Skip to content

[1.34] vendor: bump spdystream to v0.5.1#9884

Merged
openshift-merge-bot[bot] merged 1 commit into
cri-o:release-1.34from
haircommander:spdy-1.34
Apr 14, 2026
Merged

[1.34] vendor: bump spdystream to v0.5.1#9884
openshift-merge-bot[bot] merged 1 commit into
cri-o:release-1.34from
haircommander:spdy-1.34

Conversation

@haircommander

@haircommander haircommander commented Apr 14, 2026

Copy link
Copy Markdown
Member

fixes https://www.cve.org/CVERecord?id=CVE-2026-35469

What type of PR is this?

/kind dependency-change

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Fix CVE-2026-35469 by updating spdystream dependency

@haircommander
vendor: bump spdystream to v0.5.1
6045995 
fixes https://www.cve.org/CVERecord?id=CVE-2026-35469

Signed-off-by: Peter Hunt <pehunt@redhat.com>
@haircommander haircommander requested a review from mrunalp as a code owner April 14, 2026 13:32
@openshift-ci openshift-ci Bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. kind/dependency-change Categorizes issue or PR as related to changing dependencies labels Apr 14, 2026
@openshift-ci openshift-ci Bot requested review from bitoku and littlejawa April 14, 2026 13:33
@coderabbitai

coderabbitai Bot commented Apr 14, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 16f0d860-aa4d-4a8a-87b0-38b364db55b2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 14, 2026
@haircommander

haircommander commented Apr 14, 2026

Copy link
Copy Markdown
Member Author

/cherry-pick release-1.33
/lgtm
/approve

@openshift-ci

openshift-ci Bot commented Apr 14, 2026

Copy link
Copy Markdown
Contributor

@haircommander: you cannot LGTM your own PR.

Details

In response to this:

/cherry-pick release-1.33
/lgtm
/approve

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-cherrypick-robot

openshift-cherrypick-robot commented Apr 14, 2026

Copy link
Copy Markdown

@haircommander: once the present PR merges, I will cherry-pick it on top of release-1.33 in a new PR and assign it to you.

Details

In response to this:

/cherry-pick release-1.33
/lgtm
/approve

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-ci

openshift-ci Bot commented Apr 14, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: haircommander

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@haircommander

haircommander commented Apr 14, 2026

Copy link
Copy Markdown
Member Author

@cri-o/cri-o-maintainers PTAL

@codecov

codecov Bot commented Apr 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 46.90%. Comparing base (dd7d093) to head (6045995).
⚠️ Report is 2 commits behind head on release-1.34.

Additional details and impacted files 
@@               Coverage Diff                @@
##           release-1.34    #9884      +/-   ##
================================================
- Coverage         46.91%   46.90%   -0.01%     
================================================
  Files               164      164              
  Lines             25138    25138              
================================================
- Hits              11793    11791       -2     
- Misses            12183    12185       +2     
  Partials           1162     1162
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

This was referenced Apr 14, 2026
Merged
Merged
Merged
@haircommander haircommander added the lgtm Indicates that a PR is ready to be merged. label Apr 14, 2026
@openshift-merge-bot openshift-merge-bot Bot merged commit afb8939 into cri-o:release-1.34 Apr 14, 2026
42 of 55 checks passed
@openshift-cherrypick-robot

openshift-cherrypick-robot commented Apr 14, 2026

Copy link
Copy Markdown

@haircommander: #9884 failed to apply on top of branch "release-1.33":

Applying: vendor: bump spdystream to v0.5.1
Using index info to reconstruct a base tree...
M	go.mod
M	go.sum
M	vendor/modules.txt
Falling back to patching base and 3-way merge...
Auto-merging vendor/modules.txt
Auto-merging go.sum
CONFLICT (content): Merge conflict in go.sum
Auto-merging go.mod
CONFLICT (content): Merge conflict in go.mod
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 vendor: bump spdystream to v0.5.1
Details

In response to this:

/cherry-pick release-1.33
/lgtm
/approve

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mrunalp mrunalp Awaiting requested review from mrunalp mrunalp is a code owner

@bitoku bitoku Awaiting requested review from bitoku

@littlejawa littlejawa Awaiting requested review from littlejawa

Assignees

No one assigned

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. kind/dependency-change Categorizes issue or PR as related to changing dependencies lgtm Indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@haircommander @openshift-cherrypick-robot