NO-JIRA: chore: bump golang/x/crypto

[Cali0707]

We recently had a security scanner flag a vulnerability with x/crypto 0.51.0. Through scanning the code, the vulnerable path is not present in this repo.

However for future proofing in case someone later adds the vulnerable code into this repo, we should still bump the dep (hence this PR).

Summary by CodeRabbit

• Chores
  • Updated underlying components to newer versions.
  • Includes improvements and fixes from the latest supporting libraries.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@Cali0707: This pull request explicitly references no jira issue.

Details

In response to this:

We recently had a security scanner flag a vulnerability with x/crypto 0.51.0. Through scanning the code, the vulnerable path is not present in this repo.

However for future proofing in case someone later adds the vulnerable code into this repo, we should still bump the dep (hence this PR).

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[Cali0707]

/cc @cajieh

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Cali0707
Once this PR has been reviewed and has the lgtm label, please assign rhamilto for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a49bc186-17c3-4e52-adb5-08922c06ff3e

📥 Commits

Reviewing files that changed from the base of the PR and between cf6fc4c and 3070c99.

⛔ Files ignored due to path filters (44)

• go.sum is excluded by !**/*.sum
• vendor/golang.org/x/crypto/blake2b/go125.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/ssh/agent/client.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/ssh/agent/keyring.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/ssh/agent/server.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/ssh/certs.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/ssh/channel.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/ssh/cipher.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/ssh/client.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/ssh/client_auth.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/ssh/connection.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/ssh/control.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/ssh/kex.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/ssh/keys.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/ssh/knownhosts/knownhosts.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/ssh/mux.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/ssh/server.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/ssh/session.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/server.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/server_common.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/server_wrap.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/transport.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/transport_common.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/writesched_common.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/writesched_priority_rfc7540.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sync/errgroup/errgroup.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sync/semaphore/semaphore.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/ztypes_linux.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/ztypes_linux_386.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/ztypes_linux_arm.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/ztypes_linux_loong64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/ztypes_linux_mips.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go is excluded by !**/vendor/**, !vendor/**
• vendor/modules.txt is excluded by !**/vendor/**, !vendor/**

📒 Files selected for processing (1)

• go.mod

---

Walkthrough

Updated golang.org/x/net and five indirect golang.org/x dependencies to newer versions in go.mod.

Changes

Go module dependency updates

Layer / File(s)	Summary
golang.org/x dependency version bumps go.mod	The direct golang.org/x/net requirement and indirect golang.org/x/crypto, sync, sys, term, and text requirements were upgraded.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related issues

• openshift/image-based-install-operator#443 — Concerns upgrading golang.org/x/crypto for newer versions and security fixes.
• openshift/machine-api-provider-azure#178 — Concerns upgrading golang.org/x/crypto to v0.53.0.
• openshift/cluster-baremetal-operator#536 — Concerns upgrading golang.org/x/crypto alongside other golang.org/x dependencies.
• openshift/cluster-api-provider-ibmcloud#141 — Concerns upgrading golang.org/x/crypto.
• openshift/oc-mirror#1330 — Concerns upgrading golang.org/x/crypto.
• openshift/machine-config-operator#5506 — Concerns upgrading golang.org/x/crypto to v0.53.0.
• openshift/installer#10170 — Concerns upgrading golang.org/x/crypto and other dependencies.

Suggested reviewers: jhadvig, ingvagabund

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description is too brief and misses the required template sections, including root cause, solution, testing, browser conformance, and reviewers.	Fill out the full template with analysis/root cause, solution details, test setup/cases, browser conformance, additional info, and reviewers/assignees.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is specific and reflects the dependency bump, though it names only x/crypto while the PR also updates related x/* modules.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only bumps deps/vendor files; no _test files or Ginkgo titles were added or edited.
Test Structure And Quality	✅ Passed	No Ginkgo test files or test logic changed; this PR only bumps vendored Go dependencies and go.mod/go.sum.
Microshift Test Compatibility	✅ Passed	Only dependency/vendor files changed; no new Ginkgo e2e tests were added, so MicroShift compatibility is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo/e2e tests were added; the PR only bumps Go module/vendor dependencies.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR only bumps Go module/vendor dependencies (go.mod, go.sum, vendor/*); no deployment manifests, operators, or controllers were changed, so no new topology assumptions.
Ote Binary Stdout Contract	✅ Passed	Only dependency/vendor bumps changed; no modified main/init/TestMain/suite setup files or stdout writes in process-level code were introduced.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo tests were added; the PR only bumps deps and vendor files, so this check is not applicable.
No-Weak-Crypto	✅ Passed	The diff only bumps deps and adjusts SSH internals; it adds no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB usage or insecure secret comparisons.
Container-Privileges	✅ Passed	PR only updates Go deps/vendor files; no container/K8s manifests or privilege settings appear in the patch.
No-Sensitive-Data-In-Logs	✅ Passed	The PR only bumps dependencies and vendored files; I found no new logging statements or log calls exposing sensitive data.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

@Cali0707: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/backend	3070c99	link	true	/test backend

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.