OCPBUGS-96835: Bump golang.org/x/net to v0.55.0

[jkaurredhat]

Summary

This PR addresses CVE-2026-27136 by updating golang.org/x/net from v0.49.0 to v0.55.0, which includes a fix for an XSS vulnerability in the HTML parser.

CVE Details

CVE-2026-27136: Cross-Site Scripting via HTML parsing bypass in golang.org/x/net/html

• Severity: Medium
• Affected: golang.org/x/net < v0.55.0
• Impact: XSS vulnerability when parsing HTML with duplicate attributes
• Vulnerable functions: html.Parse(), html.ParseFragment()

[openshift-ci-robot]

@jkaurredhat: This pull request references Jira Issue OCPBUGS-96835, which is invalid:

• expected Jira Issue OCPBUGS-96835 to depend on a bug targeting a version in 5.1.0 and in one of the following states: MODIFIED, ON_QA, VERIFIED, but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

This PR addresses CVE-2026-27136 by updating golang.org/x/net from v0.49.0 to v0.55.0, which includes a fix for an XSS vulnerability in the HTML parser.

CVE Details

CVE-2026-27136: Cross-Site Scripting via HTML parsing bypass in golang.org/x/net/html

• Severity: Medium
• Affected: golang.org/x/net < v0.55.0
• Impact: XSS vulnerability when parsing HTML with duplicate attributes
• Vulnerable functions: html.Parse(), html.ParseFragment()

Risk Assessment

LOW RISK ⚠️

Analysis confirmed:

• ✅ The installer does NOT import golang.org/x/net/html
• ✅ Vulnerable functions are NOT called by application code
• ⚠️ Dependency present as transitive dependency only
• ✅ No code uses HTML parsing functionality

This update is applied for compliance with security scanning requirements.

Changes

• Updated golang.org/x/net from v0.49.0 to v0.55.0
• Updated related golang.org/x/* dependencies (crypto, mod, sync, sys, term, text, tools)
• Ran go mod tidy and go mod vendor
• Updated vendor directory (175 files changed)

Go Version Compatibility

• ✅ Project Go version: 1.25.8
• ✅ Fix requires: Go 1.25.0
• ✅ Compatible - direct update (Path A)
• ✅ No Go version upgrade needed

Test Plan

• Unit tests pass
• Integration tests pass
• Verify no regression in installer functionality
• QE verification

Related

• Jira: OCPBUGS-96835
• CVE: CVE-2026-27136
• Go issue: golang/go#79575

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR updates go.mod to bump several golang.org/x dependency versions, including crypto, sync, sys, term, text, mod, net, and tools, while oauth2 and time remain unchanged.

Changes

Dependency version updates

Layer / File(s)	Summary
golang.org/x dependency bumps go.mod	Upgrades x/crypto, x/sync, x/sys, x/term, x/text (direct), and x/mod, x/net, x/tools (indirect) to newer versions; x/oauth2 and x/time remain unchanged.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Related issues: None specified.

Related PRs: None specified.

Suggested labels: dependencies, go

Suggested reviewers: None specified.

Poem

A rabbit hops through go.mod's field,
Bumping versions, a modest yield.
Crypto, sync, and text all rise,
Net and tools grow in size.
No exports changed, just numbers anew —
Hop along, the build stays true. 🐇

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	No *_test.go files or Ginkgo title changes appear in the PR diff; this is a dependency/vendor update only.
Test Structure And Quality	✅ Passed	PR changes only go.mod, go.sum, and vendor files; no Ginkgo test code was modified, so the check is not applicable.
Microshift Test Compatibility	✅ Passed	No new Ginkgo tests were added; the PR only updates go.mod/go.sum and vendored x/* code, with no MicroShift-sensitive test APIs present.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The diff only updates go.mod/go.sum and vendored x/* code; no _test.go or Ginkgo e2e tests were added, so there are no new SNO assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: Diff only updates go.mod/go.sum and vendored Go deps; no deployment manifests, controllers, or scheduling constraints were changed.
Ote Binary Stdout Contract	✅ Passed	No added stdout writes in main/init paths; touched files only add stderr logging/debug calls or non-process-level functions.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Commit only updates go.mod/go.sum and vendored deps; no *_test.go or Ginkgo e2e tests were added, so IPv4/external-connectivity checks are not applicable.
No-Weak-Crypto	✅ Passed	Diff only updates vendored deps; no new weak-crypto algorithms, custom crypto, or non-constant-time secret comparisons were introduced.
Container-Privileges	✅ Passed	PR only changes go.mod/go.sum and vendored Go deps; no container/K8s manifests or privilege-related fields were modified.
No-Sensitive-Data-In-Logs	✅ Passed	Diff is vendor/go.mod only; no app log changes or added messages exposing passwords, tokens, PII, or customer data.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main security-related change: bumping golang.org/x/net to v0.55.0.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign zaneb for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@jkaurredhat: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ovn	a4918e4	link	true	/test e2e-aws-ovn

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.