OCPBUGS-98642 OCPBUGS-90007: Fix CVE-2026-33814 and CVE-2026-39829 by Atharva-Shinde · Pull Request #9529 · openshift/hypershift

Atharva-Shinde · 2026-09-07T11:57:46Z

What this PR does / why we need it:

Bumps golang.org/x/net and golang.org/x/crypto

Which issue(s) this PR fixes:

Fixes CVE-2026-33814 and CVE-2026-39829

Special notes for your reviewer:

Checklist:

Subject and description added to both, commit and PR.
Relevant issues have been referenced.
This change includes docs.
This change includes unit tests.

openshift-merge-bot · 2026-09-07T11:57:49Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

coderabbitai · 2026-09-07T11:57:53Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Advanced
Run ID: 39123d44-10e2-43ec-8a28-2fb59a3cb4df

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}

openshift-ci-robot · 2026-09-07T11:57:54Z

@Atharva-Shinde: This pull request references Jira Issue OCPBUGS-98642, which is invalid:

expected dependent Jira Issue OCPBUGS-101951 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is ASSIGNED instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

This pull request references Jira Issue OCPBUGS-90007, which is invalid:

expected Jira Issue OCPBUGS-90007 to depend on a bug targeting a version in 4.22.0 and in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

What this PR does / why we need it:

Bumps golang.org/x/net and golang.org/x/crypto

Which issue(s) this PR fixes:

Fixes CVE-2026-33814 and CVE-2026-39829

Special notes for your reviewer:

Checklist:

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

everettraven · 2026-09-10T13:38:53Z

vendor only changes for api.

/approve for api

Atharva-Shinde · 2026-09-22T17:47:55Z

/retest

red-hat-konflux · 2026-09-22T17:48:19Z

All PipelineRuns for this commit have already succeeded. Use /retest <pipeline-name> to re-run a specific pipeline or /test to re-run all pipelines.

Atharva-Shinde · 2026-09-22T18:09:59Z

/test verify
/test images
/test e2e-aks
/test e2e-aws-upgrade-hypershift-operator

jparrill · 2026-09-23T08:27:40Z

/test verify

jparrill · 2026-09-23T09:08:18Z

Hey @Atharva-Shinde, the verify failure is because the PR adds vendor/ directories to contrib/aws-tag-lb-service-webhook/ and contrib/gomaxprocs-webhook/ — these don't exist on main and aren't needed. Both projects build with go mod download, not vendor mode.

Remove the contrib/*/vendor/ dirs from the PR and keep only the go.mod/go.sum changes there. The api/vendor/ changes are fine.

The e2e failures are caused by a known blocker on this branch, tracked in #9736 and #9600. Once those merge and you rebase, /retest should pass.

Atharva-Shinde · 2026-09-23T09:20:04Z

on it @jparrill thanks!

devguyio · 2026-09-29T23:00:23Z

/uncc @devguyio
I'm currently out of capacity to review this PR

jparrill · 2026-09-30T13:46:52Z

/retest-required

jparrill · 2026-09-30T13:46:59Z

/approve

openshift-ci · 2026-09-30T13:54:26Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Atharva-Shinde, everettraven, jparrill

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [jparrill]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

clebs · 2026-10-01T08:06:22Z

HI @Atharva-Shinde,
Overall LGTM, verify is failing due to not updated modules.txt. You need to run make verify locally to get those changes and push them.

clebs · 2026-10-01T08:07:48Z

 	github.com/IBM/vpc-go-sdk v0.68.0
 	github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5
 	github.com/aws/aws-sdk-go v1.55.7
+	github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager v0.4.3


Were these AWS dependencies added intentionally? for what purpose?

clebs · 2026-10-01T08:09:27Z

/jira refresh

openshift-ci-robot · 2026-10-01T08:09:33Z

@clebs: This pull request references Jira Issue OCPBUGS-98642, which is invalid:

expected dependent Jira Issue OCPBUGS-101951 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is MODIFIED instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

This pull request references Jira Issue OCPBUGS-90007, which is invalid:

expected Jira Issue OCPBUGS-90007 to depend on a bug targeting a version in 4.22.0 and in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

jparrill · 2026-10-01T08:40:05Z

/jira refresh

openshift-ci-robot · 2026-10-01T08:40:10Z

@jparrill: This pull request references Jira Issue OCPBUGS-98642, which is invalid:

expected dependent Jira Issue OCPBUGS-101951 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is ON_QA instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

This pull request references Jira Issue OCPBUGS-90007, which is invalid:

expected Jira Issue OCPBUGS-90007 to depend on a bug targeting a version in 4.22.0 and in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-merge-robot · 2026-10-01T21:59:15Z

/jira refresh

openshift-ci-robot · 2026-10-01T21:59:21Z

@openshift-merge-robot: This pull request references Jira Issue OCPBUGS-98642, which is valid. The bug has been moved to the POST state.

7 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.21.z) matches configured target version for branch (4.21.z)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)
release note type set to "Release Note Not Required"
dependent bug Jira Issue OCPBUGS-101951 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA))
dependent Jira Issue OCPBUGS-101951 targets the "4.22.z" version, which is one of the valid target versions: 4.22.0
bug has dependents

No GitHub users were found matching the public email listed for the QA contact in Jira (ocp-sustaining-admins@redhat.com), skipping review request.

This pull request references Jira Issue OCPBUGS-90007, which is invalid:

expected Jira Issue OCPBUGS-90007 to depend on a bug targeting a version in 4.22.0 and in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

…-2026-39829 Signed-off-by: Atharva Shinde <atshinde@redhat.com>

Atharva-Shinde · 2026-10-06T12:12:03Z

/retest

red-hat-konflux · 2026-10-06T12:12:11Z

All PipelineRuns for this commit have already succeeded. Use /retest <pipeline-name> to re-run a specific pipeline or /test to re-run all pipelines.

openshift-ci · 2026-10-06T14:05:00Z

@Atharva-Shinde: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot added jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. labels Sep 7, 2026

openshift-ci-robot added the jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. label Sep 7, 2026

openshift-ci Bot added the do-not-merge/needs-area label Sep 7, 2026

openshift-ci Bot requested review from bryan-cox and devguyio September 7, 2026 11:59

openshift-ci Bot added area/api Indicates the PR includes changes for the API and removed do-not-merge/needs-area labels Sep 7, 2026

openshift-ci Bot added the area/ci-tooling Indicates the PR includes changes for CI or tooling label Sep 23, 2026

openshift-ci Bot removed the request for review from devguyio September 29, 2026 23:00

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 30, 2026

Atharva-Shinde force-pushed the 4.21-cve-fix branch from 5a6eaca to 608cb2d Compare October 1, 2026 07:00

clebs reviewed Oct 1, 2026

View reviewed changes

Atharva-Shinde force-pushed the 4.21-cve-fix branch from 608cb2d to 031fc0a Compare October 5, 2026 17:20

chore(deps): update module dependencies to fix CVE-2026-33814 and CVE…

bcb4117

…-2026-39829 Signed-off-by: Atharva Shinde <atshinde@redhat.com>

Atharva-Shinde force-pushed the 4.21-cve-fix branch from 031fc0a to bcb4117 Compare October 6, 2026 09:00

Conversation

Atharva-Shinde commented Sep 7, 2026

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Checklist:

Uh oh!

openshift-merge-bot Bot commented Sep 7, 2026

Uh oh!

coderabbitai Bot commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

openshift-ci-robot commented Sep 7, 2026

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Checklist:

Uh oh!

everettraven commented Sep 10, 2026

Uh oh!

Atharva-Shinde commented Sep 22, 2026

Uh oh!

red-hat-konflux Bot commented Sep 22, 2026

Uh oh!

Atharva-Shinde commented Sep 22, 2026

Uh oh!

jparrill commented Sep 23, 2026

Uh oh!

jparrill commented Sep 23, 2026

Uh oh!

Atharva-Shinde commented Sep 23, 2026

Uh oh!

devguyio commented Sep 29, 2026

Uh oh!

jparrill commented Sep 30, 2026

Uh oh!

jparrill commented Sep 30, 2026

Uh oh!

openshift-ci Bot commented Sep 30, 2026

Uh oh!

clebs commented Oct 1, 2026

Uh oh!

clebs Oct 1, 2026

Choose a reason for hiding this comment

Uh oh!

clebs commented Oct 1, 2026

Uh oh!

openshift-ci-robot commented Oct 1, 2026

Uh oh!

jparrill commented Oct 1, 2026

Uh oh!

openshift-ci-robot commented Oct 1, 2026

Uh oh!

openshift-merge-robot commented Oct 1, 2026

Uh oh!

openshift-ci-robot commented Oct 1, 2026

Uh oh!

Atharva-Shinde commented Oct 6, 2026

Uh oh!

red-hat-konflux Bot commented Oct 6, 2026

Uh oh!

openshift-ci Bot commented Oct 6, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

coderabbitai Bot commented Sep 7, 2026 •

edited

Loading