-
Notifications
You must be signed in to change notification settings - Fork 72
[release-4.18] OCPBUGS-51245,OCPBUGS-51227,OCPBUGS-51225: pin go-jose/[email protected] (#3550) #992
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[release-4.18] OCPBUGS-51245,OCPBUGS-51227,OCPBUGS-51225: pin go-jose/[email protected] (#3550) #992
Conversation
@anik120: This pull request references Jira Issue OCPBUGS-51225, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
/jira refresh |
@anik120: This pull request references Jira Issue OCPBUGS-51225, which is invalid:
Comment In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
b4503f0
to
24a5b5b
Compare
/hold looks like d3160ca only changed the staging directory, and not the main go.mod file (as a result the the wrong thing is being vendored in). Holding this till I and done fixing it in master -> 4.19 |
24a5b5b
to
9c1b1d1
Compare
/hold cancel Fixed the upgrade. |
Upstream-repository: operator-lifecycle-manager Upstream-commit: dfd0b2bea85038d3c0d65348bc812d297f16b8d2
9c1b1d1
to
6fb8afa
Compare
@anik120: This pull request references Jira Issue OCPBUGS-51227, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. This pull request references Jira Issue OCPBUGS-51225, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
/jira refresh |
@anik120: This pull request references Jira Issue OCPBUGS-51227, which is invalid:
Comment This pull request references Jira Issue OCPBUGS-51225, which is invalid:
Comment In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
@@ -87,7 +87,7 @@ require ( | |||
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect | |||
github.com/go-git/go-billy/v5 v5.6.1 // indirect | |||
github.com/go-git/go-git/v5 v5.13.1 // indirect | |||
github.com/go-jose/go-jose/v4 v4.0.4 // indirect | |||
github.com/go-jose/go-jose/v4 v4.0.5 // indirect |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It will not solve the CVE for operator-registry downstream
That is here: https://github.com/openshift/operator-framework-olm/blob/main/staging/operator-registry/go.mod#L104
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We don't have to change the staging folder, all of this is incorporated by the top level go.mod file change.
@anik120: This pull request references Jira Issue OCPBUGS-51245, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. This pull request references Jira Issue OCPBUGS-51227, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. This pull request references Jira Issue OCPBUGS-51225, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
/jira refresh |
@anik120: This pull request references Jira Issue OCPBUGS-51245, which is invalid:
Comment This pull request references Jira Issue OCPBUGS-51227, which is invalid:
Comment This pull request references Jira Issue OCPBUGS-51225, which is invalid:
Comment In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
/lgtm
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: anik120, camilamacedo86 The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
@anik120: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
/jira refresh |
@anik120: This pull request references Jira Issue OCPBUGS-51245, which is valid. The bug has been moved to the POST state. 7 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira ([email protected]), skipping review request. This pull request references Jira Issue OCPBUGS-51227, which is valid. The bug has been moved to the POST state. 7 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira ([email protected]), skipping review request. This pull request references Jira Issue OCPBUGS-51225, which is invalid:
Comment In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
/jira refresh |
@anik120: This pull request references Jira Issue OCPBUGS-51245, which is valid. 7 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira ([email protected]), skipping review request. This pull request references Jira Issue OCPBUGS-51227, which is valid. 7 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira ([email protected]), skipping review request. This pull request references Jira Issue OCPBUGS-51225, which is invalid:
Comment In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
/jira refresh |
@anik120: This pull request references Jira Issue OCPBUGS-51245, which is valid. 7 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira ([email protected]), skipping review request. This pull request references Jira Issue OCPBUGS-51227, which is valid. 7 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira ([email protected]), skipping review request. This pull request references Jira Issue OCPBUGS-51225, which is valid. The bug has been moved to the POST state. 7 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira ([email protected]), skipping review request. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
/label cherry-pick-approved |
/label backport-risk-assessed |
3ea075d
into
openshift:release-4.18
@anik120: Jira Issue OCPBUGS-51245: All pull requests linked via external trackers have merged: Jira Issue OCPBUGS-51245 has been moved to the MODIFIED state. Jira Issue OCPBUGS-51227: All pull requests linked via external trackers have merged: Jira Issue OCPBUGS-51227 has been moved to the MODIFIED state. Jira Issue OCPBUGS-51225: All pull requests linked via external trackers have merged: Jira Issue OCPBUGS-51225 has been moved to the MODIFIED state. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
[ART PR BUILD NOTIFIER] Distgit: operator-registry |
[ART PR BUILD NOTIFIER] Distgit: ose-operator-framework-tools |
[ART PR BUILD NOTIFIER] Distgit: operator-lifecycle-manager |
Fix included in accepted release 4.18.0-0.nightly-2025-05-02-014239 |
CVE-2025-27144
Upstream-repository: operator-lifecycle-manager
Upstream-commit: dfd0b2bea85038d3c0d65348bc812d297f16b8d2