fix(deps): update gomod dependencies - #3259
Conversation
red-hat-konflux
Bot
added
approved
|
|
There are test jobs defined for this repository which are not configured to run automatically. Comment |
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 59: The github.com/gomarkdown/markdown dependency is pinned to a
vulnerable version (v0.0.0-20260217112301-37c66b85d6ab) that is susceptible to
CVE-2026-40890 with a CVSS score of 7.5 due to an out-of-bounds read in
SmartypantsRenderer. Update the version of github.com/gomarkdown/markdown in the
go.mod file to a patched version such as v0.0.0-20260614204949-e08cff860f76 or
any later version that includes the fix committed on April 10, 2026.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: a0d29158-e7c8-45e3-826f-3322c44b02f7
📒 Files selected for processing (1)
go.mod
|
|
||
| require ( | ||
| github.com/golang-jwt/jwt/v4 v4.5.2 | ||
| github.com/gomarkdown/markdown v0.0.0-20260217112301-37c66b85d6ab |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
GHSA-77fj-vx54-gvh7 gomarkdown markdown out-of-bounds read vulnerability details
💡 Result:
GHSA-77fj-vx54-gvh7, also tracked as CVE-2026-40890, is a security vulnerability in the gomarkdown/markdown Go library that causes an out-of-bounds read or a panic [1][2]. The vulnerability occurs specifically within the SmartypantsRenderer component [1][3]. When the library processes malformed input containing a '<' character that is not followed by a '>' character anywhere in the remaining text, the smartLeftAngle function performs an out-of-bounds slice operation [1]. This behavior can lead to a denial-of-service (DoS) condition if the application panics [1][4]. Technical details: - Affected Component: SmartypantsRenderer [1] - Vulnerability Type: Out-of-bounds Read (CWE-125) [1] - Impact: Denial of Service / Panic [1][4] - Fix: The issue was addressed in commit 759bbc3e32073c3bc4e25969c132fc520eda2778 [1][2]. Users of the library are advised to update their dependency to a version containing this patch to mitigate the risk [2].
Citations:
- 1: GHSA-77fj-vx54-gvh7
- 2: https://nvd.nist.gov/vuln/detail/CVE-2026-40890
- 3: https://advisories.gitlab.com/golang/github.com/gomarkdown/markdown/GHSA-77fj-vx54-gvh7/
- 4: https://test.osv.dev/vulnerability/GHSA-77fj-vx54-gvh7
🏁 Script executed:
# Check if we can fetch information about the gomarkdown/markdown commit
# The pseudo-version indicates commit 37c66b85d6ab from Feb 17, 2026
# We need to verify if this includes the fix commit 759bbc3e32073c3bc4e25969c132fc520eda2778
# First, let's try to check if there's any git history or refs available
cd /tmp && git clone --depth 100 https://github.com/gomarkdown/markdown.git 2>&1 | head -20 || trueRepository: openshift/osde2e
Length of output: 149
🌐 Web query:
gomarkdown/markdown commit 759bbc3e32073c3bc4e25969c132fc520eda2778 GHSA-77fj-vx54-gvh7 fix merged when
💡 Result:
The commit 759bbc3e32073c3bc4e25969c132fc520eda2778 in the gomarkdown/markdown repository, which addresses the vulnerability identified as GHSA-77fj-vx54-gvh7 (CVE-2026-40890), was authored on April 10, 2026 [1]. This patch corrects an out-of-bounds read vulnerability in the SmartypantsRenderer [1][2]. Although the commit itself is dated April 10, 2026 [1], the associated security advisory (GHSA-77fj-vx54-gvh7) was published on April 13, 2026 [2]. The fix ensures that the library correctly handles malformed input containing a '<' character not followed by a '>' character, preventing potential service panics or out-of-bounds reads [3][2].
Citations:
- 1: gomarkdown/markdown@759bbc3
- 2: GHSA-77fj-vx54-gvh7
- 3: https://nvd.nist.gov/vuln/detail/CVE-2026-40890
🌐 Web query:
gomarkdown/markdown v0.0.0-20260217112301 release date vulnerability status
💡 Result:
The Go package github.com/gomarkdown/markdown version v0.0.0-20260217112301-37c66b85d6ab was released on February 17, 2026 [1][2]. Regarding its vulnerability status, this version is affected by CVE-2026-40890 (GHSA-77fj-vx54-gvh7) [3][4]. This vulnerability involves an out-of-bounds read or potential panic when using a SmartypantsRenderer to process malformed input containing a '<' character that is not followed by a '>' character [3][4]. The issue was officially documented and assigned a CVSS v3.1 base score of 7.5 (High) [3][4]. Users of this package are advised to upgrade to a version containing the fix, which is commit 759bbc3e32073c3bc4e25969c132fc520eda2778 [4]. Current registry data indicates that later versions, such as v0.0.0-20260614204949-e08cff860f76, are available [5].
Citations:
- 1: https://deps.dev/go/github.com%2Fgomarkdown%2Fmarkdown/v0.0.0-20260217112301-37c66b85d6ab
- 2: chore: upgrade github.com/gomarkdown/markdown to latest version kubernetes-sigs/descheduler#1831
- 3: GHSA-77fj-vx54-gvh7
- 4: https://nvd.nist.gov/vuln/detail/CVE-2026-40890
- 5: https://pkg.go.dev/github.com/gomarkdown/markdown
Update gomarkdown/markdown to patched version before merge.
The version v0.0.0-20260217112301-37c66b85d6ab (February 17, 2026) is vulnerable to CVE-2026-40890 / GHSA-77fj-vx54-gvh7 (out-of-bounds read in SmartypantsRenderer, CVSS 7.5). The fix was committed April 10, 2026. Upgrade to a patched version such as v0.0.0-20260614204949-e08cff860f76 or later.
🧰 Tools
🪛 OSV Scanner (2.3.8)
[HIGH] 59-59: github.com/gomarkdown/markdown 0.0.0-20260217112301-37c66b85d6ab: Go Markdown has an Out-of-bounds Read in SmartypantsRenderer
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 59, The github.com/gomarkdown/markdown dependency is pinned
to a vulnerable version (v0.0.0-20260217112301-37c66b85d6ab) that is susceptible
to CVE-2026-40890 with a CVSS score of 7.5 due to an out-of-bounds read in
SmartypantsRenderer. Update the version of github.com/gomarkdown/markdown in the
go.mod file to a patched version such as v0.0.0-20260614204949-e08cff860f76 or
any later version that includes the fix committed on April 10, 2026.
Source: Linters/SAST tools
|
/hold Revision b8569c5 was retested 3 times: holding |
openshift-ci
Bot
added
the
do-not-merge/hold
b8569c5 to
bd3263d
Compare
|
New changes are detected. LGTM label has been removed. |
e392220 to
bd81291
Compare
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
bd81291 to
9b5cbc0
Compare
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: red-hat-konflux[bot] The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@red-hat-konflux[bot]: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This PR contains the following updates:
v1.21.1→v1.33.0v3.4.0→v3.5.0v1.10.2→v1.12.0v1.42.0→v1.43.0v1.32.25→v1.32.31v1.19.24→v1.19.30v0.2.11→v0.3.5v1.71.4→v1.75.0v1.294.1→v1.317.0v1.54.5→v1.56.0v1.104.0→v1.106.0v1.27.1→v1.27.4v1.27.5v1.9.0→v1.10.1v1.4.3→v1.4.437c66b8→8435af3v1.7.0→v1.9.0v0.9.2→v0.9.5v0.23.0→v0.25.2v2.28.1→v2.32.0v1.39.1→v1.42.1v0.22.0→v0.46.0v0.74.0→v0.92.1v0.74.0→v0.92.1v1.23.2→v1.24.1v1.12.0→v1.15.0v1.10.0→v1.10.2v1.0.9→v1.0.10v1.19.0→v1.21.0v1.10.2→v1.18.2v0.227.0→v0.290.0v1.51.0→v1.65.0v0.21.0→v0.24.1Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
Masterminds/semver (github.com/Masterminds/semver/v3)
v3.5.0Compare Source
What's Changed
New Contributors
Full Changelog: Masterminds/semver@v3.4.0...v3.5.0
PuerkitoBio/goquery (github.com/PuerkitoBio/goquery)
v1.12.0Compare Source
Note that Go1.25 is now required (use goquery < 1.12.0 if you can't use go1.25+, see README for version details).
v1.11.0Compare Source
Note that Go1.24 is now required (use goquery < 1.11.0 if you can't use go1.24+).
v1.10.3Compare Source
Update dependencies and a small memory optimization.
