OADP-7565,OADP-7570,OADP-7573: Bump Go toolchain to 1.25.8 and fix x/* CVEs by kaovilai · Pull Request #2121 · openshift/oadp-operator

kaovilai · 2026-03-17T19:55:41Z

Why the changes were made

Fix multiple CVEs in the Go toolchain and golang.org/x/* dependencies. Go 1.24 is EOL; 1.25 and 1.26 are the supported releases.

Go toolchain CVEs fixed (Go 1.25.8):

GO-2026-4337, GO-2026-4340: crypto/tls
GO-2026-4341: net/url
GO-2026-4342: archive/zip
CVE-2026-25679: net/url IPv6 host parsing
CVE-2026-27137: crypto/x509 email constraints

golang.org/x/ CVEs fixed:*

GHSA-vvgc-356p-c3xw: golang.org/x/net XSS in HTML tokenizer (fixed in v0.38.0+, pulled in v0.52.0)
GHSA-j5w8-q4qc-rx2x: golang.org/x/crypto ssh DoS (fixed in v0.45.0+, pulled in v0.49.0)
GHSA-f6x5-jh6r-wrfv: golang.org/x/crypto ssh/agent panic (fixed in v0.45.0+, pulled in v0.49.0)

Changes:

go.mod: go 1.23.0 / toolchain go1.23.6 → go 1.25.0 / toolchain go1.25.8
golang.org/x/crypto: v0.39.0 → v0.49.0
golang.org/x/net: v0.41.0 → v0.52.0
Transitive bumps: x/sys v0.42.0, x/text v0.35.0, x/term v0.41.0, x/sync v0.20.0, x/tools v0.42.0
konflux.Dockerfile: rhel_9_golang_1.24 → rhel_9_golang_1.25
must-gather/Dockerfile.oadp: rhel_9_golang_1.23 → rhel_9_golang_1.25

Jira: OADP-7565, OADP-7570, OADP-7573

How to test the changes made

go build ./... — verifies compilation with new toolchain
go test ./... — verifies unit tests pass
CI/Prow E2E tests validate end-to-end functionality
go version in built binary confirms Go 1.25.8 toolchain

Note

Responses generated with Claude

openshift-ci-robot · 2026-03-17T19:55:47Z

@kaovilai: This pull request references OADP-7565 which is a valid jira issue.

This pull request references OADP-7570 which is a valid jira issue.

This pull request references OADP-7573 which is a valid jira issue.

Details

In response to this:

Why the changes were made

Fix multiple CVEs in the Go toolchain and golang.org/x/* dependencies. Go 1.24 is EOL; 1.25 and 1.26 are the supported releases.

Go toolchain CVEs fixed (Go 1.25.8):

GO-2026-4337, GO-2026-4340: crypto/tls

GO-2026-4341: net/url

GO-2026-4342: archive/zip

CVE-2026-25679: net/url IPv6 host parsing

CVE-2026-27137: crypto/x509 email constraints

golang.org/x/ CVEs fixed:*

GHSA-vvgc-356p-c3xw: golang.org/x/net XSS in HTML tokenizer (fixed in v0.38.0+, pulled in v0.52.0)

GHSA-j5w8-q4qc-rx2x: golang.org/x/crypto ssh DoS (fixed in v0.45.0+, pulled in v0.49.0)

GHSA-f6x5-jh6r-wrfv: golang.org/x/crypto ssh/agent panic (fixed in v0.45.0+, pulled in v0.49.0)

Changes:

go.mod: go 1.23.0 / toolchain go1.23.6 → go 1.25.0 / toolchain go1.25.8

golang.org/x/crypto: v0.39.0 → v0.49.0

golang.org/x/net: v0.41.0 → v0.52.0

Transitive bumps: x/sys v0.42.0, x/text v0.35.0, x/term v0.41.0, x/sync v0.20.0, x/tools v0.42.0

konflux.Dockerfile: rhel_9_golang_1.24 → rhel_9_golang_1.25

must-gather/Dockerfile.oadp: rhel_9_golang_1.23 → rhel_9_golang_1.25

Jira: OADP-7565, OADP-7570, OADP-7573

How to test the changes made

go build ./... — verifies compilation with new toolchain

go test ./... — verifies unit tests pass

CI/Prow E2E tests validate end-to-end functionality

go version in built binary confirms Go 1.25.8 toolchain

[!Note]
Responses generated with Claude

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-03-17T19:55:50Z

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Review skipped — only excluded labels are configured. (1)

do-not-merge/work-in-progress

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 828cd423-2683-4d35-83e2-e4011a369e2b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Copilot

Pull request overview

Updates the project’s Go toolchain and several golang.org/x/* dependencies to address security CVEs, and aligns container build images with the newer Go major/minor release.

