You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "villebro (via GitHub)" <gi...@apache.org> on 2026/08/19 17:19:08 UTC
[PR] fix(deps): bump cel-go, otel, x/mod for known advisories [superset-kubernetes-operator]
villebro opened a new pull request, #290:
URL: https://github.com/apache/superset-kubernetes-operator/pull/290
## Summary
The OpenSSF Scorecard **Vulnerabilities** check flags four advisories against **indirect** Go dependencies that were pinned below their fixed versions. This bumps each module to its fixed version to clear the finding. All four are transitive modules, so Go's minimal-version-selection kept them at whatever their parents require and Renovate's normal cadence did not raise them.
| OSV / CVE | Indirect module | Was | Now |
|---|---|---|---|
| GO-2026-6094 (GHSA-gcjh-h69q-9w9g) | `github.com/google/cel-go` | 0.29.0 | 0.30.0 |
| GO-2026-5158 (CVE-2026-41178) | `go.opentelemetry.io/otel` | 1.43.0 | 1.44.0 |
| GO-2026-6179 (CVE-2026-56865) | `golang.org/x/mod` | 0.37.0 | 0.40.0 |
| GO-2026-6180 (CVE-2026-56864) | `golang.org/x/mod` | 0.37.0 | 0.40.0 |
## Details
Our `govulncheck` gate stays green because the built binary never reaches the vulnerable symbols (`cel-go/ext`, otel `baggage`/`propagation`, `x/mod/sumdb`). Scorecard uses version-based OSV scanning with no reachability analysis, so it flags these regardless of whether the code path is reachable — hence the discrepancy between our CI and the Scorecard result.
The `go.opentelemetry.io/otel` `v1.x` family (`metric`, `trace`, `sdk`) is bumped together to avoid version skew. `go mod tidy` also carried a few adjacent `golang.org/x/*` updates along. Only `go.mod`/`go.sum` change; there are no source changes.
Verified locally: `make build`, `make test-unit`, and `make codegen` (no drift) all pass. `govulncheck` runs in CI.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(deps): bump cel-go, otel, x/mod for known advisories [superset-kubernetes-operator]
Posted by "villebro (via GitHub)" <gi...@apache.org>.
villebro merged PR #290:
URL: https://github.com/apache/superset-kubernetes-operator/pull/290
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(deps): bump cel-go, otel, x/mod for known advisories [superset-kubernetes-operator]
Posted by "codecov-commenter (via GitHub)" <gi...@apache.org>.
codecov-commenter commented on PR #290:
URL: https://github.com/apache/superset-kubernetes-operator/pull/290#issuecomment-5346222050
## [Codecov](https://app.codecov.io/gh/apache/superset-kubernetes-operator/pull/290?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 90.05%. Comparing base ([`e3e2a44`](https://app.codecov.io/gh/apache/superset-kubernetes-operator/commit/e3e2a447f78e65ec58567af1f79228d07f9605c5?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`ca9641a`](https://app.codecov.io/gh/apache/superset-kubernetes-operator/commit/ca9641acb3294220fb97fa3a327231a2a142f36a?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
[:umbrella: View full report in Codecov by Harness](https://app.codecov.io/gh/apache/superset-kubernetes-operator/pull/290?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org