Skip to content

NO-ISSUE: Update github.com/openshift/hive/apis digest to 732be3a #10749

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
red-hat-konflux wants to merge 1 commit into
base: master
Choose a base branch
from
Open

NO-ISSUE: Update github.com/openshift/hive/apis digest to 732be3a #10749

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
62 changes: 36 additions & 26 deletions api/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,50 +7,60 @@ toolchain go1.26.2
require (
github.com/openshift/assisted-service/models v0.0.0
github.com/openshift/custom-resource-status v1.1.3-0.20220503160415-f2fdb4999d87
github.com/openshift/hive/apis v0.0.0-20260415205034-aa1db747a6ba
k8s.io/api v0.34.2
k8s.io/apimachinery v0.34.2
github.com/openshift/hive/apis v0.0.0-20260731185504-732be3a5e787
k8s.io/api v0.36.2
k8s.io/apimachinery v0.36.2
sigs.k8s.io/yaml v1.6.0
)

require (
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
github.com/fxamacker/cbor/v2 v2.9.0 // indirect
github.com/go-logr/logr v1.4.3 // indirect
github.com/go-openapi/analysis v0.21.4 // indirect
github.com/go-openapi/errors v0.20.4 // indirect
github.com/go-openapi/jsonpointer v0.21.0 // indirect
github.com/go-openapi/jsonreference v0.20.2 // indirect
github.com/go-openapi/loads v0.21.2 // indirect
github.com/go-openapi/spec v0.20.9 // indirect
github.com/go-openapi/strfmt v0.21.7 // indirect
github.com/go-openapi/swag v0.23.0 // indirect
github.com/go-openapi/validate v0.22.2 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/go-openapi/analysis v0.23.0 // indirect
github.com/go-openapi/errors v0.22.4 // indirect
github.com/go-openapi/jsonpointer v0.22.3 // indirect
github.com/go-openapi/jsonreference v0.21.0 // indirect
github.com/go-openapi/loads v0.22.0 // indirect
github.com/go-openapi/spec v0.21.0 // indirect
github.com/go-openapi/strfmt v0.25.0 // indirect
github.com/go-openapi/swag v0.25.4 // indirect
github.com/go-openapi/swag/cmdutils v0.25.4 // indirect
github.com/go-openapi/swag/conv v0.25.4 // indirect
github.com/go-openapi/swag/fileutils v0.25.4 // indirect
github.com/go-openapi/swag/jsonname v0.25.4 // indirect
github.com/go-openapi/swag/jsonutils v0.25.4 // indirect
github.com/go-openapi/swag/loading v0.25.4 // indirect
github.com/go-openapi/swag/mangling v0.25.4 // indirect
github.com/go-openapi/swag/netutils v0.25.4 // indirect
github.com/go-openapi/swag/stringutils v0.25.4 // indirect
github.com/go-openapi/swag/typeutils v0.25.4 // indirect
github.com/go-openapi/swag/yamlutils v0.25.4 // indirect
github.com/go-openapi/validate v0.24.0 // indirect
github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/jinzhu/inflection v1.0.0 // indirect
github.com/jinzhu/now v1.1.4 // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/lib/pq v1.10.9 // indirect
github.com/mailru/easyjson v0.7.7 // indirect
github.com/mitchellh/mapstructure v1.5.0 // indirect
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
github.com/oklog/ulid v1.3.1 // indirect
github.com/openshift/api v0.0.0-20251120220512-cb382c9eaf42 // indirect
github.com/openshift/api v0.0.0-20260728120005-8ba0b25b0f29 // indirect
github.com/openshift/installer v1.5.0-alpha.1 // indirect

@coderabbitai coderabbitai Bot Aug 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

go mod why -m github.com/openshift/installer
go list -m -json github.com/openshift/installer

Repository: openshift/assisted-service

Length of output: 9089

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

printf '%s\n' '--- api/go.mod context ---'
sed -n '1,90p' api/go.mod

printf '%s\n' '--- module/workspace files ---'
git ls-files '*go.work' 'api/go.mod' 'vendor/modules.txt'

printf '%s\n' '--- installer references ---'
rg -n --glob '*.go' 'github\.com/openshift/installer|installer/pkg' .

printf '%s\n' '--- vendor entries ---'
rg -n -A3 -B2 '^# github\.com/openshift/installer' vendor/modules.txt api/vendor/modules.txt 2>/dev/null || true

printf '%s\n' '--- module declarations and build configuration ---'
rg -n '^(module |go |replace |use )|GOFLAGS|vendor' go.mod api/go.mod go.work Makefile .github 2>/dev/null || true

Repository: openshift/assisted-service

Length of output: 6148

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

sed -n '1,90p' api/go.mod
rg -n --glob '*.go' 'github\.com/openshift/installer|installer/pkg' .
rg -n -A3 -B2 '^# github\.com/openshift/installer' vendor/modules.txt api/vendor/modules.txt 2>/dev/null || true

Repository: openshift/assisted-service

Length of output: 5424

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

printf '%s\n' '--- root module references to api ---'
rg -n 'github\.com/openshift/assisted-service/api|replace .*assisted-service/api|require .*assisted-service/api' go.mod .
printf '%s\n' '--- api module files and package imports ---'
git ls-files api | sed -n '1,120p'
rg -n --glob '*.go' 'github\.com/openshift/hive|github\.com/openshift/installer/pkg/types/vsphere' api --glob '!api/vendor/**'
printf '%s\n' '--- vendored installer package files ---'
find api/vendor/github.com/openshift/installer -type f -maxdepth 6 -print 2>/dev/null | sort
printf '%s\n' '--- build tags on vendored hive vsphere files ---'
sed -n '1,35p' api/vendor/github.com/openshift/hive/apis/hive/v1/vsphere/platform.go
sed -n '1,25p' api/vendor/github.com/openshift/hive/apis/hive/v1/vsphere/machinepools.go

Repository: openshift/assisted-service

Length of output: 21830

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

rg -n 'github\.com/openshift/assisted-service/api|replace .*assisted-service/api|require .*assisted-service/api' go.mod .
rg -n --glob '*.go' 'github\.com/openshift/hive|github\.com/openshift/installer/pkg/types/vsphere' api --glob '!api/vendor/**'
find api/vendor/github.com/openshift/installer -type f -maxdepth 6 -print 2>/dev/null | sort

Repository: openshift/assisted-service

Length of output: 13343

Replace the pre-release installer dependency.

github.com/openshift/installer v1.5.0-alpha.1 is included in the production dependency graph through github.com/openshift/hive/apis and ./api. Use a stable installer release or update the dependency chain to remove this pre-release module.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/go.mod` at line 49, Update the dependency declaration for
github.com/openshift/installer in api/go.mod to use a stable release instead of
v1.5.0-alpha.1, or revise the github.com/openshift/hive/apis and ./api
dependency chain so the pre-release module is removed while preserving required
functionality.

Source: Path instructions

github.com/x448/float16 v0.8.4 // indirect
go.mongodb.org/mongo-driver v1.12.0 // indirect
go.yaml.in/yaml/v2 v2.4.3 // indirect
golang.org/x/net v0.54.0 // indirect
golang.org/x/text v0.37.0 // indirect
go.mongodb.org/mongo-driver v1.17.6 // indirect
go.yaml.in/yaml/v2 v2.4.4 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect
golang.org/x/net v0.55.1-0.20260602153038-42abb857022c // indirect

@coderabbitai coderabbitai Bot Aug 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

for module in . api; do
  echo "== $module =="
  (
    cd "$module"
    go list -m -json golang.org/x/net
    go mod graph | grep 'golang.org/x/net'
  )
done

curl -sS -X POST https://api.osv.dev/v1/query \
  -H 'Content-Type: application/json' \
  --data '{"package":{"ecosystem":"Go","name":"golang.org/x/net"},"version":"v0.24.0"}' |
  jq .

Repository: openshift/assisted-service

Length of output: 641

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo '== api/go.mod relevant lines =='
nl -ba api/go.mod | sed -n '48,74p'

echo '== root go.mod replacement and x/net references =='
rg -n -C 3 'golang\.org/x/net|replace' go.mod

echo '== all module files containing x/net or replacements =='
rg -n -C 2 'golang\.org/x/net|golang\.org/x/net =>' --glob 'go.mod' --glob '!vendor/**'

echo '== OSV results for the declared and replacement versions =='
python3 - <<'PY'
import json, urllib.request
for version in [
    "v0.24.0",
    "v0.55.1-0.20260602153038-42abb857022c",
    "v0.55.0",
    "v0.56.0",
]:
    payload = json.dumps({
        "package": {"ecosystem": "Go", "name": "golang.org/x/net"},
        "version": version,
    }).encode()
    req = urllib.request.Request(
        "https://api.osv.dev/v1/query",
        data=payload,
        headers={"Content-Type": "application/json"},
    )
    try:
        with urllib.request.urlopen(req) as response:
            data = json.load(response)
        vulns = data.get("vulns", [])
        print(version, [(v["id"], v.get("database_specific", {}).get("fixed")) for v in vulns])
    except Exception as exc:
        print(version, "ERROR", exc)
PY

Repository: openshift/assisted-service

Length of output: 236

🏁 Script executed:

#!/usr/bin/env bash
set -u

echo '== api/go.mod relevant lines =='
awk 'NR >= 48 && NR <= 74 { print NR ":" $0 }' api/go.mod

echo '== root go.mod replacement and x/net references =='
grep -n -C 3 -E 'golang\.org/x/net|replace' go.mod || true

echo '== all module files containing x/net or replacements =='
grep -R -n -C 2 -E 'golang\.org/x/net|golang\.org/x/net =>' --include='go.mod' --exclude-dir=vendor . || true

echo '== OSV results =='
python3 - <<'PY'
import json
import urllib.request

for version in (
    "v0.24.0",
    "v0.55.1-0.20260602153038-42abb857022c",
    "v0.55.0",
    "v0.56.0",
):
    body = json.dumps({
        "package": {"ecosystem": "Go", "name": "golang.org/x/net"},
        "version": version,
    }).encode()
    request = urllib.request.Request(
        "https://api.osv.dev/v1/query",
        data=body,
        headers={"Content-Type": "application/json"},
    )
    try:
        with urllib.request.urlopen(request) as response:
            result = json.load(response)
        print(version, [item.get("id") for item in result.get("vulns", [])])
    except Exception as error:
        print(version, "ERROR", repr(error))
PY

Repository: openshift/assisted-service

Length of output: 3687

🏁 Script executed:

#!/usr/bin/env bash
set -u

echo '== OSV results =='
for version in \
  v0.24.0 \
  v0.55.1-0.20260602153038-42abb857022c \
  v0.55.0 \
  v0.56.0
do
  printf '%s: ' "$version"
  curl -ksS -X POST https://api.osv.dev/v1/query \
    -H 'Content-Type: application/json' \
    --data "{\"package\":{\"ecosystem\":\"Go\",\"name\":\"golang.org/x/net\"},\"version\":\"$version\"}" |
    python3 -c 'import json,sys; d=json.load(sys.stdin); print([(v.get("id"), v.get("affected", [{}])[0].get("ranges")) for v in d.get("vulns", [])])'
done

echo '== module metadata commands =='
(
  cd api
  go env GOMOD GOFLAGS
  go list -mod=mod -m -json golang.org/x/net
)

Repository: openshift/assisted-service

Length of output: 2755

🏁 Script executed:

#!/usr/bin/env bash
set -u

echo '== root go.mod =='
awk 'NR >= 250 && NR <= 262 { print NR ":" $0 }' go.mod

echo '== vendored x/net version =='
grep -n -A3 -B2 'golang.org/x/net' vendor/modules.txt 2>/dev/null || true

echo '== x/net versions in repository metadata =='
grep -R -n -E 'golang\.org/x/net(@|[[:space:]])' \
  --exclude-dir=.git --exclude-dir=vendor --include='go.mod' --include='go.sum' . 2>/dev/null || true

Repository: openshift/assisted-service

Length of output: 14511

Use golang.org/x/net v0.56.0 or later.

Remove the wildcard replacement in api/go.mod, update the declared version, and update the root module and vendor data. The replacement currently makes standalone api resolve to vulnerable v0.24.0. Root builds currently use vulnerable v0.55.0, while GO-2026-5942 is fixed in v0.56.0. Validate both module builds.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/go.mod` at line 54, Update the golang.org/x/net dependency in api/go.mod
to v0.56.0 or later, remove its wildcard replacement, and synchronize the root
module declarations and vendor data to the same fixed version. Ensure standalone
api and root module builds resolve the updated dependency and validate both
builds.

Source: Path instructions

golang.org/x/text v0.38.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
gorm.io/gorm v1.24.5 // indirect
k8s.io/klog/v2 v2.130.1 // indirect
k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect
k8s.io/klog/v2 v2.140.0 // indirect
k8s.io/kube-openapi v0.0.0-20260519202549-bbf5c5577288 // indirect
k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3 // indirect
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
sigs.k8s.io/randfill v1.0.0 // indirect
sigs.k8s.io/structured-merge-diff/v6 v6.3.1 // indirect
sigs.k8s.io/structured-merge-diff/v6 v6.4.0 // indirect
)

replace (
Expand Down
149 changes: 72 additions & 77 deletions api/go.sum
View file
Open in desktop

Large diffs are not rendered by default.

15 changes: 0 additions & 15 deletions api/vendor/github.com/asaskevich/govalidator/.gitignore
View file
Open in desktop

This file was deleted.

12 changes: 0 additions & 12 deletions api/vendor/github.com/asaskevich/govalidator/.travis.yml
View file
Open in desktop

This file was deleted.

43 changes: 0 additions & 43 deletions api/vendor/github.com/asaskevich/govalidator/CODE_OF_CONDUCT.md
View file
Open in desktop

This file was deleted.

63 changes: 0 additions & 63 deletions api/vendor/github.com/asaskevich/govalidator/CONTRIBUTING.md
View file
Open in desktop

This file was deleted.

21 changes: 0 additions & 21 deletions api/vendor/github.com/asaskevich/govalidator/LICENSE
View file
Open in desktop

This file was deleted.

Loading