Fix some CVEs

[masap]

What this PR does / why we need it:
This PR fixes some vulnerabilities found by Trivy.

sonobuoy (gobinary)

Total: 4 (UNKNOWN: 1, LOW: 0, MEDIUM: 2, HIGH: 1, CRITICAL: 0)

┌─────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────┬──────────────────────────────────────────────────────────────┐
│       Library       │ Vulnerability  │ Severity │ Status │ Installed Version │  Fixed Version  │                            Title                             │
├─────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/oauth2 │ CVE-2025-22868 │ HIGH     │ fixed  │ v0.15.0           │ 0.27.0          │ golang.org/x/oauth2/jws: Unexpected memory consumption       │
│                     │                │          │        │                   │                 │ during token parsing in golang.org/x/oauth2/jws              │
│                     │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2025-22868                   │
├─────────────────────┼────────────────┼──────────┤        ├───────────────────┼─────────────────┼──────────────────────────────────────────────────────────────┤
│ stdlib              │ CVE-2025-0913  │ MEDIUM   │        │ v1.23.8           │ 1.23.10, 1.24.4 │ Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows │
│                     │                │          │        │                   │                 │ in os in syscall...                                          │
│                     │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2025-0913                    │
│                     ├────────────────┤          │        │                   │                 ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2025-4673  │          │        │                   │                 │ net/http: Sensitive headers not cleared on cross-origin      │
│                     │                │          │        │                   │                 │ redirect in net/http                                         │
│                     │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2025-4673                    │
│                     ├────────────────┼──────────┤        │                   ├─────────────────┼──────────────────────────────────────────────────────────────┤
│                     │ CVE-2025-47907 │ UNKNOWN  │        │                   │ 1.23.12, 1.24.6 │ Incorrect results returned from Rows.Scan in database/sql    │
│                     │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2025-47907                   │
└─────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────┴──────────────────────────────────────────────────────────────┘

Which issue(s) this PR fixes

• Fixes #

Special notes for your reviewer:

Release note:

Fix CVE-2025-22868, CVE-2025-0913, CVE-2025-4673, CVE-2025-47907.

[farazkhawaja]

Thanks @masap for the PR. We should also periodically review the weekly trivy scan workflow for sonobuoy to address vuln earlier: https://github.com/vmware-tanzu/sonobuoy/actions/runs/15949670484/job/44987968467

[rizzza]

@masap Think you could add the fix for

┌─────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────┬──────────────────────────────────────────────────────────────┐
│       Library       │ Vulnerability  │ Severity │ Status │ Installed Version │  Fixed Version  │                            Title                             │
├─────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/oauth2 │ CVE-2025-22868 │ HIGH     │ fixed  │ v0.15.0           │ 0.27.0          │ golang.org/x/oauth2/jws: Unexpected memory consumption       │
│                     │                │          │        │                   │                 │ during token parsing in golang.org/x/oauth2/jws              │
│                     │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2025-22868                   │
├─────────────────────┼────────────────┼──────────┤        ├───────────────────┼─────────────────┼──────────────────────────────────────────────────────────────┤

https://github.com/vmware-tanzu/sonobuoy/actions/runs/16699265919/job/47267729568

And maybe @lubronzhan could cut a release?

[masap]

@rizzza Sure, I fixed this PR.

[ShashankGirish]

Thanks for the PR, @masap . I'm assuming the lint errors are due to this change here?

[masap]

@ShashankGirish

I'm assuming the lint errors are due to this change here?

No, we need this change to fix trailing warning.

Warning: Unexpected input(s) 'skip-pkg-cache', 'skip-build-cache', valid inputs are ['version', 'install-mode', 'working-directory', 'github-token', 'verify', 'only-new-issues', 'skip-cache', 'skip-save-cache', 'problem-matchers', 'args', 'cache-invalidation-interval']

[ShashankGirish]

Ack, would you be able to resolve the lint errors?

[masap]

Let me check.

[masap]

@ShashankGirish I fixed the lint errors.

[masap]

And fixed some additional CVEs.

[jerrychengca]

CI Test/integration-test-on-kind failed with this error

• Error: parsing AggregatorURL: parse "https://[10.244.1.12]:8080": invalid IPv6 host

This happens after upgrading go version to 1.24.9.
Root cause:
"// Per RFC 3986, only a host identified by a valid
// IPv6 address can be enclosed by square brackets."
See https://github.com/golang/go/blob/release-branch.go1.24/src/net/url/url.go#L626
Sonobuoy encloses an ipv4 address with square brackets in URL which breaks the rule.
I have made a fix: f0bc847
@masap, would you like to pick it up and rerun the tests ?
CC @ShashankGirish

[masap]

would you like to pick it up and rerun the tests ?

@jerrychengca Thank you, I picked it up.