[NO-JIRA] fix(cve): bump golang.org/x/image from v0.39.0 to v0.45.0

[Clee2691]

Description

Update golang.org/x/image from v0.39.0 to v0.45.0

Fixes CVE:

CVE-2026-46604 openshift-logging/cluster-logging-rhel9-operator: golang.org/x/image/tiff: Denial of Service via invalid TIFF image

/cc @vparfonov
/assign @jcantrill

NO-JIRA

Summary by CodeRabbit

• Chores
  • Updated several networking, synchronization, system, terminal, text, and tooling components to newer versions.
  • These maintenance updates improve compatibility, reliability, and ongoing support without changing user-facing functionality.

[qodo-for-rh-openshift]

PR Summary by Qodo

Fix CVE by bumping golang.org/x/image to v0.43.0

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Bump golang.org/x/image indirect dependency to v0.43.0 to address CVE.
• Update Go module metadata (go.mod/go.sum) to reflect new version and checksums.

Diagram

graph TD
A["App build"] --> B["Go modules"] --> C["golang.org/x/image v0.43.0"]

Loading

High-Level Assessment

The direct version bump is the most appropriate remediation for a CVE on an indirect dependency. Considered alternatives (temporary replace directives or pinning via transitive constraints) add complexity without improving security posture versus upgrading to a fixed release.

Files changed (2) +3 / -3

Other (2) +3 / -3

go.modBump golang.org/x/image to v0.43.0 (indirect) +1/-1

Bump golang.org/x/image to v0.43.0 (indirect)

• Updates the indirect requirement on golang.org/x/image from v0.39.0 to v0.43.0 to pick up security fixes. No other module requirements are changed.

go.mod

go.sumRefresh go.sum checksums for golang.org/x/image v0.43.0 +2/-2

Refresh go.sum checksums for golang.org/x/image v0.43.0

• Replaces the v0.39.0 checksum entries with v0.43.0 checksums to match the updated module version.

go.sum

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 4f22ed82-4054-45aa-a391-131c5924285d

📥 Commits

Reviewing files that changed from the base of the PR and between 9dbe937 and 6898328.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• go.mod

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request updates direct and indirect golang.org/x dependencies in go.mod. No exported or public declarations changed.

Changes

Go dependency updates

Layer / File(s)	Summary
Refresh Go module versions go.mod	Direct versions of golang.org/x/net, golang.org/x/sync, and golang.org/x/sys are updated. Indirect versions of golang.org/x/image, golang.org/x/mod, golang.org/x/term, golang.org/x/text, and golang.org/x/tools are also updated.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: 🔵 Low · up to 68983

This PR only updates the image dependency, but the selected v0.45.0 version should be explicitly confirmed against the repository's Go 1.25.0 target; it is otherwise mergeable with owner awareness.

Suggested reviewers: vparfonov, jcantrill, xperimental

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the CVE-related update to golang.org/x/image and matches the primary change described in the pull request.
Description check	✅ Passed	The description explains the dependency update and CVE, and it includes the required reviewer and approver assignments.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-for-rh-openshift]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can tweak Display preferences with a live preview to see your comment before it ships

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[jcantrill]

/approve

[jcantrill]

/hold

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Clee2691, jcantrill

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [jcantrill]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@Clee2691: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[Clee2691]

closing in favor of: #3427

[openshift-ci]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.