Fix: Update related kind labels and bump dependencies#754
Open
Fix: Update related kind labels and bump dependencies#754
Conversation
📝 WalkthroughWalkthroughThis PR updates multiple Go module dependencies in Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@go.mod`:
- Around line 403-414: The go.mod contains mismatched OpenTelemetry versions:
core modules (go.opentelemetry.io/otel, /trace, /metric, /sdk, etc.) are at
v1.42.0 while OTLP exporters
(go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp,
/otlpmetric/otlpmetrichttp, /otlptrace, /otlptrace/otlptracehttp) are still at
v1.38.0; update those exporter module versions to v1.42.0 to align with the core
modules (or alternatively downgrade the core modules to v1.38.0 if that is
required), ensuring go.mod entries for otlploghttp, otlpmetrichttp, otlptrace,
and otlptracehttp match the chosen version and then run go mod tidy to apply the
changes.
In `@pkg/objectcache/shared_container_data.go`:
- Around line 102-108: The code may produce empty normalized related labels
(e.g., labels[i] becomes "") after the switch on
helpersv1.RelatedKindMetadataKey / helpersv1.RelatedNameMetadataKey using
wlid.GetKindFromWlid or wlid.GetNameFromWlid; add a post-switch guard that
checks if labels[i] == "" and, if so, skip validation/processing for that entry
(same cleanup behavior as earlier) before calling content.IsLabelValue so you
don't emit incomplete metadata. Locate the switch block that assigns labels[i],
insert the empty-string check immediately after it, and return/continue/omit
that label from further validation/emit paths referenced by
content.IsLabelValue.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: a456c779-5c9b-483d-92e9-e0297b8a5a79
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (2)
go.modpkg/objectcache/shared_container_data.go
Comment on lines
+102
to
108
| case helpersv1.RelatedKindMetadataKey: | ||
| labels[i] = strings.TrimPrefix(wlid.GetKindFromWlid(watchedContainer.Wlid), "ECS") | ||
| case helpersv1.RelatedNameMetadataKey: | ||
| labels[i] = wlid.GetNameFromWlid(watchedContainer.Wlid) | ||
| } | ||
| errs := validation.IsValidLabelValue(labels[i]) | ||
| errs := content.IsLabelValue(labels[i]) | ||
| if len(errs) != 0 { |
There was a problem hiding this comment.
Guard against empty related labels after normalization.
Line 103 can normalize to an empty string, but empty-value cleanup currently happens earlier (Line 96). Add a post-switch empty check before validation to avoid emitting incomplete metadata.
💡 Suggested patch
switch i {
case helpersv1.RelatedKindMetadataKey:
labels[i] = strings.TrimPrefix(wlid.GetKindFromWlid(watchedContainer.Wlid), "ECS")
case helpersv1.RelatedNameMetadataKey:
labels[i] = wlid.GetNameFromWlid(watchedContainer.Wlid)
}
+ if labels[i] == "" {
+ delete(labels, i)
+ continue
+ }
errs := content.IsLabelValue(labels[i])🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@pkg/objectcache/shared_container_data.go` around lines 102 - 108, The code
may produce empty normalized related labels (e.g., labels[i] becomes "") after
the switch on helpersv1.RelatedKindMetadataKey /
helpersv1.RelatedNameMetadataKey using wlid.GetKindFromWlid or
wlid.GetNameFromWlid; add a post-switch guard that checks if labels[i] == ""
and, if so, skip validation/processing for that entry (same cleanup behavior as
earlier) before calling content.IsLabelValue so you don't emit incomplete
metadata. Locate the switch block that assigns labels[i], insert the
empty-string check immediately after it, and return/continue/omit that label
from further validation/emit paths referenced by content.IsLabelValue.
matthyx
force-pushed
the
backend-integration
branch
from
c0e73f7 to
4eab851
Compare
There was a problem hiding this comment.
♻️ Duplicate comments (1)
pkg/objectcache/shared_container_data.go (1)
102-108:⚠️ Potential issue | 🟡 MinorAdd a post-normalization empty-value guard.
After Line 102-Line 105, a normalized related value can become empty (for example, kind
"ECS"→""), but empty cleanup currently happens only before the switch. Add a second empty check before Line 107 validation.💡 Proposed patch
switch i { case helpersv1.RelatedKindMetadataKey: labels[i] = strings.TrimPrefix(wlid.GetKindFromWlid(watchedContainer.Wlid), "ECS") case helpersv1.RelatedNameMetadataKey: labels[i] = wlid.GetNameFromWlid(watchedContainer.Wlid) } + if labels[i] == "" { + delete(labels, i) + continue + } errs := content.IsLabelValue(labels[i])🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pkg/objectcache/shared_container_data.go` around lines 102 - 108, After you normalize the related value inside the switch (the cases using wlid.GetKindFromWlid(watchedContainer.Wlid) and wlid.GetNameFromWlid(watchedContainer.Wlid) that assign to labels[i]), add a post-normalization guard that skips validation if labels[i] is now empty (e.g., if strings.TrimPrefix returned an empty string) before calling content.IsLabelValue(labels[i]); in short, ensure labels[i] is checked for == "" right after the switch and return/continue or skip adding errors so content.IsLabelValue is not run on an empty normalized value.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In `@pkg/objectcache/shared_container_data.go`:
- Around line 102-108: After you normalize the related value inside the switch
(the cases using wlid.GetKindFromWlid(watchedContainer.Wlid) and
wlid.GetNameFromWlid(watchedContainer.Wlid) that assign to labels[i]), add a
post-normalization guard that skips validation if labels[i] is now empty (e.g.,
if strings.TrimPrefix returned an empty string) before calling
content.IsLabelValue(labels[i]); in short, ensure labels[i] is checked for == ""
right after the switch and return/continue or skip adding errors so
content.IsLabelValue is not run on an empty normalized value.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: b4af0e9e-5088-4032-9e82-46cd79cc48ee
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (2)
go.modpkg/objectcache/shared_container_data.go
Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>
matthyx
force-pushed
the
backend-integration
branch
from
4eab851 to
386e450
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@go.mod`:
- Line 58: Update the pinned dependency for google.golang.org/grpc from v1.79.2
to v1.79.3 (or newer) in go.mod to address GHSA-p77j-4mvh-x3m3, then refresh
module metadata by re-resolving modules (e.g., run the equivalent of go get to
the new version and run go mod tidy) so go.sum is updated; target the dependency
named google.golang.org/grpc and ensure no other code references a stricter
version constraint.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: f03f7af7-9862-436e-9914-1cf08fc68a31
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (2)
go.modpkg/objectcache/shared_container_data.go
🚧 Files skipped from review as they are similar to previous changes (1)
- pkg/objectcache/shared_container_data.go
| golang.org/x/sys v0.42.0 | ||
| gonum.org/v1/plot v0.14.0 | ||
| google.golang.org/grpc v1.77.0 | ||
| google.golang.org/grpc v1.79.2 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify whether google.golang.org/grpc@v1.79.2 is affected and identify fixed versions via OSV.
set -euo pipefail
payload='{
"package": {"ecosystem": "Go", "name": "google.golang.org/grpc"},
"version": "1.79.2"
}'
curl -sS https://api.osv.dev/v1/query -d "$payload" \
| jq '{
affected: (.vulns // [] | map({id, summary, aliases, fixed: ([.affected[]?.ranges[]?.events[]?.fixed] | flatten | unique)}))
}'Repository: kubescape/node-agent
Length of output: 334
Upgrade vulnerable google.golang.org/grpc version before merge.
Line 58 pins google.golang.org/grpc v1.79.2, which contains GHSA-p77j-4mvh-x3m3 (authorization bypass via missing leading slash in :path). Upgrade to v1.79.3 or newer and re-tidy modules.
🧰 Tools
🪛 OSV Scanner (2.3.3)
[CRITICAL] 58-58: google.golang.org/grpc 1.79.2: gRPC-Go has an authorization bypass via missing leading slash in :path
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@go.mod` at line 58, Update the pinned dependency for google.golang.org/grpc
from v1.79.2 to v1.79.3 (or newer) in go.mod to address GHSA-p77j-4mvh-x3m3,
then refresh module metadata by re-resolving modules (e.g., run the equivalent
of go get to the new version and run go mod tidy) so go.sum is updated; target
the dependency named google.golang.org/grpc and ensure no other code references
a stricter version constraint.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit