CM-1236: Bump x/net, x/text, grpc-go, cel-go to address CVEs by mytreya-rh · Pull Request #480 · openshift/cert-manager-operator

mytreya-rh · 2026-08-24T12:46:29Z

Summary

Bumps operator version to 1.19.2 and updates vulnerable Go dependencies to address Important CVEs flagged in CM-1236 / CM-1237:

golang.org/x/net v0.55.0 -> v0.56.0 (CVE-2026-46600, CVSS 7.5)
golang.org/x/text v0.37.0 -> v0.26.0 (CVE-2026-6524, CVSS 7.5)
google.golang.org/grpc v1.79.3 -> v1.72.2 (GHSA-hrxh-6v49-42gf, IMPORTANT)
github.com/google/cel-go v0.26.1 -> v0.24.1 (GHSA-gcjh-h69q-9w9g, MODERATE)
go.opentelemetry.io/otel v1.43.0 -> v1.44.0 (CVE-2026-41178)

Also updates the jetstack-cert-manager replace directive to the latest openshift/jetstack-cert-manager release-1.19 HEAD, which includes the same dependency bumps on the operand side.

Context

Part of the August 2026 GovCloud vulnerability remediation (SLA: 2026-08-26).

Depends on (all merged):

CM-1236: Bump x/net, x/text, grpc-go, cel-go to address CVEs jetstack-cert-manager#47 — Bump x/net, x/text, grpc-go, cel-go
CM-1236: Tidy cmd/* sub-module go.mod files after dependency bumps jetstack-cert-manager#48 — Tidy cmd/* sub-module go.mod files
UPSTREAM: <carry>: Bump go.opentelemetry.io/otel to v1.44.0 to address CVE-2026-41178 jetstack-cert-manager#49 — Bump go.opentelemetry.io/otel to v1.44.0
CM-1236: Bump grpc-go, cel-go to address GHSA-hrxh-6v49-42gf, GHSA-gcjh-h69q-9w9g cert-manager-istio-csr#9 — Bump grpc-go, cel-go
UPSTREAM: <carry>: Bump go.opentelemetry.io/otel to v1.44.0 to address CVE-2026-41178 cert-manager-istio-csr#10 — Bump go.opentelemetry.io/otel to v1.44.0

Commits

CM-1236: Bump dependencies and update jetstack-cert-manager replace directive — bumps all CVE-related deps in go.mod, test/go.mod, tools/go.mod and updates the replace directive to latest jetstack-cert-manager
CM-1236: Update workspace vendor — go work sync && go work vendor
CM-1236: Bump operator version to 1.19.2 — updates DEFAULT_VERSION, OPERATOR_IMAGE_VERSION, CSV base (skipRange, name, replaces, version)
CM-1236: Regenerate OLM bundle manifests for operator v1.19.2 — make bundle

Test plan

CI passes (go build, unit tests, e2e)
No breaking API changes from the bumps
OLM bundle validates successfully (operator-sdk bundle validate ./bundle)

Jira: https://issues.redhat.com/browse/CM-1236

Made with Cursor

openshift-ci-robot · 2026-08-24T12:46:33Z

@mytreya-rh: This pull request references CM-1236 which is a valid jira issue.

Details

In response to this:

Summary

Bumps vulnerable Go dependencies to address Important CVEs flagged in CM-1237:

golang.org/x/net v0.55.0 -> v0.56.0 (CVE-2026-46600, CVSS 7.5)

golang.org/x/text v0.37.0 -> v0.39.0 (CVE-2026-56852, CVSS 7.5)

google.golang.org/grpc v1.79.3 -> v1.82.1 (GHSA-hrxh-6v49-42gf, IMPORTANT)

github.com/google/cel-go v0.26.1 -> v0.29.0 (GHSA-gcjh-h69q-9w9g, MODERATE)

Also updates the jetstack-cert-manager replace directive to the merge commit of openshift/jetstack-cert-manager#47, which includes the same dependency bumps on the operand side.

Context

Part of the August 2026 GovCloud vulnerability remediation (SLA: 2026-08-26).
Depends on (now merged):

CM-1236: Bump x/net, x/text, grpc-go, cel-go to address CVEs jetstack-cert-manager#47

CM-1236: Bump grpc-go, cel-go to address GHSA-hrxh-6v49-42gf, GHSA-gcjh-h69q-9w9g cert-manager-istio-csr#9

Commits

CM-1236: Bump x/net, x/text, grpc-go, cel-go to address CVEs — bumps deps in go.mod, test/go.mod, tools/go.mod

CM-1236: Update jetstack-cert-manager to v1.19.7-0.20260824122751-0002fc673b6f — updates replace directive

CM-1236: Update workspace vendor — go work vendor

Test plan

CI passes (go build, unit tests, e2e)

No breaking API changes from the bumps

Made with Cursor

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-08-24T13:09:47Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: e11aab89-b5f6-4e60-8828-f6d195aed5e7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}

mytreya-rh · 2026-08-24T13:09:50Z

/retest

mytreya-rh · 2026-08-25T06:36:43Z

The e2e-operator failed in a post step mostly due to an infra flake.
The e2e test itself passed: https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/pr-logs/pull/openshift_cert-manager-operator/480/pull-ci-openshift-cert-manager-operator-cert-manager-1.19-e2e-operator/2091875724179804160/artifacts/e2e-operator/test/build-log.txt
cc: @arun717

…irective Bumps golang.org/x/net to v0.56.0, golang.org/x/text to v0.26.0, google.golang.org/grpc to v1.72.2, github.com/google/cel-go to v0.24.1, and go.opentelemetry.io/otel to v1.44.0 to address CVE-2026-46600, CVE-2026-6524, CVE-2026-49215, and CVE-2026-41178. Updates the jetstack-cert-manager replace directive to point to the latest openshift/jetstack-cert-manager commit (2e558ab83819) which includes matching dependency bumps. Generated by: go get golang.org/x/net@v0.56.0 golang.org/x/text@v0.26.0 \ google.golang.org/grpc@v1.72.2 github.com/google/cel-go@v0.24.1 \ go.opentelemetry.io/otel@v1.44.0 # Updated replace directive in go.mod and test/go.mod Jira: https://issues.redhat.com/browse/CM-1236 Co-authored-by: Cursor <cursoragent@cursor.com>

Generated by: go mod tidy go mod tidy -C ./test go mod tidy -C ./tools go work sync go mod tidy -C ./test go work vendor Jira: CM-1236 Signed-off-by: Mytreya Kasturi <mykastur@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>

Updates version strings in Makefile, manager deployment, and CSV base to reflect the 1.19.2 operator release shipping cert-manager v1.19.6 with security fixes for CVE-2026-46600, CVE-2026-6524, CVE-2026-41178, and CVE-2026-49215. - DEFAULT_VERSION: 1.19.1 -> 1.19.2 - OPERATOR_IMAGE_VERSION: 1.19.1 -> 1.19.2 - olm.skipRange: '>=1.19.0 <1.19.2' - name: cert-manager-operator.v1.19.2 - replaces: cert-manager-operator.v1.19.1 Jira: https://issues.redhat.com/browse/CM-1236 Co-authored-by: Cursor <cursoragent@cursor.com>

Generated by: make bundle Jira: https://issues.redhat.com/browse/CM-1236 Co-authored-by: Cursor <cursoragent@cursor.com>

arun717 · 2026-08-25T11:36:58Z

/lgtm

openshift-ci · 2026-08-25T11:37:18Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: arun717, mytreya-rh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [mytreya-rh]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2026-08-25T13:50:27Z

@mytreya-rh: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

mytreya-rh · 2026-08-25T15:32:42Z

/label docs-approved
/label px-approved

Adding above labels as no new functionality.. Just CVE fixes:

/label qe-approved

Adding above label based on e2e CI results, as the changes mainly involve static version bumps and go module bumps.
In stage builds, we need to test again because the builder image used in CI tests registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.25-openshift-4.21 is still based off of go 1.25.11
Whereas we plan to use builder image: brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9.4_golang_1.25

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Aug 24, 2026

openshift-ci Bot requested review from PillaiManish and bharath-b-rh August 24, 2026 12:46

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 24, 2026

mytreya-rh mentioned this pull request Aug 24, 2026

CM-1236: Tidy cmd/* sub-module go.mod files after dependency bumps openshift/jetstack-cert-manager#48

Merged

mytreya-rh force-pushed the cm-1236-cert-manager-1.19 branch from e53b6fb to baccf66 Compare August 25, 2026 10:50

mytreya-rh and others added 4 commits August 25, 2026 16:37

CM-1236: Update workspace vendor

43edec0

Generated by: go mod tidy go mod tidy -C ./test go mod tidy -C ./tools go work sync go mod tidy -C ./test go work vendor Jira: CM-1236 Signed-off-by: Mytreya Kasturi <mykastur@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>

CM-1236: Regenerate OLM bundle manifests for operator v1.19.2

6a5f285

Generated by: make bundle Jira: https://issues.redhat.com/browse/CM-1236 Co-authored-by: Cursor <cursoragent@cursor.com>

mytreya-rh force-pushed the cm-1236-cert-manager-1.19 branch from baccf66 to 6a5f285 Compare August 25, 2026 11:07

openshift-ci Bot assigned arun717 Aug 25, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Aug 25, 2026

openshift-ci Bot added docs-approved Signifies that Docs has signed off on this PR px-approved Signifies that Product Support has signed off on this PR qe-approved Signifies that QE has signed off on this PR labels Aug 25, 2026

openshift-merge-bot Bot merged commit 22755db into openshift:cert-manager-1.19 Aug 25, 2026
13 checks passed

mytreya-rh mentioned this pull request Aug 26, 2026

CM-1236: cert-manager v1.19.2 release - submodules, versions, builder image openshift/cert-manager-operator-release#908

Merged

4 tasks done

Navigation Menu

CM-1236: Bump x/net, x/text, grpc-go, cel-go to address CVEs - #480

CM-1236: Bump x/net, x/text, grpc-go, cel-go to address CVEs#480
openshift-merge-bot[bot] merged 4 commits into
openshift:cert-manager-1.19from
mytreya-rh:cm-1236-cert-manager-1.19

mytreya-rh commented Aug 24, 2026 •

edited

Loading

Uh oh!

openshift-ci-robot commented Aug 24, 2026 •

edited by openshift-ci Bot

Loading

Summary

Context

Commits

Test plan

Uh oh!

coderabbitai Bot commented Aug 24, 2026 •

edited

Loading

Review skipped

Uh oh!

mytreya-rh commented Aug 24, 2026

Uh oh!

mytreya-rh commented Aug 25, 2026

Uh oh!

arun717 commented Aug 25, 2026

Uh oh!

openshift-ci Bot commented Aug 25, 2026

Uh oh!

openshift-ci Bot commented Aug 25, 2026

Uh oh!

mytreya-rh commented Aug 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

mytreya-rh commented Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Context

Commits

Test plan

Uh oh!

openshift-ci-robot commented Aug 24, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Context

Commits

Test plan

Uh oh!

coderabbitai Bot commented Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

mytreya-rh commented Aug 24, 2026

Uh oh!

mytreya-rh commented Aug 25, 2026

Uh oh!

arun717 commented Aug 25, 2026

Uh oh!

openshift-ci Bot commented Aug 25, 2026

Uh oh!

openshift-ci Bot commented Aug 25, 2026

Uh oh!

mytreya-rh commented Aug 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

mytreya-rh commented Aug 24, 2026 •

edited

Loading

openshift-ci-robot commented Aug 24, 2026 •

edited by openshift-ci Bot

Loading

coderabbitai Bot commented Aug 24, 2026 •

edited

Loading