OCPBUGS-98624, OCPBUGS-96676: Bump golang.org/x/net to v0.55.0 (CVE-2026-25681, CVE-2026-27136) [Release-4.22] by rissh · Pull Request #715 · openshift/ptp-operator

rissh · 2026-07-15T06:21:08Z

Summary

Bump golang.org/x/net from v0.49.0 to v0.55.0 on release-4.22 to resolve two security vulnerabilities in the golang.org/x/net/html package. Both CVEs are fixed in the same version.

CVE-2026-25681 (GO-2026-5029)

Severity: CRITICAL (CVSS 6.1)
Description: Incorrect handling of character references in DOCTYPE nodes — unescaped > in DOCTYPE PUBLIC/SYSTEM identifiers during html.Render enables sanitizer bypass XSS.
Advisory: https://pkg.go.dev/vuln/GO-2026-5029
Fix: https://go.dev/cl/781703

CVE-2026-27136 (GO-2026-5030)

Severity: CRITICAL (CVSS 6.1)
Description: Duplicate HTML attributes not deduplicated during tokenization, causing parser misalignment exploitable for XSS.
Advisory: https://pkg.go.dev/vuln/GO-2026-5030
Fix: https://go.dev/cl/781685

Related PR

Same fix applied to main in #714.

Changes

golang.org/x/net v0.49.0 → v0.55.0
Cascading bumps: golang.org/x/crypto (v0.51.0), x/sys, x/text, x/term, x/mod, x/sync, x/tools
No application code changes

Verification

go build ./... — passes
govulncheck ./... — GO-2026-5029 and GO-2026-5030 no longer reported

coderabbitai · 2026-07-15T06:21:17Z

Warning

Review limit reached

@rissh, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 43 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 871e4457-de25-4dff-92e5-1b102a5b5ec0

📥 Commits

Reviewing files that changed from the base of the PR and between 5da547a and f2ff149.

⛔ Files ignored due to path filters (168)

go.sum is excluded by !**/*.sum
vendor/golang.org/x/crypto/pbkdf2/pbkdf2.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/crypto/scrypt/scrypt.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/html/iter.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/html/node.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/html/nodetype_string.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/html/parse.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/html/render.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/html/token.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/http2/README.md is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/http2/client_conn_pool.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/http2/client_priority_go126.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/http2/client_priority_go127.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/http2/clientconn.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/http2/config.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/http2/frame.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/http2/http2.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/http2/server.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/http2/server_common.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/http2/server_wrap.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/http2/transport.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/http2/transport_common.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/http2/transport_wrap.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/http2/writesched.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/http2/writesched_common.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/http2/writesched_priority_rfc7540.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/http2/writesched_priority_rfc9218.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/http2/writesched_random.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/http2/writesched_roundrobin.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/idna/go118.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/idna/idna.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/idna/idna9.0.0.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/idna/pre_go118.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/idna/punycode.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/idna/tables10.0.0.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/idna/tables11.0.0.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/idna/tables12.0.0.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/idna/tables13.0.0.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/idna/tables15.0.0.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/idna/tables17.0.0.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/idna/tables9.0.0.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/idna/trie12.0.0.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/idna/trie13.0.0.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/internal/httpcommon/request.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/net/internal/httpsfv/httpsfv.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/plan9/syscall_plan9.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/affinity_linux.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/ioctl_signed.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/ioctl_unsigned.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/mkall.sh is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/mkerrors.sh is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/readv_unix.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/syscall_darwin.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/syscall_linux.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/syscall_linux_arm.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/syscall_linux_arm64.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/syscall_linux_loong64.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/syscall_openbsd.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/syscall_solaris.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/syscall_unix.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zerrors_linux.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zerrors_linux_386.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zerrors_linux_arm.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zerrors_linux_mips.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zsyscall_linux.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.s is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.s is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.s is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.s is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.s is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.s is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.s is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zsysnum_linux_386.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zsysnum_linux_amd64.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zsysnum_linux_arm.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zsysnum_linux_arm64.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zsysnum_linux_loong64.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zsysnum_linux_mips.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zsysnum_linux_mips64.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zsysnum_linux_mips64le.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zsysnum_linux_mipsle.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zsysnum_linux_ppc.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64le.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zsysnum_linux_riscv64.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zsysnum_linux_s390x.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/zsysnum_linux_sparc64.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/ztypes_linux.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/ztypes_linux_386.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/ztypes_linux_arm.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/ztypes_linux_loong64.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/ztypes_linux_mips.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/windows/aliases.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/windows/dll_windows.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/windows/security_windows.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/windows/syscall_windows.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/windows/types_windows.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/sys/windows/zsyscall_windows.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/text/secure/bidirule/bidirule.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/text/secure/bidirule/bidirule10.0.0.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/text/secure/bidirule/bidirule9.0.0.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/text/unicode/bidi/tables10.0.0.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/text/unicode/bidi/tables11.0.0.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/text/unicode/bidi/tables12.0.0.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/text/unicode/bidi/tables13.0.0.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/text/unicode/bidi/tables15.0.0.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/text/unicode/bidi/tables17.0.0.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/text/unicode/bidi/tables9.0.0.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/text/unicode/norm/forminfo.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/text/unicode/norm/tables10.0.0.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/text/unicode/norm/tables11.0.0.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/text/unicode/norm/tables12.0.0.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/text/unicode/norm/tables15.0.0.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/text/unicode/norm/tables17.0.0.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/text/unicode/norm/tables9.0.0.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/tools/go/ast/inspector/cursor.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/tools/go/ast/inspector/inspector.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/tools/go/ast/inspector/iter.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/tools/go/packages/golist.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/tools/go/packages/packages.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/tools/go/types/objectpath/objectpath.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/tools/internal/aliases/aliases.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/tools/internal/aliases/aliases_go122.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/tools/internal/event/core/event.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/tools/internal/event/keys/keys.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/tools/internal/event/label/label.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/tools/internal/gcimporter/iexport.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/tools/internal/gcimporter/iimport.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/tools/internal/gcimporter/ureader.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/tools/internal/gocommand/version.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/tools/internal/pkgbits/version.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/tools/internal/stdlib/deps.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/tools/internal/typeparams/coretype.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/tools/internal/typeparams/free.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/tools/internal/typesinternal/types.go is excluded by !**/vendor/**, !vendor/**
vendor/golang.org/x/tools/internal/versions/features.go is excluded by !**/vendor/**, !vendor/**
vendor/modules.txt is excluded by !**/vendor/**, !vendor/**

