OCPBUGS-96835: Bump golang.org/x/net to v0.55.0 by jkaurredhat · Pull Request #10672 · openshift/installer

jkaurredhat · 2026-07-03T16:19:13Z

Summary

This PR addresses CVE-2026-27136 by updating golang.org/x/net from v0.49.0 to v0.55.0, which includes a fix for an XSS vulnerability in the HTML parser.

CVE Details

CVE-2026-27136: Cross-Site Scripting via HTML parsing bypass in golang.org/x/net/html

Severity: Medium
Affected: golang.org/x/net < v0.55.0
Impact: XSS vulnerability when parsing HTML with duplicate attributes
Vulnerable functions: html.Parse(), html.ParseFragment()

Summary by CodeRabbit

Chores
- Updated an indirect Go dependency to a newer version.
- Improves compatibility, reliability, and security via refreshed underlying components.

openshift-ci-robot · 2026-07-03T16:19:20Z

@jkaurredhat: This pull request references Jira Issue OCPBUGS-96835, which is invalid:

expected Jira Issue OCPBUGS-96835 to depend on a bug targeting a version in 5.1.0 and in one of the following states: MODIFIED, ON_QA, VERIFIED, but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

This PR addresses CVE-2026-27136 by updating golang.org/x/net from v0.49.0 to v0.55.0, which includes a fix for an XSS vulnerability in the HTML parser.

CVE Details

CVE-2026-27136: Cross-Site Scripting via HTML parsing bypass in golang.org/x/net/html

Severity: Medium

Affected: golang.org/x/net < v0.55.0

Impact: XSS vulnerability when parsing HTML with duplicate attributes

Vulnerable functions: html.Parse(), html.ParseFragment()

Risk Assessment

LOW RISK ⚠️

Analysis confirmed:

✅ The installer does NOT import golang.org/x/net/html

✅ Vulnerable functions are NOT called by application code

⚠️ Dependency present as transitive dependency only

✅ No code uses HTML parsing functionality

This update is applied for compliance with security scanning requirements.

Changes

Updated golang.org/x/net from v0.49.0 to v0.55.0

Updated related golang.org/x/* dependencies (crypto, mod, sync, sys, term, text, tools)

Ran go mod tidy and go mod vendor

Updated vendor directory (175 files changed)

Go Version Compatibility

✅ Project Go version: 1.25.8

✅ Fix requires: Go 1.25.0

✅ Compatible - direct update (Path A)

✅ No Go version upgrade needed

Test Plan

Unit tests pass

Integration tests pass

Verify no regression in installer functionality

QE verification

Related

Jira: OCPBUGS-96835

CVE: CVE-2026-27136

Go issue: golang/go#79575

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-07-03T16:19:47Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 8d57576a-e57b-490a-9324-b1ecdab5525e

📥 Commits

Reviewing files that changed from the base of the PR and between 97c7bed and 66ecdb5.

⛔ Files ignored due to path filters (12)

go.sum is excluded by !**/*.sum
vendor/golang.org/x/net/html/parse.go is excluded by !vendor/**, !**/vendor/**
vendor/golang.org/x/net/html/render.go is excluded by !vendor/**, !**/vendor/**
vendor/golang.org/x/net/html/token.go is excluded by !vendor/**, !**/vendor/**
vendor/golang.org/x/net/http2/server.go is excluded by !vendor/**, !**/vendor/**
vendor/golang.org/x/net/http2/server_common.go is excluded by !vendor/**, !**/vendor/**
vendor/golang.org/x/net/http2/server_wrap.go is excluded by !vendor/**, !**/vendor/**
vendor/golang.org/x/net/http2/transport.go is excluded by !vendor/**, !**/vendor/**
vendor/golang.org/x/net/http2/transport_common.go is excluded by !vendor/**, !**/vendor/**
vendor/golang.org/x/net/http2/writesched_common.go is excluded by !vendor/**, !**/vendor/**
vendor/golang.org/x/net/http2/writesched_priority_rfc7540.go is excluded by !vendor/**, !**/vendor/**
vendor/modules.txt is excluded by !vendor/**, !**/vendor/**

📒 Files selected for processing (1)

go.mod

📝 Walkthrough

Walkthrough

This PR upgrades the indirect golang.org/x/net dependency in go.mod from v0.54.0 to v0.55.0. No exported entities or other dependency versions are changed.

Changes

Go module update

Layer / File(s)	Summary
Upgrade indirect x/net dependency `go.mod`	Changes the indirect `golang.org/x/net` requirement from `v0.54.0` to `v0.55.0`.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: upgrading golang.org/x/net to v0.55.0.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	No Ginkgo test files or title changes are present in the diff; only dependency/vendor files were updated.
Test Structure And Quality	✅ Passed	This PR only bumps x/net and updates vendor files; no Ginkgo test code was added or modified, so the test-quality check is not applicable.
Microshift Test Compatibility	✅ Passed	No Ginkgo e2e tests were added; the PR only bumps vendored x/net and updates module files.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Only go.mod/go.sum and vendored x/net files changed; no *_test.go or Ginkgo It/Describe/When definitions were added.
Topology-Aware Scheduling Compatibility	✅ Passed	Only go.mod/go.sum and vendored x/net files changed; no deployment manifests, operators, or controllers were modified.
Ote Binary Stdout Contract	✅ Passed	No process-level stdout writes were added; the only fmt.Println is inside a regular test case, and no main/TestMain/init/setup code changed.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo/e2e test files were added; the PR only updates vendored x/net and module metadata.
No-Weak-Crypto	✅ Passed	PR only bumps golang.org/x/net and vendors html/http2 parser changes; no MD5/SHA1/DES/RC4/3DES/Blowfish, ECB, custom crypto, or secret compares found.
Container-Privileges	✅ Passed	The PR only updates dependency versions and non-privilege manifest data; no changed manifest adds privileged:true, hostPID/hostNetwork/hostIPC, SYS_ADMIN, or allowPrivilegeEscalation:true.
No-Sensitive-Data-In-Logs	✅ Passed	Diff only updates vendored x/net code and metadata; no new logging, debug output, or sensitive data exposure found.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

go.mod

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

🔧 golangci-lint (2.12.2)

Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions
The command is terminated due to an error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions

_{Comment @coderabbitai help to get the list of available commands.}

tthvo · 2026-07-07T02:12:17Z

@jkaurredhat Thanks, but could you:

Set the PR target branch to main. Branch release-5.0 will auto-sync with main.
Separate the changes into 2 commits to make it easier for us to review:
- Commit 1: only file go.mod and go.sum
- Commit 2: go mod vendor and commit the vendor directory.

openshift-ci-robot · 2026-07-20T14:07:56Z

@jkaurredhat: This pull request references Jira Issue OCPBUGS-96835, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.0.0) matches configured target version for branch (5.0.0)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (ocp-sustaining-admins@redhat.com), skipping review request.

Details

In response to this:

Summary

This PR addresses CVE-2026-27136 by updating golang.org/x/net from v0.49.0 to v0.55.0, which includes a fix for an XSS vulnerability in the HTML parser.

CVE Details

CVE-2026-27136: Cross-Site Scripting via HTML parsing bypass in golang.org/x/net/html

Severity: Medium

Affected: golang.org/x/net < v0.55.0

Impact: XSS vulnerability when parsing HTML with duplicate attributes

Vulnerable functions: html.Parse(), html.ParseFragment()

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-07-20T14:14:27Z

@jkaurredhat: This pull request explicitly references no jira issue.

Details

In response to this:

Summary

This PR addresses CVE-2026-27136 by updating golang.org/x/net from v0.49.0 to v0.55.0, which includes a fix for an XSS vulnerability in the HTML parser.

CVE Details

CVE-2026-27136: Cross-Site Scripting via HTML parsing bypass in golang.org/x/net/html

Severity: Medium

Affected: golang.org/x/net < v0.55.0

Impact: XSS vulnerability when parsing HTML with duplicate attributes

Vulnerable functions: html.Parse(), html.ParseFragment()

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-07-20T14:15:43Z

@jkaurredhat: This pull request references Jira Issue OCPBUGS-96835, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.0.0) matches configured target version for branch (5.0.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (ocp-sustaining-admins@redhat.com), skipping review request.

Details

In response to this:

Summary

This PR addresses CVE-2026-27136 by updating golang.org/x/net from v0.49.0 to v0.55.0, which includes a fix for an XSS vulnerability in the HTML parser.

CVE Details

CVE-2026-27136: Cross-Site Scripting via HTML parsing bypass in golang.org/x/net/html

Severity: Medium

Affected: golang.org/x/net < v0.55.0

Impact: XSS vulnerability when parsing HTML with duplicate attributes

Vulnerable functions: html.Parse(), html.ParseFragment()

Summary by CodeRabbit

Chores

Updated several underlying Go libraries to newer versions.

Improved compatibility, reliability, and security through refreshed supporting components.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@go.mod`:
- Line 106: Update the golang.org/x/crypto dependency in go.mod from v0.51.0 to
v0.52.0 or later, then refresh go.sum to match the selected version and verify
module consistency.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: d6485ed0-cb9f-4d14-9ba4-0153568e9235

📥 Commits

Reviewing files that changed from the base of the PR and between a4918e4 and 97c7bed.

⛔ Files ignored due to path filters (1)

go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

go.mod

tthvo · 2026-07-21T22:55:16Z

@jkaurredhat Could you rebase this PR? Thanks!

Update golang.org/x/net from v0.54.0 to v0.55.0 for compliance with CVE-2026-5026 (golang.org/x/net/idna ASCII-only Punycode vulnerability). Related: OCPBUGS-96835

tthvo

/lgtm
/approve

openshift-merge-bot · 2026-07-23T16:45:09Z

Scheduling required tests:
/test e2e-azure-nat-gateway-single-zone

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn

openshift-ci · 2026-07-23T16:45:27Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: tthvo

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [tthvo]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

tthvo · 2026-07-23T21:10:10Z

/retest

tthvo · 2026-07-23T21:25:35Z

/test e2e-gcp-ovn
/test e2e-agent-compact-ipv4-iso-no-registry

tthvo · 2026-07-24T16:42:30Z

/test e2e-azure-nat-gateway-single-zone

openshift-ci · 2026-07-24T20:55:47Z

@jkaurredhat: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ovn	`66ecdb5`	link	true	`/test e2e-aws-ovn`
ci/prow/e2e-gcp-ovn	`66ecdb5`	link	true	`/test e2e-gcp-ovn`
ci/prow/e2e-azure-nat-gateway-single-zone	`66ecdb5`	link	true	`/test e2e-azure-nat-gateway-single-zone`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot added jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. labels Jul 3, 2026

openshift-ci-robot added the jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. label Jul 3, 2026

openshift-ci Bot requested review from andfasano and bfournie July 3, 2026 16:20

openshift-ci Bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 9, 2026

jkaurredhat changed the base branch from release-5.0 to main July 20, 2026 14:07

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Jul 20, 2026

jkaurredhat force-pushed the update-xnet-5.0 branch from a4918e4 to 97c7bed Compare July 20, 2026 14:13

jkaurredhat changed the title ~~OCPBUGS-96835: Bump golang.org/x/net to v0.55.0~~ NO-ISSUE: Bump golang.org/x/net to v0.55.0 Jul 20, 2026

openshift-ci Bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 20, 2026

openshift-ci-robot removed jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. labels Jul 20, 2026

jkaurredhat changed the title ~~NO-ISSUE: Bump golang.org/x/net to v0.55.0~~ OCPBUGS-96835: Bump golang.org/x/net to v0.55.0 Jul 20, 2026

openshift-ci-robot added jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. labels Jul 20, 2026

coderabbitai Bot reviewed Jul 20, 2026

View reviewed changes

Comment thread go.mod Outdated

coderabbitai Bot mentioned this pull request Jul 20, 2026

OCPBUGS-95491: Bump golang.org/x/crypto to v0.52.0 #10699

Closed

openshift-ci Bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 21, 2026

NO-ISSUE: Bump golang.org/x/net to v0.55.0

66ecdb5

Update golang.org/x/net from v0.54.0 to v0.55.0 for compliance with CVE-2026-5026 (golang.org/x/net/idna ASCII-only Punycode vulnerability). Related: OCPBUGS-96835

jkaurredhat force-pushed the update-xnet-5.0 branch from 97c7bed to 66ecdb5 Compare July 23, 2026 13:47

openshift-ci Bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 23, 2026

tthvo reviewed Jul 23, 2026

View reviewed changes

openshift-ci Bot assigned tthvo Jul 23, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 23, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 23, 2026

tthvo mentioned this pull request Jul 24, 2026

OCPBUGS-99755: OTE: fix AWS endpoint resolution for non-standard partitions openshift/cluster-cloud-controller-manager-operator#494

Open

Uh oh!

Conversation

jkaurredhat commented Jul 3, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

CVE Details

Summary by CodeRabbit

Uh oh!

openshift-ci-robot commented Jul 3, 2026

Summary

CVE Details

Risk Assessment

Changes

Go Version Compatibility

Test Plan

Related

Uh oh!

coderabbitai Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

tthvo commented Jul 7, 2026

Uh oh!

openshift-ci-robot commented Jul 20, 2026

Summary

CVE Details

Uh oh!

openshift-ci-robot commented Jul 20, 2026

Summary

CVE Details

Uh oh!

openshift-ci-robot commented Jul 20, 2026

Summary

CVE Details

Summary by CodeRabbit

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

tthvo commented Jul 21, 2026

Uh oh!

tthvo left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-merge-bot Bot commented Jul 23, 2026

Uh oh!

openshift-ci Bot commented Jul 23, 2026

Uh oh!

tthvo commented Jul 23, 2026

Uh oh!

tthvo commented Jul 23, 2026

Uh oh!

tthvo commented Jul 24, 2026

Uh oh!

openshift-ci Bot commented Jul 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jkaurredhat commented Jul 3, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 3, 2026 •

edited

Loading