[backplane-2.9] ACM-32571: CVE-2026-34986 Bump github.com/go-jose/go-jose/v4 to v4.1.4 through indirect dependency conversion by cve-automation[bot] · Pull Request #826 · openshift/image-based-install-operator

cve-automation · 2026-04-28T16:25:17Z

Bump github.com/go-jose/go-jose/v4 to v4.1.4 to fix CVE-2026-34986 through indirect dependency conversion

Strategy Selection

Strategies Not Applicable

Direct dependency version bump
Not applicable: dependency is indirect. Direct version bumps only work for explicitly required modules.
Direct dependency major version upgrade
Not applicable: dependency is indirect. Major version upgrades only apply to direct dependencies.
Indirect dependency fix via parent update
- Suitable versions found for introducers:
  - google.golang.org/grpc@v1.82.0-dev
  - cloud.google.com/go/iam@v1.8.0
  - cloud.google.com/go/storage@v1.62.1
- No suitable versions found for introducers:
  - github.com/spiffe/go-spiffe/v2
  - github.com/openshift/cloud-credential-operator
  - github.com/coreos/ignition/v2
  - github.com/containers/image/v5
  - sigs.k8s.io/cluster-api-provider-gcp
  - sigs.k8s.io/cluster-api-provider-aws/v2
  - github.com/openshift/installer
  - cloud.google.com/go

✓ Successful Strategy: Indirect to direct dependency conversion

Converted indirect dependency to direct requirement. Necessary because parent modules don't provide a fixed version.

https://redhat.atlassian.net/browse/ACM-32571

This PR was automatically generated by the CVE Automation tool.
For questions or issues, reach out in #cve-automation.

…4 through indirect dependency conversion

openshift-ci-robot · 2026-04-28T16:25:21Z

@cve-automation[bot]: This pull request references ACM-32571 which is a valid jira issue.

Details

In response to this:

Bump github.com/go-jose/go-jose/v4 to v4.1.4 to fix CVE-2026-34986 through indirect dependency conversion

Strategy Selection

Strategies Not Applicable

Direct dependency version bump
Not applicable: dependency is indirect. Direct version bumps only work for explicitly required modules.

Direct dependency major version upgrade
Not applicable: dependency is indirect. Major version upgrades only apply to direct dependencies.

Indirect dependency fix via parent update

Suitable versions found for introducers:

google.golang.org/grpc@v1.82.0-dev

cloud.google.com/go/iam@v1.8.0

cloud.google.com/go/storage@v1.62.1

No suitable versions found for introducers:

github.com/spiffe/go-spiffe/v2

github.com/openshift/cloud-credential-operator

github.com/coreos/ignition/v2

github.com/containers/image/v5

sigs.k8s.io/cluster-api-provider-gcp

sigs.k8s.io/cluster-api-provider-aws/v2

github.com/openshift/installer

cloud.google.com/go

✓ Successful Strategy: Indirect to direct dependency conversion

Converted indirect dependency to direct requirement. Necessary because parent modules don't provide a fixed version.

https://redhat.atlassian.net/browse/ACM-32571

This PR was automatically generated by the CVE Automation tool.
For questions or issues, reach out in #cve-automation.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-04-28T16:25:25Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: e34454a2-1780-49a3-99a4-604d7493af69

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch cve-CVE-2026-34986-33ef32bf-6ff661

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

openshift-ci · 2026-04-28T16:25:55Z

Hi @cve-automation[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci · 2026-04-28T20:21:58Z

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: cve-automation[bot]

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-merge-bot · 2026-04-28T21:38:53Z

/retest-required

Remaining retests: 0 against base HEAD 794eed1 and 2 for PR HEAD a9b3e8a in total

openshift-ci · 2026-04-28T22:41:40Z

@cve-automation[bot]: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/ibio-reinstall	`a9b3e8a`	link	false	`/test ibio-reinstall`
ci/prow/e2e-ibio	`a9b3e8a`	link	true	`/test e2e-ibio`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

cve-automation · 2026-04-29T06:23:18Z

/retest

openshift-ci · 2026-04-29T06:24:43Z

@cve-automation[bot]: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

Details

In response to this:

/retest

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

cve-automation · 2026-04-29T07:55:45Z

/retest

openshift-ci · 2026-04-29T07:56:21Z

@cve-automation[bot]: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

Details

In response to this:

/retest

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

cve-automation · 2026-04-29T08:15:58Z

/retest

red-hat-konflux · 2026-04-29T08:16:03Z

All PipelineRuns for this commit have already succeeded. Use /retest <pipeline-name> to re-run a specific pipeline or /test to re-run all pipelines.

openshift-ci · 2026-04-29T08:18:41Z

@cve-automation[bot]: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

Details

In response to this:

/retest

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

cve-automation · 2026-04-29T08:32:28Z

/retest

openshift-ci · 2026-04-29T08:33:06Z

@cve-automation[bot]: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

Details

In response to this:

/retest

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

cve-automation · 2026-04-29T11:09:29Z

/retest

openshift-ci · 2026-04-29T11:10:13Z

@cve-automation[bot]: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

Details

In response to this:

/retest

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

ACM-32571: CVE-2026-34986 Bump github.com/go-jose/go-jose/v4 to v4.1.…

a9b3e8a

…4 through indirect dependency conversion

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Apr 28, 2026

openshift-ci Bot requested review from carbonin and pixelsoccupied April 28, 2026 16:25

openshift-ci Bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Apr 28, 2026

cve-automation Bot added approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. labels Apr 28, 2026

Conversation

cve-automation Bot commented Apr 28, 2026

Strategy Selection

Strategies Not Applicable

✓ Successful Strategy: Indirect to direct dependency conversion

Uh oh!

openshift-ci-robot commented Apr 28, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Strategy Selection

Strategies Not Applicable

✓ Successful Strategy: Indirect to direct dependency conversion

Uh oh!

coderabbitai Bot commented Apr 28, 2026

Review skipped

Uh oh!

openshift-ci Bot commented Apr 28, 2026

Uh oh!

openshift-ci Bot commented Apr 28, 2026

Uh oh!

openshift-merge-bot Bot commented Apr 28, 2026

Uh oh!

openshift-ci Bot commented Apr 28, 2026

Uh oh!

cve-automation Bot commented Apr 29, 2026

Uh oh!

openshift-ci Bot commented Apr 29, 2026

Uh oh!

cve-automation Bot commented Apr 29, 2026

Uh oh!

openshift-ci Bot commented Apr 29, 2026

Uh oh!

cve-automation Bot commented Apr 29, 2026

Uh oh!

red-hat-konflux Bot commented Apr 29, 2026

Uh oh!

openshift-ci Bot commented Apr 29, 2026

Uh oh!

cve-automation Bot commented Apr 29, 2026

Uh oh!

openshift-ci Bot commented Apr 29, 2026

Uh oh!

cve-automation Bot commented Apr 29, 2026

Uh oh!

openshift-ci Bot commented Apr 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

openshift-ci-robot commented Apr 28, 2026 •

edited by openshift-ci Bot

Loading