-
Notifications
You must be signed in to change notification settings - Fork 138
Bump github.com/openshift/backplane-cli from 0.10.1 to 0.10.2 #924
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -8,9 +8,9 @@ require ( | |
| github.com/Masterminds/semver/v3 v3.4.0 | ||
| github.com/PagerDuty/go-pagerduty v1.8.0 | ||
| github.com/andygrunwald/go-jira v1.17.0 | ||
| github.com/aws/aws-sdk-go-v2 v1.41.12 | ||
| github.com/aws/aws-sdk-go-v2/config v1.32.23 | ||
| github.com/aws/aws-sdk-go-v2/credentials v1.19.22 | ||
| github.com/aws/aws-sdk-go-v2 v1.42.0 | ||
| github.com/aws/aws-sdk-go-v2/config v1.32.25 | ||
| github.com/aws/aws-sdk-go-v2/credentials v1.19.24 | ||
| github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.47.4 | ||
| github.com/aws/aws-sdk-go-v2/service/costexplorer v1.46.7 | ||
| github.com/aws/aws-sdk-go-v2/service/ec2 v1.279.2 | ||
|
|
@@ -22,7 +22,7 @@ require ( | |
| github.com/aws/aws-sdk-go-v2/service/route53 v1.48.7 | ||
| github.com/aws/aws-sdk-go-v2/service/s3 v1.95.1 | ||
| github.com/aws/aws-sdk-go-v2/service/servicequotas v1.34.1 | ||
| github.com/aws/aws-sdk-go-v2/service/sts v1.43.2 | ||
| github.com/aws/aws-sdk-go-v2/service/sts v1.43.3 | ||
| github.com/aws/smithy-go v1.27.1 | ||
| github.com/brianvoe/gofakeit/v6 v6.24.0 | ||
| github.com/cenkalti/backoff/v4 v4.3.0 | ||
|
|
@@ -40,14 +40,14 @@ require ( | |
| github.com/observatorium/api v0.1.3-0.20260127104902-9709b1e9e333 | ||
| github.com/olekukonko/tablewriter v0.0.5 | ||
| github.com/onsi/ginkgo v1.16.5 | ||
| github.com/onsi/gomega v1.41.0 | ||
| github.com/onsi/gomega v1.42.0 | ||
| github.com/openshift-online/ocm-cli v1.0.11 | ||
| github.com/openshift-online/ocm-common v0.0.37 | ||
| github.com/openshift-online/ocm-sdk-go v0.1.501 | ||
| github.com/openshift-online/ocm-sdk-go v0.1.503 | ||
| github.com/openshift/api v0.0.0-20250207102212-9e59a77ed2e0 | ||
| github.com/openshift/aws-account-operator/api v0.0.0-20250205151445-6455c35fc4ae | ||
| github.com/openshift/backplane-api v0.0.0-20260205054653-459856398d59 | ||
| github.com/openshift/backplane-cli v0.10.1 | ||
| github.com/openshift/backplane-cli v0.10.2 | ||
| github.com/openshift/cloud-credential-operator v0.0.0-20250120201329-db5f2531a5b4 | ||
| github.com/openshift/gcp-project-operator v0.0.0-20241024143818-ec4eabd35aba | ||
| github.com/openshift/hive/apis v0.0.0-20250206153200-5a34ea42e678 | ||
|
|
@@ -67,7 +67,7 @@ require ( | |
| go.uber.org/mock v0.6.0 | ||
| golang.org/x/oauth2 v0.35.0 | ||
| golang.org/x/sync v0.20.0 | ||
| golang.org/x/term v0.43.0 | ||
| golang.org/x/term v0.44.0 | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🧩 Analysis chain🌐 Web query:
💡 Result: As of June 22, 2026, there are no specific CVEs associated with golang.org/x/term v0.44.0 [1]. For golang.org/x/sys v0.46.0, there is a known vulnerability tracked as GO-2026-5024 (CVE-2026-39824), which was published on May 22, 2026 [2]. This vulnerability relates to the NewNTUnicodeString function failing to properly check for string length overflows, potentially leading to truncated strings when a string exceeds the maximum size of a NTUnicodeString [2]. While automated security analysis tools may flag these packages based on various heuristic or unconfirmed signals (such as dependency structures, lack of build provenance, or access to sensitive system calls), these should be distinguished from confirmed CVEs [3][4][5]. Users are encouraged to monitor the official Go vulnerability database at https://pkg.go.dev/vuln/list for the most accurate and up-to-date security information [2]. Citations:
golang.org/x/sys v0.46.0 contains a known vulnerability (CVE-2026-39824 / GO-2026-5024). golang.org/x/term v0.44.0 has no known CVEs. However, golang.org/x/sys v0.46.0 (line 248) contains CVE-2026-39824, a vulnerability in the NewNTUnicodeString function that fails to properly check for string length overflows, potentially leading to truncated strings. This was published May 22, 2026. Upgrade to a patched version of golang.org/x/sys to resolve the vulnerability. 🤖 Prompt for AI AgentsSource: Coding guidelines |
||
| google.golang.org/api v0.257.0 | ||
| google.golang.org/genproto v0.0.0-20251213004720-97cd9d5aeac2 | ||
| gopkg.in/yaml.v2 v2.4.0 | ||
|
|
@@ -102,18 +102,18 @@ require ( | |
| github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect | ||
| github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect | ||
| github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 // indirect | ||
| github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.28 // indirect | ||
| github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.28 // indirect | ||
| github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.28 // indirect | ||
| github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.29 // indirect | ||
| github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.29 // indirect | ||
| github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.29 // indirect | ||
| github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29 // indirect | ||
