CVE-2025-27144: pin go-jose/v4@v4.0.5 (#3550)

anik120 · ci-robot · commit d3160cadb6b5 · 2025-04-05T00:04:47.000Z
Upstream-repository: operator-lifecycle-manager
Upstream-commit: dfd0b2bea85038d3c0d65348bc812d297f16b8d2
diff --git a/staging/operator-lifecycle-manager/go.mod b/staging/operator-lifecycle-manager/go.mod
@@ -190,6 +190,7 @@ require (
 replace google.golang.org/grpc => google.golang.org/grpc v1.63.2
 
 replace (
+	github.com/go-jose/go-jose/v4 => github.com/go-jose/go-jose/v4 v4.0.5 // CVE-2025-27144
 	// controller runtime
 	github.com/openshift/api => github.com/openshift/api v0.0.0-20221021112143-4226c2167e40 // release-4.12
 	github.com/openshift/client-go => github.com/openshift/client-go v0.0.0-20221019143426-16aed247da5c // release-4.12

-Original file line number
+Diff line change
 replace google.golang.org/grpc => google.golang.org/grpc v1.63.2
 replace (
 +	github.com/go-jose/go-jose/v4 => github.com/go-jose/go-jose/v4 v4.0.5 // CVE-2025-27144
 	// controller runtime
 	github.com/openshift/api => github.com/openshift/api v0.0.0-20221021112143-4226c2167e40 // release-4.12
 	github.com/openshift/client-go => github.com/openshift/client-go v0.0.0-20221019143426-16aed247da5c // release-4.12