📒 Files selected for processing (1)

go.mod

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

openshift-ci-robot · 2026-07-15T06:21:19Z

@rissh: This pull request references Jira Issue OCPBUGS-98624, which is invalid:

expected dependent Jira Issue OCPBUGS-98623 to be in one of the following states: MODIFIED, ON_QA, VERIFIED, but it is POST instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

This pull request references Jira Issue OCPBUGS-96676, which is invalid:

expected dependent Jira Issue OCPBUGS-96887 to be in one of the following states: MODIFIED, ON_QA, VERIFIED, but it is POST instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

Bump golang.org/x/net from v0.49.0 to v0.55.0 on release-4.22 to resolve two security vulnerabilities in the golang.org/x/net/html package. Both CVEs are fixed in the same version.

CVE-2026-25681 (GO-2026-5029)

Severity: CRITICAL (CVSS 6.1)

Description: Incorrect handling of character references in DOCTYPE nodes — unescaped > in DOCTYPE PUBLIC/SYSTEM identifiers during html.Render enables sanitizer bypass XSS.

Advisory: https://pkg.go.dev/vuln/GO-2026-5029

Fix: https://go.dev/cl/781703

CVE-2026-27136 (GO-2026-5030)

Severity: CRITICAL (CVSS 6.1)

Description: Duplicate HTML attributes not deduplicated during tokenization, causing parser misalignment exploitable for XSS.

Advisory: https://pkg.go.dev/vuln/GO-2026-5030

Fix: https://go.dev/cl/781685

Related PR

Same fix applied to main in #714.

Changes

golang.org/x/net v0.49.0 → v0.55.0

Cascading bumps: golang.org/x/crypto (v0.51.0), x/sys, x/text, x/term, x/mod, x/sync, x/tools

No application code changes

Verification

go build ./... — passes

govulncheck ./... — GO-2026-5029 and GO-2026-5030 no longer reported

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

rissh · 2026-07-15T06:22:06Z

@coderabbitai review

coderabbitai · 2026-07-15T06:22:12Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

rissh · 2026-07-15T09:48:04Z

/retest

rissh · 2026-07-15T14:02:23Z

/retest

rissh · 2026-07-15T19:01:14Z

/retest

openshift-ci · 2026-07-15T22:19:24Z

@rissh: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

rissh · 2026-07-16T18:37:03Z

/jira refresh

openshift-ci-robot · 2026-07-16T18:37:10Z

@rissh: This pull request references Jira Issue OCPBUGS-98624, which is invalid:

expected dependent Jira Issue OCPBUGS-98623 to be in one of the following states: MODIFIED, ON_QA, VERIFIED, but it is Closed (Done) instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

This pull request references Jira Issue OCPBUGS-96676, which is invalid:

expected dependent Jira Issue OCPBUGS-96887 to be in one of the following states: MODIFIED, ON_QA, VERIFIED, but it is Closed (Done) instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

jzding · 2026-07-16T19:42:18Z

/label backport-risk-assessed

jzding

/lgtm

openshift-ci · 2026-07-16T19:43:02Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jzding, rissh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [jzding]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Bump golang.org/x/net to v0.55.0 (CVE-2026-25681, CVE-2026-27136)

f2ff149

openshift-ci-robot added the jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. label Jul 15, 2026

openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Jul 15, 2026

openshift-ci Bot requested review from lack and sebsoto July 15, 2026 06:21

openshift-ci Bot added the backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. label Jul 16, 2026

openshift-ci Bot assigned anuragthehatter, asood-rh, gsr-shanks, jechen0648, mffiedler, obochan-rh, rbbratta, weliang1 and yliu127 Jul 16, 2026

jzding approved these changes Jul 16, 2026

View reviewed changes

openshift-ci Bot assigned jzding Jul 16, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 16, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 16, 2026

Uh oh!

Conversation

rissh commented Jul 15, 2026

Summary

CVE-2026-25681 (GO-2026-5029)

CVE-2026-27136 (GO-2026-5030)

Related PR

Changes

Verification

Uh oh!

coderabbitai Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

openshift-ci-robot commented Jul 15, 2026

Summary

CVE-2026-25681 (GO-2026-5029)

CVE-2026-27136 (GO-2026-5030)

Related PR

Changes

Verification

Uh oh!

rissh commented Jul 15, 2026

Uh oh!

coderabbitai Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rissh commented Jul 15, 2026

Uh oh!

rissh commented Jul 15, 2026

Uh oh!

rissh commented Jul 15, 2026

Uh oh!

openshift-ci Bot commented Jul 15, 2026

Uh oh!

rissh commented Jul 16, 2026

Uh oh!

openshift-ci-robot commented Jul 16, 2026

Uh oh!

jzding commented Jul 16, 2026

Uh oh!

jzding left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Jul 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants

coderabbitai Bot commented Jul 15, 2026 •

edited

Loading

coderabbitai Bot commented Jul 15, 2026 •

edited

Loading