Repository navigation
DFBUGS-9295: [release-4.18] switch to openshift-sustaining/net v0.35.0-sec.3 for CVE-2026-33814 - #799
Conversation
CVE-2026-33814 (GO-2026-4918) requires two fixes on this branch: 1. RHEL Go builder image with stdlib backport (golang-1.22.12-17.el9) 2. openshift-sustaining/net v0.35.0-sec.3 via go.mod replace The builder image fix is already available. This commit adds the sustaining fork replacement for golang.org/x/net and refreshes vendor. Ref-DFBUGS-9295 Signed-off-by: AnikaYadav1 <Anika.Yadav1@ibm.com>
openshift-ci-robot
added
jira/severity-important
|
@AnikaYadav1: This pull request references [Jira Issue DFBUGS-9295](https://redhat.atlassian.net/browse/DFBUGS-9295), which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: AnikaYadav1, leelavg The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
3 participants
DFBUGS-9295
Address CVE-2026-33814 (GO-2026-4918), which requires two fixes on ODF 4.18:
A patched upstream x/net would force a Go bump on this branch. The sustaining fork applies the fix and keeps the current toolchain.The operator build gets the stdlib fix from the updated RHEL builder image.