Build(deps): Bump cloud.google.com/go/storage from 1.58.0 to 1.61.3#1046
Build(deps): Bump cloud.google.com/go/storage from 1.58.0 to 1.61.3#1046dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
WalkthroughBumped Go toolchain from 1.24.13 to 1.25.0 and updated multiple module versions in Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@go.mod`:
- Line 3: The go.mod change bumped the module toolchain to "go 1.25.0" which
conflicts with CI workflows; either revert the go.mod entry back to the previous
toolchain version (restore the "go X.Y.Z" line to the prior value) or update all
GitHub Actions workflows that reference older Go versions to include and test
"1.25.0" so CI and go.mod remain consistent; locate the "go 1.25.0" entry in
go.mod and apply the chosen fix, and if you update CI ensure each workflow
matrix or uses: actions/setup-go references 1.25.0.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 1d69a47c-72fa-451b-928a-dfc0555019ef
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
| module github.com/openshift-online/ocm-cli | ||
|
|
||
| go 1.24.13 | ||
| go 1.25.0 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify repo toolchain expectations vs go.mod
set -euo pipefail
echo "== go.mod go directive =="
rg -n '^\s*go\s+[0-9]+\.[0-9]+' go.mod
echo
echo "== GitHub Actions Go versions =="
fd -H -t f '\.ya?ml$' .github/workflows | xargs -I{} rg -n 'go-version|setup-go|golang:' {}
echo
echo "== Dockerfiles / Makefiles with Go version pins =="
fd -H -t f 'Dockerfile|Makefile|\.tool-versions|go\.env' . | xargs -I{} rg -n '1\.25|1\.24|golang:|GO_VERSION|go version' {}Repository: openshift-online/ocm-cli
Length of output: 382
Go toolchain bump to 1.25.0 conflicts with CI configuration and should not be part of this dependency update PR.
go.mod declares go 1.25.0 (line 3), but GitHub Actions workflows are pinned to Go 1.22 and 1.23. This version mismatch means CI will not test against the declared minimum toolchain, risking undetected incompatibilities or failures in production environments running Go 1.25.0.
Either revert the toolchain change to align with the PR's dependency-only scope, or update all CI workflows to test with Go 1.25.0.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@go.mod` at line 3, The go.mod change bumped the module toolchain to "go
1.25.0" which conflicts with CI workflows; either revert the go.mod entry back
to the previous toolchain version (restore the "go X.Y.Z" line to the prior
value) or update all GitHub Actions workflows that reference older Go versions
to include and test "1.25.0" so CI and go.mod remain consistent; locate the "go
1.25.0" entry in go.mod and apply the chosen fix, and if you update CI ensure
each workflow matrix or uses: actions/setup-go references 1.25.0.
|
rebase DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
Bumps [cloud.google.com/go/storage](https://github.com/googleapis/google-cloud-go) from 1.58.0 to 1.61.3. - [Release notes](https://github.com/googleapis/google-cloud-go/releases) - [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/CHANGES.md) - [Commits](googleapis/google-cloud-go@spanner/v1.58.0...storage/v1.61.3) --- updated-dependencies: - dependency-name: cloud.google.com/go/storage dependency-version: 1.61.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dc9265f to
aa37855
Compare
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@go.mod`:
- Line 31: Update the grpc dependency from google.golang.org/grpc v1.79.2 to
v1.79.3 to pull in the security fix; change the dependency entry (the line
containing "google.golang.org/grpc v1.79.2") to "google.golang.org/grpc v1.79.3"
and then run go get google.golang.org/grpc@v1.79.3 (or go get ./... and go mod
tidy) to update go.sum and ensure the module is rebuilt with the patched
version.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 4bf2bad3-7323-415c-972c-005db8ed94ab
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
| golang.org/x/term v0.40.0 | ||
| golang.org/x/text v0.34.0 | ||
| google.golang.org/api v0.271.0 | ||
| google.golang.org/grpc v1.79.2 |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
Is google.golang.org/grpc version 1.79.2 affected by CVE or vulnerability GO-2026-4762 or GHSA-p77j-4mvh-x3m3 (authorization bypass via missing leading slash in :path)? What is the latest patched version of google.golang.org/grpc?
💡 Result:
Yes. google.golang.org/grpc v1.79.2 is affected by GO-2026-4762 / GHSA-p77j-4mvh-x3m3 (authorization bypass when an attacker sends an HTTP/2 :path without a leading /). The advisory states affected versions are < 1.79.3 and the patched version is 1.79.3. [1]
Latest patched version: v1.79.3 (this is also the current latest grpc-go release as of today, March 31, 2026). [2]
Action: upgrade to google.golang.org/grpc v1.79.3 or newer. [1]
Sources
[1] GitHub Security Advisory GHSA-p77j-4mvh-x3m3 (grpc/grpc-go)
[2] grpc/grpc-go “latest release” tag (currently v1.79.3)
Upgrade google.golang.org/grpc to v1.79.3 to address critical authorization bypass vulnerability.
google.golang.org/grpc v1.79.2 contains a critical authorization bypass vulnerability (GO-2026-4762, GHSA-p77j-4mvh-x3m3) where missing leading slash in HTTP/2 :path can bypass authorization checks. The patched version is v1.79.3.
🧰 Tools
🪛 OSV Scanner (2.3.5)
[CRITICAL] 31-31: google.golang.org/grpc 1.79.2: Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc
(GO-2026-4762)
[CRITICAL] 31-31: google.golang.org/grpc 1.79.2: gRPC-Go has an authorization bypass via missing leading slash in :path
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@go.mod` at line 31, Update the grpc dependency from google.golang.org/grpc
v1.79.2 to v1.79.3 to pull in the security fix; change the dependency entry (the
line containing "google.golang.org/grpc v1.79.2") to "google.golang.org/grpc
v1.79.3" and then run go get google.golang.org/grpc@v1.79.3 (or go get ./... and
go mod tidy) to update go.sum and ensure the module is rebuilt with the patched
version.
|
Superseded by #1087. |
Bumps cloud.google.com/go/storage from 1.58.0 to 1.61.3.
Release notes
Sourced from cloud.google.com/go/storage's releases.
... (truncated)
Commits
35cd86achore: librarian release pull request: 20260313T045834Z (#14170)428b228docs(storage): Fix godoc formatting (#14169)e56381cfeat(vertexai): Support AgentEngine for Agent Development Kit (#14168)d38abf9feat(auth): add OpenTelemetry gRPC and HTTP wrappers for T4 tracing (#14133)9f56e9fchore: librarian release pull request: 20260312T071057Z (#14164)2dc8c9fchore: librarian release pull request: 20260312T041544Z (#14162)aeffa93feat(pubsub/v2): add keep alive support (#13457)bb64998feat(bigtable): add load balancing penalty for channel (#14149)704a21fRevert "Revert "chore: librarian release pull request: 20260311T074420Z"" (#1...b1b0586Revert "chore: librarian release pull request: 20260311T074420Z" (#14157)