fix(cve): Go dependency security updates for release-v0.49.x (CVE-2026-56852, CVE-2026-39822, GHSA-hrxh-6v49-42gf)

[theakshaypant]

Summary

This PR fixes 3 fixable Important-severity CVEs in release-v0.49.x identified by a ROSA-GovCloud FedRAMP compliance scan affecting the following container images:

• pipelines-pipelines-as-code-controller-rhel9
• pipelines-pipelines-as-code-watcher-rhel9
• pipelines-pipelines-as-code-webhook-rhel9

FedRAMP SLA deadline: 2026-08-26

CVE Details

CVE ID	Alt ID	Package	Before	After	CVSS	Status
CVE-2026-56852	GO-2026-5970	golang.org/x/text	v0.38.0	v0.39.0	7.5 IMPORTANT	Fixed ✅
CVE-2026-39822	GO-2026-4970	Go stdlib	go 1.26.4	go 1.26.5	IMPORTANT	Fixed ✅
GHSA-hrxh-6v49-42gf	-	google.golang.org/grpc	v1.81.1	v1.82.1	IMPORTANT	Fixed ✅

Note: golang.org/x/net was already at the fixed version (v0.56.0 ≥ required v0.56.0).

Fix Method

• golang.org/x/text: Upgraded to v0.39.0 (minimum safe patch in same minor line)
• Go stdlib (CVE-2026-39822): Updated go directive in go.mod from 1.26.4 → 1.26.5
• google.golang.org/grpc: Upgraded to v1.82.1 (minimum safe patch in same minor line)
• Ran go mod tidy, go mod verify, and go mod vendor

Context

These CVEs also appear in main which already has newer versions (x/text v0.40.0, grpc v1.83.0, go 1.26.5). This PR backports the minimum required fix to the release-v0.49.x maintenance branch.

Test Results

Status: ✅ All tests passed

Test command: go test ./pkg/...
Exit code: 0
Result: PASSED — all packages in ./pkg/ suite passed

Full provider tests (GitHub, GitLab, Bitbucket, Gitea), reconciler, resolver, webhook, and all other packages passed without issues.

Breaking Changes

None — all upgrades are minimum safe patch versions within the same minor line. No breaking API changes in any of the updated packages.

Verification Steps

• Confirm CVE scan clears after merge and image rebuild
• Check that controller/watcher/webhook deployments start successfully
• Verify no regression in CI pipeline runs

Risk Assessment

Risk: LOW

• Minimum safe patch versions used (no major version bumps)
• main branch already runs with equal or newer versions
• All unit tests passed locally

Jira Issues

Resolves: SRVKP-13182, SRVKP-13183, SRVKP-13192

---

🤖 Generated by CVE Fixer Workflow

[linux-foundation-easycla]

• ❌ The email address for the commit (d04fcbc) is not linked to the GitHub account, preventing the EasyCLA check. Consult this Help Article and GitHub Help to resolve. (To view the commit's email address, add .patch at the end of this PR page's URL.) For further assistance with EasyCLA, please visit our EasyCLA portal and chat with our support bot.

[theakshaypant]

Not needed

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (release-v0.49.x@25d6710). Learn more about missing BASE report.

Additional details and impacted files

@@                Coverage Diff                 @@
##             release-v0.49.x    #2906   +/-   ##
==================================================
  Coverage                   ?   61.54%           
==================================================
  Files                      ?      213           
  Lines                      ?    17510           
  Branches                   ?        0           
==================================================
  Hits                       ?    10776           
  Misses                     ?     5913           
  Partials                   ?      821           

Flag	Coverage Δ
unit-tests	61.54% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.