OCPBUGS-109468: fix CVE-2026-41178 by updating otel to v1.44.0 - #761
OCPBUGS-109468: fix CVE-2026-41178 by updating otel to v1.44.0#761ehearne-redhat wants to merge 1 commit into
Conversation
This commit updates otel to v1.44.0 which to required to resolve CVE-2026-41178. It also updates transient dependencies. See https://pkg.go.dev/vuln/GO-2026-5158 for reference.
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
jira/severity-important
|
@ehearne-redhat: This pull request references Jira Issue OCPBUGS-109468, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/cherry-pick release-5.0 |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (134)
📒 Files selected for processing (1)
Included review availability: Your plan provides up to 12 included reviews per hour; 10 remain after this review. WalkthroughThe pull request updates indirect Go module dependencies in ChangesIndirect dependency updates
Estimated code review effort: 1 (Trivial) | ~5 minutes Merge Risk: ⚪ Minimal · up to This PR updates the telemetry dependencies to address the reported vulnerability and introduces no evidenced merge-blocking risk; it is merge-ready after normal checks and review. Suggested reviewers: 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.) Full details: Stable And Deterministic Test NamesExplanation The pull request changes dependency metadata and vendored dependency files only. The commit diff contains no changed or added Full details: Test Structure And QualityExplanation PASS: The pull request does not add or modify Ginkgo test code. The commit changes only module metadata and vendored dependencies (135 paths total); exact path and patch checks found no test paths or Ginkgo API markers. Therefore, none of the specified test-quality failure conditions apply. Full details: Single Node Openshift (Sno) Test CompatibilityExplanation PASS: The pull request adds no Ginkgo e2e tests. The HEAD-versus-parent diff contains only go.mod, go.sum, and vendored dependency files; it contains zero changed test files and no new project source files. Therefore, the SNO multi-node compatibility check is not applicable. Full details: Topology-Aware Scheduling CompatibilityExplanation PASS: The pull request changes only dependency declarations/checksums and vendored dependency files. The committed diff contains Full details: Ote Binary Stdout ContractExplanation PASS. The pull request changes only go.mod/go.sum and vendored dependency code; it does not change the OTE binary, suite registration, TestMain, or Ginkgo setup. The changed dependency diff has no added stdout writes, logging redirection changes, or suite setup code. The unchanged OTE framework routes GinkgoWriter to os.Stderr, and its stdout writes are JSON result/list output. No changed-code causal path introduces a non-JSON stdout write. Full details: Ipv6 And Disconnected Network Test CompatibilityExplanation PASS: The pull request changes dependency declarations, go.sum, and vendored library files only. The committed diff adds no Go source outside vendor, no test-like paths, and no new Ginkgo declarations such as Full details: No-Weak-CryptoExplanation The pull request only updates Go dependencies and vendored sources. The exact diff adds no weak-crypto imports or constructor calls for MD5, SHA1, DES, RC4, Blowfish, 3DES, or ECB modes. It adds no secret or token comparison using a non-constant-time pattern. The new MD5/SHA1 references are OpenTelemetry TLS semantic-convention attribute names and string metadata. The new 3DES reference is an example cipher-name string. Existing weak-crypto calls in unrelated vendor files are unchanged and are not caused by this pull request. Full details: Container-PrivilegesExplanation No container-privilege violation was introduced. The commit changes Go dependency files and vendored sources. The parent-to-HEAD diff has no changes under Full details: No-Sensitive-Data-In-LogsExplanation No new sensitive-data logging is introduced. The PR changes go.mod/go.sum and vendored dependencies. Added gRPC logs contain only balancer names and header sizes. The OpenTelemetry baggage error path already logged parse errors before this PR; the change limits and aggregates those errors, and oversized headers now report only their size. The changed MarshalLog formatter preserves existing attribute logging, and no application call sites use the new byte-slice or slice attribute constructors. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
@ehearne-redhat: once the present PR merges, I will cherry-pick it on top of DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@ehearne-redhat: This pull request references Jira Issue OCPBUGS-109468, which is valid. 3 validation(s) were run on this bug
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@ehearne-redhat: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
3 participants
This commit updates otel to v1.44.0 which to required to resolve CVE-2026-41178. It also updates transient dependencies.
See https://pkg.go.dev/vuln/GO-2026-5158 for reference.
Summary by CodeRabbit