OCPBUGS-108032: update otel to 1.44.0 to fix CVE-2026-41178 - #684
OCPBUGS-108032: update otel to 1.44.0 to fix CVE-2026-41178#684ehearne-redhat wants to merge 1 commit into
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
jira/severity-important
|
@ehearne-redhat: This pull request references Jira Issue OCPBUGS-108032, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (79)
📒 Files selected for processing (1)
Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review. WalkthroughThe pull request updates indirect Go dependencies in ChangesIndirect dependency updates
Estimated code review effort: 1 (Trivial) | ~3 minutes Merge Risk: ⚪ Minimal · up to The dependency refresh does not affect the cited vulnerable package because that package is absent and unreferenced in this repository; no actionable merge-blocking risk remains beyond normal checks. 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.) Full details: Stable And Deterministic Test NamesExplanation PASS. The pull request changes dependency metadata and vendored dependency files only. The diff from cd8b27c to its parent contains no test files, no files outside go.mod, go.sum, or vendor/, and no added Ginkgo title calls. Therefore, the pull request introduces no unstable or overly-specific test name. Full details: Test Structure And QualityExplanation PASS: The pull request does not change Ginkgo test code. The diff contains 80 dependency and vendored-source paths, with zero changed *_test.go files and no Ginkgo constructs such as It, BeforeEach, AfterEach, Eventually, or Consistently. Therefore, the listed test-structure requirements are not applicable. Full details: Microshift Test CompatibilityExplanation The pull request changes dependency declarations, checksums, and vendored dependency code only. The diff adds or modifies no test paths and adds no Ginkgo constructs such as It(), Describe(), Context(), or When(). Therefore, the MicroShift test compatibility check is not applicable. Full details: Single Node Openshift (Sno) Test CompatibilityExplanation PASS — The pull request changes dependency declarations, checksums, and vendored dependency files only. The diff adds no Go files outside vendor, no test files, and no new Ginkgo e2e constructs such as Full details: Topology-Aware Scheduling CompatibilityExplanation PASS: The pull request changes only dependency metadata ( Full details: Ote Binary Stdout ContractExplanation PASS. The pull request changes dependency declarations and vendored dependency code only. The only non-vendor changes are go.mod and go.sum. The changed Go additions contain no fmt.Print*, log output, klog, grpclog, os.Stdout, or SetOutput calls. Changed generated init functions only initialize protobuf descriptors. The OTE main function is unchanged, so its pre-existing klog.Fatal path is not caused by this pull request. Full details: Ipv6 And Disconnected Network Test CompatibilityExplanation PASS: The pull request adds no Ginkgo or e2e tests. The diff from Full details: No-Weak-CryptoExplanation PASS: The pull request only updates dependency versions and vendored generated/dependency code. The added-line scan found no MD5, SHA-1, DES, 3DES, RC4, Blowfish, or ECB implementation or call. The changed OTel hash code uses xxHash, and the only crypto import added to changed code is Full details: Container-PrivilegesExplanation PASS — The pull request changes dependency versions, vendored source, and one vendored dependency Dockerfile image tag. No changed container or Kubernetes manifest introduces Full details: No-Sensitive-Data-In-LogsExplanation PASS. The pull request changes module metadata and vendored dependencies only. The added Go code contains no new logging or print calls. The OpenTelemetry baggage error-handler calls still report parser errors, but the same path already existed in the parent revision. New aggregate-size errors contain only numeric limits. The grpc-gateway changes do not add sensitive-data logging. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
/cherry-pick release-5.0 |
|
@ehearne-redhat: once the present PR merges, I will cherry-pick it on top of DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@ehearne-redhat: This pull request references Jira Issue OCPBUGS-108032, which is valid. 3 validation(s) were run on this bug
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Scheduling tests matching the |
|
@ehearne-redhat: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/verified by @gangwgr |
openshift-ci-robot
added
the
verified
|
@gangwgr: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
We generally don't put Jira issue IDs in commit messages, can we remove that pls? |
|
/hold |
openshift-ci
Bot
added
the
do-not-merge/hold
This change fixes CVE-2026-41178 by updating otel to v1.44.0 and its dependencies. See https://pkg.go.dev/vuln/GO-2026-5158 for reference.
cd8b27c to
508fae9
Compare
openshift-ci-robot
removed
the
verified
|
@tchap that's done now - feel free to take a look. :) |
|
/lgtm |
openshift-ci
Bot
removed
the
do-not-merge/hold
|
Scheduling tests matching the |
|
/pipeline required |
|
Scheduling tests matching the |
6 participants
This change fixes CVE-2026-41178 by updating otel to v1.44.0 and its dependencies.
See https://pkg.go.dev/vuln/GO-2026-5158 for reference.
Summary by CodeRabbit