[Project Darkstar] PSHP-558: Remediate 6 Go stdlib CVEs in external-dns-operator by kseiter-rh · Pull Request #538 · openshift/external-dns-operator

kseiter-rh · 2026-07-22T15:50:55Z

Project Darkstar — Automated CVE Remediation

This PR was generated by Project Darkstar, an automated CVE remediation tool.
For questions or concerns, contact Kevin Seiter (ROSA Trust Engineering).

Summary

Bumps Go toolchain from 1.25.9/1.25 to 1.25.11 in all build contexts to remediate 6 Go stdlib CVEs from PSHP-558
Updates Containerfile.external-dns-operator, Dockerfile, drift-cache/Dockerfile, and go.mod
Adds toolchain go1.25.11 directive to go.mod (preferred over bumping the go minimum version for stdlib CVE fixes)

CVE Details

CVE	Severity	CVSS	Component	Fixed In
CVE-2026-33814	Important	7.5	Go stdlib (GO-2026-4918)	go1.25.10
CVE-2026-33811	Important	7.5	Go stdlib (GO-2026-4981)	go1.25.10
CVE-2026-39820	Important	7.5	Go stdlib (GO-2026-4986)	go1.25.10
CVE-2026-42499	Important	7.5	Go stdlib (GO-2026-4977)	go1.25.10
CVE-2026-42504	Important	7.5	Go stdlib (GO-2026-5038)	go1.25.11
CVE-2026-27145	Important	7.5	Go stdlib (GO-2026-5037)	go1.25.11

Changes

Containerfile.external-dns-operator: go-toolset:1.25.9-1778675823 → go-toolset:1.25.11
Dockerfile: go-toolset:1.25 → go-toolset:1.25.11
drift-cache/Dockerfile: go-toolset:1.25 → go-toolset:1.25.11 (kept in sync with Dockerfile for drift check)
go.mod: added toolchain go1.25.11 directive
go.sum: updated checksums

Not Fixed (Mintmaker scope)

The following CVEs from PSHP-558 affect golang.org/x/crypto (v0.37.0 → v0.52.0 needed) and golang.org/x/net (v0.39.0 → v0.55.0 needed). Per Project Darkstar policy, module bumps in MintMaker-managed repos are left to the MintMaker bot:

CVE-2026-39828 (x/crypto, CVSS 8.8), CVE-2026-39832 (x/crypto, CVSS 8.7), CVE-2026-39821 (x/net, CVSS 8.2), and 9 additional x/crypto/x/net CVEs

MintMaker should be prompted to open an x/crypto + x/net bump PR urgently.

Verification

go build ./... passes with go1.25.11 toolchain
make test passes
No regressions in existing functionality
Drift detection check in Containerfile still passes (Dockerfile and drift-cache/Dockerfile updated together)

References

Jira: PSHP-558
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-33814

Project Darkstar — Automated CVE Remediation | Contact: Kevin Seiter (ROSA Trust Engineering)

…33811, CVE-2026-39820, CVE-2026-42499, CVE-2026-42504, CVE-2026-27145 — update go-toolset to 1.25.11 Addresses 6 Go stdlib CVEs (all Important, CVSS 7.5) from PSHP-558. Bumps go-toolset from 1.25.9/1.25 to 1.25.11 in Containerfile.external-dns-operator, Dockerfile, and drift-cache/Dockerfile. Adds toolchain go1.25.11 directive to go.mod. CVEs fixed in go1.25.10: CVE-2026-33814, CVE-2026-33811, CVE-2026-39820, CVE-2026-42499. CVEs fixed in go1.25.11: CVE-2026-42504, CVE-2026-27145. Ref: PSHP-558 Project Darkstar — automated CVE remediation (contact: Kevin Seiter)

openshift-ci-robot · 2026-07-22T15:50:59Z

@kseiter-rh: This pull request references PSHP-558 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the vulnerability to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Project Darkstar — Automated CVE Remediation

This PR was generated by Project Darkstar, an automated CVE remediation tool.
For questions or concerns, contact Kevin Seiter (ROSA Trust Engineering).

Summary

Bumps Go toolchain from 1.25.9/1.25 to 1.25.11 in all build contexts to remediate 6 Go stdlib CVEs from PSHP-558

Updates Containerfile.external-dns-operator, Dockerfile, drift-cache/Dockerfile, and go.mod

Adds toolchain go1.25.11 directive to go.mod (preferred over bumping the go minimum version for stdlib CVE fixes)

CVE Details

CVE Severity CVSS Component Fixed In

CVE-2026-33814 Important 7.5 Go stdlib (GO-2026-4918) go1.25.10

CVE-2026-33811 Important 7.5 Go stdlib (GO-2026-4981) go1.25.10

CVE-2026-39820 Important 7.5 Go stdlib (GO-2026-4986) go1.25.10

CVE-2026-42499 Important 7.5 Go stdlib (GO-2026-4977) go1.25.10

CVE-2026-42504 Important 7.5 Go stdlib (GO-2026-5038) go1.25.11

CVE-2026-27145 Important 7.5 Go stdlib (GO-2026-5037) go1.25.11

Changes

Containerfile.external-dns-operator: go-toolset:1.25.9-1778675823 → go-toolset:1.25.11

Dockerfile: go-toolset:1.25 → go-toolset:1.25.11

drift-cache/Dockerfile: go-toolset:1.25 → go-toolset:1.25.11 (kept in sync with Dockerfile for drift check)

go.mod: added toolchain go1.25.11 directive

go.sum: updated checksums

Not Fixed (Mintmaker scope)

The following CVEs from PSHP-558 affect golang.org/x/crypto (v0.37.0 → v0.52.0 needed) and golang.org/x/net (v0.39.0 → v0.55.0 needed). Per Project Darkstar policy, module bumps in MintMaker-managed repos are left to the MintMaker bot:

CVE-2026-39828 (x/crypto, CVSS 8.8), CVE-2026-39832 (x/crypto, CVSS 8.7), CVE-2026-39821 (x/net, CVSS 8.2), and 9 additional x/crypto/x/net CVEs

MintMaker should be prompted to open an x/crypto + x/net bump PR urgently.

Verification

go build ./... passes with go1.25.11 toolchain

make test passes

No regressions in existing functionality

Drift detection check in Containerfile still passes (Dockerfile and drift-cache/Dockerfile updated together)

References

Jira: PSHP-558

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-33814

Project Darkstar — Automated CVE Remediation | Contact: Kevin Seiter (ROSA Trust Engineering)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-07-22T15:51:04Z

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 065bc83c-5b5a-4510-8ad5-c1398a1424ce

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

openshift-ci · 2026-07-22T15:51:30Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

openshift-ci · 2026-07-22T15:57:16Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign knobunc for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 22, 2026

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 22, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Project Darkstar] PSHP-558: Remediate 6 Go stdlib CVEs in external-dns-operator#538

[Project Darkstar] PSHP-558: Remediate 6 Go stdlib CVEs in external-dns-operator#538
kseiter-rh wants to merge 1 commit into
openshift:mainfrom
kseiter-rh:cve-fix/external-dns-operator-darkstar-2026-07-22

kseiter-rh commented Jul 22, 2026 •

edited by openshift-ci Bot

Loading

Uh oh!

openshift-ci-robot commented Jul 22, 2026 •

edited by openshift-ci Bot

Loading

Project Darkstar — Automated CVE Remediation

Summary

CVE Details

Changes

Not Fixed (Mintmaker scope)

Verification

References

Uh oh!

coderabbitai Bot commented Jul 22, 2026

Review skipped

Uh oh!

openshift-ci Bot commented Jul 22, 2026

Uh oh!

openshift-ci Bot commented Jul 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

kseiter-rh commented Jul 22, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Project Darkstar — Automated CVE Remediation

Summary

CVE Details

Changes

Not Fixed (Mintmaker scope)

Verification

References

Uh oh!

openshift-ci-robot commented Jul 22, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Project Darkstar — Automated CVE Remediation

Summary

CVE Details

Changes

Not Fixed (Mintmaker scope)

Verification

References

Uh oh!

coderabbitai Bot commented Jul 22, 2026

Review skipped

Uh oh!

openshift-ci Bot commented Jul 22, 2026

Uh oh!

openshift-ci Bot commented Jul 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

kseiter-rh commented Jul 22, 2026 •

edited by openshift-ci Bot

Loading

openshift-ci-robot commented Jul 22, 2026 •

edited by openshift-ci Bot

Loading