Skip to content

Build(deps): Bump google.golang.org/api from 0.291.0 to 0.292.0 #1234

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 1 commit into from
Aug 10, 2026
Merged

Build(deps): Bump google.golang.org/api from 0.291.0 to 0.292.0 #1234

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ require (
go.uber.org/mock v0.6.0
golang.org/x/term v0.45.0
golang.org/x/text v0.40.0
google.golang.org/api v0.291.0
google.golang.org/api v0.292.0

@coderabbitai coderabbitai Bot Aug 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

check_osv() {
  local module="$1"
  local version="$2"
  local response

  response="$(
    curl -fsS -X POST 'https://api.osv.dev/v1/query' \
      -H 'Content-Type: application/json' \
      -d "$(jq -n \
        --arg name "$module" \
        --arg version "$version" \
        '{package: {name: $name, ecosystem: "Go"}, version: $version}')"
  )"

  if jq -e '((.vulns // []) | length) > 0' <<<"$response" >/dev/null; then
    printf '%s@%s has OSV findings\n' "$module" "$version"
    jq '.vulns[] | {id, summary, affected}' <<<"$response"
    return 1
  fi

  printf '%s@%s: no matching OSV records\n' "$module" "$version"
}

check_osv \
  'google.golang.org/api' \
  'v0.292.0'

check_osv \
  'google.golang.org/genproto/googleapis/rpc' \
  'v0.0.0-20260803160001-6ac0973c030d'

rg -n -F \
  'google.golang.org/api v0.292.0 h1:Ewiwo/GTtiaPZSNAZQUcWLh8AYDEoPmIXyJfeoTSMHU=' \
  go.sum

rg -n -F \
  'google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d h1:IL4hdHzcUv2l/gcg98/Rj3FbtE6axwqslOW8SW0C+S0=' \
  go.sum

rg -n -i --hidden --glob '!.git/**' \
  'sbom|cyclonedx|syft|slsa|provenance|attest|cosign|sigstore' . || true

Repository: openshift-online/ocm-cli

Length of output: 599

🏁 Script executed:

#!/usr/bin/env bash
set -u

printf '%s\n' '--- dependency declarations and checksums ---'
cat -n go.mod | sed -n '20,36p;142,156p'
rg -n -F \
  -e 'google.golang.org/api v0.292.0' \
  -e 'google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d' \
  go.mod go.sum

printf '%s\n' '--- repository policy and dependency metadata files ---'
git ls-files | rg -i '(^|/)(license|copying|notice|contributing|security|policy|governance|makefile|github/workflows/|hack/build_hermetic_image\.sh$)' || true
rg -n -i --hidden --glob '!.git/**' \
  'license|third.party|dependency.policy|allowed.?license|sbom|cyclonedx|syft|slsa|provenance|attest|cosign|sigstore|artifact signing|actions/upload-artifact' \
  . || true

printf '%s\n' '--- hermetic image build context ---'
cat -n hack/build_hermetic_image.sh | sed -n '1,120p'

printf '%s\n' '--- Go proxy metadata ---'
for module_version in \
  'google.golang.org/api/@v/v0.292.0.mod' \
  'google.golang.org/api/@v/v0.292.0.info' \
  'google.golang.org/genproto/googleapis/rpc/@v/v0.0.0-20260803160001-6ac0973c030d.mod' \
  'google.golang.org/genproto/googleapis/rpc/@v/v0.0.0-20260803160001-6ac0973c030d.info'
do
  printf '%s\n' "--- $module_version"
  curl -fsS "https://proxy.golang.org/$module_version" || true
  printf '\n'
done

printf '%s\n' '--- OSV exact-version queries ---'
python3 - <<'PY'
import json, urllib.request
queries = [
    ("google.golang.org/api", "v0.292.0"),
    ("google.golang.org/genproto/googleapis/rpc",
     "v0.0.0-20260803160001-6ac0973c030d"),
]
for name, version in queries:
    req = urllib.request.Request(
        "https://api.osv.dev/v1/query",
        data=json.dumps({
            "package": {"name": name, "ecosystem": "Go"},
            "version": version,
        }).encode(),
        headers={"Content-Type": "application/json"},
        method="POST",
    )
    with urllib.request.urlopen(req) as response:
        data = json.load(response)
    print(name, version, "findings=", len(data.get("vulns", [])))
    for vuln in data.get("vulns", []):
        print(vuln.get("id"), vuln.get("summary"))
PY

Repository: openshift-online/ocm-cli

Length of output: 50380

🏁 Script executed:

# Awaiting capability results.

Repository: openshift-online/ocm-cli

Length of output: 162

🏁 Script executed:

#!/usr/bin/env bash
set -u

printf '%s\n' '--- focused dependency declarations ---'
sed -n '27,32p;147,152p' go.mod
rg -n -F \
  -e 'google.golang.org/api v0.292.0' \
  -e 'google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d' \
  go.sum

printf '%s\n' '--- module metadata and retractions ---'
for path in \
  'google.golang.org/api/@v/v0.292.0.mod' \
  'google.golang.org/api/@v/v0.292.0.info' \
  'google.golang.org/genproto/googleapis/rpc/@v/v0.0.0-20260803160001-6ac0973c030d.mod' \
  'google.golang.org/genproto/googleapis/rpc/@v/v0.0.0-20260803160001-6ac0973c030d.info'
do
  printf '%s\n' "--- $path"
  curl -fsS "https://proxy.golang.org/$path"
  printf '\n'
done

printf '%s\n' '--- dependency license files ---'
tmpdir="$(mktemp -d)"
trap 'rm -rf "$tmpdir"' EXIT
for spec in \
  'api v0.292.0' \
  'genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d'
do
  name="${spec%% *}"
  version="${spec#* }"
  encoded="$(printf '%s' "$name" | sed 's|/|%2F|g')"
  zip="$tmpdir/$(printf '%s' "$name" | tr / _).zip"
  if curl -fsS "https://proxy.golang.org/google.golang.org/$encoded/@v/$version.zip" -o "$zip"; then
    printf '%s\n' "--- google.golang.org/$name $version"
    unzip -Z1 "$zip" | grep -Ei '(^|/)(license|copying|notice)([^/]*)?$' | head -20
    for f in $(unzip -Z1 "$zip" | grep -Ei '(^|/)(license|copying|notice)([^/]*)?$' | head -5); do
      printf '%s\n' "[$f]"
      unzip -p "$zip" "$f" | head -8
    done
  else
    printf '%s\n' "unable to download $name $version"
  fi
done

printf '%s\n' '--- SBOM, provenance, and signing controls ---'
rg -n -i --hidden --glob '!.git/**' --glob '!*.go' \
  'sbom|cyclonedx|syft|slsa|provenance|attest|cosign|sigstore|sign(ing|ed)? artifact|upload-artifact' \
  . 2>/dev/null | head -200 || true

printf '%s\n' '--- hermetic image SBOM command ---'
sed -n '55,85p' hack/build_hermetic_image.sh

Repository: openshift-online/ocm-cli

Length of output: 5941

🏁 Script executed:

# Awaiting focused capability results.

Repository: openshift-online/ocm-cli

Length of output: 162

🏁 Script executed:

#!/usr/bin/env bash
set -u

printf '%s\n' '--- tracked CI and release files ---'
git ls-files | grep -E '(^|/)\.github/workflows/|(^|/)(release|publish|build|image|artifact|sign)' | head -200 || true

printf '%s\n' '--- tracked supply-chain configuration ---'
git grep -n -I -E 'provenance|attest|cosign|sigstore|slsa|rekor|fulcio|sign-artifacts|signing' -- ':!*.sum' ':!README.md' 2>/dev/null || true

printf '%s\n' '--- google.golang.org/api license metadata ---'
curl -fsSL 'https://pkg.go.dev/google.golang.org/api@v0.292.0?tab=licenses' |
  grep -Eio 'BSD[- ]3[- ]Clause|Apache[- ]2\.0|MIT' | sort -u | head -20 || true

printf '%s\n' '--- module archive license names ---'
tmpdir="$(mktemp -d)"
trap 'rm -rf "$tmpdir"' EXIT
url='https://proxy.golang.org/google.golang.org/api/@v/v0.292.0.zip'
if curl -fsSL "$url" -o "$tmpdir/api.zip"; then
  unzip -Z1 "$tmpdir/api.zip" |
    grep -Ei '(^|/)(license|copying|notice)([^/]*)?$' |
    head -20
fi

Repository: openshift-online/ocm-cli

Length of output: 653

🏁 Script executed:

# Awaiting final capability results.

Repository: openshift-online/ocm-cli

Length of output: 162

🏁 Script executed:

#!/usr/bin/env bash
set -u

for file in .github/workflows/publish-release.yaml hack/build_image.sh hack/build_release_images.sh hack/build_hermetic_image.sh; do
  if [ -f "$file" ]; then
    printf '%s\n' "--- $file"
    wc -l "$file"
    cat -n "$file" | head -240
  fi
done

Repository: openshift-online/ocm-cli

Length of output: 13933

🏁 Script executed:

# Awaiting release workflow results.

Repository: openshift-online/ocm-cli

Length of output: 162

Add release provenance and artifact signing.

The versions are pinned, their module and go.mod hashes are in go.sum, OSV reports no findings, and the versions are not retracted. The Apache-2.0 repository license is compatible with the BSD-3-Clause and Apache-2.0 dependency licenses. hack/build_hermetic_image.sh generates a CycloneDX SBOM.

The release workflow only uploads binaries and SHA-256 files. Add enforced provenance attestations and Sigstore/cosign signatures for release artifacts, or document the external control that provides them, before merging.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 30, Update the release workflow’s artifact-upload job to
generate and publish enforced provenance attestations and Sigstore/cosign
signatures for every binary and SHA-256 file, ensuring signing and attestation
failures block the release. If these controls are provided externally instead,
document the authoritative control and verification process alongside the
release configuration.

Source: Path instructions

google.golang.org/grpc v1.83.0
gopkg.in/yaml.v3 v3.0.1
k8s.io/apimachinery v0.34.3
Expand Down Expand Up @@ -147,7 +147,7 @@ require (
golang.org/x/tools v0.47.0 // indirect
google.golang.org/genproto v0.0.0-20260519071638-aa98bba5eb94 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260729162451-8efbd57d26e0 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260727163830-6c54dddc4772 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect
google.golang.org/protobuf v1.36.11 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
k8s.io/klog/v2 v2.130.1 // indirect
Expand Down
8 changes: 4 additions & 4 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -408,14 +408,14 @@ golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8T
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
google.golang.org/api v0.291.0 h1:wfPbbY+mr9c7wZLqqzrHJLft/q8iFKREd6IgTBUene0=
google.golang.org/api v0.291.0/go.mod h1:at7kwWbuonglBFEBoeMDAV1bguHqL3qf0BHFsv3coa0=
google.golang.org/api v0.292.0 h1:Ewiwo/GTtiaPZSNAZQUcWLh8AYDEoPmIXyJfeoTSMHU=
google.golang.org/api v0.292.0/go.mod h1:07kjmMnFGm2RQuCza2EZM/5N68G/fVvFb1xKjWqoFA0=
google.golang.org/genproto v0.0.0-20260519071638-aa98bba5eb94 h1:YJjbgu+dkp5kUJLfpMyCLfBIWZb/FcJyuLeo1gVBOuo=
google.golang.org/genproto v0.0.0-20260519071638-aa98bba5eb94/go.mod h1:RRHjglSYABVCWpQ7USCpdfhcd9t4PkajvVwyynZizTc=
google.golang.org/genproto/googleapis/api v0.0.0-20260729162451-8efbd57d26e0 h1:ybvH/ZpOcpCrjtkb7oW/fdlzbEmRVeumw19SRQmNFKU=
google.golang.org/genproto/googleapis/api v0.0.0-20260729162451-8efbd57d26e0/go.mod h1:HJ9MpJLeDSstBkx1LILTpd5f41ADSMZcTPypw02qEGw=
google.golang.org/genproto/googleapis/rpc v0.0.0-20260727163830-6c54dddc4772 h1:zuslGE3FGxH0hC6veLvSLME3TZzun9MQzjYwo1CBN+k=
google.golang.org/genproto/googleapis/rpc v0.0.0-20260727163830-6c54dddc4772/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d h1:IL4hdHzcUv2l/gcg98/Rj3FbtE6axwqslOW8SW0C+S0=
google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
google.golang.org/grpc v1.83.0 h1:JeNZEKJFbQxArAMl+hiytHauacDNqJUllNfmIMmpqnQ=
google.golang.org/grpc v1.83.0/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ=
google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
Expand Down
Loading