OCPBUGS-93750: Bump github.com/moby/moby to v28.5.2 - #10680
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@jkaurredhat: This pull request explicitly references no jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
added
the
size/S
WalkthroughUpdates the direct Moby dependency and adds the related indirect ChangesMoby dependency update
Estimated code review effort: 1 (Trivial) | ~3 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 14 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: jkaurredhat The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
jkaurredhat
changed the title
openshift-ci-robot
added
jira/severity-important
|
@jkaurredhat: This pull request references Jira Issue OCPBUGS-93750, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira (ocp-sustaining-admins@redhat.com), skipping review request. The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@jkaurredhat: This pull request references Jira Issue OCPBUGS-93750, which is valid. 3 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira (ocp-sustaining-admins@redhat.com), skipping review request. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 47: Update the github.com/moby/moby dependency in go.mod to a release or
commit containing the CVE-2026-41567 fix, ensuring pkg/s3wrapper/filesystem.go
remains compatible with its direct pkg/ioutils import; alternatively, remove
that root-module dependency by replacing the import with a safe supported
equivalent.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 982b7e10-2363-4dfd-8c9d-48a6616eff92
⛔ Files ignored due to path filters (14)
go.sumis excluded by!**/*.sumvendor/github.com/moby/moby/AUTHORSis excluded by!**/vendor/**,!vendor/**vendor/github.com/moby/moby/pkg/ioutils/buffer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/moby/moby/pkg/ioutils/bytespipe.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/moby/moby/pkg/ioutils/fswriters.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/moby/moby/pkg/ioutils/fswriters_deprecated.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/moby/moby/pkg/ioutils/readers.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/moby/moby/pkg/ioutils/writeflusher.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/moby/moby/pkg/ioutils/writers.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/moby/sys/atomicwriter/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/moby/sys/atomicwriter/atomicwriter.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/moby/sys/sequential/sequential_unix.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/moby/sys/sequential/sequential_windows.gois excluded by!**/vendor/**,!vendor/**vendor/modules.txtis excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (1)
go.mod
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #10680 +/- ##
=======================================
Coverage 44.47% 44.47%
=======================================
Files 423 423
Lines 73355 73355
=======================================
+ Hits 32626 32628 +2
+ Misses 37810 37809 -1
+ Partials 2919 2918 -1 🚀 New features to boost your workflow:
|
openshift-ci
Bot
added
the
needs-rebase
This PR updates github.com/moby/moby from v27.2.1 to v28.5.2 for CVE-2026-41567 remediation (precautionary measure). CVE Details: - CVE-2026-41567: Docker daemon arbitrary code execution via malicious container images during compressed archive upload operations - Affected: Docker Engine < 29.5.1, moby/moby < v2.0.0-beta.14 - Fixed in: Docker Engine 29.5.1, moby/moby v2.0.0-beta.14 - Severity: High (CVSS 7.2) Impact Analysis: - This component is NOT AFFECTED by CVE-2026-41567 - Vulnerability affects Docker daemon (`dockerd`) server component only - assisted-service uses Docker client library only, does not run daemon - No vulnerable API endpoints (PUT /containers/{id}/archive) in use - No CopyToContainer/CopyFromContainer functions used in application code Why This Update: - Precautionary dependency hygiene measure - Updates to latest v28.x release (v28.5.2) - No security risk from CVE-2026-41567, but newer version is safer - v28.5.2 is safer migration path than jumping to v2.x beta Changes: - Updated github.com/moby/moby: v27.2.1 → v28.5.2 - Updated transitive dependencies: - github.com/moby/sys/sequential: v0.5.0 → v0.6.0 - Added github.com/moby/sys/atomicwriter v0.1.0 - Ran go mod tidy and go mod vendor GHSA: GHSA-x86f-5xw2-fm2r Related: OCPBUGS-93750
ab52764 to
a1bb28b
Compare
openshift-ci
Bot
added
size/XS
There was a problem hiding this comment.
♻️ Duplicate comments (1)
go.mod (1)
47-47: 🔒 Security & Privacy | 🟠 MajorDo not treat
v28.5.2as the security fix; remove the root Moby dependency if possible.OSV still lists the Moby daemon as affected, and Moby documents the root module as engine code rather than a supported library module. (pkg.go.dev)
pkg/s3wrapper/filesystem.goonly usespkg/ioutilsto wrap an*os.File, which already satisfiesio.ReadCloser; replace that wrapper and remove this module if no other production imports remain.As per path instructions: “New deps: justify need, check license compatibility; pin exact versions; flag known CVEs (cross-ref osv.dev); ensure SBOM/provenance attestations and Sigstore/cosign signing.”
🛠️ Proposed direction
--- pkg/s3wrapper/filesystem.go - "github.com/moby/moby/pkg/ioutils" - return ioutils.NewReadCloserWrapper(fp, fp.Close), info.Size(), nil + return fp, info.Size(), nil --- go.mod - github.com/moby/moby v28.5.2+incompatibleVerify that no other production package imports
github.com/moby/mobybefore removing the module.#!/bin/bash set -euo pipefail rg -n '"github.com/moby/moby(/|")' --glob '*.go' . go mod why -m github.com/moby/moby go list -deps ./... | rg 'github.com/moby/moby/(daemon|pkg/ioutils)'🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` at line 47, Remove the root github.com/moby/moby dependency from go.mod after verifying no production imports remain, including the existing pkg/ioutils usage in pkg/s3wrapper/filesystem.go. Replace that wrapper with the *os.File’s native io.ReadCloser behavior, update imports and tests as needed, then run dependency checks to confirm Moby is absent from the production dependency graph; do not add a replacement dependency.Sources: Path instructions, Linters/SAST tools
🧹 Nitpick comments (1)
go.mod (1)
139-140: 🔒 Security & Privacy | 🔵 TrivialComplete the supply-chain validation for the new transitive modules.
The versions are exactly pinned, but the diff does not demonstrate license compatibility, OSV validation, SBOM/provenance generation, or artifact signing. The published
atomicwritermetadata identifiesv0.1.0as Apache-2.0; confirm that this is compatible with the project and that both new Moby system modules are covered by the repository’s supply-chain controls. (pkg.go.dev)As per path instructions: “New deps: justify need, check license compatibility; pin exact versions; flag known CVEs (cross-ref osv.dev); ensure SBOM/provenance attestations and Sigstore/cosign signing.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` around lines 139 - 140, Complete supply-chain validation for the newly added github.com/moby/sys/atomicwriter and github.com/moby/sys/sequential dependencies: document their required use, confirm Apache-2.0 and any applicable license compatibility, verify both pinned versions against OSV for known CVEs, and ensure they are included in the repository’s SBOM/provenance and Sigstore/cosign signing controls.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@go.mod`:
- Line 47: Remove the root github.com/moby/moby dependency from go.mod after
verifying no production imports remain, including the existing pkg/ioutils usage
in pkg/s3wrapper/filesystem.go. Replace that wrapper with the *os.File’s native
io.ReadCloser behavior, update imports and tests as needed, then run dependency
checks to confirm Moby is absent from the production dependency graph; do not
add a replacement dependency.
---
Nitpick comments:
In `@go.mod`:
- Around line 139-140: Complete supply-chain validation for the newly added
github.com/moby/sys/atomicwriter and github.com/moby/sys/sequential
dependencies: document their required use, confirm Apache-2.0 and any applicable
license compatibility, verify both pinned versions against OSV for known CVEs,
and ensure they are included in the repository’s SBOM/provenance and
Sigstore/cosign signing controls.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 1114e75b-827c-47de-96ac-95c3a04368b1
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
|
@jkaurredhat: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
Summary
This PR updates github.com/moby/moby from v27.2.1 to v28.5.2 as a precautionary dependency update.
Component Status: NOT AFFECTED by CVE-2026-41567
While the component is not vulnerable to CVE-2026-41567 (which affects Docker daemon, not client library usage), this update is done as:
Summary by CodeRabbit