NO-ISSUE: Synchronize From Upstream Repositories #788
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -20,15 +20,15 @@ require ( | |
| github.com/google/renameio/v2 v2.0.2 | ||
| github.com/gorilla/handlers v1.5.2 | ||
| github.com/graphql-go/graphql v0.8.1 | ||
| github.com/klauspost/compress v1.19.1 | ||
| github.com/opencontainers/go-digest v1.0.0 | ||
| github.com/opencontainers/image-spec v1.1.1 | ||
| github.com/operator-framework/api v0.45.0 | ||
| github.com/operator-framework/helm-operator-plugins v0.9.1 | ||
| github.com/operator-framework/operator-registry v1.73.0 | ||
| github.com/prometheus/client_golang v1.24.0 | ||
| github.com/prometheus/common v0.70.1 | ||
| github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 | ||
| github.com/spf13/cobra v1.10.2 | ||
| github.com/spf13/pflag v1.0.10 | ||
| github.com/stretchr/testify v1.11.1 | ||
|
|
@@ -38,13 +38,13 @@ require ( | |
| golang.org/x/sync v0.22.0 | ||
| golang.org/x/tools v0.48.0 | ||
| helm.sh/helm/v3 v3.21.3 | ||
| k8s.io/api v0.36.3 | ||
| k8s.io/apiextensions-apiserver v0.36.2 | ||
|
There was a problem hiding this comment. 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- go.mod diff ---'
git diff -- go.mod
printf '%s\n' '--- go.mod Kubernetes block ---'
nl -ba go.mod | sed -n '35,52p'
printf '%s\n' '--- go.sum entries for changed Kubernetes modules ---'
for module in \
k8s.io/api \
k8s.io/apimachinery \
k8s.io/apiextensions-apiserver \
k8s.io/client-go \
k8s.io/component-base \
k8s.io/kube-aggregator \
k8s.io/kube-openapi
do
printf '%s\n' "[$module]"
rg "^${module//\//\\/} v0\\.36\\.[23](/go\\.mod)? " go.sum || true
done
printf '%s\n' '--- repository supply-chain and dependency metadata files ---'
git ls-files | rg '(^|/)(go\\.sum|\\.github/|Dockerfile|Makefile|\\.goreleaser|.*sbom.*|.*provenance.*|.*cosign.*)' | head -200Repository: openshift/operator-framework-operator-controller Length of output: 7010 🌐 Web query:
💡 Result: The k8s.io/apiextensions-apiserver module at version v0.36.3 relies on the following key companion module versions in its go.mod file [1]: Dependency Module | Version --- | --- github.com/emicklei/go-restful/v3 | v3.13.0 github.com/fxamacker/cbor/v2 | v2.9.0 github.com/google/cel-go | v0.26.0 github.com/google/gnostic-models | v0.7.0 github.com/google/go-cmp | v0.7.0 github.com/google/uuid | v1.6.0 github.com/spf13/cobra | v1.10.2 github.com/spf13/pflag | v1.0.9 github.com/stretchr/testify | v1.11.1 go.etcd.io/etcd/client/pkg/v3 | v3.6.8 go.etcd.io/etcd/client/v3 | v3.6.8 go.opentelemetry.io/otel | v1.41.0 go.opentelemetry.io/otel/trace | v1.41.0 go.yaml.in/yaml/v2 | v2.4.3 golang.org/x/sync | v0.19.0 golang.org/x/text | v0.33.0 google.golang.org/grpc | v1.79.3 google.golang.org/protobuf | v1.36.12-0.20260120151049-f2248ac996af gopkg.in/evanphx/json-patch.v4 | v4.13.0 k8s.io/api | v0.36.3 k8s.io/apimachinery | v0.36.3 k8s.io/apiserver | v0.36.3 k8s.io/client-go | v0.36.3 k8s.io/code-generator | v0.36.3 k8s.io/component-base | v0.36.3 k8s.io/klog/v2 | v2.140.0 k8s.io/kube-openapi | v0.0.0-20260317180543-43fb72c5454a k8s.io/utils | v0.0.0-20260210185600-b8788abfbbc2 sigs.k8s.io/json | v0.0.0-20250730193827-2d320260d730 sigs.k8s.io/randfill | v1.0.0 sigs.k8s.io/structured-merge-diff/v6 | v6.3.3 sigs.k8s.io/yaml | v1.6.0 The module requires Go version 1.26.0 [1]. As part of the Kubernetes 1.36 release cycle, this module was updated to v0.36.3 alongside other core components [2][3]. This version specifically includes updates to dependencies such as sigs.k8s.io/structured-merge-diff/v6 to version v6.3.3 [2]. Note that many Kubernetes-internal modules are synced across the repository and share identical version numbers (v0.36.3) [1][4]. Citations:
🌐 Web query:
💡 Result: As of August 7, 2026, there are no specific security vulnerabilities publicly associated with k8s.io/apiextensions-apiserver version v0.36.3 [1][2]. The k8s.io/apiextensions-apiserver repository is a staged component of the Kubernetes project [1][3]. Security advisories for Kubernetes are managed centrally via the Kubernetes Security Response Committee and are tracked in the official Kubernetes CVE feed [4][5]. While various Kubernetes-related vulnerabilities have been disclosed in 2026 (such as CVE-2026-3864 and CVE-2026-3865 affecting CSI drivers) [4][6][7], none of these reports identify version v0.36.3 of the apiextensions-apiserver as vulnerable [4][5]. Version v0.36.3 is a maintenance release [8][9] that synchronizes with the broader Kubernetes v1.36.x series (based on the versioning patterns observed in the ecosystem) [1][8]. Users should rely on the official Kubernetes security announcements and the Go vulnerability database for up-to-date information regarding any components [2][4]. Citations:
🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- go.mod Kubernetes block ---'
sed -n '35,52p' go.mod
printf '%s\n' '--- Kubernetes module references in go.mod and vendor metadata ---'
rg -n -C 1 'k8s\.io/(api|apimachinery|apiextensions-apiserver|apiserver|client-go|code-generator|component-base|kube-openapi)' go.mod vendor/modules.txt
printf '%s\n' '--- direct imports of apiextensions-apiserver ---'
rg -n 'k8s\.io/apiextensions-apiserver' --glob '!vendor/**' --glob '!**/go.sum' .
printf '%s\n' '--- upstream module manifests ---'
for version in v0.36.2 v0.36.3; do
printf '%s\n' "--- $version ---"
curl --fail --silent --show-error \
"https://raw.githubusercontent.com/kubernetes/apiextensions-apiserver/$version/go.mod" |
sed -n '1,90p'
doneRepository: openshift/operator-framework-operator-controller Length of output: 50404 🏁 Script executed: #!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
import re
text = Path("go.mod").read_text()
mods = {}
for line in text.splitlines():
m = re.match(r"\s*(k8s\.io/\S+)\s+(v\S+)", line)
if m:
mods[m.group(1)] = m.group(2)
names = [
"k8s.io/api",
"k8s.io/apimachinery",
"k8s.io/apiextensions-apiserver",
"k8s.io/apiserver",
"k8s.io/client-go",
"k8s.io/code-generator",
"k8s.io/component-base",
"k8s.io/kube-openapi",
]
print("Root go.mod Kubernetes requirements:")
for name in names:
print(f"{name}: {mods.get(name, '<not directly required>')}")
PYRepository: openshift/operator-framework-operator-controller Length of output: 498 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- upstream Kubernetes requirements for apiextensions-apiserver ---'
for version in v0.36.2 v0.36.3; do
printf '%s\n' "--- $version ---"
curl --fail --silent --show-error \
"https://raw.githubusercontent.com/kubernetes/apiextensions-apiserver/$version/go.mod" |
grep -E '^(go |require \(|\s*k8s\.io/(api|apimachinery|apiserver|client-go|code-generator|component-base|kube-openapi))'
done
printf '%s\n' '--- root vendor module headers for Kubernetes modules ---'
grep -E '^# k8s\.io/(api|apimachinery|apiextensions-apiserver|apiserver|cli-runtime|client-go|component-base|klog/v2|kube-openapi|kubectl) ' vendor/modules.txt
printf '%s\n' '--- root dependency checksums for apiextensions-apiserver ---'
grep -E '^k8s\.io/apiextensions-apiserver ' go.sum || trueRepository: openshift/operator-framework-operator-controller Length of output: 1401 🌐 Web query:
💡 Result: There is no independent patch version skew policy for Kubernetes staging Go modules like Citations:
Use matching Kubernetes Update 🤖 Prompt for AI Agents |
||
| k8s.io/apimachinery v0.36.3 | ||
| k8s.io/apiserver v0.36.3 | ||
| k8s.io/cli-runtime v0.36.3 | ||
| k8s.io/client-go v0.36.3 | ||
| k8s.io/component-base v0.36.3 | ||
| k8s.io/klog/v2 v2.140.0 | ||
| k8s.io/utils v0.0.0-20260626114624-be93311217bd | ||
| pkg.package-operator.run/boxcutter v0.14.0 | ||
|
|
@@ -187,7 +187,7 @@ require ( | |
| github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect | ||
| github.com/proglottis/gpgme v0.1.6 // indirect | ||
| github.com/prometheus/client_model v0.6.2 // indirect | ||
| github.com/prometheus/procfs v0.21.1 // indirect | ||
| github.com/rubenv/sql-migrate v1.8.1 // indirect | ||
| github.com/russross/blackfriday/v2 v2.1.0 // indirect | ||
| github.com/secure-systems-lab/go-securesystemslib v0.11.0 // indirect | ||
|
|
@@ -245,7 +245,7 @@ require ( | |
| gopkg.in/yaml.v3 v3.0.1 // indirect | ||
| k8s.io/kube-openapi v0.0.0-20260520065146-aa012df4f4af // indirect | ||
| k8s.io/kubectl v0.36.2 // indirect | ||
| k8s.io/streaming v0.36.3 // indirect | ||
| oras.land/oras-go/v2 v2.6.2 // indirect | ||
| sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0 // indirect | ||
| sigs.k8s.io/gateway-api v1.6.0 // indirect | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
Repository: openshift/operator-framework-operator-controller
Length of output: 302
🏁 Script executed:
Repository: openshift/operator-framework-operator-controller
Length of output: 50405
🏁 Script executed:
Repository: openshift/operator-framework-operator-controller
Length of output: 26048
🏁 Script executed:
Repository: openshift/operator-framework-operator-controller
Length of output: 21442
🌐 Web query:
OSV.dev records GO-2026-5064, GO-2026-5338, GO-2026-5622, and GO-2026-5932 for the Go modules github.com/containerd/containerd v1.7.34 and golang.org/x/crypto v0.54.0💡 Result:
The OSV.dev records you referenced pertain to specific security advisories concerning the listed Go modules [1][2][3][4]. For github.com/containerd/containerd, the following records apply to the CRI (Container Runtime Interface) checkpoint restore functionality [1][3][4]: GO-2026-5064: Concerns a CDI (Container Device Interface) annotation smuggling vulnerability during CRI checkpoint restore [1]. GO-2026-5338: Relates to a local image tag poisoning vulnerability allowed by CRI checkpoint import [3]. GO-2026-5622: Involves an arbitrary host CRI log file read vulnerability via symlink following during CRI checkpoint restore [4]. Note that containerd v1.7.34, released in 2026, includes various security and dependency updates [5], though these specific OSV records were marked as UNREVIEWED as of June 2026 [1][3][4]. For golang.org/x/crypto v0.54.0, the record is: GO-2026-5932: This is a reviewed advisory stating that the golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and contains known security issues [2]. Users are advised to avoid this package and instead utilize a maintained alternative, such as github.com/ProtonMail/go-crypto/openpgp, which serves as a drop-in replacement [2]. The Go ecosystem continues to support golang.org/x/crypto for other cryptographic needs [6][7], but this specific sub-package is deprecated due to its security posture [2].
Citations:
🏁 Script executed:
Repository: openshift/operator-framework-operator-controller
Length of output: 6173
Remove the reachable
golang.org/x/crypto/openpgpdependency before merging.The root graph selects
golang.org/x/crypto v0.54.0, which reachesgo.podman.io/image/v5/signaturethroughgolang.org/x/crypto/openpgp. OSV reports GO-2026-5932 for this unsafe, unmaintained package. Replace the OpenPGP path or document an approved exception. Also assess the three containerd advisories reported forv1.7.34. The repository contains no tracked OSV, SBOM, provenance, or signing controls.🤖 Prompt for AI Agents
Source: Path instructions