NO-ISSUE: Synchronize From Upstream Repositories

[openshift-bot]

The staging/ and vendor/ directories have been synchronized from the upstream repositories, pulling in the following commits:

Date	Commit	Author	Message
2026-07-29 15:39:35	operator-framework/operator-lifecycle-manager@d333832	dependabot[bot]	🌱 Bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5 (#3881)
2026-07-29 15:42:32	operator-framework/operator-lifecycle-manager@0381031	dependabot[bot]	🌱 Bump github.com/prometheus/common from 0.70.0 to 0.70.1 (#3880)
2026-07-29 15:55:08	operator-framework/operator-lifecycle-manager@07a1c28	dependabot[bot]	🌱 Bump the k8s-dependencies group with 8 updates (#3879)
2026-07-30 04:07:52	operator-framework/operator-lifecycle-manager@761a61e	dependabot[bot]	🌱 Bump github.com/prometheus/client_golang (#3882)

This pull request is expected to merge without any human intervention. If tests are failing here, changes must land upstream to fix any issues so that future downstreaming efforts succeed.

/assign @openshift/openshift-team-operator-runtime

Summary by CodeRabbit

• Chores
  • Updated Kubernetes, Prometheus, YAML, and compression libraries to newer patch releases.
  • Applied dependency updates consistently across the main project and operator components.

[openshift-ci-robot]

@openshift-bot: This pull request explicitly references no jira issue.

Details

In response to this:

The staging/ and vendor/ directories have been synchronized from the upstream repositories, pulling in the following commits:

Date	Commit	Author	Message
2026-07-29 15:39:35	operator-framework/operator-lifecycle-manager@d333832	dependabot[bot]	🌱 Bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5 (#3881)
2026-07-29 15:42:32	operator-framework/operator-lifecycle-manager@0381031	dependabot[bot]	🌱 Bump github.com/prometheus/common from 0.70.0 to 0.70.1 (#3880)
2026-07-29 15:55:08	operator-framework/operator-lifecycle-manager@07a1c28	dependabot[bot]	🌱 Bump the k8s-dependencies group with 8 updates (#3879)

This pull request is expected to merge without any human intervention. If tests are failing here, changes must land upstream to fix any issues so that future downstreaming efforts succeed.

/assign @openshift/openshift-team-operator-runtime

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Walkthrough

The root and operator-lifecycle-manager Go modules update Kubernetes dependencies and related Prometheus, YAML, and compression packages to newer patch releases.

Changes

Dependency updates

Layer / File(s)	Summary
Align module dependency versions go.mod, staging/operator-lifecycle-manager/go.mod	Direct and indirect Kubernetes, Prometheus, YAML v3, and compression dependency versions are updated across both Go modules.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• openshift/operator-framework-olm#1338: Updates overlapping Kubernetes, Prometheus, YAML, and compression dependencies.

Suggested labels: lgtm

Suggested reviewers: pedjak, trgeiger

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the pull request's primary purpose of synchronizing dependencies from upstream repositories.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The patch changes only dependency manifests, sums, and vendored library files; no *_test.go files or Ginkgo It/Describe/Context/When declarations were added or modified.
Test Structure And Quality	✅ Passed	The full PR diff contains no changed *_test.go files or added Ginkgo constructs; it only updates go.mod/go.sum and vendored dependencies, so this check is not applicable.
Microshift Test Compatibility	✅ Passed	PASS: The full PR diff contains only dependency, vendored code, and module metadata changes; no new Ginkgo tests or test-like files were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The full PR range changes only go.mod/go.sum and vendored dependency implementation files; no new Ginkgo e2e tests or multi-node assumptions were introduced.
Topology-Aware Scheduling Compatibility	✅ Passed	The full four-commit diff changes only dependency metadata and vendored third-party files; no deployment manifests, operator/controller code, or scheduling constructs were modified.
Ote Binary Stdout Contract	✅ Passed	PR changes only dependency metadata/vendor libraries; OTE main/suite code is unchanged, GinkgoWriter is routed to stderr, and changed fmt prints are inside library decoder methods.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR adds no Ginkgo tests or test-like files; changes are limited to dependency metadata and vendored libraries, with no added IPv4 or external-connectivity test logic.
No-Weak-Crypto	✅ Passed	PR changes only dependency/vendor synchronization; added code contains no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	The full four-commit diff changes only go.mod/go.sum and vendored dependency code; no container/Kubernetes manifest privilege settings were added or modified.
No-Sensitive-Data-In-Logs	✅ Passed	Dependency/vendor sync adds no sensitive logging; new debug prints are gated by debugDecode=false and emit only errors or length metadata, not payloads or credentials.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@go.mod`:
- Around line 26-29: Upgrade or remove the affected dependencies in go.mod lines
26-29 and staging/operator-lifecycle-manager/go.mod lines 28-50: containerd
v1.7.34, otel v1.43.0, and x/crypto v0.54.0 in both modules, plus fulcio v1.8.5
in go.mod, using fixed versions where available. Regenerate go.sum and vendor
for both modules, and document any proven non-reachability exceptions.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: e1146c7a-6e8e-4b33-bc0f-570e1de54605

