OAPE-843: 4.22 chore: Rebase openshift/ocp-release-operator-sdk to upstream operator-framework/operator-sdk v1.42.3

[PillaiManish]

Rebase to upstream v1.42.3

Ran the following script to create the rebase branch:
./UPSTREAM-MERGE.sh v1.42.3

Made with Cursor

Summary by CodeRabbit

• New Features

  • Updated release references to v1.42.3 across build, test, and documentation artifacts.

• Bug Fixes

  • Refreshed bundled tooling and test images so scorecard, operator SDK, and helm/operator workflows stay aligned with v1.42.3.

• Documentation

  • Updated installation and CLI documentation to use v1.42.3 assets (including the default decompression image to UBI9 9.8).
  • Added upgrade notes for v1.42.3 (no migrations).

• Chores

  • Bumped build environments to Go 1.26 and UBI9 9.8 across supported images and CI.

[openshift-ci-robot]

@PillaiManish: This pull request references OAPE-843 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target either version "5.0." or "openshift-5.0.", but it targets "openshift-4.22" instead.

Details

In response to this:

Rebase to upstream v1.42.3

Ran the following script to create the rebase branch:
./UPSTREAM-MERGE.sh v1.42.3

Made with Cursor

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: PillaiManish
Once this PR has been reviewed and has the lgtm label, please assign oceanc80 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 41eeb328-bcb8-4254-8222-da1f10b93ff6

📥 Commits

Reviewing files that changed from the base of the PR and between a197f50 and 828a041.

📒 Files selected for processing (2)

• .ci-operator.yaml
• release/helm/Dockerfile

✅ Files skipped from review due to trivial changes (1)

• .ci-operator.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• release/helm/Dockerfile

---

Walkthrough

This PR updates release and version references, refreshes Go toolchain and dependency pins, bumps container base images, updates scorecard/operator-sdk testdata, and adds release documentation for the new versions.

Changes

Release and image refresh

Layer / File(s)	Summary
Release versions and toolchain Makefile, UPSTREAM-VERSION, patches/03-setversion.patch, go.mod, .ci-operator.yaml, release/helm/Dockerfile	Release version constants, version derivation, Go toolchain and dependency versions, and CI/build image references are updated together.
Container base image bumps images/custom-scorecard-tests/Dockerfile, images/helm-operator/Dockerfile, images/operator-sdk/Dockerfile, images/scorecard-test/Dockerfile, images/scorecard-test-kuttl/Dockerfile, images/scorecard-untar/Dockerfile, internal/olm/fbcutil/util.go	Builder and runtime base images are bumped across the Dockerfiles, and the default init image tag is updated to match.
Testdata version bumps testdata/go/v4/memcached-operator/..., testdata/go/v4/monitoring/memcached-operator/..., testdata/helm/memcached-operator/...	Operator SDK, helm-operator, and scorecard-test references are updated across Go and Helm testdata.
Documentation updates website/content/en/docs/cli/operator-sdk_run_bundle.md, website/content/en/docs/installation/_index.md, website/content/en/docs/upgrading-sdk-version/v1.42.2.md, website/content/en/docs/upgrading-sdk-version/v1.42.3.md	CLI, installation, and upgrade-version documentation update version defaults and add release note pages.

Estimated code review effort: 2 (Simple) | ~10 minutes

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
No-Sensitive-Data-In-Logs	❌ Error	htpasswd.authenticateUser now logs WithField("username", username) on auth failures, which can expose user identifiers/PII in logs.	Remove the username from log fields or redact/hash it; keep only a generic auth-failure message and non-sensitive context.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly states the main change: rebasing ocp-release-operator-sdk to upstream operator-sdk v1.42.3.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	No Ginkgo test titles were changed; the PR only touches config/docs/vendor and one non-test Go utility file.
Test Structure And Quality	✅ Passed	No _test.go or Ginkgo spec files changed; the diff is version bumps, docs, configs, and vendor updates, so this check is not applicable.
Microshift Test Compatibility	✅ Passed	PASS: HEAD^..HEAD only changes .ci-operator.yaml and release/helm/Dockerfile; no Go/e2e test files or new Ginkgo specs were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No Ginkgo/e2e tests were added or modified; only CI and Helm Dockerfile base-image tags changed.
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The PR only bumps versions/base images/docs; no deployment manifests/controllers add anti-affinity, node selectors, PDBs, or topology-aware scheduling logic.
Ote Binary Stdout Contract	✅ Passed	No repo-owned main/TestMain/suite-setup code changed; diff is version/image bumps and vendored Ginkgo CLI updates, with no new stdout writes in OTE entrypoints.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the diff is version bumps/docs/configs, and search found no It()/Describe() or IPv4-only network code in changed Go files.
No-Weak-Crypto	✅ Passed	Only exact hits were generated stdlib metadata listing crypto/des, md5, rc4, and sha1; no new weak-crypto code or secret comparisons were introduced.
Container-Privileges	✅ Passed	Touched files only retag images/build roots; no privileged, hostPID/Network/IPC, SYS_ADMIN, allowPrivilegeEscalation, or root-run changes were introduced.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@go.mod`:
- Line 93: The build still depends on the vulnerable Docker module, so update
the dependency chain to remove github.com/docker/docker or replace it with a
patched github.com/moby/moby release. Adjust the module requirement in go.mod
and any related imports or transitive constraints so the legacy
github.com/docker/docker path is no longer pulled in.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
go mod why -m github.com/docker/docker
go list -deps ./... | rg 'github.com/docker/docker'

Repository: openshift/ocp-release-operator-sdk

Length of output: 4979

---

🌐 Web query:

github.com/docker/docker v28.5.2+incompatible osv advisory CVE

💡 Result:

The version v28.5.2+incompatible of the github.com/docker/docker module is affected by multiple security vulnerabilities [1]. As of July 8, 2026, this module path is considered a legacy path for Docker/Moby, and patches for these vulnerabilities are only available in newer versions (v29.x and later) which have migrated to the github.com/moby/moby module path [1]. Notable CVEs affecting version v28.5.2 and earlier include: - CVE-2026-41567 (GHSA-x86f-5xw2-fm2r): A high-severity vulnerability where the PUT /containers/{id}/archive API can execute a container binary on the host with daemon (root) privileges when handling compressed archives [2][3][1]. - CVE-2026-41568 (GHSA-vp62-88p7-qqf5): A medium-severity race condition during docker cp mount setup that allows a malicious container to create empty files or directories at arbitrary absolute paths on the host filesystem [4][5][1]. - CVE-2026-42306 (GHSA-rg2x-37c3-w2rh): A high-severity issue involving a docker cp race condition that allows bind-mount redirection to a host path [1]. Because the github.com/docker/docker module no longer receives security updates on this path, users are advised to migrate their dependencies to the current github.com/moby/moby module (v29.x or later) to receive these fixes [1]. Users who cannot migrate immediately are advised to follow the mitigation strategies provided in the individual security advisories, such as running only trusted container images and limiting access to sensitive API endpoints [3][4].

Citations:

• 1: Vulnerable transitive dependency: docker/docker v28.3.3 carries multiple open CVEs (CVE-2026-42306, -41567, -34040, +2 more) projectdiscovery/nuclei#7442
• 2: GHSA-x86f-5xw2-fm2r
• 3: GHSA-x86f-5xw2-fm2r
• 4: GHSA-vp62-88p7-qqf5
• 5: https://nvd.nist.gov/vuln/detail/CVE-2026-41568

---

Remove or upgrade the vulnerable Docker module
github.com/docker/docker v28.5.2+incompatible is still pulled into the build graph and is covered by multiple high-severity OSV advisories. Update the dependency chain or move off the legacy github.com/docker/docker path to a patched github.com/moby/moby release.

🧰 Tools

🪛 OSV Scanner (2.4.0)

[HIGH] 93-93: github.com/docker/docker 28.5.2+incompatible: Moby has an Off-by-one error in its plugin privilege validation in github.com/docker/docker

(GO-2026-4883)

---

[HIGH] 93-93: github.com/docker/docker 28.5.2+incompatible: Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker

(GO-2026-4887)

---

[HIGH] 93-93: github.com/docker/docker 28.5.2+incompatible: Docker: Race condition in docker cp allows bind mount redirection to host path in github.com/docker/docker

(GO-2026-5617)

---

[HIGH] 93-93: github.com/docker/docker 28.5.2+incompatible: Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap in github.com/docker/docker

(GO-2026-5668)

---

[HIGH] 93-93: github.com/docker/docker 28.5.2+incompatible: Docker: PUT /containers/{id}/archive executes container binary on the host in github.com/docker/docker

(GO-2026-5746)

---

[HIGH] 93-93: github.com/docker/docker 28.5.2+incompatible: Moby has an Off-by-one error in its plugin privilege validation

(GHSA-pxq6-2prw-chj9)

---

[HIGH] 93-93: github.com/docker/docker 28.5.2+incompatible: Docker: Race condition in docker cp allows bind mount redirection to host path

(GHSA-rg2x-37c3-w2rh)

---

[HIGH] 93-93: github.com/docker/docker 28.5.2+incompatible: Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap

(GHSA-vp62-88p7-qqf5)

---

[HIGH] 93-93: github.com/docker/docker 28.5.2+incompatible: Moby has AuthZ plugin bypass when provided oversized request bodies

(GHSA-x744-4wpc-v9h2)

---

[HIGH] 93-93: github.com/docker/docker 28.5.2+incompatible: Docker: PUT /containers/{id}/archive executes container binary on the host

(GHSA-x86f-5xw2-fm2r)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 93, The build still depends on the vulnerable Docker module,
so update the dependency chain to remove github.com/docker/docker or replace it
with a patched github.com/moby/moby release. Adjust the module requirement in
go.mod and any related imports or transitive constraints so the legacy
github.com/docker/docker path is no longer pulled in.

Sources: Path instructions, Linters/SAST tools

[openshift-ci]

@PillaiManish: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[mytreya-rh]

/lgtm
cc: @chiragkyal