CM-1216: Bump cert-manager operand to v1.18.6, bundle to v1.18.2 by sujkini · Pull Request #472 · openshift/cert-manager-operator

sujkini · 2026-08-11T05:23:10Z

Bumps cert-manager operand from 1.18.4 to 1.18.6
Updates operator bundle version from 1.18.1 to 1.18.2
Updates cert-manager operand manifests with v1.18.6 chart content
Updates OLM bundle manifests (CSV name, version, replaces, skipRange)
Bumps cert-manager package version and dependent packages

Dependencies

CM-1216: Rebase to v1.18.6 for cert-manager-operator v1.18.2 z-stream release jetstack-cert-manager#46 (rebase operand to v1.18.6)
CM-1216: UPSTREAM: <carry>: Apply sustaining CVE back-ports for go 1.24 jetstack-cert-manager#44 (operand CVE backports)

Verification

go build ./... ✅
operator-sdk bundle validate ✅
Jira: CM-1216
Signed-off-by: Sujnyan Kini skini@redhat.com
Co-authored-by: Cursor cursoragent@cursor.com

openshift-ci-robot · 2026-08-11T05:23:14Z

@sujkini: This pull request references CM-1216 which is a valid jira issue.

Details

In response to this:

Bumps cert-manager operand from 1.18.4 to 1.18.6

Updates operator bundle version from 1.18.1 to 1.18.2

Updates cert-manager operand manifests with v1.18.6 chart content

Updates OLM bundle manifests (CSV name, version, replaces, skipRange)

Bumps cert-manager package version and dependent packages

Dependencies

CM-1216: Rebase to v1.18.6 for cert-manager-operator v1.18.2 z-stream release jetstack-cert-manager#46 (rebase operand to v1.18.6)

CM-1216: UPSTREAM: <carry>: Apply sustaining CVE back-ports for go 1.24 jetstack-cert-manager#44 (operand CVE backports)

Verification

go build ./... ✅

operator-sdk bundle validate ✅
Jira: CM-1216
Signed-off-by: Sujnyan Kini skini@redhat.com
Co-authored-by: Cursor cursoragent@cursor.com

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-08-11T05:23:15Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

coderabbitai · 2026-08-11T05:23:21Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 7700a7a6-697f-4170-81e0-2b0f331b7c4f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}

openshift-ci · 2026-08-11T05:23:29Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: sujkini
Once this PR has been reviewed and has the lgtm label, please assign trilokgeer for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Adds replace directive for golang.org/x/net to fix reachable CVE-2026-39821 (Critical, CVSS 9.6) in the HTTP/2 transport layer used for Kubernetes API communication. The openshift-sustaining/net fork backports the fix to the Go 1.24 dependency tree without requiring a full module upgrade. - CVE-2026-39821: golang.org/x/net/idna Punycode bypass (reachable) - CVE-2026-25681: golang.org/x/net/html parsing bypass (same module, not reachable) - CVE-2026-27136: golang.org/x/net/html parsing bypass (same module, not reachable) replace golang.org/x/net => openshift-sustaining/net@v0.50.0-sec.2 Jira: CM-1216 Signed-off-by: Sujnyan Kini <skini@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>

Updates operator and operand versions for cert-manager-operator v1.18.2 z-stream release. Bumps cert-manager operand from 1.18.4 to 1.18.6 and operator bundle from 1.18.1 to 1.18.2. - Updates Makefile: CERT_MANAGER_VERSION, BUNDLE_VERSION - Updates cert-manager operand manifests with v1.18.6 chart content - Updates OLM bundle manifests (CSV name, version, replaces, skipRange) - Bumps cert-manager package dependency and dependents Jira: CM-1216 Signed-off-by: Sujnyan Kini <skini@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>

bharath-b-rh · 2026-09-15T06:35:23Z

CVE-2026-42502

-                  value: 1.18.4
+                  value: 1.18.6
                - name: ISTIOCSR_OPERAND_IMAGE_VERSION
                  value: 0.14.2


We have 0.14.3 available too.

Verified that v0.14.3 fixes 5 of our 6 open istio-csr CVEs:

Dependency Upgrades in v0.14.3:

golang.org/x/net: v0.38.0 → v0.44.0

google.golang.org/grpc: v1.73.0 → v1.76.0

go-jose/v4: v4.0.5 → v4.1.2

Go toolchain: 1.24.0 → 1.25.0

CVEs Fixed:

CM-1229: CVE-2026-42502 (x/net html Render)

CM-1195: CVE-2026-27136 (x/net html duplicate attrs)

CM-1189/1188/1187/1149: CVE-2026-25681 (x/net html)

CM-1052: CVE-2026-33186 (grpc :path)

CM-982: CVE-2026-34986 (go-jose)

Bumped in latest commit

bharath-b-rh · 2026-09-15T06:36:56Z

 FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.20 AS builder

-ARG RELEASE_BRANCH=v1.18.4
+ARG RELEASE_BRANCH=v1.18.6


We did create a branch in downstream fork, with local bumps pkgs correct? We should be using the same release branch name instead.

Thank you for pointing out, as pr #44 is merged, updated to release-1.18 existing branch.

bharath-b-rh · 2026-09-15T06:40:35Z


 replace github.com/tdakkota/asciicheck => github.com/golangci/asciicheck v0.1.1
+
+replace golang.org/x/net => github.com/openshift-sustaining/net v0.50.0-sec.2


Why the same changes in two different PRs? Was this branch created on top or something like that?

This was created on top of #471

Updates cert-manager-istio-csr dependency to v0.14.3 which resolves 5 CVEs: - CVE-2026-42502: golang.org/x/net html Render (x/net v0.44.0) - CVE-2026-27136: golang.org/x/net html duplicate attributes (x/net v0.44.0) - CVE-2026-25681: golang.org/x/net html parsing bypass (x/net v0.44.0) - CVE-2026-33186: google.golang.org/grpc HTTP/2 :path (grpc v1.76.0) - CVE-2026-34986: go-jose signature verification (go-jose v4.1.2) Dependency upgrades in v0.14.3: - golang.org/x/net v0.38.0 → v0.44.0 - google.golang.org/grpc v1.73.0 → v1.76.0 - go-jose/v4 v4.0.5 → v4.1.2 Jira: CM-1216 Signed-off-by: Sujnyan Kini <skini@redhat.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>

Changes the RELEASE_BRANCH argument from version tag (v1.18.6) to the release branch (release-1.18) to ensure all CVE backports from PR openshift#44 are included in the build. The release-1.18 branch contains all sustaining security fixes: - replace golang.org/x/net => openshift-sustaining/net v0.50.0-sec.2 - replace google.golang.org/grpc => openshift-sustaining/grpc-go v1.75.1-sec.1 - replace golang.org/x/crypto => openshift-sustaining/crypto v0.48.0-sec.1 Using the release branch instead of version tag ensures builds include sustaining security fixes that may not be in the tag. Jira: CM-1216 Signed-off-by: Sujnyan Kini <skini@redhat.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>

sujkini · 2026-09-17T09:23:49Z

/test verify

Updates istio-csr dependency to v0.14.3 which resolves 5 CVEs by updating dependencies in the operand image: - golang.org/x/net v0.38.0 → v0.44.0 (CVE-2026-42502, CVE-2026-27136, CVE-2026-25681) - google.golang.org/grpc v1.73.0 → v1.76.0 (CVE-2026-33186) - go-jose/v4 v4.0.5 → v4.1.2 (CVE-2026-34986) Updates both config/manager and bindata manifests to keep versions in sync. Jira: CM-1216 Signed-off-by: Sujnyan Kini <skini@redhat.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>

openshift-ci · 2026-09-17T11:47:26Z

@sujkini: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 11, 2026

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Aug 11, 2026

sujkini marked this pull request as ready for review August 24, 2026 08:39

openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 24, 2026

openshift-ci Bot requested review from TrilokGeer and swghosh August 24, 2026 08:39

sujkini added 2 commits August 24, 2026 14:17

sujkini force-pushed the sujkini/cm-1216-operator-rebase branch from 0a2be97 to a4e1861 Compare August 24, 2026 08:47

bharath-b-rh reviewed Sep 15, 2026

View reviewed changes

sujkini force-pushed the sujkini/cm-1216-operator-rebase branch from 3b4de81 to b340608 Compare September 17, 2026 05:56

sujkini and others added 2 commits September 17, 2026 11:44

sujkini force-pushed the sujkini/cm-1216-operator-rebase branch 2 times, most recently from 903d2f0 to 9749e54 Compare September 17, 2026 08:45

sujkini force-pushed the sujkini/cm-1216-operator-rebase branch from 9749e54 to bf70657 Compare September 17, 2026 09:34

sujkini force-pushed the sujkini/cm-1216-operator-rebase branch from bf70657 to 95446c9 Compare September 17, 2026 09:44

Navigation Menu

CM-1216: Bump cert-manager operand to v1.18.6, bundle to v1.18.2 - #472

CM-1216: Bump cert-manager operand to v1.18.6, bundle to v1.18.2#472
sujkini wants to merge 5 commits into
openshift:cert-manager-1.18from
sujkini:sujkini/cm-1216-operator-rebase

sujkini commented Aug 11, 2026 •

edited by openshift-ci Bot

Loading

Uh oh!

openshift-ci-robot commented Aug 11, 2026 •

edited by openshift-ci Bot

Loading

Dependencies

Verification

Uh oh!

openshift-ci Bot commented Aug 11, 2026

Uh oh!

coderabbitai Bot commented Aug 11, 2026 •

edited

Loading

Review skipped

Uh oh!

openshift-ci Bot commented Aug 11, 2026

Uh oh!

bharath-b-rh Sep 15, 2026

Uh oh!

sujkini Sep 17, 2026

Uh oh!

bharath-b-rh Sep 15, 2026

Uh oh!

sujkini Sep 17, 2026

Uh oh!

bharath-b-rh Sep 15, 2026

Uh oh!

sujkini Sep 17, 2026

Uh oh!

sujkini commented Sep 17, 2026

Uh oh!

openshift-ci Bot commented Sep 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants


		replace github.com/tdakkota/asciicheck => github.com/golangci/asciicheck v0.1.1

		replace golang.org/x/net => github.com/openshift-sustaining/net v0.50.0-sec.2

Conversation

sujkini commented Aug 11, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependencies

Verification

Uh oh!

openshift-ci-robot commented Aug 11, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependencies

Verification

Uh oh!

openshift-ci Bot commented Aug 11, 2026

Uh oh!

coderabbitai Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

openshift-ci Bot commented Aug 11, 2026

Uh oh!

bharath-b-rh Sep 15, 2026

Choose a reason for hiding this comment

Uh oh!

sujkini Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

bharath-b-rh Sep 15, 2026

Choose a reason for hiding this comment

Uh oh!

sujkini Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

bharath-b-rh Sep 15, 2026

Choose a reason for hiding this comment

Uh oh!

sujkini Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

sujkini commented Sep 17, 2026

Uh oh!

openshift-ci Bot commented Sep 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

sujkini commented Aug 11, 2026 •

edited by openshift-ci Bot

Loading

openshift-ci-robot commented Aug 11, 2026 •

edited by openshift-ci Bot

Loading

coderabbitai Bot commented Aug 11, 2026 •

edited

Loading