"
}')"
echo "$resp" | jq -r '
.vulns[] |
{
id,
sev:(.database_specific.severity // "UNKNOWN"),
range:((.affected[]?.database_specific.last_known_affected_version_range) // ""),
fixed:((.affected[]?.ranges[]?.events[]?.fixed) // empty)
} | `@json`
'Repository: openshift/oc-mirror
Length of output: 834
🏁 Script executed:
#!/bin/bash
set -euo pipefail
curl -s https://api.osv.dev/v1/query \
-H 'Content-Type: application/json' \
-d '{
"package": {"name":"github.com/docker/docker","ecosystem":"Go"},
"version":"28.5.2+incompatible"
}' | jq -r '
.vulns[] |
{
id,
sev:(.database_specific.severity // "UNKNOWN"),
summary:(.summary // ""),
aliases:(.aliases // []) | map(select(startswith("CVE-"))),
fixed:((.affected[]?.ranges[]?.events[]?.fixed) // null)
} | `@json`
'Repository: openshift/oc-mirror
Length of output: 1726
🏁 Script executed:
#!/bin/bash
set -euo pipefail
curl -s https://api.osv.dev/v1/query \
-H 'Content-Type: application/json' \
-d '{
"package": {"name":"github.com/docker/docker","ecosystem":"Go"},
"version":"28.5.2+incompatible"
}' | jq -r '
.vulns[] | {id, database_sev:(.database_specific.severity//"UNKNOWN"), aliases:(.aliases//[])} as $v
| ($v + {
fixed_for_docker: (
[ .affected[]?
| select(.package.name=="github.com/docker/docker")
| .ranges[]?.events[]?.fixed? ] | unique | join(", ")
),
last_affected_range_for_docker: (
[ .affected[]?
| select(.package.name=="github.com/docker/docker")
| .database_specific.last_known_affected_version_range? ] | unique | join(", ")
)
})
| `@json`
'Repository: openshift/oc-mirror
Length of output: 1119
🏁 Script executed:
#!/bin/bash
set -euo pipefail
curl -s https://api.osv.dev/v1/query \
-H 'Content-Type: application/json' \
-d '{
"package": {"name":"github.com/docker/docker","ecosystem":"Go"},
"version":"28.5.2+incompatible"
}' | jq -r '
.vulns[] | {
id,
db_severity:(.database_specific.severity//"UNKNOWN"),
aliases:(.aliases//[]),
affected_for_docker: [
.affected[]?
| select(.package.name=="github.com/docker/docker")
| {
range: ( .ranges[]? | {type, last:(.database_specific.last_known_affected_version_range//null), fixed: (.events[]?.fixed//null)} ),
}
] }'Repository: openshift/oc-mirror
Length of output: 1834
Bump github.com/docker/docker from v28.5.2+incompatible (OSV reports HIGH vulns)
v1/go.mod line 98 pins github.com/docker/docker v28.5.2+incompatible // indirect, which OSV flags with 7 advisories (3 HIGH, 2 MODERATE, 2 UNKNOWN), including:
- AuthZ plugin bypass:
GHSA-x744-4wpc-v9h2/ CVE-2026-34040 (fixed at 29.3.1) - docker cp bind-mount redirection:
GHSA-rg2x-37c3-w2rh/ CVE-2026-42306 - archive host exec:
GHSA-x86f-5xw2-fm2r/ CVE-2026-41567
Upgrade to a patched release (at least >= 29.3.1) and re-check OSV for the target github.com/docker/docker version.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@v1/go.mod` at line 98, The go.mod pins an insecure indirect dependency
github.com/docker/docker v28.5.2+incompatible; update the module requirement for
github.com/docker/docker to a patched release (minimum v29.3.1) in v1/go.mod,
then run your Go module update/resolve steps (e.g., go get or go mod tidy) to
refresh go.sum and ensure the new version is selected; after updating, re-run
your OSS/vulnerability scan (OSV) to confirm the advisories are resolved.
| go.opentelemetry.io/otel v1.38.0 // indirect | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 // indirect | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0 // indirect | ||
| go.opentelemetry.io/otel/metric v1.38.0 // indirect | ||
| go.opentelemetry.io/otel/sdk v1.38.0 // indirect | ||
| go.opentelemetry.io/otel/trace v1.38.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Verify advisories for otel from osv.dev
curl -s https://api.osv.dev/v1/query \
-H 'Content-Type: application/json' \
-d '{
"package": {"name":"go.opentelemetry.io/otel","ecosystem":"Go"},
"version":"1.38.0"
}' | jq '{vuln_ids: [.vulns[]?.id], count: (.vulns|length)}'Repository: openshift/oc-mirror
Length of output: 127
🏁 Script executed:
#!/bin/bash
set -euo pipefail
modules=(
"go.opentelemetry.io/otel"
"go.opentelemetry.io/otel/exporters/otlp/otlptrace"
"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc"
"go.opentelemetry.io/otel/metric"
"go.opentelemetry.io/otel/sdk"
"go.opentelemetry.io/otel/trace"
)
version="1.38.0"
for m in "${modules[@]}"; do
echo "== $m@$version =="
resp="$(curl -s https://api.osv.dev/v1/query \
-H 'Content-Type: application/json' \
-d "{\"package\":{\"name\":\"$m\",\"ecosystem\":\"Go\"},\"version\":\"$version\"}")"
echo "$resp" | jq -r '
if (.vulns|length)==0 then "NO_VULNS"
else .vulns[]
| .id as $id
| "\($id) | severity=\(.severity // "n/a") | summary=\(.summary // (.details // "") | tostring)"
end
'
# Also dump full fields for any vuln returned (kept small by filtering keys)
echo "$resp" | jq -c '
if (.vulns|length)==0 then {}
else {vulns: [.vulns[] | {id, summary, severity, details, affected: (.affected // empty)}]}
end
'
echo
doneRepository: openshift/oc-mirror
Length of output: 9473
🌐 Web query:
GHSA-mh2q-q3fh-2475 allocation amplification DoS fixed version OpenTelemetry Go
💡 Result:
GHSA-mh2q-q3fh-2475 is an OpenTelemetry-Go issue where multi-value W3C baggage header extraction can cause excessive allocations/CPU, enabling remote DoS-style amplification. The vulnerability affects versions before the fix and is fixed in OpenTelemetry-Go 1.41.0. [1][2] What’s happening (root cause) When extracting baggage from an HTTP carrier that supports multiple values, extractMultiBaggage iterates over all inbound baggage header field-values, parses each value independently, and aggregates members across values. Even though there is a per-value parsing cap (8192 bytes), the multi-value path repeats parsing/aggregation once per header line, so attackers can increase CPU and allocations by sending many baggage: headers within the overall request header size limits. [1] Where the fix lands / fixed version NVD states the issue is fixed in OpenTelemetry-Go 1.41.0 (affected range 1.36.0 up to excluding 1.41.0). [2] Practical mitigation / upgrade guidance Upgrade the go.opentelemetry.io/otel / OpenTelemetry-Go libraries to 1.41.0 or later to include the patch. [2] If you want additional defense-in-depth, the advisory recommends avoiding repeated parsing across multi-values by enforcing a global budget and/or normalizing multi-values into a single value before parsing (e.g., cap total parsed bytes across all baggage headers). [1] Supporting evidence (authoritative sources) The advisory describes the multi-value baggage extraction behavior, attacker-controlled input (multiple inbound baggage headers), and the remote allocation amplification effect. [1]
Citations:
Fix OpenTelemetry v1.38.0 vulnerabilities in v1/go.mod (lines 235-240)
go.opentelemetry.io/otel v1.38.0→ GHSA-mh2q-q3fh-2475: multi-value W3Cbaggageextraction causes allocation-amplification remote DoS; fixed ingo.opentelemetry.io/otel/ OpenTelemetry-Go v1.41.0.go.opentelemetry.io/otel/sdk v1.38.0→ GHSA-9h8m-3fm2-qjrq and GHSA-hfvc-g4fc-pqhx: PATH hijacking / arbitrary code execution on affected OSes; fixed in v1.40.0 and v1.43.0 respectively.
Upgrade the pinned OTel modules to ≥ v1.43.0 (and pin exact versions/hashes per supply-chain guidelines).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@v1/go.mod` around lines 235 - 240, The OpenTelemetry modules
(go.opentelemetry.io/otel, go.opentelemetry.io/otel/exporters/otlp/otlptrace,
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc,
go.opentelemetry.io/otel/metric, go.opentelemetry.io/otel/sdk,
go.opentelemetry.io/otel/trace) are pinned at v1.38.0 and contain known
vulnerabilities; update all of these module versions to at least v1.43.0 (prefer
exact newer tags such as v1.43.0 or later) in the go.mod entries and regenerate
your dependency metadata (go.sum) so the files contain the correct checksums,
ensuring you pin exact versions/hashes per supply-chain guidelines. Ensure the
version bumps include both the core otel module (go.opentelemetry.io/otel) and
its sdk/exporter/metric/trace submodules (otlptrace, otlptracegrpc, metric, sdk,
trace).
| google.golang.org/genproto v0.0.0-20251202230838-ff82c1b0f217 // indirect | ||
| google.golang.org/genproto/googleapis/api v0.0.0-20251222181119-0a764e51fe1b // indirect | ||
| google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b // indirect | ||
| google.golang.org/grpc v1.78.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Verify grpc advisories for pinned version from osv.dev
curl -s https://api.osv.dev/v1/query \
-H 'Content-Type: application/json' \
-d '{
"package": {"name":"google.golang.org/grpc","ecosystem":"Go"},
"version":"1.78.0"
}' | jq '{vuln_ids: [.vulns[]?.id], count: (.vulns|length)}'Repository: openshift/oc-mirror
Length of output: 147
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# 1) OSV: grpc v1.78.0 (get vuln details to assess impact/severity)
grpc_resp="$(curl -s https://api.osv.dev/v1/query \
-H 'Content-Type: application/json' \
-d '{"package":{"name":"google.golang.org/grpc","ecosystem":"Go"},"version":"1.78.0"}')"
echo "$grpc_resp" | jq -r '.vulns[].id' > /tmp/osv_grpc_ids.txt
echo "grpc v1.78.0 OSV vuln IDs:"
cat /tmp/osv_grpc_ids.txt
echo "grpc v1.78.0 OSV vuln detail summaries:"
while read -r id; do
curl -s https://api.osv.dev/v1/vuln/$id -H 'Accept: application/json' \
| jq -r --arg id "$id" '
{
id: $id,
details: (
(.details // .aliases // empty) | tostring
),
severity: (
.severity[]? | . // empty
),
affected: (
(.affected // empty) | {packages: ( .packages // empty)}
)
}
| .severity? ,
"----"
'
done < /tmp/osv_grpc_ids.txt
# 2) OSV: docker/docker 28.5.2+incompatible
docker_resp="$(curl -s https://api.osv.dev/v1/query \
-H 'Content-Type: application/json' \
-d '{"package":{"name":"github.com/docker/docker","ecosystem":"Go"},"version":"28.5.2+incompatible"}')"
echo
echo "docker/docker 28.5.2+incompatible OSV response:"
echo "$docker_resp" | jq '{vuln_ids: [.vulns[]?.id], count: (.vulns|length)}'
echo "$docker_resp" | jq -r '.vulns[].id' > /tmp/osv_docker_ids.txt
echo "docker/docker v28.5.2+incompatible OSV vuln IDs:"
cat /tmp/osv_docker_ids.txt
# Show minimal details (just severity + summary/description fields) for each docker vuln id
echo "docker/docker v28.5.2+incompatible OSV vuln brief:"
while read -r id; do
curl -s https://api.osv.dev/v1/vuln/$id -H 'Accept: application/json' \
| jq -r --arg id "$id" '
{
id: $id,
summary: (.summary // empty),
details: (.details // empty),
affected: (.affected // empty | {ecosystem: (.ecosystem // empty)}),
severity: (.severity // empty),
references: ((.references // []) | map(.url) | .[0:3])
} | `@json`
'
done < /tmp/osv_docker_ids.txt
# 3) OSV: otel v1.38.0
otel_resp="$(curl -s https://api.osv.dev/v1/query \
-H 'Content-Type: application/json' \
-d '{"package":{"name":"go.opentelemetry.io/otel","ecosystem":"Go"},"version":"1.38.0"}')"
echo
echo "go.opentelemetry.io/otel 1.38.0 OSV response:"
echo "$otel_resp" | jq '{vuln_ids: [.vulns[]?.id], count: (.vulns|length)}'
echo "$otel_resp" | jq -r '.vulns[].id' > /tmp/osv_otel_ids.txt
echo "go.opentelemetry.io/otel v1.38.0 OSV vuln IDs:"
cat /tmp/osv_otel_ids.txt
echo "go.opentelemetry.io/otel v1.38.0 OSV vuln brief:"
while read -r id; do
curl -s https://api.osv.dev/v1/vuln/$id -H 'Accept: application/json' \
| jq -r --arg id "$id" '
{
id: $id,
summary: (.summary // empty),
details: (.details // empty),
severity: (.severity // empty),
references: ((.references // []) | map(.url) | .[0:3])
} | `@json`
'
done < /tmp/osv_otel_ids.txt
# 4) Confirm go.mod directive and Dockerfile GO_VERSION
echo
echo "Find go.mod Go version directive:"
rg -n '^go\s+[0-9]+\.[0-9]+' v1/go.mod || true
echo
echo "Find Dockerfile GO_VERSION setting:"
# locate Dockerfile(s) containing GO_VERSION
dockerfile_matches="$(rg -n 'GO_VERSION=go1\.' -S Dockerfile* **/Dockerfile* 2>/dev/null || true)"
echo "$dockerfile_matches" | head -n 50
# Also show the specific snippet around any match
if [ -n "$dockerfile_matches" ]; then
file="$(echo "$dockerfile_matches" | head -n1 | cut -d: -f1)"
line="$(echo "$dockerfile_matches" | head -n1 | cut -d: -f2)"
start=$((line-15))
end=$((line+15))
echo
echo "Snippet from $file around line $line:"
sed -n "${start},${end}p" "$file" | nl -ba | sed -n "1,60p"
fi
# 5) Confirm grpc version line in go.mod
echo
echo "Verify grpc line in v1/go.mod:"
rg -n 'google\.golang\.org/grpc\s+v' v1/go.modRepository: openshift/oc-mirror
Length of output: 1161
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Helper: print concise OSV vuln fields
print_vuln () {
local id="$1"
echo "== $id =="
curl -s "https://api.osv.dev/v1/vuln/$id" \
-H 'Accept: application/json' \
| jq -r '
{
id: .id,
summary: (.summary // empty),
severity: (.severity // empty),
aliases: (.aliases // empty),
details_preview: (
((.details // [] | .[]?) | tostring) // empty
)
}
' | head -n 30
echo
}
# OSV: grpc v1.78.0 (IDs from earlier query)
print_vuln "GHSA-p77j-4mvh-x3m3"
print_vuln "GO-2026-4762"
# OSV: docker/docker 28.5.2+incompatible (IDs from earlier query)
for id in \
"GHSA-pxq6-2prw-chj9" \
"GHSA-rg2x-37c3-w2rh" \
"GHSA-vp62-88p7-qqf5" \
"GHSA-x744-4wpc-v9h2" \
"GHSA-x86f-5xw2-fm2r" \
"GO-2026-4883" \
"GO-2026-4887"
do
print_vuln "$id"
done
# OSV: go.opentelemetry.io/otel 1.38.0 (IDs from earlier query)
print_vuln "GHSA-mh2q-q3fh-2475"
echo "----"
echo "go directive in v1/go.mod:"
rg -n '^go\s+[0-9]+\.[0-9]+' v1/go.mod || true
echo "----"
echo "grpc version line in v1/go.mod:"
rg -n 'google\.golang\.org/grpc\s+v' v1/go.mod || true
echo "----"
echo "Dockerfile GO_VERSION occurrences (around matches):"
rg -n 'GO_VERSION=go1\.' Dockerfile **/Dockerfile* 2>/dev/null || true
match_line="$(rg -n 'GO_VERSION=go1\.23\.5' Dockerfile **/Dockerfile* 2>/dev/null | head -n1 || true)"
if [ -n "$match_line" ]; then
file="$(echo "$match_line" | cut -d: -f1)"
line="$(echo "$match_line" | cut -d: -f2)"
start=$((line-12))
end=$((line+12))
echo "Snippet from $file:$line:"
sed -n "${start},${end}p" "$file"
fiRepository: openshift/oc-mirror
Length of output: 1833
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# 1) Dump key OSV fields for a specific id (small, structured)
show_osv () {
local id="$1"
echo "=== $id (key fields) ==="
curl -s "https://api.osv.dev/v1/vuln/$id" \
-H 'Accept: application/json' \
| jq -r '
{
id: .id,
aliases: (.aliases // []),
summary: .summary,
details: (.details // [] | map(. | tostring) | .[0:3]),
severity: (.severity // [] | map(. // {}) | .[0:5]),
affected: (.affected // [] | map({package: (.package // {}), ranges: (.ranges // [])}) | .[0:3]),
references: ((.references // []) | map(.url) | .[0:5])
} | `@json`
'
echo
}
# IDs observed from earlier OSV query results
show_osv "GHSA-p77j-4mvh-x3m3"
show_osv "GO-2026-4762"
show_osv "GHSA-mh2q-q3fh-2475"
for id in "GHSA-pxq6-2prw-chj9" "GHSA-rg2x-37c3-w2rh" "GHSA-vp62-88p7-qqf5" "GHSA-x744-4wpc-v9h2" "GHSA-x86f-5xw2-fm2r" "GO-2026-4883" "GO-2026-4887"; do
show_osv "$id"
done
# 2) Inspect v1/go.mod for any toolchain directive and current go directive(s)
echo "=== v1/go.mod go/toolchain directives ==="
rg -n '^(go|toolchain)\s+' v1/go.mod || true
# 3) Confirm grpc version line in go.mod (and whether any other grpc versions exist)
echo "=== grpc versions found in v1/go.mod ==="
rg -n 'google\.golang\.org/grpc\s+v' v1/go.mod || trueRepository: openshift/oc-mirror
Length of output: 1575
🏁 Script executed:
#!/bin/bash
set -euo pipefail
ids=("GHSA-p77j-4mvh-x3m3" "GO-2026-4762" "GHSA-mh2q-q3fh-2475")
for id in "${ids[@]}"; do
echo "=== Raw OSV response for $id ==="
resp_file="/tmp/osv_${id}.json"
http_code="$(curl -sS -o "$resp_file" -w "%{http_code}" \
"https://api.osv.dev/v1/vuln/$id" \
-H 'Accept: application/json')"
echo "HTTP: $http_code"
echo "Top-level keys (jq keys):"
jq 'keys' "$resp_file" || true
echo "First 40 lines of JSON:"
head -n 40 "$resp_file" || true
echo
done
echo "=== Check grpc OSV query endpoint response structure (v1/query) ==="
curl -sS "https://api.osv.dev/v1/query" \
-H 'Content-Type: application/json' \
-d '{"package":{"name":"google.golang.org/grpc","ecosystem":"Go"},"version":"1.78.0"}' \
| jq 'keys, {vulns_count:(.vulns|length), vulns_ids: ([.vulns[]?.id])}' || trueRepository: openshift/oc-mirror
Length of output: 856
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Dump OSV v1/query response objects for the returned IDs (limit size)
dump_query () {
local pkg_name="$1"
local version="$2"
local out="/tmp/osv_query_${pkg_name//\//_}_${version}.json"
echo "== Query: $pkg_name $version =="
curl -sS -o "$out" https://api.osv.dev/v1/query \
-H 'Content-Type: application/json' \
-d "{\"package\":{\"name\":\"$pkg_name\",\"ecosystem\":\"Go\"},\"version\":\"$version\"}"
jq '{vulns: ([.vulns[]? | {id: .id, aliases: .aliases, summary: .summary, severity: .severity, details: (.details // [] | length)}])}' "$out"
echo
# Also print first vuln object raw keys to see what fields exist
jq -r '.vulns[0] | keys' "$out" 2>/dev/null || true
}
dump_query "google.golang.org/grpc" "1.78.0"
dump_query "github.com/docker/docker" "28.5.2+incompatible"
dump_query "go.opentelemetry.io/otel" "1.38.0"Repository: openshift/oc-mirror
Length of output: 4317
🌐 Web query:
GHSA-p77j-4mvh-x3m3 grpc auth bypass severity
💡 Result:
The vulnerability GHSA-p77j-4mvh-x3m3, also identified as CVE-2026-33186, is classified as a Critical severity issue [1][2][3]. It has a CVSS v3.1 base score of 9.1 [2][3]. This vulnerability is an authorization bypass in gRPC-Go resulting from improper input validation of the HTTP/2:path pseudo-header [1][4]. gRPC-Go servers were previously too permissive, allowing requests where the:path header omitted the mandatory leading slash (e.g., using 'Service/Method' instead of '/Service/Method') [3][4]. Because authorization interceptors (such as the official grpc/authz package or those relying on info.FullMethod) evaluated the raw, non-canonical path string, security policies using "deny" rules for canonical paths (starting with /) failed to match these malformed requests [3][4][5]. If a fallback "allow" rule existed, the request would be incorrectly permitted [4][5]. The issue has been patched; updated versions of gRPC-Go ensure that requests with a:path missing the leading slash are rejected with a codes.Unimplemented error [4][5]. Users are also advised to ensure any fronting reverse proxies or load balancers enforce strict HTTP/2 compliance and to adopt a "default deny" posture in authorization policies where possible [4][5].
Citations:
- 1: GHSA-p77j-4mvh-x3m3
- 2: https://test.osv.dev/vulnerability/GHSA-p77j-4mvh-x3m3
- 3: https://nvd.nist.gov/vuln/detail/CVE-2026-33186
- 4: GHSA-p77j-4mvh-x3m3
- 5: https://osv.dev/vulnerability/GHSA-p77j-4mvh-x3m3
🌐 Web query:
GO-2026-4762 grpc advisory
💡 Result:
GO-2026-4762 is a Go vulnerability report identifier corresponding to CVE-2026-33186, which describes an authorization bypass vulnerability in the gRPC-Go library (google.golang.org/grpc) [1][2][3]. This vulnerability arises from improper input validation of the HTTP/2:path pseudo-header [4][3]. Specifically, the gRPC-Go server was found to be too lenient when routing requests, accepting:path values that lacked the mandatory leading slash (e.g., Service/Method instead of /Service/Method) [4][3]. While the server would still route these requests to the correct handler, authorization interceptors (such as those using the official grpc/authz package) would evaluate the raw, non-canonical path string [4][3]. If a security policy relied on canonical paths (starting with /) for "deny" rules but allowed other requests by default, this discrepancy allowed an attacker to bypass the authorization policy [4][3]. The vulnerability is addressed in gRPC-Go version 1.79.3, which enforces strict path checking and rejects any request where the:path does not begin with a leading slash, returning a codes.Unimplemented error [4][3]. Users are strongly advised to upgrade to version 1.79.3 or newer [1][4][5]. If an immediate upgrade is not feasible, temporary mitigations include implementing custom validating interceptors, infrastructure-level path normalization, or hardening security policies [3].
Citations:
- 1: https://test.osv.dev/vulnerability/GO-2026-4762
- 2: Security: GO-2026-4762 in openbao/openbao-plugins/main openbao/dependency-vulnerabilities#10
- 3: https://nvd.nist.gov/vuln/detail/cve-2026-33186
- 4: GHSA-p77j-4mvh-x3m3
- 5: Critical gRPC vulnerability (CVE-2026-33186) kubernetes/autoscaler#9406
🌐 Web query:
GHSA-mh2q-q3fh-2475 go.opentelemetry.io/otel 1.38.0 severity impact
💡 Result:
GHSA-mh2q-q3fh-2475 is a security advisory for the OpenTelemetry Go implementation regarding excessive memory and CPU consumption during baggage header extraction [1][2]. Vulnerability Impact: The vulnerability allows for a remote denial-of-service (DoS) amplification attack [1][2]. By sending an inbound HTTP request containing many baggage header field-values, an attacker can trigger repeated, independent parsing and aggregation of these headers [1][2]. Because the library parses each field-value independently, this process can lead to significant per-request memory allocations and increased CPU latency, even if each individual header value stays within the 8192-byte parsing limit [1][2]. Technical Details: The issue is located in the propagation/baggage.go file within the extractMultiBaggage function [1][2]. Under default net/http configurations—which may allow up to 1MB of header data—a single crafted request can cause excessive work for the server [1][2]. Mitigation and Remediation: To remediate this, it is recommended to ensure your project is using a patched version of the OpenTelemetry Go library [1][2]. The vulnerability was addressed by ensuring that multi-value baggage headers are handled efficiently, such as by normalizing them into a single string or enforcing a global byte budget across all header values before parsing [1][2]. Regarding your specific mention of go.opentelemetry.io/otel version 1.38.0: While version 1.38.0 is a known release in the OpenTelemetry Go ecosystem, this specific advisory (GHSA-mh2q-q3fh-2475) highlights a vulnerability found in the library's baggage extraction logic [1][2]. Users should verify their current version and upgrade to a release where this behavior has been corrected to prevent the described DoS amplification [1][2].
Citations:
🌐 Web query:
GHSA-pxq6-2prw-chj9 github.com/docker/docker severity impact
💡 Result:
GHSA-pxq6-2prw-chj9 is a security vulnerability in Moby (the open-source container framework used by Docker) concerning an off-by-one error in plugin privilege validation [1][2]. Severity and Impact - Severity: Moderate [1][2][3]. It has a CVSS v3.1 base score of 6.8 [1][2][3]. - Impact: The vulnerability allows the plugin privilege validation to be bypassed during the docker plugin install process [1][2]. Because of an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a set of privileges that differs from what the user intended to approve [1][2]. In cases where a plugin requests exactly one privilege, no comparison is performed at all [1][2]. This could potentially allow a malicious plugin to obtain sensitive permissions, such as broad device access [1][2]. - Prerequisites for Exploitation: Exploitation requires a user to install a malicious plugin [1][2]. If plugins are not in use, the system is not affected [1][2]. Additionally, Docker Desktop does not support plugins [1][2]. Remediation - Patch: The vulnerability was addressed in Moby version 29.3.1 [3][4]. Users are advised to upgrade to this version or newer [4]. - Workarounds: If an immediate update is not possible, users should avoid installing plugins from untrusted sources, carefully review all requested privileges during installation, restrict access to the Docker daemon to trusted parties (following the principle of least privilege), and avoid relying on the plugin privilege approval flow as a sole security boundary [5].
Citations:
- 1: https://test.osv.dev/vulnerability/GHSA-pxq6-2prw-chj9
- 2: GHSA-pxq6-2prw-chj9
- 3: https://app.opencve.io/cve/CVE-2026-33997
- 4: https://nvd.nist.gov/vuln/detail/CVE-2026-33997
- 5: https://osv.dev/vulnerability/GHSA-pxq6-2prw-chj9
🌐 Web query:
GHSA-rg2x-37c3-w2rh github.com/docker/docker severity impact
💡 Result:
GHSA-rg2x-37c3-w2rh is a security advisory concerning a race condition in the docker cp command within github.com/docker/docker [1][2]. Severity: The vulnerability is classified as High severity, with a CVSS v3.1 score of 7.2 (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H) [2]. Impact: The race condition allows a malicious container to redirect a volume bind mount to an arbitrary path on the host system [1][2]. The specific impact depends on the mount options and content of the volume [2]: - If the volume is writable, a malicious container could potentially overwrite arbitrary files on the host [2]. - If the volume is read-only, the host path may be masked for the duration of the docker cp operation, resulting in a denial of service (DoS) [2]. - The mount created is temporary and is removed after the docker cp operation completes; however, any file writes performed during this time persist on the host [2]. Conditions for exploitation include: - The container must have at least one volume mount [2]. - A process inside the container must be able to rapidly create and swap symlinks at the volume mount destination path [2]. - An operator must perform a docker cp operation into the container or interact with the PUT/HEAD /containers/{id}/archive API endpoints [2]. Containers without volume mounts are not affected [2]. As of May 2026, the vulnerability affects github.com/docker/docker versions <= 28.5.2, with no upstream release currently available to fix this specific module path [3].
Citations:
- 1: GHSA-rg2x-37c3-w2rh
- 2: https://osv.dev/vulnerability/GHSA-rg2x-37c3-w2rh
- 3: https://images.chainguard.dev/security/CGA-j9q3-xhj9-vgf6
Blocker: upgrade google.golang.org/grpc v1.78.0 (critical auth bypass)
v1/go.mod pins google.golang.org/grpc to v1.78.0 (OSV: GHSA-p77j-4mvh-x3m3 / CVE-2026-33186), a Critical authorization bypass in gRPC-Go via missing leading slash in the HTTP/2 :path pseudo-header. Upgrade to the fixed gRPC-Go release (per the advisory, >= v1.79.3) before merge.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@v1/go.mod` at line 253, The dependency google.golang.org/grpc is pinned to
v1.78.0 (the vulnerable version); update the grpc module to a fixed release (>=
v1.79.3) by changing the grpc version entry in the go.mod that currently lists
google.golang.org/grpc v1.78.0 to v1.79.3 (or newer), then run go get
google.golang.org/grpc@v1.79.3 and go mod tidy to refresh go.sum and module
graph and run the project's tests/build to ensure no breakage; ensure any CI
workflows pick up the updated go.mod.
Bumps the oc-mirror-v1-security-updates group with 7 updates in the /v1 directory:
1.7.271.7.3227.5.0+incompatible29.2.0+incompatible5.14.05.19.13.18.43.20.24.0.54.1.41.6.41.8.51.3.61.5.0Updates
github.com/containerd/containerdfrom 1.7.27 to 1.7.32Release notes
Sourced from github.com/containerd/containerd's releases.
... (truncated)
Commits
180a7b7Merge pull request #13452 from samuelkarp/prepare-1.7.32bc87d86Prepare release notes for v1.7.326a05dddMerge pull request #13450 from samuelkarp/oci-withuser-errrange-1.79c3d01bMerge pull request #13406 from k8s-infra-cherrypick-robot/cherry-pick-13327-t...e55b747seccomp: Block AF_ALG in default socket policy4627a65seccomp: Document socket rule scope and socketcall limitation33d9e24Merge pull request #10028 from brandond/fix-hosts-toml503f479oci: return explicit error for out-of-range USER values4393e22Merge pull request #13299 from chrishenzie/release/1.7-volatile9407331Support both styles of volatile mount optionUpdates
github.com/docker/clifrom 27.5.0+incompatible to 29.2.0+incompatibleCommits
0b9d198Merge pull request #6764 from vvoland/update-docker9c9ec73vendor: github.com/moby/moby/client v0.2.2bab3e81vendor: github.com/moby/moby/api v1.53.02e64fc1Merge pull request #6367 from thaJeztah/template_slicejoin1f2ba2aMerge pull request #6760 from thaJeztah/container_create_fix_errore34a342templates: make "join" work with non-string slices and map valuesa86356dMerge pull request #6763 from thaJeztah/bump_mapstructure771660avendor: github.com/go-viper/mapstructure/v2 v2.5.09cff36bMerge pull request #6762 from thaJeztah/bump_x_deps08ed2bccli/command/container: make injecting config.json failures a warningUpdates
github.com/go-git/go-git/v5from 5.14.0 to 5.19.1Release notes
Sourced from github.com/go-git/go-git/v5's releases.
... (truncated)
Commits
3c3be60Merge pull request #2137 from go-git/validate-v53fba897plumbing: format/packfile, cap delta chain depth in parsera97d660Merge pull request #2125 from hiddeco/v5/format-input-boundsaeaa125plumbing: format/objfile, require Header before Read1f38e17plumbing: format/packfile, bound inflate sizef7545a0plumbing: format/idxfile, bound nr by file size170b881Merge pull request #2116 from pjbgf/symlink-v57b6d994Merge pull request #2117 from hiddeco/v5/worktree-fs-mkdirall-root-noopf0709b3git: Stop validating symlink target paths776d00fgit: Allow MkdirAll on worktree-root pathsUpdates
helm.sh/helm/v3from 3.18.4 to 3.20.2Release notes
Sourced from helm.sh/helm/v3's releases.