Changes:

Bump root module go.mod to go 1.25.0 and toolchain go1.25.8.
Update golang.org/x/* dependency versions (and corresponding go.sum entries).
Update builder base images in konflux.Dockerfile and must-gather/Dockerfile.oadp to rhel_9_golang_1.25.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

File	Description
`must-gather/Dockerfile.oadp`	Switches must-gather build stage to Go 1.25 builder image.
`konflux.Dockerfile`	Switches Konflux build stage to Go 1.25 builder image.
`go.mod`	Bumps Go language/toolchain version and updates indirect `golang.org/x/*` deps.
`go.sum`	Updates checksums to match the bumped module versions.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

must-gather/Dockerfile.oadp

-#@follow_tag(registry-proxy.engineering.redhat.com/rh-osbs/openshift-golang-builder:rhel_9_golang_1.23)
-FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_golang_1.23 AS builder
+#@follow_tag(registry-proxy.engineering.redhat.com/rh-osbs/openshift-golang-builder:rhel_9_golang_1.25)
+FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_golang_1.25 AS builder


mpryc · 2026-03-18T11:09:23Z

/hold something is off here with the tests

…* CVEs - Update go directive from 1.23.0 to 1.25.0, toolchain go1.23.6 -> go1.25.8 (Go 1.24 is EOL; 1.25 and 1.26 are the supported releases) - Bump golang.org/x/crypto v0.39.0 -> v0.49.0 (fixes GHSA-j5w8-q4qc-rx2x ssh DoS, GHSA-f6x5-jh6r-wrfv ssh/agent panic) - Bump golang.org/x/net v0.41.0 -> v0.52.0 (fixes GHSA-vvgc-356p-c3xw XSS in HTML tokenizer) - Transitive bumps: x/sys v0.42.0, x/text v0.35.0, x/term v0.41.0, x/sync v0.20.0, x/tools v0.42.0 - Update konflux.Dockerfile: rhel_9_golang_1.24 -> rhel_9_golang_1.25 - Update must-gather/Dockerfile.oadp: rhel_9_golang_1.23 -> rhel_9_golang_1.25 Go toolchain CVEs fixed: - GO-2026-4337, GO-2026-4340 (crypto/tls) - GO-2026-4341 (net/url) - GO-2026-4342 (archive/zip) - CVE-2026-25679 (net/url IPv6 host parsing) - CVE-2026-27137 (crypto/x509 email constraints) Generated with [Claude Code](https://claude.ai/code) via [Happy](https://happy.engineering) Co-Authored-By: Claude <noreply@anthropic.com> Co-Authored-By: Happy <yesreply@happy.engineering>

kaovilai · 2026-03-19T15:30:16Z

/retest

kaovilai · 2026-03-23T20:14:05Z

/retest

openshift-ci · 2026-03-23T23:15:26Z

@kaovilai: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

weshayutin

/LGTM

openshift-ci · 2026-03-23T23:45:00Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kaovilai, weshayutin

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [kaovilai]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

weshayutin · 2026-03-24T01:22:48Z

@mpryc 0/

Copilot AI review requested due to automatic review settings March 17, 2026 19:55

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Mar 17, 2026

Copilot started reviewing on behalf of kaovilai March 17, 2026 19:56 View session

openshift-ci bot requested review from mpryc and mrnold March 17, 2026 19:56

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 17, 2026

Copilot AI reviewed Mar 17, 2026

View reviewed changes

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 18, 2026

kaovilai force-pushed the cve-fix-oadp-1.5 branch from 4d6acb0 to 52bd654 Compare March 18, 2026 18:22

kaovilai force-pushed the cve-fix-oadp-1.5 branch from 52bd654 to 0418f91 Compare March 19, 2026 01:48

weshayutin approved these changes Mar 23, 2026

View reviewed changes

openshift-ci bot assigned weshayutin Mar 23, 2026

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Mar 23, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OADP-7565,OADP-7570,OADP-7573: Bump Go toolchain to 1.25.8 and fix x/* CVEs#2121

OADP-7565,OADP-7570,OADP-7573: Bump Go toolchain to 1.25.8 and fix x/* CVEs#2121
kaovilai wants to merge 1 commit intoopenshift:oadp-1.5from
kaovilai:cve-fix-oadp-1.5

kaovilai commented Mar 17, 2026

Uh oh!

openshift-ci-robot commented Mar 17, 2026

Why the changes were made

How to test the changes made

Uh oh!

coderabbitai bot commented Mar 17, 2026 •

edited

Loading

Review skipped

Uh oh!

Copilot AI left a comment

Uh oh!

mpryc commented Mar 18, 2026

Uh oh!

kaovilai commented Mar 19, 2026

Uh oh!

kaovilai commented Mar 23, 2026

Uh oh!

openshift-ci bot commented Mar 23, 2026

Uh oh!

weshayutin left a comment

Uh oh!

openshift-ci bot commented Mar 23, 2026

Uh oh!

weshayutin commented Mar 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

kaovilai commented Mar 17, 2026

Why the changes were made

How to test the changes made

Uh oh!

openshift-ci-robot commented Mar 17, 2026

Why the changes were made

How to test the changes made

Uh oh!

coderabbitai bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

mpryc commented Mar 18, 2026

Uh oh!

kaovilai commented Mar 19, 2026

Uh oh!

kaovilai commented Mar 23, 2026

Uh oh!

openshift-ci bot commented Mar 23, 2026

Uh oh!

weshayutin left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Mar 23, 2026

Uh oh!

weshayutin commented Mar 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

coderabbitai bot commented Mar 17, 2026 •

edited

Loading