OCPBUGS-96835: Bump golang.org/x/net to v0.55.0

[jkaurredhat]

Summary

This PR addresses CVE-2026-27136 by updating golang.org/x/net from v0.49.0 to v0.55.0, which includes a fix for an XSS vulnerability in the HTML parser.

CVE Details

CVE-2026-27136: Cross-Site Scripting via HTML parsing bypass in golang.org/x/net/html

• Severity: Medium
• Affected: golang.org/x/net < v0.55.0
• Impact: XSS vulnerability when parsing HTML with duplicate attributes
• Vulnerable functions: html.Parse(), html.ParseFragment()

Summary by CodeRabbit

• Chores
  • Updated an indirect Go dependency to a newer version.
  • Improves compatibility, reliability, and security via refreshed underlying components.

[openshift-ci-robot]

@jkaurredhat: This pull request references Jira Issue OCPBUGS-96835, which is invalid:

• expected Jira Issue OCPBUGS-96835 to depend on a bug targeting a version in 5.1.0 and in one of the following states: MODIFIED, ON_QA, VERIFIED, but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

This PR addresses CVE-2026-27136 by updating golang.org/x/net from v0.49.0 to v0.55.0, which includes a fix for an XSS vulnerability in the HTML parser.

CVE Details

CVE-2026-27136: Cross-Site Scripting via HTML parsing bypass in golang.org/x/net/html

• Severity: Medium
• Affected: golang.org/x/net < v0.55.0
• Impact: XSS vulnerability when parsing HTML with duplicate attributes
• Vulnerable functions: html.Parse(), html.ParseFragment()

Risk Assessment

LOW RISK ⚠️

Analysis confirmed:

• ✅ The installer does NOT import golang.org/x/net/html
• ✅ Vulnerable functions are NOT called by application code
• ⚠️ Dependency present as transitive dependency only
• ✅ No code uses HTML parsing functionality

This update is applied for compliance with security scanning requirements.

Changes

• Updated golang.org/x/net from v0.49.0 to v0.55.0
• Updated related golang.org/x/* dependencies (crypto, mod, sync, sys, term, text, tools)
• Ran go mod tidy and go mod vendor
• Updated vendor directory (175 files changed)

Go Version Compatibility

• ✅ Project Go version: 1.25.8
• ✅ Fix requires: Go 1.25.0
• ✅ Compatible - direct update (Path A)
• ✅ No Go version upgrade needed

Test Plan

• Unit tests pass
• Integration tests pass
• Verify no regression in installer functionality
• QE verification

Related

• Jira: OCPBUGS-96835
• CVE: CVE-2026-27136
• Go issue: golang/go#79575

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 8d57576a-e57b-490a-9324-b1ecdab5525e

📥 Commits

Reviewing files that changed from the base of the PR and between 97c7bed and 66ecdb5.

⛔ Files ignored due to path filters (12)

• go.sum is excluded by !**/*.sum
• vendor/golang.org/x/net/html/parse.go is excluded by !vendor/**, !**/vendor/**
• vendor/golang.org/x/net/html/render.go is excluded by !vendor/**, !**/vendor/**
• vendor/golang.org/x/net/html/token.go is excluded by !vendor/**, !**/vendor/**
• vendor/golang.org/x/net/http2/server.go is excluded by !vendor/**, !**/vendor/**
• vendor/golang.org/x/net/http2/server_common.go is excluded by !vendor/**, !**/vendor/**
• vendor/golang.org/x/net/http2/server_wrap.go is excluded by !vendor/**, !**/vendor/**
• vendor/golang.org/x/net/http2/transport.go is excluded by !vendor/**, !**/vendor/**
• vendor/golang.org/x/net/http2/transport_common.go is excluded by !vendor/**, !**/vendor/**
• vendor/golang.org/x/net/http2/writesched_common.go is excluded by !vendor/**, !**/vendor/**
• vendor/golang.org/x/net/http2/writesched_priority_rfc7540.go is excluded by !vendor/**, !**/vendor/**
• vendor/modules.txt is excluded by !vendor/**, !**/vendor/**

📒 Files selected for processing (1)

• go.mod

---

📝 Walkthrough

Walkthrough

This PR upgrades the indirect golang.org/x/net dependency in go.mod from v0.54.0 to v0.55.0. No exported entities or other dependency versions are changed.

Changes

Go module update

Layer / File(s)	Summary
Upgrade indirect x/net dependency go.mod	Changes the indirect golang.org/x/net requirement from v0.54.0 to v0.55.0.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: upgrading golang.org/x/net to v0.55.0.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	No Ginkgo test files or title changes are present in the diff; only dependency/vendor files were updated.
Test Structure And Quality	✅ Passed	This PR only bumps x/net and updates vendor files; no Ginkgo test code was added or modified, so the test-quality check is not applicable.
Microshift Test Compatibility	✅ Passed	No Ginkgo e2e tests were added; the PR only bumps vendored x/net and updates module files.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Only go.mod/go.sum and vendored x/net files changed; no *_test.go or Ginkgo It/Describe/When definitions were added.
Topology-Aware Scheduling Compatibility	✅ Passed	Only go.mod/go.sum and vendored x/net files changed; no deployment manifests, operators, or controllers were modified.
Ote Binary Stdout Contract	✅ Passed	No process-level stdout writes were added; the only fmt.Println is inside a regular test case, and no main/TestMain/init/setup code changed.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo/e2e test files were added; the PR only updates vendored x/net and module metadata.
No-Weak-Crypto	✅ Passed	PR only bumps golang.org/x/net and vendors html/http2 parser changes; no MD5/SHA1/DES/RC4/3DES/Blowfish, ECB, custom crypto, or secret compares found.
Container-Privileges	✅ Passed	The PR only updates dependency versions and non-privilege manifest data; no changed manifest adds privileged:true, hostPID/hostNetwork/hostIPC, SYS_ADMIN, or allowPrivilegeEscalation:true.
No-Sensitive-Data-In-Logs	✅ Passed	Diff only updates vendored x/net code and metadata; no new logging, debug output, or sensitive data exposure found.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

go.mod

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

🔧 golangci-lint (2.12.2)

Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions
The command is terminated due to an error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions

---

_{Comment @coderabbitai help to get the list of available commands.}

[tthvo]

@jkaurredhat Thanks, but could you:

• Set the PR target branch to main. Branch release-5.0 will auto-sync with main.
• Separate the changes into 2 commits to make it easier for us to review:
  • Commit 1: only file go.mod and go.sum
  • Commit 2: go mod vendor and commit the vendor directory.

[openshift-ci-robot]

@jkaurredhat: This pull request references Jira Issue OCPBUGS-96835, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (ocp-sustaining-admins@redhat.com), skipping review request.

Details

In response to this:

Summary

This PR addresses CVE-2026-27136 by updating golang.org/x/net from v0.49.0 to v0.55.0, which includes a fix for an XSS vulnerability in the HTML parser.

CVE Details

CVE-2026-27136: Cross-Site Scripting via HTML parsing bypass in golang.org/x/net/html

• Severity: Medium
• Affected: golang.org/x/net < v0.55.0
• Impact: XSS vulnerability when parsing HTML with duplicate attributes
• Vulnerable functions: html.Parse(), html.ParseFragment()

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@jkaurredhat: This pull request explicitly references no jira issue.

Details

In response to this:

Summary

This PR addresses CVE-2026-27136 by updating golang.org/x/net from v0.49.0 to v0.55.0, which includes a fix for an XSS vulnerability in the HTML parser.

CVE Details

CVE-2026-27136: Cross-Site Scripting via HTML parsing bypass in golang.org/x/net/html

• Severity: Medium
• Affected: golang.org/x/net < v0.55.0
• Impact: XSS vulnerability when parsing HTML with duplicate attributes
• Vulnerable functions: html.Parse(), html.ParseFragment()

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@jkaurredhat: This pull request references Jira Issue OCPBUGS-96835, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (ocp-sustaining-admins@redhat.com), skipping review request.

Details

In response to this:

Summary

This PR addresses CVE-2026-27136 by updating golang.org/x/net from v0.49.0 to v0.55.0, which includes a fix for an XSS vulnerability in the HTML parser.

CVE Details

CVE-2026-27136: Cross-Site Scripting via HTML parsing bypass in golang.org/x/net/html

• Severity: Medium
• Affected: golang.org/x/net < v0.55.0
• Impact: XSS vulnerability when parsing HTML with duplicate attributes
• Vulnerable functions: html.Parse(), html.ParseFragment()

Summary by CodeRabbit

• Chores
• Updated several underlying Go libraries to newer versions.
• Improved compatibility, reliability, and security through refreshed supporting components.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@go.mod`:
- Line 106: Update the golang.org/x/crypto dependency in go.mod from v0.51.0 to
v0.52.0 or later, then refresh go.sum to match the selected version and verify
module consistency.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: d6485ed0-cb9f-4d14-9ba4-0153568e9235

📥 Commits

Reviewing files that changed from the base of the PR and between a4918e4 and 97c7bed.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• go.mod

[tthvo]

@jkaurredhat Could you rebase this PR? Thanks!

[tthvo]

/lgtm
/approve

[openshift-merge-bot]

Scheduling required tests:
/test e2e-azure-nat-gateway-single-zone

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: tthvo

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [tthvo]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[tthvo]

/retest

[tthvo]

/test e2e-gcp-ovn
/test e2e-agent-compact-ipv4-iso-no-registry

[tthvo]

/test e2e-azure-nat-gateway-single-zone

[openshift-ci]

@jkaurredhat: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ovn	66ecdb5	link	true	/test e2e-aws-ovn
ci/prow/e2e-gcp-ovn	66ecdb5	link	true	/test e2e-gcp-ovn
ci/prow/e2e-azure-nat-gateway-single-zone	66ecdb5	link	true	/test e2e-azure-nat-gateway-single-zone

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.