chore(deps): update module github.com/prometheus/procfs to v0.20.1#43
chore(deps): update module github.com/prometheus/procfs to v0.20.1#43red-hat-konflux[bot] wants to merge 1 commit into
Conversation
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
📝 WalkthroughWalkthroughUpdated two indirect dependencies in ChangesDependency Version Updates
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 69: Update the indirect module entry for golang.org/x/sys in go.mod from
v0.41.0 to at least v0.44.0 to pick up the GO-2026-5024 fix: replace the line
containing "golang.org/x/sys v0.41.0 // indirect" with "golang.org/x/sys v0.44.0
// indirect" (or a newer patch/minor), then run "go get
golang.org/x/sys@v0.44.0" (or "go get golang.org/x/sys@latest") and "go mod
tidy" to update go.sum and ensure the dependency graph is consistent; finally
run your tests/build to verify no regressions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 8cbf7f62-aed8-4e07-84fa-4a5cd0fcb600
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum,!go.sum
📒 Files selected for processing (1)
go.mod
| golang.org/x/oauth2 v0.34.0 // indirect | ||
| golang.org/x/sync v0.19.0 // indirect | ||
| golang.org/x/sys v0.40.0 // indirect | ||
| golang.org/x/sys v0.41.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify golang.org/x/sys v0.41.0 exists and check for vulnerabilities
echo "=== Checking if v0.41.0 tag exists ==="
gh api repos/golang/sys/git/refs/tags/v0.41.0 --jq '.ref' || echo "Tag not found"
echo -e "\n=== Checking for security advisories ==="
gh api graphql -f query='
{
securityVulnerabilities(first: 10, ecosystem: GO, package: "golang.org/x/sys") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'Repository: openshift/lightspeed-agentic-operator
Length of output: 517
🏁 Script executed:
#!/bin/bash
set -euo pipefail
PKG="golang.org/x/sys"
VER="v0.41.0"
echo "=== OSV check for ${PKG}@${VER} ==="
cat <<JSON > /tmp/osv_query.json
{
"package": { "name": "${PKG}" },
"version": "${VER}"
}
JSON
curl -sS -H "Content-Type: application/json" \
-d `@/tmp/osv_query.json` \
https://api.osv.dev/v1/query | jq .Repository: openshift/lightspeed-agentic-operator
Length of output: 2102
Update golang.org/x/sys to pick up a fix (v0.41.0 is affected by GO-2026-5024)
golang.org/x/sysv0.41.0 tag exists.- Security issue: OSV reports
GO-2026-5024(aliasCVE-2026-39824) affectinggolang.org/x/sys/windows(NewNTUnicodeStringlength overflow/truncation); first fixed inv0.44.0(sov0.41.0is impacted).
Update the indirect dependency togolang.org/x/sys v0.44.0+.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 69, Update the indirect module entry for golang.org/x/sys in
go.mod from v0.41.0 to at least v0.44.0 to pick up the GO-2026-5024 fix: replace
the line containing "golang.org/x/sys v0.41.0 // indirect" with
"golang.org/x/sys v0.44.0 // indirect" (or a newer patch/minor), then run "go
get golang.org/x/sys@v0.44.0" (or "go get golang.org/x/sys@latest") and "go mod
tidy" to update go.sum and ensure the dependency graph is consistent; finally
run your tests/build to verify no regressions.
|
@red-hat-konflux[bot]: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This PR contains the following updates:
v0.19.2→v0.20.1Warning
Some dependencies could not be looked up. Check the warning logs for more information.
Release Notes
prometheus/procfs (github.com/prometheus/procfs)
v0.20.1Compare Source
What's Changed
New Contributors
Full Changelog: prometheus/procfs@v0.20.0...v0.20.1
v0.20.0Compare Source
What's Changed
New Contributors
Full Changelog: prometheus/procfs@v0.19.2...v0.20.0
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.