| github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.30 // indirect | ||
| github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.12 // indirect | ||
| github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.8 // indirect | ||
| github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.28 // indirect | ||
| github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.29 // indirect | ||
| github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.17 // indirect | ||
| github.com/aws/aws-sdk-go-v2/service/signin v1.1.4 // indirect | ||
| github.com/aws/aws-sdk-go-v2/service/ssm v1.69.2 // indirect | ||
| github.com/aws/aws-sdk-go-v2/service/sso v1.31.2 // indirect | ||
| github.com/aws/aws-sdk-go-v2/service/ssooidc v1.36.5 // indirect | ||
| github.com/aws/aws-sdk-go-v2/service/signin v1.2.0 // indirect | ||
| github.com/aws/aws-sdk-go-v2/service/ssm v1.69.3 // indirect | ||
| github.com/aws/aws-sdk-go-v2/service/sso v1.31.3 // indirect | ||
| github.com/aws/aws-sdk-go-v2/service/ssooidc v1.36.6 // indirect | ||
| github.com/aymerick/douceur v0.2.0 // indirect | ||
| github.com/beorn7/perks v1.0.1 // indirect | ||
| github.com/blang/semver/v4 v4.0.0 // indirect | ||
|
|
@@ -201,8 +201,8 @@ require ( | |
| github.com/oapi-codegen/runtime v1.1.2 // indirect | ||
| github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 // indirect | ||
| github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 // indirect | ||
| github.com/openshift-online/ocm-api-model/clientapi v0.0.456 // indirect | ||
| github.com/openshift-online/ocm-api-model/model v0.0.456 // indirect | ||
| github.com/openshift-online/ocm-api-model/clientapi v0.0.457 // indirect | ||
| github.com/openshift-online/ocm-api-model/model v0.0.457 // indirect | ||
| github.com/openshift/custom-resource-status v1.1.3-0.20220503160415-f2fdb4999d87 // indirect | ||
| github.com/pelletier/go-toml/v2 v2.2.4 // indirect | ||
| github.com/perimeterx/marshmallow v1.1.5 // indirect | ||
|
|
@@ -245,7 +245,7 @@ require ( | |
| golang.org/x/crypto v0.50.0 // indirect | ||
| golang.org/x/mod v0.35.0 // indirect | ||
| golang.org/x/net v0.53.0 // indirect | ||
| golang.org/x/sys v0.44.0 // indirect | ||
| golang.org/x/sys v0.46.0 // indirect | ||
| golang.org/x/text v0.36.0 // indirect | ||
| golang.org/x/time v0.14.0 // indirect | ||
| golang.org/x/tools v0.44.0 // indirect | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🌐 Web query:
Known CVEs in github.com/aws/aws-sdk-go-v2 v1.42.0, github.com/aws/aws-sdk-go-v2/config v1.32.25, github.com/aws/aws-sdk-go-v2/credentials v1.19.24, github.com/aws/aws-sdk-go-v2/service/sts v1.43.3💡 Result:
Known CVEs for the specified aws-sdk-go-v2 Go modules/versions (as of 2026-06-22): 1) github.com/aws/aws-sdk-go-v2 v1.42.0 - No specific CVE ID was found for this exact version via the official GitHub advisory database entries surfaced in this research. The closest official advisory related to these versions is GHSA-3jcv-796g-cpjg (“Defense in depth enhancement for region parameter value”), which is patched in 1.42.2 / 1.42.3 (i.e., affected range includes versions <1.42.2 / <1.42.3 depending on patch line), but the advisory text does not list a CVE ID in the surfaced source. [1] 2) github.com/aws/aws-sdk-go-v2/config v1.32.25 - No CVE IDs were found in the surfaced official advisory material; and a third-party dependency inventory (Sonatype) reports 0 vulnerabilities for v1.32.25. [2] 3) github.com/aws/aws-sdk-go-v2/credentials v1.19.24 - No CVE IDs were found in the surfaced official advisory material; and a third-party dependency inventory (Sonatype) reports 0 vulnerabilities for v1.19.24. [3] 4) github.com/aws/aws-sdk-go-v2/service/sts v1.43.3 - No CVE IDs were found for this exact version in the surfaced official advisory material. Important related security advisory (not tied to a CVE ID in the sources found here) - GHSA-xmrv-pmrh-hhx2: “Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder”. The advisory states no known CVE ID and describes impacted versions as predating 2026-03-23, with a fix in 2026-03-23 and above. [4] Practical recommendation - For your three exact module versions (config 1.32.25, credentials 1.19.24, sts 1.43.3), the sources surfaced in this research did not reveal any known CVE IDs. - For github.com/aws/aws-sdk-go-v2 v1.42.0, an official security GHSA exists that has a fix at/around v1.42.2 and v1.42.3, but no CVE ID was present in the surfaced advisory content. [1] - Regardless of CVE presence, upgrading to the patched releases referenced by the relevant GHSA(s) is the actionable mitigation. [1][4]
Citations:
Upgrade
github.com/aws/aws-sdk-go-v2to v1.42.2 or v1.42.3 to resolve GHSA-3jcv-796g-cpjg.The version v1.42.0 is affected by a security advisory covering region parameter defense-in-depth enhancements. The fix is available in v1.42.2 and v1.42.3. The other AWS SDK v2 modules (config v1.32.25, credentials v1.19.24, service/sts v1.43.3) have no known CVEs.
Ensure
go.sumis committed in the PR to verify cryptographic integrity of all module versions.🤖 Prompt for AI Agents
Source: Coding guidelines