Skip to content

CMP-4370,CMP-4402,CMP-4405: Bump Go to 1.25.11 and update dependencies - #1324

Open
abushkin-redhat wants to merge 1 commit into
ComplianceAsCode:masterfrom
abushkin-redhat:go-bump-1.25.11-co-master
Open

CMP-4370,CMP-4402,CMP-4405: Bump Go to 1.25.11 and update dependencies#1324
abushkin-redhat wants to merge 1 commit into
ComplianceAsCode:masterfrom
abushkin-redhat:go-bump-1.25.11-co-master

Conversation

@abushkin-redhat

@abushkin-redhat abushkin-redhat commented Aug 6, 2026

Copy link
Copy Markdown
Collaborator

What

Bump Go toolchain from 1.25.8 to 1.25.11 and refresh vendored dependencies
to their latest Go 1.25-compatible patch releases; re-vendored.

Why

Pick up Go standard-library security fixes flagged against the
compliance-operator-bundle image (Red Hat ProdSec trackers):

CVE Jira Go package
CVE-2026-33811 CMP-4370 net
CVE-2026-27145 CMP-4402 crypto/x509
CVE-2026-42504 CMP-4405 mime

Changes

Package From To
go (toolchain) 1.25.8 1.25.11
golang.org/x/crypto v0.52.0 v0.54.0
golang.org/x/net v0.55.0 v0.57.0
golang.org/x/sys v0.45.0 v0.47.0
golang.org/x/text v0.37.0 v0.40.0
golang.org/x/term v0.43.0 v0.45.0
golang.org/x/mod v0.36.0 v0.38.0
golang.org/x/tools v0.45.0 v0.48.0
golang.org/x/sync v0.20.0 v0.22.0
golang.org/x/exp Jun 3 Jul 27
k8s.io/* v0.35.5 v0.35.7
k8s.io/kube-openapi Jun 3 Jul 21
k8s.io/utils May 7 Jul 7
sigs.k8s.io/structured-merge-diff/v6 v6.3.2 v6.4.2
google.golang.org/genproto Jun 8 Aug 3
google.golang.org/protobuf v1.36.11 v1.36.12-pre
go.opentelemetry.io/otel v1.43.0 v1.45.0
github.com/google/cel-go v0.26.1 v0.30.0
github.com/go-logr/logr v1.4.3 v1.4.4
go-openapi/jsonpointer v0.23.1 v1.0.0
go-openapi/jsonreference v0.21.6 v1.0.0
go-openapi/swag v0.25.5 v0.27.1

All updated dependencies require only go 1.25.0 — verified via each
module's go.mod. Packages whose latest versions require go >= 1.26.0
(e.g., sigs.k8s.io/controller-runtime@v0.24.1,
github.com/openshift/library-go@latest) were left at their current versions.

Verification

  • go mod tidy produces no diff
  • go mod vendor produces no diff
  • go build ./... compiles cleanly
  • CI pipelines pass

@openshift-ci-robot

openshift-ci-robot commented Aug 6, 2026

Copy link
Copy Markdown
Collaborator

@abushkin-redhat: This pull request references CMP-4370 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the vulnerability to target the "5.0.0" version, but no target version was set.

This pull request references CMP-4402 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the vulnerability to target the "5.0.0" version, but no target version was set.

This pull request references CMP-4405 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the vulnerability to target the "5.0.0" version, but no target version was set.

Details

In response to this:

What

Bump Go toolchain from 1.25.8 to 1.25.11 and refresh vendored dependencies
to their latest Go 1.25-compatible patch releases; re-vendored.

Why

Pick up Go standard-library security fixes flagged against the
compliance-operator-bundle image (Red Hat ProdSec trackers):

CVE Jira Go package
CVE-2026-33811 CMP-4370 net
CVE-2026-27145 CMP-4402 crypto/x509
CVE-2026-42504 CMP-4405 mime

Changes

Package From To
go (toolchain) 1.25.8 1.25.11
golang.org/x/crypto v0.52.0 v0.54.0
golang.org/x/net v0.55.0 v0.57.0
golang.org/x/sys v0.45.0 v0.47.0
golang.org/x/text v0.37.0 v0.40.0
golang.org/x/term v0.43.0 v0.45.0
golang.org/x/mod v0.36.0 v0.38.0
golang.org/x/tools v0.45.0 v0.48.0
golang.org/x/sync v0.20.0 v0.22.0
golang.org/x/exp Jun 3 Jul 27
k8s.io/* v0.35.5 v0.35.7
k8s.io/kube-openapi Jun 3 Jul 21
k8s.io/utils May 7 Jul 7
sigs.k8s.io/structured-merge-diff/v6 v6.3.2 v6.4.2
google.golang.org/genproto Jun 8 Aug 3
google.golang.org/protobuf v1.36.11 v1.36.12-pre
go.opentelemetry.io/otel v1.43.0 v1.45.0
github.com/google/cel-go v0.26.1 v0.30.0
github.com/go-logr/logr v1.4.3 v1.4.4
go-openapi/jsonpointer v0.23.1 v1.0.0
go-openapi/jsonreference v0.21.6 v1.0.0
go-openapi/swag v0.25.5 v0.27.1

All updated dependencies require only go 1.25.0 — verified via each
module's go.mod. Packages whose latest versions require go >= 1.26.0
(e.g., sigs.k8s.io/controller-runtime@v0.24.1,
github.com/openshift/library-go@latest) were left at their current versions.

Verification

  • go mod tidy produces no diff
  • go mod vendor produces no diff
  • go build ./... compiles cleanly
  • CI pipelines pass

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci
openshift-ci Bot requested review from jhrozek and yuumasato August 6, 2026 10:52
@openshift-ci openshift-ci Bot added the approved label Aug 6, 2026
@yuumasato yuumasato added this to the 1.10.0 milestone Aug 6, 2026
@yuumasato yuumasato self-assigned this Aug 6, 2026
yuumasato
yuumasato requested changes Aug 6, 2026
View reviewed changes

@yuumasato yuumasato left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@abushkin-redhat Looking good, I just noticed that build/Dockerfile and images/operator/Dockerfile still pin to 1.25.8. They should be updated to pin 1.25.11.

@yuumasato

yuumasato commented Aug 6, 2026

Copy link
Copy Markdown
Member

Actually, the Konflux builds fail because of that.

@abushkin-redhat
abushkin-redhat force-pushed the go-bump-1.25.11-co-master branch from 77567d3 to cf30052 Compare August 6, 2026 14:24
@yuumasato

yuumasato commented Aug 6, 2026

Copy link
Copy Markdown
Member

/test e2e-aws-parallel

yuumasato
yuumasato approved these changes Aug 6, 2026
View reviewed changes

@yuumasato yuumasato left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
Just pending CI

@openshift-ci openshift-ci Bot added the lgtm label Aug 6, 2026
@openshift-ci

openshift-ci Bot commented Aug 6, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: abushkin-redhat, yuumasato

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:
  • OWNERS [abushkin-redhat,yuumasato]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@github-actions

github-actions Bot commented Aug 6, 2026

Copy link
Copy Markdown

🤖 To deploy this PR, run the following command:

make catalog-deploy CATALOG_IMG=ghcr.io/complianceascode/compliance-operator-catalog:1324-cf3005259f4c0da93af6b36c40c8a85c2eb80531

@yuumasato

yuumasato commented Aug 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Weird...

2026/08/06 16:41:44 waiting until suite test-strict-node-scan-configuration-binding reaches target status 'DONE'. Current status: AGGREGATING
2026/08/06 16:41:54 ComplianceScan ready (DONE)
2026/08/06 16:41:54 All scans in ComplianceSuite have finished (test-strict-node-scan-configuration-binding)
    main_test.go:3531: suite left PENDING state (expected to remain PENDING for 30s): phase=
--- FAIL: TestStrictNodeScanConfiguration (83.23s)

@abushkin-redhat
abushkin-redhat force-pushed the go-bump-1.25.11-co-master branch from cf30052 to c2989c9 Compare August 6, 2026 17:28
@openshift-ci openshift-ci Bot removed the lgtm label Aug 6, 2026
@openshift-ci

openshift-ci Bot commented Aug 6, 2026

Copy link
Copy Markdown

New changes are detected. LGTM label has been removed.

@github-actions

github-actions Bot commented Aug 6, 2026

Copy link
Copy Markdown

🤖 To deploy this PR, run the following command:

make catalog-deploy CATALOG_IMG=ghcr.io/complianceascode/compliance-operator-catalog:1324-c2989c99bee0e62e6578b476d5c0736944e1db18

@abushkin-redhat

abushkin-redhat commented Aug 7, 2026

Copy link
Copy Markdown
Collaborator Author

/test e2e-aws-parallel

@openshift-ci

openshift-ci Bot commented Aug 7, 2026

Copy link
Copy Markdown

@abushkin-redhat: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-aws-parallel c2989c9 link true /test e2e-aws-parallel

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@yuumasato yuumasato yuumasato approved these changes
@jhrozek jhrozek Awaiting requested review from jhrozek

Assignees

@yuumasato yuumasato

Labels

approved jira/valid-reference

Projects

None yet

Milestone

1.10.0

Development

Successfully merging this pull request may close these issues.

3 participants

@abushkin-redhat @openshift-ci-robot @yuumasato