📥 Commits

Reviewing files that changed from the base of the PR and between 097b7ff and 2050b03.

⛔ Files ignored due to path filters (11)

• go.sum is excluded by !**/*.sum
• staging/operator-lifecycle-manager/go.sum is excluded by !**/*.sum
• vendor/github.com/klauspost/compress/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/klauspost/compress/flate/inflate_gen.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/klauspost/compress/zstd/fse_decoder_arm64.s is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/klauspost/compress/zstd/seqdec_arm64.s is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/klauspost/compress/zstd/snappy.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/prometheus/client_golang/prometheus/promhttp/http.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.yaml.in/yaml/v3/parserc.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.yaml.in/yaml/v3/yamlh.go is excluded by !**/vendor/**, !vendor/**
• vendor/modules.txt is excluded by !**/vendor/**, !vendor/**

📒 Files selected for processing (2)

• go.mod
• staging/operator-lifecycle-manager/go.mod

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

for mod in go.mod staging/operator-lifecycle-manager/go.mod; do
  dir="${mod%/*}"
  [[ "$dir" == "$mod" ]] && dir="."
  sum="$dir/go.sum"

  while read -r name version; do
    payload=$(jq -nc --arg n "$name" --arg v "$version" \
      '{package:{name:$n, ecosystem:"Go"}, version:$v}')
    result=$(curl -fsS -X POST -H 'Content-Type: application/json' \
      -d "$payload" https://api.osv.dev/v1/query)

    if jq -e '.vulns? | length > 0' <<<"$result" >/dev/null; then
      echo "OSV findings for $name@$version in $mod"
      jq '.vulns[] | {id, summary}' <<<"$result"
      exit 1
    fi

    grep -Fq "$name $version " "$sum" || {
      echo "Missing checksum for $name@$version in $sum"
      exit 1
    }
  done < <(
    awk '
      /^require[[:space:]]*\(/ { inreq=1; next }
      /^\)/ { inreq=0; next }
      /^require[[:space:]]+[^ (]/ { print $2, $3; next }
      inreq && NF >= 2 && $1 !~ /^\/\// { print $1, $2 }
    ' "$mod"
  )
done

Repository: openshift/operator-framework-olm

Length of output: 222

---

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

printf '%s\n' '--- module files ---'
for f in go.mod staging/operator-lifecycle-manager/go.mod; do
  printf '\n[%s]\n' "$f"
  sed -n '1,260p' "$f"
done

printf '\n--- related supply-chain files ---\n'
git ls-files | grep -E '(^|/)(go\.sum|vendor/|.*(sbom|provenance|cosign|sigstore|attest|slsa|license|NOTICE|LICENSE).*)$' | head -300

printf '\n--- module metadata ---\n'
for d in . staging/operator-lifecycle-manager; do
  printf '\n[%s]\n' "$d"
  test -f "$d/go.sum" && wc -l "$d/go.sum" || true
  test -d "$d/vendor" && find "$d/vendor" -maxdepth 2 -type f | head -20 || true
done

Repository: openshift/operator-framework-olm

Length of output: 38943

---

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path
import re

for mod in [Path("go.mod"), Path("staging/operator-lifecycle-manager/go.mod")]:
    print(f"\n[{mod}]")
    text = mod.read_text()
    in_block = False
    reqs = []
    for line in text.splitlines():
        s = line.strip()
        if s.startswith("require ("):
            in_block = True
            continue
        if in_block and s == ")":
            in_block = False
            continue
        if s.startswith("require ") and not s.startswith("require ("):
            s = s[len("require "):]
        if in_block or line.lstrip().startswith("require "):
            m = re.match(r"(\S+)\s+(\S+)", s)
            if m and not m.group(1).startswith("//"):
                reqs.append(m.groups())
    print("requirements:", len(reqs))
    sums = (mod.parent / "go.sum")
    sum_text = sums.read_text() if sums.exists() else ""
    missing = [(n, v) for n, v in reqs if f"{n} {v} " not in sum_text]
    print("go.sum:", sums if sums.exists() else "MISSING")
    print("missing direct-version checksum entries:", missing[:20], "count=", len(missing))
    print("vendor:", (mod.parent / "vendor").is_dir())
PY

printf '\n--- supply-chain workflow/config references ---\n'
rg -n -i 'osv|sbom|provenance|slsa|cosign|sigstore|attest|license|vendor|go mod verify|govulncheck' \
  --glob '!vendor/**' --glob '!node_modules/**' . | head -300

Repository: openshift/operator-framework-olm

Length of output: 31540

---

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

printf '%s\n' '--- vendor policy and synchronization checks ---'
sed -n '145,205p' Makefile
sed -n '1,100p' scripts/check-staging-vendor.sh
printf '\n--- root vendor metadata ---\n'
sed -n '1,80p' vendor/modules.txt

printf '\n--- module and checksum consistency summary ---\n'
python3 - <<'PY'
from pathlib import Path
import re, json, urllib.request, urllib.error

mods = [Path("go.mod"), Path("staging/operator-lifecycle-manager/go.mod")]

def requirements(path):
    out = []
    block = False
    for raw in path.read_text().splitlines():
        line = raw.strip()
        if line.startswith("require ("):
            block = True
            continue
        if block and line == ")":
            block = False
            continue
        if line.startswith("require ") and not line.startswith("require ("):
            line = line[len("require "):]
        if (block or raw.lstrip().startswith("require ")) and not line.startswith("//"):
            m = re.match(r"(\S+)\s+(\S+)", line)
            if m:
                out.append((m.group(1), m.group(2)))
    return out

for mod in mods:
    reqs = requirements(mod)
    sums = (mod.parent / "go.sum").read_text()
    missing = [(n,v) for n,v in reqs if f"{n} {v} " not in sums]
    print(f"{mod}: requirements={len(reqs)}, missing exact sum entries={len(missing)}")
    print("  " + "\n  ".join(f"{n} {v}" for n,v in missing) if missing else "  none")

    if mod.parent == Path("."):
        vendor = Path("vendor/modules.txt").read_text()
        absent = [(n,v) for n,v in reqs if f"\n# {n} {v}" not in "\n" + vendor]
        print(f"  not represented by exact vendor header={len(absent)}")
        print("  " + "\n  ".join(f"{n} {v}" for n,v in absent) if absent else "  none")

print("\n--- OSV batch query ---")
queries = []
owners = []
for mod in mods:
    for name, version in requirements(mod):
        queries.append({"package": {"name": name, "ecosystem": "Go"}, "version": version})
        owners.append((str(mod), name, version))

payload = json.dumps({"queries": queries}).encode()
request = urllib.request.Request(
    "https://api.osv.dev/v1/querybatch",
    data=payload,
    headers={"Content-Type": "application/json"},
    method="POST",
)
try:
    with urllib.request.urlopen(request, timeout=60) as response:
        data = json.load(response)
except Exception as e:
    print("OSV request failed:", repr(e))
    raise SystemExit(0)

findings = []
for owner, result in zip(owners, data.get("results", [])):
    for vuln in result.get("vulns", []) or []:
        findings.append((*owner, vuln.get("id"), vuln.get("summary")))
print("queries:", len(queries), "findings:", len(findings))
for row in findings:
    print("\t".join(map(str, row)))
PY

Repository: openshift/operator-framework-olm

Length of output: 6057

---

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path
import re, json, urllib.request

mods = [Path("go.mod"), Path("staging/operator-lifecycle-manager/go.mod")]

def reqs(path):
    result, block = [], False
    for raw in path.read_text().splitlines():
        s = raw.strip()
        if s == "require (":
            block = True
            continue
        if block and s == ")":
            block = False
            continue
        if s.startswith("require ") and s != "require (":
            s = s[8:]
        if (block or raw.lstrip().startswith("require ")) and not s.startswith("//"):
            m = re.match(r"(\S+)\s+(\S+)", s)
            if m:
                result.append(m.groups())
    return result

queries, labels = [], []
for mod in mods:
    for name, version in reqs(mod):
        queries.append({"package": {"name": name, "ecosystem": "Go"}, "version": version})
        labels.append((mod, name, version))

request = urllib.request.Request(
    "https://api.osv.dev/v1/querybatch",
    data=json.dumps({"queries": queries}).encode(),
    headers={"Content-Type": "application/json"},
    method="POST",
)
with urllib.request.urlopen(request, timeout=60) as response:
    results = json.load(response)["results"]

for (mod, name, version), result in zip(labels, results):
    for vuln in result.get("vulns", []) or []:
        print(f"{mod}\t{name}\t{version}\t{vuln.get('id')}\t{vuln.get('summary')}")
print(f"queried={len(queries)} findings={sum(len(r.get('vulns', []) or []) for r in results)}")
PY

Repository: openshift/operator-framework-olm

Length of output: 2457

---

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path
import re

for p in [Path("go.mod"), Path("staging/operator-lifecycle-manager/go.mod")]:
    text = p.read_text()
    replaces = re.findall(r'^\s*(\S+)\s*=>\s*(\S+)', text, re.M)
    print(f"{p} replacements:", replaces)

    block = False
    requirements = []
    for raw in text.splitlines():
        s = raw.strip()
        if s == "require (":
            block = True
            continue
        if block and s == ")":
            block = False
            continue
        if s.startswith("require ") and s != "require (":
            s = s[8:]
        if (block or raw.lstrip().startswith("require ")) and not s.startswith("//"):
            m = re.match(r"(\S+)\s+(\S+)", s)
            if m:
                requirements.append(m.groups())

    sums = (p.parent / "go.sum").read_text()
    for name, version in requirements:
        if f"{name} {version} " not in sums:
            replaced = any(old == name and target.startswith(".") for old, target in replaces)
            print("missing:", name, version, "local_replace=", replaced)
PY

printf '\n--- dependency declarations and CI security tooling ---\n'
rg -n -i 'dependabot|renovate|osv|govulncheck|trivy|grype|syft|bom|sbom|slsa|provenance|cosign|sigstore|license|go mod verify' \
  .github Makefile scripts Dockerfile* '*.Dockerfile' 2>/dev/null | head -250

Repository: openshift/operator-framework-olm

Length of output: 1012

---

🏁 Script executed:

#!/usr/bin/env bash
set -u

printf '%s\n' '--- pre-release dependency usage ---'
rg -n 'github.com/golang/mock|gomock' --glob '*.go' --glob '!vendor/**' . | head -120

printf '\n--- all explicit release-candidate or pseudo-version direct requirements ---\n'
python3 - <<'PY'
from pathlib import Path
import re
for p in [Path("go.mod"), Path("staging/operator-lifecycle-manager/go.mod")]:
    print(p)
    block = False
    for raw in p.read_text().splitlines():
        s = raw.strip()
        if s == "require (":
            block = True
            continue
        if block and s == ")":
            block = False
            continue
        if s.startswith("require ") and s != "require (":
            s = s[8:]
        if (block or raw.lstrip().startswith("require ")) and not s.startswith("//"):
            m = re.match(r"(\S+)\s+(\S+)", s)
            if m and ("-rc." in m[2] or re.match(r"v\d+\.\d+\.\d+-\d{14}-[0-9a-f]+$", m[2])):
                print(" ", m[1], m[2])
PY

printf '\n--- OSV response status only ---\n'
curl --insecure --silent --show-error --write-out '\nHTTP_STATUS=%{http_code}\n' \
  -H 'Content-Type: application/json' \
  --data '{"queries":[{"package":{"name":"k8s.io/api","ecosystem":"Go"},"version":"v0.36.3"}]}' \
  https://api.osv.dev/v1/querybatch | head -30

