Update dependencies by erpel · Pull Request #56 · openshift/eventrouter

erpel · 2025-10-10T14:47:19Z

Just trying to keep dependencies updated to keep CVE scanners quiet.

openshift-ci · 2025-10-10T14:48:37Z

Hi @erpel. Thanks for your PR.

I'm waiting for a github.com member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

jcantrill · 2025-10-13T18:20:41Z

/ok-to-test

jcantrill · 2025-10-13T18:24:24Z

go.mod

-go 1.23.0
-
-toolchain go1.23.4
+go 1.24.0


This should require a Dockerfile update https://github.com/openshift/eventrouter/blob/master/Dockerfile#L1 and I am uncertain if our product tooling has this image available. cc @xperimental

Pushed with updated builder image, but had to do this blindly as that registry is not browsable for me.
If 1.24 is absolutely not available, I could try to update deps to versions that work with 1.23 but getting it to work with 1.24 seems better for the long term.

@jcantrill I could change the builder image to a plain upstream FROM golang AS builder - it does build without issue in our pipelines.
Would that be an option?

This PR will not pass until openshift/release#70571 merges

I think the question about availability of a Go 1.24 image is solved already, but I had a comment on another part of the PR.

Unable to verify that the image exists, so just trying it.

jcantrill · 2025-10-22T15:18:04Z

Dockerfile

@@ -1,4 +1,4 @@
-FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.23-openshift-4.19 AS builder
+FROM golang AS builder


registry.access.redhat.com/ubi9/go-toolset:9.6

IMO we should be using public images in the open-source Dockerfiles, so I think it's fine to switch to the "upstream Go image". We can choose to build with a different image in the CI, but having the public image in the public Dockerfiles makes it much easier for the public to build the software / contribute fixes.

I would pin the image to a specific Go version though, to have an indication of what we expect to build with. In this case this would be the latest 1.24:

Suggested change

FROM golang AS builder

FROM docker.io/library/golang:1.24.9 AS builder

The image I suggested is publicly available. If we wish to use the "library" version then we will need to make an additional change to the openshift CI to substitute it correctly

I wasn't sure if that image is available without authentication. But if it is, then that's also a possibilty. I think I would use the Go version as tag though and not the RHEL version.

jcantrill · 2025-10-22T17:24:05Z

/retest

jcantrill · 2025-10-22T18:00:01Z

/hold

jcantrill · 2025-10-22T18:00:18Z

Adding hold pending our 6.4 release to reduce churn

jcantrill · 2025-10-22T18:00:32Z

/approve
/lgtm

erpel · 2025-11-25T15:44:03Z

Adding hold pending our 6.4 release to reduce churn

Hi @jcantrill does this refer to OpenShift Logging? Since this was released earlier in November, does this mean this can go forward now?

1it · 2026-02-17T10:51:44Z

Hey folks,
Any chance this PR is going to be merged?

openshift-ci · 2026-02-17T14:40:59Z

@erpel: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

jcantrill · 2026-03-02T20:36:21Z

/approve
/lgtm

openshift-ci · 2026-03-02T20:36:46Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: erpel, jcantrill

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [jcantrill]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

erpel · 2026-03-03T19:00:01Z

Is there anything else to do before the hold label can be removed?
I'm happy to do another run of updates but don't want to reset everything again.

xperimental · 2026-03-03T19:42:11Z

@jcantrill Do you want to pull this into 6.5.0 as well?

I have not looked at the build configuration yet ... probably needs a bump for 1.25 as well...

jcantrill · 2026-03-10T15:28:51Z

@xperimental this can go into 6.5 but given we are in code freeze I believe it can wait for a z-stream

Update dependencies

d5fd3aa

openshift-ci bot requested review from alanconway and cahartma October 10, 2025 14:48

openshift-ci bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Oct 10, 2025

Keep FatalF but add format string to fix error.

4499583

openshift-ci bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Oct 13, 2025

jcantrill reviewed Oct 13, 2025

View reviewed changes

erpel added 2 commits October 14, 2025 10:03

Update builder docker image.

bd63ce0

Unable to verify that the image exists, so just trying it.

Use plain golang image for build

7a9e38f

jcantrill reviewed Oct 22, 2025

View reviewed changes

jcantrill mentioned this pull request Oct 22, 2025

update the golang builder openshift/release#70571

Merged

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 22, 2025

openshift-ci bot assigned jcantrill Oct 22, 2025

openshift-ci bot added lgtm Indicates that a PR is ready to be merged. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Oct 22, 2025

Use specific version for builder

c322016

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Oct 23, 2025

Update dependencies

c8c1b5e

erpel force-pushed the update_deps branch from c04b7f3 to c8c1b5e Compare February 17, 2026 14:36

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Mar 2, 2026

		@@ -1,4 +1,4 @@
		FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.23-openshift-4.19 AS builder
		FROM golang AS builder

	FROM golang AS builder
	FROM docker.io/library/golang:1.24.9 AS builder

Conversation

erpel commented Oct 10, 2025

Uh oh!

openshift-ci bot commented Oct 10, 2025

Uh oh!

jcantrill commented Oct 13, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jcantrill commented Oct 22, 2025

Uh oh!

jcantrill commented Oct 22, 2025

Uh oh!

jcantrill commented Oct 22, 2025

Uh oh!

jcantrill commented Oct 22, 2025

Uh oh!

erpel commented Nov 25, 2025

Uh oh!

1it commented Feb 17, 2026

Uh oh!

openshift-ci bot commented Feb 17, 2026

Uh oh!

jcantrill commented Mar 2, 2026

Uh oh!

openshift-ci bot commented Mar 2, 2026

Uh oh!

erpel commented Mar 3, 2026

Uh oh!

xperimental commented Mar 3, 2026

Uh oh!

jcantrill commented Mar 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants