NO-JIRA: Bump golang.org/x deps to fix reachable CVEs

[rh-roman]

govulncheck found 6 reachable vulnerabilities in golang.org/x/crypto/ssh (all fixed in v0.52.0) and 2 in golang.org/x/net (fixed in v0.53.0 and v0.55.0), all reachable via validation.go's use of ssh.NewClientConn and sftp.NewClient:

• GO-2026-5020: infinite loop on large channel writes (ssh)
• GO-2026-5019: bypass of FIDO/U2F physical interaction (ssh)
• GO-2026-5018: pathological RSA/DSA parameters cause DoS (ssh)
• GO-2026-5017: client can cause server deadlock (ssh)
• GO-2026-5013: byte arithmetic underflow and panic (ssh)
• GO-2026-5026: failure to reject Punycode labels (net/idna)
• GO-2026-4918: infinite loop on bad SETTINGS_MAX_FRAME_SIZE (net/http2)

Summary by CodeRabbit

• Chores
  • Updated several Go module dependencies to newer versions for improved compatibility and maintenance.
  • Refreshed multiple golang.org/x/* packages, including crypto, networking, sync, sys, term, text, and tools-related libraries.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: rh-roman
Once this PR has been reviewed and has the lgtm label, please assign rafael-azevedo for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Walkthrough

This PR updates go.mod, bumping version pins for golang.org/x/crypto, golang.org/x/net, and indirect dependencies x/sync, x/sys, x/term, x/text, and x/tools to newer releases, with no changes to exported entities.

Changes

Dependency version bumps

Layer / File(s)	Summary
Update golang.org/x dependency pins go.mod	Bumps golang.org/x/crypto and golang.org/x/net direct dependency versions, and x/sync, x/sys, x/term, x/text, x/tools indirect dependency versions; x/time is unchanged.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related issues

• Update golang.org/x/crypto to address security vulnerabilities #372: Both changes update golang.org/x/crypto in go.mod, so they are related.
• Update golang.org/x/crypto to address security vulnerabilities oc-mirror#1330: Bumps golang.org/x/crypto, matching this PR's dependency update.
• Update golang.org/x/crypto to address security vulnerabilities oauth-server#206: Updates golang.org/x/crypto in go.mod, matching this PR's dependency update.
• Update golang.org/x/crypto to address security vulnerabilities assisted-installer#1404: Requests upgrading golang.org/x/crypto, matching this PR's change.
• Update golang.org/x/crypto to address security vulnerabilities image-based-install-operator#443: Includes a golang.org/x/crypto security-driven update matching this PR.
• Update golang.org/x/crypto to address security vulnerabilities cluster-api-provider-ibmcloud#141: Requests upgrading golang.org/x/crypto, matching this PR's change.
• Update golang.org/x/crypto to address security vulnerabilities machine-config-operator#5506: Targets updating golang.org/x/crypto, matching this PR's change.
• Update golang.org/x/crypto to address security vulnerabilities origin#30621: Updates golang.org/x/crypto in go.mod, matching this PR's change.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	No changed _test.go files; the PR only updates dependencies/vendor content, so no Ginkgo test titles were introduced.
Test Structure And Quality	✅ Passed	PR only updates go.mod/vendor deps; no *_test.go files changed, so Ginkgo test-structure checks are not applicable.
Microshift Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added or changed; this PR only updates Go module/vendor dependencies, so the MicroShift check is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new or modified Ginkgo e2e tests are present; changes are dependency/vendor updates only, so the SNO check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: Diff only updates go.mod and vendored dependency code; no deployment manifests, operator code, or controllers were modified.
Ote Binary Stdout Contract	✅ Passed	Only go.mod/go.sum and vendored deps changed; no repo main/TestMain/RunSpecs/init code was modified, so no new stdout writes in process-level code.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No Ginkgo/e2e test files were added or changed; the diff is a dependency/vendor bump only.
No-Weak-Crypto	✅ Passed	No new weak-crypto code was added; the only SHA1 mention in the diff is a removed pbkdf2 doc example, and no insecure secret comparisons were introduced.
Container-Privileges	✅ Passed	PR only bumps Go deps (go.mod/go.sum/vendor Go files); no K8s/container manifests with privileged, hostPID/hostNetwork/hostIPC, SYS_ADMIN, or allowPrivilegeEscalation=true were changed.
No-Sensitive-Data-In-Logs	✅ Passed	PR only bumps deps/vendor files; no new log statements expose passwords/tokens/PII, and existing http2 verbose logs pre-existed.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: updating golang.org/x dependencies to remediate reachable CVEs.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.32%. Comparing base (6860bae) to head (aee9f23).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #373   +/-   ##
=======================================
  Coverage   82.32%   82.32%           
=======================================
  Files           8        8           
  Lines         905      905           
=======================================
  Hits          745      745           
  Misses        148      148           
  Partials       12       12           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[openshift-ci-robot]

@rh-roman: This pull request explicitly references no jira issue.

Details

In response to this:

govulncheck found 6 reachable vulnerabilities in golang.org/x/crypto/ssh (all fixed in v0.52.0) and 2 in golang.org/x/net (fixed in v0.53.0 and v0.55.0), all reachable via validation.go's use of ssh.NewClientConn and sftp.NewClient:

• GO-2026-5020: infinite loop on large channel writes (ssh)
• GO-2026-5019: bypass of FIDO/U2F physical interaction (ssh)
• GO-2026-5018: pathological RSA/DSA parameters cause DoS (ssh)
• GO-2026-5017: client can cause server deadlock (ssh)
• GO-2026-5013: byte arithmetic underflow and panic (ssh)
• GO-2026-5026: failure to reject Punycode labels (net/idna)
• GO-2026-4918: infinite loop on bad SETTINGS_MAX_FRAME_SIZE (net/http2)

Summary by CodeRabbit

• Chores
• Updated several Go module dependencies to newer versions for improved compatibility and maintenance.
• Refreshed multiple golang.org/x/* packages, including crypto, networking, sync, sys, term, text, and tools-related libraries.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@rh-roman: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/validate-boilerplate	aee9f23	link	false	/test validate-boilerplate

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.