Repository: openshift/operator-framework-olm

Length of output: 25885

---

🏁 Script executed:

#!/usr/bin/env bash
set -u

python3 - <<'PY' >/tmp/osv-queries.json
from pathlib import Path
import json, re
queries = []
for p in [Path("go.mod"), Path("staging/operator-lifecycle-manager/go.mod")]:
    block = False
    for raw in p.read_text().splitlines():
        s = raw.strip()
        if s == "require (":
            block = True
            continue
        if block and s == ")":
            block = False
            continue
        if s.startswith("require ") and s != "require (":
            s = s[8:]
        if (block or raw.lstrip().startswith("require ")) and not s.startswith("//"):
            m = re.match(r"(\S+)\s+(\S+)", s)
            if m:
                queries.append({"package": {"name": m[1], "ecosystem": "Go"}, "version": m[2]})
print(json.dumps({"queries": queries}))
PY

response=$(curl --insecure --silent --show-error --write-out '\n__STATUS__%{http_code}' \
  -H 'Content-Type: application/json' \
  --data-binary `@/tmp/osv-queries.json` \
  https://api.osv.dev/v1/querybatch)
status=$(printf '%s\n' "$response" | sed -n 's/^__STATUS__//p')
body=$(printf '%s\n' "$response" | sed '/^__STATUS__/d')
printf 'HTTP status: %s\n' "$status"

BODY="$body" python3 - <<'PY'
import json, os
try:
    data = json.loads(os.environ["BODY"])
except Exception as e:
    print("invalid response:", e)
    raise SystemExit(0)
findings = []
for result in data.get("results", []):
    findings.extend(result.get("vulns", []) or [])
print("OSV findings:", len(findings))
for v in findings:
    print(v.get("id"), v.get("summary"))
PY

Repository: openshift/operator-framework-olm

Length of output: 427

---

🏁 Script executed:

#!/usr/bin/env bash
set -u

python3 - <<'PY' >/tmp/osv-labeled.json
from pathlib import Path
import json, re
queries, labels = [], []
for p in [Path("go.mod"), Path("staging/operator-lifecycle-manager/go.mod")]:
    block = False
    for raw in p.read_text().splitlines():
        s = raw.strip()
        if s == "require (":
            block = True
            continue
        if block and s == ")":
            block = False
            continue
        if s.startswith("require ") and s != "require (":
            s = s[8:]
        if (block or raw.lstrip().startswith("require ")) and not s.startswith("//"):
            m = re.match(r"(\S+)\s+(\S+)", s)
            if m:
                labels.append((str(p), m.group(1), m.group(2)))
                queries.append({"package": {"name": m.group(1), "ecosystem": "Go"}, "version": m.group(2)})
print(json.dumps({"queries": queries, "labels": labels}))
PY

queries=$(python3 -c 'import json; print(json.dumps(json.load(open("/tmp/osv-labeled.json"))["queries"]))')
response=$(curl --insecure --silent --show-error \
  -H 'Content-Type: application/json' \
  --data "{\"queries\":$queries}" \
  https://api.osv.dev/v1/querybatch)

RESPONSE="$response" python3 - <<'PY'
import json, os
data = json.loads(os.environ["RESPONSE"])
meta = json.load(open("/tmp/osv-labeled.json"))
for label, result in zip(meta["labels"], data.get("results", [])):
    vulns = result.get("vulns", []) or []
    for v in vulns:
        print("\t".join([
            label[0], label[1], label[2],
            v.get("id", ""),
            v.get("summary") or "",
            ",".join(v.get("aliases", [])),
        ]))
PY

Repository: openshift/operator-framework-olm

Length of output: 1052

---

🏁 Script executed:

