Skip to content

[release-4.12] OCPBUGS-79754: Bump google.golang.org/grpc to v1.79.3 #533

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ocp-sustaining-admins wants to merge 1 commit into
base: release-4.12
Choose a base branch
from
Open

[release-4.12] OCPBUGS-79754: Bump google.golang.org/grpc to v1.79.3 #533

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
48 changes: 25 additions & 23 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ require (
github.com/containers/storage v1.42.0
github.com/docker/distribution v2.8.1+incompatible
github.com/fsouza/go-dockerclient v1.7.11
github.com/go-logr/logr v1.2.3 // indirect
github.com/go-logr/logr v1.4.1 // indirect
github.com/google/gofuzz v1.2.0 // indirect
github.com/opencontainers/runc v1.1.12
github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417
Expand All @@ -24,7 +24,7 @@ require (
github.com/spf13/cobra v1.5.0
github.com/spf13/pflag v1.0.5
github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635
golang.org/x/sys v0.13.0
golang.org/x/sys v0.21.0
k8s.io/api v0.25.2
k8s.io/apimachinery v0.25.2
k8s.io/client-go v0.25.2
Expand All @@ -45,9 +45,9 @@ require (
github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/blang/semver v3.5.1+incompatible // indirect
github.com/cespare/xxhash/v2 v2.1.2 // indirect
github.com/cespare/xxhash/v2 v2.2.0 // indirect
github.com/chai2010/gettext-go v1.0.2 // indirect
github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e // indirect
github.com/chzyer/readline v1.5.0 // indirect
github.com/containerd/cgroups v1.0.3 // indirect
github.com/containerd/containerd v1.6.6 // indirect
github.com/containerd/continuity v0.2.2 // indirect
Expand Down Expand Up @@ -78,12 +78,12 @@ require (
github.com/godbus/dbus/v5 v5.1.0 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
github.com/golang/protobuf v1.5.2 // indirect
github.com/golang/protobuf v1.5.4 // indirect
github.com/google/btree v1.0.1 // indirect
github.com/google/go-cmp v0.5.8 // indirect
github.com/google/go-cmp v0.6.0 // indirect
github.com/google/go-intervals v0.0.2 // indirect
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
github.com/google/uuid v1.3.0 // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/gorilla/mux v1.8.0 // indirect
github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
github.com/hashicorp/errwrap v1.1.0 // indirect
Expand All @@ -95,7 +95,7 @@ require (
github.com/jinzhu/copier v0.3.5 // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/klauspost/compress v1.15.9 // indirect
github.com/klauspost/compress v1.16.7 // indirect
github.com/klauspost/pgzip v1.2.5 // indirect
github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
github.com/magiconair/properties v1.8.5 // indirect
Expand Down Expand Up @@ -128,19 +128,19 @@ require (
github.com/pmezard/go-difflib v1.0.0 // indirect
github.com/proglottis/gpgme v0.1.3 // indirect
github.com/prometheus/client_golang v1.12.1 // indirect
github.com/prometheus/client_model v0.2.0 // indirect
github.com/prometheus/client_model v0.5.0 // indirect
github.com/prometheus/common v0.32.1 // indirect
github.com/prometheus/procfs v0.7.3 // indirect
github.com/rivo/uniseg v0.2.0 // indirect
github.com/russross/blackfriday v1.6.0 // indirect
github.com/seccomp/libseccomp-golang v0.10.0 // indirect
github.com/sirupsen/logrus v1.9.0 // indirect
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check what is using logrus and if we can upgrade
echo "=== Direct dependencies requiring logrus ==="
rg "github.com/sirupsen/logrus" go.mod -A 1 -B 1

# Check for latest logrus version and security advisories
curl -s https://pypi.org/pypi/logrus/json 2>/dev/null || echo "Not a Python package"
curl -s https://proxy.golang.org/github.com/sirupsen/logrus/@v/list | tail -5

Repository: openshift/builder

Length of output: 14947

🌐 Web query:

What is the latest version of github.com/sirupsen/logrus and does it fix the DoS vulnerabilities GO-2025-4188 and GHSA-4f99-4q7p-p3gh?

💡 Result:

Latest github.com/sirupsen/logrus version (as of 2026-05-14): v1.9.4 [1][2][3]. Does v1.9.4 fix the DoS vulnerabilities GO-2025-4188 and GHSA-4f99-4q7p-p3gh? Yes. These advisories describe a DoS when using Entry.Writer/Writer (or Entry.writerScanner) with a single-line payload >64KB without newlines, affecting logrus versions < 1.8.3 and specific 1.9.x ranges [4][5][6]. They state the issue is fixed in 1.8.3/1.9.1/1.9.3+ (i.e., versions at or above those fix releases) [4][6][5]. Since v1.9.4 is 1.9.3+ (and the logrus changelog notes repeated fixes for the >64KB single-line Writer DoS in 1.9.1/1.9.3) [7], v1.9.4 should be fixed for GHSA-4f99-4q7p-p3gh and thus also for GO-2025-4188 (which lists the GHSA as an alias/reference) [4].

