chore(deps): Update golang module CVE fixes (main)

[simonbaird]

Bump golang module dependencies to address several CVEs (no rhtas trackers for main, but carrying the fixes forward to keep main in sync with the release branches).

Modules updated to latest:

• golang.org/x/crypto v0.55.0 → v0.57.0 (also carried golang.org/x/text v0.41.0 → v0.42.0)
• github.com/moby/buildkit v0.29.0 → v0.33.0

CVEs addressed:

• CVE-2026-56854 — golang.org/x/crypto/ssh: source-address restriction bypass (fixed in x/crypto v0.53.0)
• CVE-2026-56852 — golang.org/x/text: DoS via invalid UTF-8 (fixed in x/text v0.39.0)
• CVE-2026-75593 — buildkit: file escape / unauthorized file modification (fixed in v0.31.2)
• CVE-2026-15792 — buildkit: DoS via malicious client request (fixed in v0.31.2)

Note: oras-go CVE-2026-50162 is already fixed on this branch (v2.6.2 ≥ fixed-in v2.6.1).

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: b854b1aa-0b3f-453b-8f7f-6b66659f5809

📥 Commits

Reviewing files that changed from the base of the PR and between 7f067af and 8418af5.

⛔ Files ignored due to path filters (4)

• acceptance/go.sum is excluded by !**/*.sum
• go.sum is excluded by !**/*.sum
• tools/go.sum is excluded by !**/*.sum
• tools/kubectl/go.sum is excluded by !**/*.sum

📒 Files selected for processing (4)

• acceptance/go.mod
• go.mod
• tools/go.mod
• tools/kubectl/go.mod

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request refreshes dependency versions in the main, acceptance, tooling, and kubectl Go modules. It also removes an indirect protobuf dependency and adds indirect Testify support.

Changes

Go module dependency refresh

Layer / File(s)	Summary
Main module dependency updates go.mod	Updates Kubernetes, AWS, container, Sigstore, OpenTelemetry, Prometheus, and supporting dependency versions.
Acceptance module dependency updates acceptance/go.mod	Updates direct and indirect dependencies across Sigstore, AWS, Docker, OpenAPI, TUF, OpenTelemetry, and golang.org/x modules.
Tooling module dependency updates tools/go.mod, tools/kubectl/go.mod	Updates tooling dependencies, removes indirect github.com/gogo/protobuf, and adds indirect github.com/stretchr/testify to the kubectl module.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 8418a

The dependency-only security refresh has no demonstrated merge-blocking regression.

Suggested reviewers: robnester-rh, joejstuart

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies Go dependency updates for CVE fixes, which matches the primary change.
Description check	✅ Passed	The description explains the dependency updates, security rationale, affected CVEs, and tracker status. It provides the information required by the template despite not using its exact headings.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-for-conforma]

PR Summary by Qodo

Update Go dependencies to address crypto and BuildKit CVEs

🐞 Bug fix ⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Upgrade x/crypto and x/text to remediate SSH bypass and invalid UTF-8 denial-of-service
 vulnerabilities.
• Upgrade BuildKit to prevent file escapes, unauthorized modifications, and malicious-request denial
 of service.
• Refresh dependency graphs and checksums across application, acceptance, and tooling modules.

Diagram

graph TD
  A["Crypto modules"] --> C["Go resolver"] --> D["Root module"] --> H["Checksum files"]
  B["BuildKit"] --> C
  C --> E["Acceptance module"] --> H
  C --> F["Tools module"] --> H
  C --> G["Kubectl module"] --> H

Loading

High-Level Assessment

The current approach is appropriate: upgrade the vulnerable modules through the repository's Go module helper and regenerate every independent module graph. Pinning only fixed minimum versions or adding replace directives would reduce immediate transitive churn but create ongoing maintenance and synchronization risk.

Files changed (8) +705 / -734

Other (8) +705 / -734

go.modRefresh acceptance dependency graph for crypto fixes +49/-47

Refresh acceptance dependency graph for crypto fixes

• Updates x/crypto to v0.57.0 and x/text to v0.42.0 in the acceptance module. Re-resolves related Sigstore, OpenTelemetry, AWS, testing, and other transitive dependencies.

acceptance/go.mod

go.sumRegenerate acceptance module checksums +126/-125

Regenerate acceptance module checksums

• Synchronizes acceptance-module checksums with the upgraded crypto libraries and resolved transitive dependency versions.

acceptance/go.sum

go.modUpgrade vulnerable crypto and BuildKit dependencies +78/-79

Upgrade vulnerable crypto and BuildKit dependencies

• Moves x/crypto to v0.57.0, x/text to v0.42.0, and BuildKit to v0.33.0. Refreshes the root module's associated Kubernetes, container, telemetry, Sigstore, cloud, and utility dependencies.

go.mod

go.sumRegenerate root module checksums +172/-183

Regenerate root module checksums

• Updates root-module integrity hashes for the security-fixed crypto and BuildKit versions. Adds, removes, and refreshes checksums for their resolved transitive dependency graph.

go.sum

go.modAlign tooling dependencies with security upgrades +72/-73

Align tooling dependencies with security upgrades

• Updates tooling to BuildKit v0.33.0, x/crypto v0.57.0, and x/text v0.42.0. Re-resolves cloud, container, telemetry, Sigstore, and Go tooling dependencies.

tools/go.mod

go.sumRegenerate tooling module checksums +152/-163

Regenerate tooling module checksums

• Synchronizes tooling checksums with the upgraded security dependencies and resulting transitive graph.

tools/go.sum

go.modRefresh kubectl transitive dependencies +16/-15

Refresh kubectl transitive dependencies

• Carries x/text v0.42.0 and related Go, OpenTelemetry, Prometheus, compression, testing, and OpenAPI dependency updates into the isolated kubectl module.

tools/kubectl/go.mod

go.sumRegenerate kubectl module checksums +40/-49

Regenerate kubectl module checksums

• Refreshes kubectl tooling checksums and removes stale entries after transitive dependency resolution.

tools/kubectl/go.sum

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:17 PM UTC · Completed 9:24 PM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $4.53

[qodo-for-conforma]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can commit Qodo's fix in one click with committable suggestions (GitHub & GitLab)

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[fullsend-ai-review]

Review

Findings

Info

• [description-scope-discrepancy] N/A — The PR body's "Modules updated to latest" section lists only golang.org/x/crypto, golang.org/x/text, and github.com/moby/buildkit, but the diff also bumps several other direct-require modules alongside the CVE fixes: github.com/go-logr/logr v1.4.3→v1.4.4, github.com/sirupsen/logrus v1.9.4→v1.10.1, github.com/stretchr/testify v1.11.1→v1.12.1, github.com/sigstore/sigstore-go (v1.1.4→v1.2.2 in main go.mod), golang.org/x/sync v0.22.0→v0.23.0, golang.org/x/exp (weekly bump), and k8s.io/api,k8s.io/apimachinery,k8s.io/client-go v0.36.0→v0.36.3. These direct-require bumps are generally not side-effects of go mod tidy after bumping x/crypto or buildkit, so noting them in the PR body would help reviewers understand whether they were intentional "freshness" updates or unintended.

Verified

• CVE claims: each stated fixed-in version is satisfied by the new version (x/crypto v0.57.0 ≥ v0.53.0; x/text v0.42.0 ≥ v0.39.0; buildkit v0.33.0 ≥ v0.31.2; oras-go remains at v2.6.2 ≥ v2.6.1).
• Cross-file version consistency: all shared transitive dependencies (x/crypto, x/text, x/sync, x/sys, x/term, x/mod, x/exp, x/tools, otel core, protobuf, yaml/v3, docker/cli, klauspost/compress, prometheus/client_golang, sigstore/*, aws-sdk-go-v2, and others) resolve to the same version across go.mod, acceptance/go.mod, tools/go.mod, and tools/kubectl/go.mod.
• k8s.io/api,apimachinery,client-go skew (v0.36.3 in main go.mod, v0.36.0 in acceptance/go.mod and tools/kubectl/go.mod) is patch-only across separate module graphs — not a functional break.
• github.com/gogo/protobuf cleanly removed from go.mod; no orphan risk.
• No direct-require jumped a major version; larger minor jumps (e.g., buildkit v0.29→v0.33, rekor-tiles/v2 v2.0.1→v2.3.0) are all indirect, so the repo's Go source doesn't compile against those types directly.
• No production Go source files changed; no protected paths modified.

Note: go.sum hash integrity cannot be statically verified from the diff alone — CI's go mod verify / go build ./... is the authoritative check.

---

Labels: PR is a Go module dependency update addressing CVE fixes.

[robnester-rh]

LGTM

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.46% <ø> (ø)
generative	12.27% <ø> (ø)
integration	23.59% <ø> (ø)
unit	72.21% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 1:40 PM UTC · Completed 1:45 PM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $1.87

[fullsend-ai-retro]

Retro on PR #3551 — a Go module CVE bump touching only go.mod/go.sum across four module graphs. The review workflow (run 34405955897, agents fullsend-ai/agents@v0.41.0, ~8m54s, ~$4.53, 63 tool calls, 6 dimension sub-agents) approved with a single Info-level description-scope-discrepancy finding noting that the PR body listed 3 module bumps while the diff carried ~9 additional direct-require bumps. Human reviewers (robnester-rh "LGTM", joejstuart approve) confirmed and the PR merged. CodeRabbit and Qodo both reported zero actionable findings.

Verification depth was strong. The review agent independently validated each CVE fixed-in version (x/crypto ≥v0.53.0, x/text ≥v0.39.0, buildkit ≥v0.31.2, oras-go ≥v2.6.1), cross-file version consistency across all four go.mod files, confirmed the k8s.io skew was patch-only, and noted that gogo/protobuf was cleanly removed with no major-version jumps in direct requires. No human comment matched that depth — a positive autonomy signal that lines up with existing tracker fullsend-ai/fullsend#7184.

No new proposals filed. The one plausibly-actionable observation — that a lone Info finding on an already-approved dep-bump PR generates little reader value — overlaps with the existing severity-calibration cluster already in flight: agents#1216 (downgrade cosmetic findings), agents#1208 (raise re-review thresholds), and agents#1201 (classify findings by mutation scope). A minor sub-agent output-format retry (intent-coherence and style-conventions retried on haiku after opus/sonnet, ~60s ScheduleWakeup) is a single-instance anomaly, not a pattern I can substantiate from one run.