OADP-7565: Go 1.25.8 toolchain + golang.org/x/* CVE bumps

[kaovilai]

Summary

• Adds toolchain go1.25.8 directive to fix Go stdlib CVEs:
  • GO-2026-4337, GO-2026-4340 (crypto/tls)
  • GO-2026-4341 (net/url)
  • GO-2026-4342 (archive/zip)
  • CVE-2026-25679 (net/url IPv6 host parsing)
  • CVE-2026-27137 (crypto/x509 email constraints)
• Bumps golang.org/x/net v0.38.0 → v0.52.0 (fixes GHSA-vvgc-356p-c3xw, XSS in HTML tokenizer)
• Transitive bumps: x/sys → v0.42.0, x/text → v0.35.0, x/term → v0.41.0, x/mod → v0.33.0

Note

golang.org/x/crypto is not in this module's dependency graph — those CVEs do not apply here.

Test plan

• go build ./... passes
• CI passes

Note

Responses generated with Claude

[openshift-ci-robot]

@kaovilai: This pull request references OADP-7565 which is a valid jira issue.

Details

In response to this:

Summary

• Adds toolchain go1.25.8 directive to fix Go stdlib CVEs:
• GO-2026-4337, GO-2026-4340 (crypto/tls)
• GO-2026-4341 (net/url)
• GO-2026-4342 (archive/zip)
• CVE-2026-25679 (net/url IPv6 host parsing)
• CVE-2026-27137 (crypto/x509 email constraints)
• Bumps golang.org/x/net v0.38.0 → v0.52.0 (fixes GHSA-vvgc-356p-c3xw, XSS in HTML tokenizer)
• Transitive bumps: x/sys → v0.42.0, x/text → v0.35.0, x/term → v0.41.0, x/mod → v0.33.0

[!Note]
golang.org/x/crypto is not in this module's dependency graph — those CVEs do not apply here.

Test plan

• go build ./... passes
• CI passes

[!Note]
Responses generated with Claude

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: c97bfda9-0c34-403b-a918-a5bc73862e4e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cve-fix-oadp-1.6

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Joeavaikath]

We could get this into dev and cherrypick?

[Copilot]

Pull request overview

Updates the module’s Go toolchain and golang.org/x/* dependencies to pick up security fixes (Go stdlib CVEs via a pinned toolchain patch release, plus x/net and related transitive bumps).

Changes:

• Add toolchain go1.25.8 to ensure builds use a patched Go toolchain version.
• Bump golang.org/x/net to v0.52.0 and update related golang.org/x/* indirect dependencies.
• Refresh go.sum accordingly for the updated dependency graph.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
go.mod	Adds a Go toolchain directive and bumps indirect golang.org/x/* versions to incorporate CVE fixes.
go.sum	Updates checksums for the new golang.org/x/* versions selected by the module graph.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[mpryc]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kaovilai, mpryc

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [kaovilai,mpryc]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment