OADP-7565,OADP-7570,OADP-7573: Go 1.25.8 + x/* dependency bumps

[kaovilai]

Summary

• Update Go toolchain from 1.23.6 to 1.25.8 (Go 1.24 is EOL; 1.25 and 1.26 are the supported releases)
• Bump golang.org/x/* dependencies to latest (x/net v0.52.0, x/sync v0.20.0, x/sys v0.42.0, x/text v0.35.0, x/term v0.41.0)
• Update Dockerfile to golang:1.25.8 and konflux.Dockerfile to rhel_9_golang_1.25

CVEs Addressed

Go Toolchain (1.25.8)

CVE	Component
GO-2026-4337	crypto/tls
GO-2026-4340	crypto/tls
GO-2026-4341	net/url
GO-2026-4342	archive/zip
CVE-2026-25679	net/url (IPv6 host parsing)
CVE-2026-27137	crypto/x509 (email constraints)

golang.org/x/* Dependencies

CVE	Component	Fix Version
GHSA-vvgc-356p-c3xw	golang.org/x/net (XSS in HTML tokenizer)	v0.38.0+ (pulled in v0.52.0)

Jira

• OADP-7565
• OADP-7570
• OADP-7573

Test plan

• go build ./... passes locally
• CI passes

Note

Responses generated with Claude

[openshift-ci-robot]

@kaovilai: This pull request references OADP-7565 which is a valid jira issue.

This pull request references OADP-7570 which is a valid jira issue.

This pull request references OADP-7573 which is a valid jira issue.

Details

In response to this:

Summary

• Update Go toolchain from 1.23.6 to 1.25.8 (Go 1.24 is EOL; 1.25 and 1.26 are the supported releases)
• Bump golang.org/x/* dependencies to latest (x/net v0.52.0, x/sync v0.20.0, x/sys v0.42.0, x/text v0.35.0, x/term v0.41.0)
• Update Dockerfile to golang:1.25.8 and konflux.Dockerfile to rhel_9_golang_1.25

CVEs Addressed

Go Toolchain (1.25.8)

CVE	Component
GO-2026-4337	crypto/tls
GO-2026-4340	crypto/tls
GO-2026-4341	net/url
GO-2026-4342	archive/zip
CVE-2026-25679	net/url (IPv6 host parsing)
CVE-2026-27137	crypto/x509 (email constraints)

golang.org/x/* Dependencies

CVE	Component	Fix Version
GHSA-vvgc-356p-c3xw	golang.org/x/net (XSS in HTML tokenizer)	v0.38.0+ (pulled in v0.52.0)

Jira

• OADP-7565
• OADP-7570
• OADP-7573

Test plan

• go build ./... passes locally
• CI passes

[!Note]
Responses generated with Claude

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 5004f60d-5652-48e3-a572-d7094c379e53

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[oadp-snyk]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[Copilot]

Pull request overview

Updates the project’s Go toolchain and container build images to a newer Go release, along with bumping golang.org/x/* module dependencies to pick up security fixes and stay current with supported versions.

Changes:

• Update go.mod to Go 1.25.x (including toolchain) and bump golang.org/x/* module versions.
• Refresh go.sum checksums for the updated module versions.
• Update container build images in Dockerfile and konflux.Dockerfile to Go 1.25-based builders.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

File	Description
go.mod	Moves module go/toolchain to 1.25.x and bumps golang.org/x/* requirements.
go.sum	Updates sums to match the new golang.org/x/* module versions.
Dockerfile	Switches builder image to golang:1.25.8.
konflux.Dockerfile	Switches Konflux builder image to rhel_9_golang_1.25.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[mpryc]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kaovilai, mpryc

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [kaovilai,mpryc]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment