Skip to content

Fix CVEs in release-0.23 - #4153

Open
dfarrell07 wants to merge 3 commits into
submariner-io:release-0.23from
dfarrell07:fix-0.23-cves-2026-08-21
Open

Fix CVEs in release-0.23#4153
dfarrell07 wants to merge 3 commits into
submariner-io:release-0.23from
dfarrell07:fix-0.23-cves-2026-08-21

Conversation

@dfarrell07

@dfarrell07 dfarrell07 commented Aug 24, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Member

See commit messages for details.

Summary by CodeRabbit

  • Security

    • Refined vulnerability tracking to remove outdated exceptions and accurately identify an unresolved security issue.
    • Updated underlying networking, system, text, synchronization, and tooling components to newer versions.

  • Maintenance

    • Improved the application’s security posture and compatibility through routine component updates.

@dfarrell07
Bump x/mod for CVEs
e4a1734 
Full package: golang.org/x/mod
Fixes: GO-2026-6179, GO-2026-6180

Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
@dfarrell07
Remove stale protobuf CVE false-positive ignores
a7ca45e 
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
@dfarrell07
Add fix-state: not-fixed to GO-2026-5932 ignore entry
166fbc6 
The GO-2026-5932 (golang.org/x/crypto) ignore entry lacked the
fix-state: not-fixed field, making it a permanent unconditional
suppress instead of an auto-expiring one. Without fix-state, grype
keeps the entry active even after a fix is published, silently hiding
the CVE rather than re-reporting it for remediation.

Add fix-state: not-fixed so the entry auto-expires when the OSV
advisory records an available fix.

Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
@dfarrell07 dfarrell07 self-assigned this Aug 24, 2026
@submariner-bot

submariner-bot commented Aug 24, 2026

Copy link
Copy Markdown
Contributor

🤖 Created branch: z_pr4153/dfarrell07/fix-0.23-cves-2026-08-21
🚀 Full E2E won't run until the "ready-to-test" label is applied. I will add it automatically once the PR has 2 approvals, or you can add it manually.

@coderabbitai

coderabbitai Bot commented Aug 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6f95a969-fa17-44dd-9e7b-230133d44f44

📥 Commits

Reviewing files that changed from the base of the PR and between 018e1bb and 166fbc6.

⛔ Files ignored due to path filters (2)
  • go.sum is excluded by !**/*.sum
  • tools/go.sum is excluded by !**/*.sum
📒 Files selected for processing (3)
  • .grype.yaml
  • go.mod
  • tools/go.mod

Included review availability: Your plan provides up to 8 included reviews per hour; 5 remain after this review.

Walkthrough

The change updates golang.org/x/* dependency versions in both Go modules and revises Grype ignore rules for protobuf CVEs and GO-2026-5932.

Changes

Dependency and security updates

Layer / File(s) Summary
Vulnerability ignore policy
.grype.yaml		 Removes two protobuf CVE ignore entries and adds fix-state: not-fixed to the GO-2026-5932 entry.
Go module version updates
go.mod, tools/go.mod		 Updates direct and indirect golang.org/x/* dependency versions in both modules.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 166fb

This dependency and vulnerability metadata update is merge-ready after normal checks and review; no actionable merge-blocking risk remains.

Suggested reviewers: vthapar, skitt

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

  • Ignore

❌ Failed checks (1 error)

Check name Status Explanation Resolution
Actionable Comments Resolved ❌ Error PR #4153 has an unresolved actionable bot comment: full E2E requires the missing ready-to-test label; the PR has zero labels and zero reviews. Apply the ready-to-test label, or obtain two approvals so the bot adds it, then run the full E2E test.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the dependency and vulnerability remediation changes in the release-0.23 branch.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@aswinsuryan aswinsuryan Awaiting requested review from aswinsuryan aswinsuryan is a code owner
@maayanf24 maayanf24 Awaiting requested review from maayanf24 maayanf24 is a code owner
@Oats87 Oats87 Awaiting requested review from Oats87 Oats87 is a code owner
@skitt skitt Awaiting requested review from skitt skitt is a code owner
@sridhargaddam sridhargaddam Awaiting requested review from sridhargaddam sridhargaddam is a code owner
@tpantelis tpantelis Awaiting requested review from tpantelis tpantelis is a code owner
@vthapar vthapar Awaiting requested review from vthapar vthapar is a code owner
@yboaron yboaron Awaiting requested review from yboaron yboaron is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

@dfarrell07 dfarrell07

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@dfarrell07 @submariner-bot