Repository navigation
Conversation
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
…ecurity] Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
…[security] Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Combine the open red-hat-konflux[bot] security PRs from this week (1040, 1042, 1046, 1049, 1051, 1052, 1054-1057, 1059-1068, 1070) into one change. Highest version of each dependency wins. Extra changes needed to keep the build green: - bump otelslog bridge to v0.21.0 (needed by otel/log v0.21) - adapt openapi-ir to kin-openapi v0.149 ExclusiveBound type - bump @vitest/coverage-v8 to 4.1.11 to match vitest - refresh forbidden-terms whitelist line numbers - add 14-day age exceptions for x/crypto v0.59.0 and its x/ deps Not included: openshift-online#1048 (moby/go-archive v0.3.0) breaks docker/docker v28. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the
 |
|
This pull request is merged. |
…s-consolidate-0a1df2 # Conflicts: # components/agents/tools/gitleaks/go.mod # components/agents/tools/gitleaks/go.sum # components/api-server/go.mod # components/api-server/go.sum # components/control-plane/go.mod # components/control-plane/go.sum # components/control-plane/tools/helm/go.mod # components/control-plane/tools/helm/go.sum # components/fleet-dashboard/go.mod # components/fleet-dashboard/go.sum # components/web-console/bff/package.json # pnpm-lock.yaml # pnpm-workspace.yaml
rardecode/v2 v2.2.0 (security update) no longer satisfies the interface used by mholt/archives v0.1.2, so the fullsend-sandbox image failed to build gitleaks. mholt/archives v0.1.5 supports it. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This was referenced Nov 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Combines this week's open
red-hat-konflux[bot]security PRs into one change, so they land together instead of conflicting ingo.mod,go.sumand the pnpm lock file.Included (21): #1040, #1042, #1046, #1048, #1049, #1051, #1052, #1054, #1055, #1056, #1057, #1059, #1060, #1061, #1062, #1063, #1064, #1065, #1066, #1067, #1068, #1070
Where PRs overlapped, the highest version of each dependency won. Lock files were regenerated.
#1048 (
moby/go-archive) needed more than a bump:testcontainers-gov0.33 uses an archive API removed aftergo-archivev0.1.0. This PR movestestcontainers-goto v0.41.0 (v0.42+ switches tomoby/mobyand breaksrh-trex-ai) andgo-archiveto v0.3.3. Theapi-serverintegration suite passes on it.Extra changes needed to keep the build green
otelslogbridge v0.19.0 to v0.21.0 (needed byotel/logv0.21). This also movesotel/log,otel/metricandotel/traceto v1.47.0.scripts/openapi-ir: adapt to thekin-openapiv0.149ExclusiveBoundtype. Behavior is unchanged for our OpenAPI 3.0.3 specs.@vitest/coverage-v8to 4.1.11 to match vitest..forbidden-terms-whitelist.json: refresh line numbers moved bygo.sumchanges.dependency-age-allowlist.json: 14-day cooldown exceptions forx/cryptov0.59.0 (the security fix) andx/sys,x/term,x/text, which it requires. Each entry expires 2026-11-26. Reviewers: please confirm you accept these exceptions.Testing
go buildandgo vetclean for all 13 Go modules.api-serverintegration suite run against PostgreSQL (Podman): all pass exceptTestExtKindsNameBackfillDeduplicatesCollisions, which is flaky (failed 2 of 5 runs on clean main).pnpm run check:web:lintpasses (format, lint, typecheck, build, Storybook build).operational-dashboard-uihas 28 failures on main as well, seen with Node 26 locally (repo pins Node 24).make checkpasses.tests/e2e(needs a live cluster).Once this merges, #1048 is the only one left to handle, and the other 20 source PRs can be closed.
🤖 Generated with Claude Code