... (truncated)
Commits
8fb76d6fix: Chart dot-name path bug3a8927efix: pin codeql-action/upload-sarif to commit SHA in scorecards workflowa2369cachore(deps): bump the k8s-io group with 7 updates90e1056add image index test911f2e9fix pulling charts from OCI indices76dad33Remove refactorring changes from coalesce_test.go45c12f7Fix import26c6f19Update pkg/chart/common/util/coalesce_test.go09f5129Fix lint warning417deb2Preserve nil values in chart alreadyUpdates
github.com/go-git/go-billy/v5from 5.6.2 to 5.9.0Release notes
Sourced from github.com/go-git/go-billy/v5's releases.
Commits
237e529Merge pull request #206 from pjbgf/v5-improvements04edb39build: Add go-git integration testd8efefdosfs: preserve empty ChrootOS base07f2a0bMerge pull request #205 from pjbgf/v5-improvements25207c8build: Bump Go versions in workflows2fda229osfs: ChrootOS eval baseDir on creation427b27fMerge pull request #203 from pjbgf/v5-improvements7d5a23echroot: Reject symlink loops2c2287autil: avoid following symlinks in RemoveAll fallbackcbd88e9Fix mount path handlingUpdates
github.com/go-jose/go-jose/v4from 4.0.5 to 4.1.4Release notes
Sourced from github.com/go-jose/go-jose/v4's releases.
... (truncated)
Commits
0e59876Merge commit from forkddffdbcBump actions/checkout from 5 to 6 (#213)5348b9aReject JWS with an unprotected critical b64 header (#210)9153a5eBump actions/setup-python from 5 to 6 (#208)2126e17Bump actions/setup-go from 5 to 6 (#209)9860c65Bump actions/checkout from 4 to 5 (#206)14239fdRemove Go 1.23 support (#205)a16e158Update CI to run on Go 1.24 and 1.25 (#204)a1565a4testutils/assert: remove True, Nil, NotNil (#202)3a80e13jwe: accept non-pointer JSONWebKey in Recipient (#200)Updates
github.com/sigstore/fulciofrom 1.6.4 to 1.8.5Release notes
Sourced from github.com/sigstore/fulcio's releases.
... (truncated)
Changelog
Sourced from github.com/sigstore/fulcio's changelog.
... (truncated)
Commits
eaae2f2Add anchors when matching meta issuer regexp (GHSA-59jp-pj84-45mr) (#2263)9325775Update changelog for v1.8.5 (#2264)b23705dbuild(deps): bump google.golang.org/api from 0.258.0 to 0.259.0 (#2260)9e8841dbuild(deps): bump golang froma22b2e6to36b4f45(#2251)5c13588build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#2253)4c823aebuild(deps): bump the all group across 1 directory with 4 updates (#2259)c15246abuild(deps): bump google.golang.org/api from 0.257.0 to 0.258.0 (#2252)f2e48e1Use transparency-dev tesseract image (#2250)9e26cb4Add read service for CT log (#2258)7bff3d6Switch to go.yaml.in/yaml/v3 (#2257)Updates
github.com/sigstore/rekorfrom 1.3.6 to 1.5.0Release notes
Sourced from github.com/sigstore/rekor's releases.
... (truncated)
Changelog
Sourced from github.com/sigstore/rekor's changelog.
... (truncated)
Commits
fe9717fChangelog for v1.5.0 (#2730)60ef2bcDrop support for fetching public keys by URL in the search index (#2731)ca625dcbuild(deps): Bump github.com/redis/go-redis/v9 from 9.14.1 to 9.17.2 (#2706)39bae3dMerge commit from fork (#2729)812e699build(deps): Bump google.golang.org/api from 0.256.0 to 0.259.0 (#2723)4596e4ebuild(deps): Bump golang.org/x/net from 0.47.0 to 0.48.0 (#2722)a3e73cdbuild(deps): Bump github.com/sigstore/sigstore from 1.9.5 to 1.10.3 (#2724)94d259cbuild(deps): Bump the all group across 1 directory with 3 updates (#2727)a5329c9build(deps): Bump the all group with 2 updates (#2728)5e6bdcdbuild(deps): Bump google.com/cloudsdktool/google-cloud-cli (#2726)Updates
github.com/sigstore/sigstorefrom 1.8.9 to 1.10.3Release notes
Sourced from github.com/sigstore/sigstore's releases.
... (truncated)
Commits
72f0ed7build(deps): Bump github.com/aws/aws-sdk-go-v2/config (#2230)b257168build(deps): Bump github.com/aws/aws-sdk-go-v2 in /pkg/signature/kms/aws (#2226)84f57b8build(deps): Bump github.com/sigstore/sigstore (#2221)bdc1a86build(deps): Bump actions/checkout from 5.0.1 to 6.0.0 (#2220)11dfe81build(deps): Bump golang.org/x/crypto in /pkg/signature/kms/aws (#2236)0214948Add back ValidatePubKey as a deprecated, minimal function (#2235)