aws/aws-sdk-go-v2 (github.com/aws/aws-sdk-go-v2)
v1.43.0Compare Source
General Highlights
Module Highlights
github.com/aws/aws-sdk-go-v2: v1.41.10github.com/aws/aws-sdk-go-v2/service/cloudwatch: v1.58.0github.com/aws/aws-sdk-go-v2/service/ec2: v1.305.0github.com/aws/aws-sdk-go-v2/service/elasticache: v1.54.0github.com/aws/aws-sdk-go-v2/service/georoutes: v1.11.0github.com/aws/aws-sdk-go-v2/service/guardduty: v1.79.0github.com/aws/aws-sdk-go-v2/service/iot: v1.75.1github.com/aws/aws-sdk-go-v2/service/keyspacesstreams: v1.8.0github.com/aws/aws-sdk-go-v2/service/lambda: v1.92.0github.com/aws/aws-sdk-go-v2/service/lexruntimeservice: v1.30.0github.com/aws/aws-sdk-go-v2/service/managedblockchain: v1.32.0github.com/aws/aws-sdk-go-v2/service/marketplacemetering: v1.37.0github.com/aws/aws-sdk-go-v2/service/mediaconvert: v1.92.0github.com/aws/aws-sdk-go-v2/service/medialive: v1.98.0github.com/aws/aws-sdk-go-v2/service/mediastore: v1.30.0github.com/aws/aws-sdk-go-v2/service/migrationhub: v1.32.0github.com/aws/aws-sdk-go-v2/service/mturk: v1.31.0github.com/aws/aws-sdk-go-v2/service/neptune: v1.45.0github.com/aws/aws-sdk-go-v2/service/personalizeruntime: v1.34.0github.com/aws/aws-sdk-go-v2/service/pi: v1.37.0github.com/aws/aws-sdk-go-v2/service/pinpoint: v1.40.0github.com/aws/aws-sdk-go-v2/service/pinpointemail: v1.30.0github.com/aws/aws-sdk-go-v2/service/polly: v1.58.0github.com/aws/aws-sdk-go-v2/service/ram: v1.37.0github.com/aws/aws-sdk-go-v2/service/redshift: v1.63.0github.com/aws/aws-sdk-go-v2/service/rekognition: v1.52.0github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi: v1.33.0github.com/aws/aws-sdk-go-v2/service/route53: v1.63.0github.com/aws/aws-sdk-go-v2/service/route53domains: v1.36.0github.com/aws/aws-sdk-go-v2/service/s3: v1.103.0github.com/aws/aws-sdk-go-v2/service/sagemaker: v1.251.0github.com/aws/aws-sdk-go-v2/service/sagemakerjobruntime: v1.0.0github.com/aws/aws-sdk-go-v2/service/secretsmanager: v1.42.0github.com/aws/aws-sdk-go-v2/service/servicecatalog: v1.40.0github.com/aws/aws-sdk-go-v2/service/sfn: v1.42.0github.com/aws/aws-sdk-go-v2/service/shield: v1.35.0github.com/aws/aws-sdk-go-v2/service/snowball: v1.37.0github.com/aws/aws-sdk-go-v2/service/sqs: v1.43.0github.com/aws/aws-sdk-go-v2/service/ssm: v1.69.0github.com/aws/aws-sdk-go-v2/service/sso: v1.31.0github.com/aws/aws-sdk-go-v2/service/storagegateway: v1.44.0github.com/aws/aws-sdk-go-v2/service/sts: v1.43.0github.com/aws/aws-sdk-go-v2/service/swf: v1.34.0github.com/aws/aws-sdk-go-v2/service/transcribe: v1.56.0github.com/aws/aws-sdk-go-v2/service/transfer: v1.73.0github.com/aws/aws-sdk-go-v2/service/waf: v1.31.0github.com/aws/aws-sdk-go-v2/service/xray: v1.37.0v1.42.1Compare Source
General Highlights
Module Highlights
github.com/aws/aws-sdk-go-v2: v1.41.5github.com/aws/aws-sdk-go-v2/service/accessanalyzer: v1.45.12github.com/aws/aws-sdk-go-v2/service/account: v1.30.5github.com/aws/aws-sdk-go-v2/service/acm: v1.37.23github.com/aws/aws-sdk-go-v2/service/acmpca: v1.46.12github.com/aws/aws-sdk-go-v2/service/aiops: v1.6.21github.com/aws/aws-sdk-go-v2/service/amp: v1.42.9github.com/aws/aws-sdk-go-v2/service/amplify: v1.38.14github.com/aws/aws-sdk-go-v2/service/amplifybackend: v1.32.20github.com/aws/aws-sdk-go-v2/service/amplifyuibuilder: v1.28.20github.com/aws/aws-sdk-go-v2/service/apigateway: v1.39.1github.com/aws/aws-sdk-go-v2/service/apigatewaymanagementapi: v1.29.14github.com/aws/aws-sdk-go-v2/service/apigatewayv2: v1.34.1github.com/aws/aws-sdk-go-v2/service/appconfig: v1.43.13github.com/aws/aws-sdk-go-v2/service/appconfigdata: v1.23.22github.com/aws/aws-sdk-go-v2/service/appfabric: v1.16.21github.com/aws/aws-sdk-go-v2/service/appflow: v1.51.12github.com/aws/aws-sdk-go-v2/service/appintegrations: v1.37.7github.com/aws/aws-sdk-go-v2/service/applicationautoscaling: v1.41.14github.com/aws/aws-sdk-go-v2/service/applicationcostprofiler: v1.27.12github.com/aws/aws-sdk-go-v2/service/applicationdiscoveryservice: v1.35.13github.com/aws/aws-sdk-go-v2/service/applicationinsights: v1.34.20github.com/aws/aws-sdk-go-v2/service/applicationsignals: v1.19.1github.com/aws/aws-sdk-go-v2/service/appmesh: v1.35.12github.com/aws/aws-sdk-go-v2/service/apprunner: v1.39.14github.com/aws/aws-sdk-go-v2/service/appstream: v1.54.4github.com/aws/aws-sdk-go-v2/service/appsync: v1.53.5github.com/aws/aws-sdk-go-v2/service/arcregionswitch: v1.6.3github.com/aws/aws-sdk-go-v2/service/arczonalshift: v1.22.23github.com/aws/aws-sdk-go-v2/service/artifact: v1.15.5github.com/aws/aws-sdk-go-v2/service/athena: v1.57.4github.com/aws/aws-sdk-go-v2/service/auditmanager: v1.46.12github.com/aws/aws-sdk-go-v2/service/autoscaling: v1.64.4github.com/aws/aws-sdk-go-v2/service/autoscalingplans: v1.30.14github.com/aws/aws-sdk-go-v2/service/b2bi: v1.0.0-preview.100github.com/aws/aws-sdk-go-v2/service/backup: v1.54.11github.com/aws/aws-sdk-go-v2/service/backupgateway: v1.26.3github.com/aws/aws-sdk-go-v2/service/backupsearch: v1.6.23github.com/aws/aws-sdk-go-v2/service/batch: v1.63.2github.com/aws/aws-sdk-go-v2/service/bcmdashboards: v1.1.4github.com/aws/aws-sdk-go-v2/service/bcmdataexports: v1.14.0github.com/aws/aws-sdk-go-v2/service/bcmpricingcalculator: v1.10.9github.com/aws/aws-sdk-go-v2/service/bcmrecommendedactions: v1.1.5github.com/aws/aws-sdk-go-v2/service/bedrock: v1.57.1github.com/aws/aws-sdk-go-v2/service/bedrockagent: v1.52.7github.com/aws/aws-sdk-go-v2/service/bedrockagentcore: v1.15.2github.com/aws/aws-sdk-go-v2/service/bedrockagentcorecontrol: v1.25.1github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime: v1.51.8github.com/aws/aws-sdk-go-v2/service/bedrockdataautomation: v1.13.5github.com/aws/aws-sdk-go-v2/service/bedrockdataautomationruntime: v1.10.4github.com/aws/aws-sdk-go-v2/service/bedrockruntime: v1.50.4github.com/aws/aws-sdk-go-v2/service/billing: v1.10.4github.com/aws/aws-sdk-go-v2/service/billingconductor: v1.28.5github.com/aws/aws-sdk-go-v2/service/braket: v1.39.8github.com/aws/aws-sdk-go-v2/service/budgets: v1.43.4github.com/aws/aws-sdk-go-v2/service/chatbot: v1.14.21github.com/aws/aws-sdk-go-v2/service/chime: v1.41.12github.com/aws/aws-sdk-go-v2/service/chimesdkidentity: v1.27.20github.com/aws/aws-sdk-go-v2/service/chimesdkmediapipelines: v1.26.21github.com/aws/aws-sdk-go-v2/service/chimesdkmeetings: v1.33.15github.com/aws/aws-sdk-go-v2/service/chimesdkmessaging: v1.32.17github.com/aws/aws-sdk-go-v2/service/chimesdkvoice: v1.28.13github.com/aws/aws-sdk-go-v2/service/cleanrooms: v1.42.4github.com/aws/aws-sdk-go-v2/service/cleanroomsml: v1.22.5github.com/aws/aws-sdk-go-v2/service/cloud9: v1.33.20github.com/aws/aws-sdk-go-v2/service/cloudcontrol: v1.29.13github.com/aws/aws-sdk-go-v2/service/clouddirectory: v1.30.12github.com/aws/aws-sdk-go-v2/service/cloudformation: v1.71.9github.com/aws/aws-sdk-go-v2/service/cloudfront: v1.60.4github.com/aws/aws-sdk-go-v2/service/cloudfrontkeyvaluestore: v1.12.24github.com/aws/aws-sdk-go-v2/service/cloudhsm: v1.29.21github.com/aws/aws-sdk-go-v2/service/cloudhsmv2: v1.34.21github.com/aws/aws-sdk-go-v2/service/cloudsearch: v1.32.12github.com/aws/aws-sdk-go-v2/service/cloudsearchdomain: v1.28.20github.com/aws/aws-sdk-go-v2/service/cloudtrail: v1.55.9github.com/aws/aws-sdk-go-v2/service/cloudtraildata: v1.17.13github.com/aws/aws-sdk-go-v2/service/cloudwatch: v1.55.3github.com/aws/aws-sdk-go-v2/service/cloudwatchevents: v1.32.23github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs: v1.65.0github.com/aws/aws-sdk-go-v2/service/codeartifact: v1.38.21github.com/aws/aws-sdk-go-v2/service/codebuild: v1.68.13github.com/aws/aws-sdk-go-v2/service/codecatalyst: v1.21.12github.com/aws/aws-sdk-go-v2/service/codecommit: v1.33.12github.com/aws/aws-sdk-go-v2/service/codeconnections: v1.10.20github.com/aws/aws-sdk-go-v2/service/codedeploy: v1.35.13github.com/aws/aws-sdk-go-v2/service/codeguruprofiler: v1.29.20github.com/aws/aws-sdk-go-v2/service/codegurureviewer: v1.34.20github.com/aws/aws-sdk-go-v2/service/codegurusecurity: v1.16.24github.com/aws/aws-sdk-go-v2/service/codepipeline: v1.46.21github.com/aws/aws-sdk-go-v2/service/codestarconnections: v1.35.13github.com/aws/aws-sdk-go-v2/service/codestarnotifications: v1.31.21github.com/aws/aws-sdk-go-v2/service/cognitoidentity: v1.33.22github.com/aws/aws-sdk-go-v2/service/cognitoidentityprovider: v1.59.3github.com/aws/aws-sdk-go-v2/service/cognitosync: v1.29.12github.com/aws/aws-sdk-go-v2/service/comprehend: v1.40.21github.com/aws/aws-sdk-go-v2/service/comprehendmedical: v1.31.21github.com/aws/aws-sdk-go-v2/service/computeoptimizer: v1.49.8github.com/aws/aws-sdk-go-v2/service/computeoptimizerautomation: v1.0.8github.com/aws/aws-sdk-go-v2/service/configservice: v1.62.1github.com/aws/aws-sdk-go-v2/service/connect: v1.166.1github.com/aws/aws-sdk-go-v2/service/connectcampaigns: v1.20.20github.com/aws/aws-sdk-go-v2/service/connectcampaignsv2: v1.11.4github.com/aws/aws-sdk-go-v2/service/connectcases: v1.39.1github.com/aws/aws-sdk-go-v2/service/connectcontactlens: v1.33.13github.com/aws/aws-sdk-go-v2/service/connecthealth: v1.0.3github.com/aws/aws-sdk-go-v2/service/connectparticipant: v1.36.7github.com/aws/aws-sdk-go-v2/service/controlcatalog: v1.14.9github.com/aws/aws-sdk-go-v2/service/controltower: v1.28.9github.com/aws/aws-sdk-go-v2/service/costandusagereportservice: v1.34.13github.com/aws/aws-sdk-go-v2/service/costexplorer: v1.63.6github.com/aws/aws-sdk-go-v2/service/costoptimizationhub: v1.22.8github.com/aws/aws-sdk-go-v2/service/customerprofiles: v1.57.2github.com/aws/aws-sdk-go-v2/service/databasemigrationservice: v1.61.10github.com/aws/aws-sdk-go-v2/service/databrew: v1.39.14github.com/aws/aws-sdk-go-v2/service/dataexchange: [v1.40Configuration
📅 Schedule: (in timezone UTC)
* 2-4 * * 1-5)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.