[openshift-5.0] OCPBUGS-98615: bump golang.org/x/net to v0.55.0

[AkashMore08]

Bump golang.org/x/net from v0.48.0 to v0.55.0 to address CVE-2026-25681 (GO-2026-5029).

CVE-2026-25681 is an XSS vulnerability in golang.org/x/net/html caused by incorrect handling of character references in DOCTYPE nodes. Parsing attacker-controlled HTML via Parse/ParseFragment followed by Render can produce an unexpected HTML tree that enables cross-site scripting.

Impact on multus-cni: multus-cni does not import or use golang.org/x/net/html in any production binary. The vulnerable package is vendored but is dead code unreachable from any entry point. However, we are proactively bumping golang.org/x/net to v0.55.0 on the main branch as a best practice to prevent any potential exposure in the future.

Changes

• golang.org/x/net v0.48.0 → v0.55.0
• Transitive bumps: x/sys v0.39.0→v0.45.0, x/mod v0.30.0→v0.35.0, x/sync v0.19.0→v0.20.0, x/term v0.38.0→v0.43.0, x/text v0.32.0→v0.37.0, x/tools v0.39.0→v0.44.0
• Refreshed vendor/ directory

Summary by CodeRabbit

• Chores
  • Updated foundational networking, system, synchronization, terminal, text, tooling, and module components to newer versions.
  • Included routine maintenance updates with no user-facing feature changes.

[openshift-ci-robot]

@AkashMore08: This pull request references Jira Issue OCPBUGS-98615, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Bump golang.org/x/net from v0.48.0 to v0.55.0 to address CVE-2026-25681 (GO-2026-5029).

CVE-2026-25681 is an XSS vulnerability in golang.org/x/net/html caused by incorrect handling of character references in DOCTYPE nodes. Parsing attacker-controlled HTML via Parse/ParseFragment followed by Render can produce an unexpected HTML tree that enables cross-site scripting.

Impact on multus-cni: multus-cni does not import or use golang.org/x/net/html in any production binary. The vulnerable package is vendored but is dead code unreachable from any entry point. However, we are proactively bumping golang.org/x/net to v0.55.0 to v0.59.1 on the main branch as a best practice to prevent any potential exposure in the future.

Changes

• golang.org/x/net v0.48.0 → v0.55.0
• Transitive bumps: x/sys v0.39.0→v0.45.0, x/mod v0.30.0→v0.35.0, x/sync v0.19.0→v0.20.0, x/term v0.38.0→v0.43.0, x/text v0.32.0→v0.37.0, x/tools v0.39.0→v0.44.0
• Refreshed vendor/ directory

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Walkthrough

Updates direct and indirect golang.org/x/* dependency versions in go.mod, with golang.org/x/oauth2 and golang.org/x/time unchanged.

Changes

Go dependency updates

Layer / File(s)	Summary
Align golang.org/x dependency versions go.mod	Updates direct golang.org/x/net and golang.org/x/sys requirements, along with indirect golang.org/x/mod, golang.org/x/sync, golang.org/x/term, golang.org/x/text, and golang.org/x/tools versions.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only bumps vendored deps; no *_test.go files or Ginkgo title changes are present in the diff.
Test Structure And Quality	✅ Passed	No Ginkgo test files were changed; this PR only updates go.mod/go.sum and vendored deps, so the test-quality check is not applicable.
Microshift Test Compatibility	✅ Passed	This PR only updates go.mod/go.sum and vendored deps; no new Ginkgo e2e tests were added, so MicroShift compatibility isn’t impacted.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR only bumps go.mod/vendor dependencies; no *_test.go files or new Ginkgo e2e tests were added, so no SNO-specific assumptions to review.
Topology-Aware Scheduling Compatibility	✅ Passed	Only go.mod/go.sum and vendored dependency files changed; no manifests, controllers, or scheduling logic were modified.
Ote Binary Stdout Contract	✅ Passed	Touched files are vendor/dependency updates only; no stdout writes were found in any process-level init/main setup.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only go.mod/go.sum changed outside vendor; no new Ginkgo e2e tests or IP/connectivity-sensitive code was added.
No-Weak-Crypto	✅ Passed	Vendor-only bump; scans found no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB code or custom crypto. Remaining bytes.Equal/DeepEqual uses are non-secret checks.
Container-Privileges	✅ Passed	The PR only updates go.mod/go.sum and vendored Go code; no container or Kubernetes manifests were changed.
No-Sensitive-Data-In-Logs	✅ Passed	Diff is only dependency/vendor refresh; no new logging of passwords, tokens, PII, or hostnames was introduced.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: bumping golang.org/x/net to v0.55.0.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: AkashMore08
Once this PR has been reviewed and has the lgtm label, please assign bpickard22 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@AkashMore08: This pull request references Jira Issue OCPBUGS-98615, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

Bump golang.org/x/net from v0.48.0 to v0.55.0 to address CVE-2026-25681 (GO-2026-5029).

CVE-2026-25681 is an XSS vulnerability in golang.org/x/net/html caused by incorrect handling of character references in DOCTYPE nodes. Parsing attacker-controlled HTML via Parse/ParseFragment followed by Render can produce an unexpected HTML tree that enables cross-site scripting.

Impact on multus-cni: multus-cni does not import or use golang.org/x/net/html in any production binary. The vulnerable package is vendored but is dead code unreachable from any entry point. However, we are proactively bumping golang.org/x/net to v0.55.0 to v0.59.1 on the main branch as a best practice to prevent any potential exposure in the future.

Changes

• golang.org/x/net v0.48.0 → v0.55.0
• Transitive bumps: x/sys v0.39.0→v0.45.0, x/mod v0.30.0→v0.35.0, x/sync v0.19.0→v0.20.0, x/term v0.38.0→v0.43.0, x/text v0.32.0→v0.37.0, x/tools v0.39.0→v0.44.0
• Refreshed vendor/ directory

Summary by CodeRabbit

• Chores
• Updated foundational networking, system, synchronization, terminal, text, tooling, and module components to newer versions.
• Included routine maintenance updates with no user-facing feature changes.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[AkashMore08]

/retest

[AkashMore08]

/test e2e-aws

[openshift-ci]

@AkashMore08: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/security	2b96544	link	false	/test security

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[ocp-sustaining-admins]

/retest-required