NO-ISSUE: Update module github.com/openshift/golang-oauth2 to v0.28.0#757
Conversation
|
@red-hat-konflux[bot]: This pull request explicitly references no jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
added
the
jira/valid-reference
WalkthroughUpdated the golang.org/x/oauth2 module replace directive in go.mod to use a newer version of the openshift fork, incrementing from v0.26.1-0.20250310184649-06a918c6239d to v0.28.0. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes ✨ Finishing touches🧪 Generate unit tests (beta)
Comment |
openshift-ci
bot
added
the
size/S
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: red-hat-konflux[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
needs-ok-to-test
|
Hi @red-hat-konflux[bot]. Thanks for your PR. I'm waiting for a github.com member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
red-hat-konflux
bot
force-pushed
the
konflux/mintmaker/master/ghproxy-9d2.pages.dev-openshift-golang-oauth2-0.x
branch
5 times, most recently
from
bf2a68e to
c302872
Compare
red-hat-konflux
bot
force-pushed
the
konflux/mintmaker/master/ghproxy-9d2.pages.dev-openshift-golang-oauth2-0.x
branch
2 times, most recently
from
59cefe1 to
e043184
Compare
red-hat-konflux
bot
force-pushed
the
konflux/mintmaker/master/ghproxy-9d2.pages.dev-openshift-golang-oauth2-0.x
branch
2 times, most recently
from
513a75c to
b0a8cee
Compare
red-hat-konflux
bot
force-pushed
the
konflux/mintmaker/master/ghproxy-9d2.pages.dev-openshift-golang-oauth2-0.x
branch
from
b0a8cee to
be6c76e
Compare
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
red-hat-konflux
bot
force-pushed
the
konflux/mintmaker/master/ghproxy-9d2.pages.dev-openshift-golang-oauth2-0.x
branch
from
be6c76e to
0c9819f
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@go.mod`:
- Line 149: The go.mod replace pointing to github.com/openshift/golang-oauth2
v0.28.0 must be validated and justified: verify that the OpenShift fork tag
v0.28.0 actually exists and contains the CVE-2025-22868 patch (inspect the fork
repo/commit history for the jws fix), and then either (a) add documentation in
the PR/CHANGELOG explaining why the OpenShift fork is required (what additional
patches/behavior it provides) or (b) if the fork only supplies the CVE fix,
change the replace to use the upstream golang.org/x/oauth2 v0.28.0 (or the
minimal upstream v0.27.x+ release that includes the patch) instead; update
go.mod accordingly and run go mod tidy to ensure builds resolve.
| // CVE-2025-22868 | ||
| // This is from tag v0.26.openshift.1 | ||
| golang.org/x/oauth2 => github.com/openshift/golang-oauth2 v0.26.1-0.20250310184649-06a918c6239d | ||
| golang.org/x/oauth2 => github.com/openshift/golang-oauth2 v0.28.0 |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
CVE-2025-22868 golang oauth2 security vulnerability
💡 Result:
CVE-2025-22868 (Go / golang.org/x/oauth2) is a Denial-of-Service (DoS) issue where a malicious, malformed token can trigger unexpected/unbounded memory consumption during token parsing. [1][2]
- Affected component:
golang.org/x/oauth2/jws(in thegolang.org/x/oauth2module) before v0.27.0. [1][3] - Severity: HIGH (CVSS 3.1 7.5), network exploitable, no privileges or user interaction required; availability impact is high. [2][3]
- Fix: Upgrade
golang.org/x/oauth2to v0.27.0 or later (contains the patch). [1][3]
What to do
- Update your dependency (example):
go get golang.org/x/oauth2@v0.27.0 go mod tidy
- If you accept tokens from untrusted sources, consider adding request/body size limits and rate limiting as defense-in-depth (the core fix is upgrading). [1][2]
Sources
[1] Go vulnerability report (GO-2025-3488) https://pkg.go.dev/vuln/GO-2025-3488
[2] NVD entry https://nvd.nist.gov/vuln/detail/CVE-2025-22868
[3] GitHub Advisory (GHSA-6v2p-p543-phr9) GHSA-6v2p-p543-phr9
🏁 Script executed:
# Check the go.mod file context around line 149
cd . && head -n 160 go.mod | tail -n 25Repository: openshift/cluster-api-provider-agent
Length of output: 1261
🌐 Web query:
github.com/openshift/golang-oauth2 v0.28.0 release
💡 Result:
I couldn’t find any publicly indexed GitHub “Release” (or even a discoverable repository page) for github.com/openshift/golang-oauth2 or a v0.28.0 release/tag in that OpenShift org—search results consistently resolve only to the upstream golang/oauth2 project, not an OpenShift fork. [2]
For the upstream module golang.org/x/oauth2, tag v0.28.0 corresponds to a change titled “Deep copy context client in NewClient” (so client settings like timeouts from a context-provided *http.Client are preserved instead of being lost). The tag was committed on March 3, 2025. [1]
Sources:
[1] v0.28.0 tag details (commit message/date) on Chromium’s mirror of golang/oauth2: (chromium.googlesource.com)
[2] Upstream GitHub repository (no OpenShift fork/release surfaced in search): (github.com)
Citations:
- 1: https://chromium.googlesource.com/external/github.com/golang/oauth2/%2B/refs/tags/v0.28.0?utm_source=openai
- 2: https://github.com/golang/oauth2?utm_source=openai
Cannot verify the OpenShift fork version publicly—confirm the security fix is present.
The replace directive points to github.com/openshift/golang-oauth2 v0.28.0, which claims to address CVE-2025-22868 (a HIGH-severity DoS in golang.org/x/oauth2/jws). However, the OpenShift fork tag v0.28.0 cannot be verified publicly via GitHub—no release or tag is discoverable.
While the upstream golang.org/x/oauth2 v0.28.0 exists (released March 3, 2025) and would contain the fix, this change uses a fork without clear documentation. Before merging:
- Verify the fork tag
v0.28.0exists and includes the CVE-2025-22868 patch - Document why the OpenShift fork is necessary (e.g., additional patches)
- If the fork is only for CVE-2025-22868, consider using the upstream
v0.27.0+directly instead
🤖 Prompt for AI Agents
In `@go.mod` at line 149, The go.mod replace pointing to
github.com/openshift/golang-oauth2 v0.28.0 must be validated and justified:
verify that the OpenShift fork tag v0.28.0 actually exists and contains the
CVE-2025-22868 patch (inspect the fork repo/commit history for the jws fix), and
then either (a) add documentation in the PR/CHANGELOG explaining why the
OpenShift fork is required (what additional patches/behavior it provides) or (b)
if the fork only supplies the CVE fix, change the replace to use the upstream
golang.org/x/oauth2 v0.28.0 (or the minimal upstream v0.27.x+ release that
includes the patch) instead; update go.mod accordingly and run go mod tidy to
ensure builds resolve.
1 participant
This PR contains the following updates:
v0.26.1-0.20250310184649-06a918c6239d->v0.28.0Release Notes
openshift/golang-oauth2 (github.com/openshift/golang-oauth2)
v0.28.0Compare Source
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.