Citations:

Upgrade logrus to v1.9.4 to fix HIGH severity DoS vulnerabilities.

github.com/sirupsen/logrus v1.9.0 contains two HIGH severity DoS vulnerabilities:

  • GO-2025-4188: DoS when using Entry.writerScanner with large single-line payloads (>64KB without newlines)
  • GHSA-4f99-4q7p-p3gh: DoS when using Entry.Writer() with the same payload conditions

These are fixed in v1.9.4. Update the dependency to patch the vulnerability.

🧰 Tools
🪛 OSV Scanner (2.3.8)

[HIGH] 137-137: github.com/sirupsen/logrus 1.9.0: Logrus is vulnerable to DoS when using Entry.writerScanner in github.com/sirupsen/logrus

(GO-2025-4188)

[HIGH] 137-137: github.com/sirupsen/logrus 1.9.0: Logrus is vulnerable to DoS when using Entry.Writer()

(GHSA-4f99-4q7p-p3gh)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 137, Update the logrus dependency from v1.9.0 to v1.9.4 to
address the DoS vulnerabilities: edit the go.mod entry for
github.com/sirupsen/logrus and set the version to v1.9.4, then run go get
github.com/sirupsen/logrus@v1.9.4 (or go get ./... if you prefer) and go mod
tidy to refresh go.sum; finally run your test suite or build to ensure no import
or API breakages in code using logrus.Entry or Entry.Writer().

github.com/spf13/afero v1.6.0 // indirect
github.com/spf13/afero v1.10.0 // indirect
github.com/spf13/cast v1.4.1 // indirect
github.com/spf13/jwalterweatherman v1.1.0 // indirect
github.com/spf13/viper v1.10.0 // indirect
github.com/stefanberger/go-pkcs11uri v0.0.0-20201008174630-78d3cae3a980 // indirect
github.com/stretchr/testify v1.8.0
github.com/stretchr/testify v1.8.4
github.com/subosito/gotenv v1.2.0 // indirect
github.com/sylabs/sif/v2 v2.7.1 // indirect
github.com/tchap/go-patricia v2.3.0+incompatible // indirect
Expand All @@ -155,20 +155,19 @@ require (
github.com/xlab/treeprint v1.1.0 // indirect
go.etcd.io/bbolt v1.3.6 // indirect
go.mozilla.org/pkcs7 v0.0.0-20200128120323-432b2356ecb1 // indirect
go.opencensus.io v0.23.0 // indirect
go.opencensus.io v0.24.0 // indirect
go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect
golang.org/x/crypto v0.14.0 // indirect
golang.org/x/mod v0.8.0 // indirect
golang.org/x/net v0.8.0 // indirect
golang.org/x/oauth2 v0.0.0-20220622183110-fd043fe589d2 // indirect
golang.org/x/sync v0.1.0 // indirect
golang.org/x/crypto v0.19.0 // indirect
golang.org/x/mod v0.17.0 // indirect
golang.org/x/net v0.26.0 // indirect
golang.org/x/oauth2 v0.18.0 // indirect
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check latest oauth2 version
curl -s https://proxy.golang.org/golang.org/x/oauth2/@v/list | tail -5

# Check what requires oauth2
echo -e "\n=== Dependencies requiring oauth2 ==="
rg "golang.org/x/oauth2" go.mod -B 2 -A 2

Repository: openshift/builder

Length of output: 333

🌐 Web query:

What is the latest version of golang.org/x/oauth2 and does it fix vulnerabilities GO-2025-3488 and GHSA-6v2p-p543-phr9?

💡 Result:

The latest version of golang.org/x/oauth2 (as of 2026-05-14) is v0.36.0. [1] Does the latest version fix vulnerabilities GO-2025-3488 and GHSA-6v2p-p543-phr9? Yes. Both GO-2025-3488 and GHSA-6v2p-p543-phr9 are described as being fixed starting in golang.org/x/oauth2 v0.27.0 (affected “before v0.27.0”). [2][3] Since v0.36.0 is greater than v0.27.0, upgrading to v0.36.0 addresses these issues. [1][2][3] Supporting details: - GO-2025-3488 affects golang.org/x/oauth2 versions “before v0.27.0”. [2] - GHSA-6v2p-p543-phr9 affects golang.org/x/oauth2 versions “before v0.27.0”. [3] - The oauth2 v0.27.0 tag includes a fix commit “jws: split token into fixed number of parts” and references fixes for CVE-2025-22868 / GO-2025-3488. [4]

Citations:

Upgrade golang.org/x/oauth2 to v0.27.0 or later (currently v0.18.0).

The current version has HIGH severity vulnerabilities:

  • GO-2025-3488: Unexpected memory consumption during token parsing
  • GHSA-6v2p-p543-phr9: Improper Validation of Syntactic Correctness of Input

Both are fixed in v0.27.0+. Latest version is v0.36.0.

🧰 Tools
🪛 OSV Scanner (2.3.8)

[HIGH] 163-163: golang.org/x/oauth2 0.18.0: Unexpected memory consumption during token parsing in golang.org/x/oauth2

(GO-2025-3488)

[HIGH] 163-163: golang.org/x/oauth2 0.18.0: golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability

(GHSA-6v2p-p543-phr9)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 163, Update the golang.org/x/oauth2 module from v0.18.0 to a
safe upstream release (>= v0.27.0, ideally v0.36.0) in go.mod and then run the
Go module commands to fetch and tidy dependencies (e.g., go get
golang.org/x/oauth2@v0.36.0 && go mod tidy) so the project builds with the
patched library; ensure any code importing oauth2 (import path
"golang.org/x/oauth2") is compatible and run unit tests to validate no
breakages.

golang.org/x/sync v0.7.0 // indirect
golang.org/x/term v0.13.0 // indirect
golang.org/x/text v0.13.0 // indirect
golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect
google.golang.org/appengine v1.6.7 // indirect
google.golang.org/genproto v0.0.0-20220624142145-8cd45d7dbd1f // indirect
google.golang.org/grpc v1.47.0 // indirect
google.golang.org/protobuf v1.28.0 // indirect
golang.org/x/text v0.16.0 // indirect
golang.org/x/time v0.5.0 // indirect
google.golang.org/appengine v1.6.8 // indirect
google.golang.org/grpc v1.62.1 // indirect
google.golang.org/protobuf v1.33.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/ini.v1 v1.66.2 // indirect
gopkg.in/square/go-jose.v2 v2.6.0 // indirect
Expand All @@ -194,6 +193,7 @@ require (
github.com/sigstore/sigstore v1.3.1-0.20220629021053-b95fc0d626c1 // indirect
github.com/theupdateframework/go-tuf v0.5.0 // indirect
github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20240318140521-94a12d6c2237 // indirect
)

replace (
Expand Down Expand Up @@ -232,3 +232,5 @@ replace (
k8s.io/pod-security-admission => k8s.io/pod-security-admission v0.25.2
k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.25.2
)

replace google.golang.org/grpc => github.com/openshift-sustaining/grpc-go v1.64.1-sec.1
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check if the openshift-sustaining fork and version exist and gather release information
gh api repos/openshift-sustaining/grpc-go/tags --jq '.[] | select(.name | contains("v1.64.1-sec")) | {name: .name, commit: .commit.sha}'

# Check for any security-related information in the fork
gh api repos/openshift-sustaining/grpc-go/releases --jq '.[] | select(.tag_name | contains("v1.64.1-sec")) | {tag: .tag_name, name: .name, body: .body}'

Repository: openshift/builder

Length of output: 450

🌐 Web query:

Does grpc-go v1.64.1-sec.1 from openshift-sustaining fork correspond to google.golang.org/grpc v1.79.3 or address CVE-2026-33186?

💡 Result:

No, grpc-go v1.64.1-sec.1 from the openshift-sustaining fork does not correspond to google.golang.org/grpc v1.79.3, and it does not address CVE-2026-33186.[1][2]

Citations:

Update PR title or explain the version discrepancy.

The PR title claims to bump gRPC to v1.79.3, but the replace directive uses github.com/openshift-sustaining/grpc-go v1.64.1-sec.1. While the OpenShift sustaining fork's v1.64.1-sec.1 release does address CVE-2026-33186 (as documented in its official release notes), these are different versions. Clarify whether the title is incorrect or if v1.64.1-sec.1 is the intended version.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 236, The PR title and the go.mod replace directive disagree:
the title says gRPC v1.79.3 but go.mod contains the replace of
google.golang.org/grpc to github.com/openshift-sustaining/grpc-go v1.64.1-sec.1;
decide which is correct and either (A) update the PR title/description to
reflect that the intended bump is to the OpenShift sustaining fork
v1.64.1-sec.1, or (B) change the replace directive to point to the actual
v1.79.3 module you intended (or remove the replace if not needed). Locate the
replace line in go.mod (the line with "replace google.golang.org/grpc =>
github.com/openshift-sustaining/grpc-go v1.64.1-sec.1") and make the
version/title consistent.

Loading