#!/usr/bin/env bash
set -u

python3 - <<'PY'
import json, urllib.request, ssl

ids = [
    "GO-2026-5064", "GO-2026-5338", "GO-2026-5622",
    "GHSA-f5mr-q85p-6hh6", "GO-2026-5853", "GO-2026-5158",
    "GO-2026-5932",
]
ctx = ssl._create_unverified_context()
for vuln_id in ids:
    req = urllib.request.Request(f"https://api.osv.dev/v1/vulns/{vuln_id}")
    with urllib.request.urlopen(req, context=ctx, timeout=30) as r:
        v = json.load(r)
    print(json.dumps({
        "id": v.get("id"),
        "summary": v.get("summary"),
        "aliases": v.get("aliases"),
        "severity": v.get("severity"),
        "affected": v.get("affected"),
        "references": v.get("references"),
    }))
PY

Repository: openshift/operator-framework-olm

Length of output: 6945

---

🏁 Script executed:

#!/usr/bin/env bash
set -u

printf '%s\n' '--- reachable imports for OSV-affected modules ---'
for pattern in \
  'github.com/containerd/containerd' \
  'github.com/sigstore/fulcio' \
  'go.opentelemetry.io/otel' \
  'golang.org/x/crypto/openpgp'
do
  printf '\n[%s]\n' "$pattern"
  rg -n "$pattern" --glob '*.go' --glob '!vendor/**' . | head -100
done

printf '\n--- module versions and relevant vendor packages ---\n'
rg -n '^# (github.com/containerd/containerd|github.com/sigstore/fulcio|go.opentelemetry.io/otel|golang.org/x/crypto)( |$)' \
  vendor/modules.txt staging/operator-lifecycle-manager/go.sum go.sum

Repository: openshift/operator-framework-olm

Length of output: 23300

---

🏁 Script executed:

#!/usr/bin/env bash
set -u

printf '%s\n' '--- dependency graph references ---'
rg -n 'containerd|fulcio|opentelemetry|x/crypto|openpgp' \
  go.mod staging/operator-lifecycle-manager/go.mod vendor/modules.txt \
  --glob '!vendor/**' | head -200

printf '\n--- package imports outside vendored sources ---\n'
rg -n 'github.com/containerd|github.com/sigstore/fulcio|go.opentelemetry.io/otel|golang.org/x/crypto' \
  --glob '*.go' --glob '!vendor/**' . | head -200

Repository: openshift/operator-framework-olm

Length of output: 43138

---

Remediate the OSV-affected dependencies before merge.

• github.com/containerd/containerd v1.7.34 in both modules: GO-2026-5064, GO-2026-5338, and GO-2026-5622.
• github.com/sigstore/fulcio v1.8.5 in the root module: GHSA-f5mr-q85p-6hh6 / GO-2026-5853; fixed in v1.8.6.
• go.opentelemetry.io/otel v1.43.0 in both modules: GO-2026-5158; fixed in v1.44.0.
• golang.org/x/crypto v0.54.0 in both modules: GO-2026-5932, affecting the vendored OpenPGP packages.

Upgrade or remove the affected paths, regenerate go.sum and vendor, and document any proven non-reachability exceptions.

📍 Affects 2 files

• go.mod#L26-L29 (this comment)
• staging/operator-lifecycle-manager/go.mod#L28-L50

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 26 - 29, Upgrade or remove the affected dependencies in
go.mod lines 26-29 and staging/operator-lifecycle-manager/go.mod lines 28-50:
containerd v1.7.34, otel v1.43.0, and x/crypto v0.54.0 in both modules, plus
fulcio v1.8.5 in go.mod, using fixed versions where available. Regenerate go.sum
and vendor for both modules, and document any proven non-reachability
exceptions.

Source: Path instructions

[openshift-ci]

@openshift-bot: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[pedjak]

/lgtm
/verified by CI

[openshift-ci-robot]

@pedjak: This PR has been marked as verified by CI.

Details

In response to this:

/lgtm
/verified by CI

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: openshift-bot, pedjak

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• DOWNSTREAM_OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment