Bump golang.org/x/net to v0.60.0 by sbouchet · Pull Request #398 · eclipse-che/che-machine-exec

sbouchet · 2026-11-05T11:05:44Z

Update golang.org/x/net from v0.38.0 to v0.60.0 (CRW-13670) and re-vendor. This pulls in the transitive upgrades of x/crypto, x/sys, x/term and x/text. golang.org/x/net v0.60.0 declares go 1.26.0, so the module's go directive is bumped to 1.26.0 accordingly.

Bump the Go build images to 1.26.10 to satisfy the new directive:

Dockerfile ubi8 go-toolset 1.25.10 -> 1.26.10
Dockerfile ubi9 go-toolset 1.26.4 -> 1.26.10
Dockerfile alpine golang 1.25.7 -> 1.26.10
rhel.Dockerfile ubi8 go-toolset 1.26.5 -> 1.26.10
brew.Dockerfile rhel8 go-toolset 1.20.10 -> 1.26.10

fixes https://redhat.atlassian.net/browse/CRW-13670

Update golang.org/x/net from v0.38.0 to v0.60.0 (CRW-13670) and re-vendor. This pulls in the transitive upgrades of x/crypto, x/sys, x/term and x/text. golang.org/x/net v0.60.0 declares go 1.26.0, so the module's go directive is bumped to 1.26.0 accordingly. Bump the Go build images to 1.26.10 to satisfy the new directive: - Dockerfile ubi8 go-toolset 1.25.10 -> 1.26.10 - Dockerfile ubi9 go-toolset 1.26.4 -> 1.26.10 - Dockerfile alpine golang 1.25.7 -> 1.26.10 - rhel.Dockerfile ubi8 go-toolset 1.26.5 -> 1.26.10 - brew.Dockerfile rhel8 go-toolset 1.20.10 -> 1.26.10 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>

coderabbitai · 2026-11-05T11:05:54Z

Important

Review skipped

Too many files!

This PR contains 240 files, which is 140 over the limit of 100.

To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch.

Upgrade to a paid plan to raise the limit.

This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Advanced
Run ID: f8aacef9-4647-4756-a81a-e08c0634d11d

Commits

Reviewing files that changed from the base of the PR and between cb2eae7 and ab7159f.

Files ignored due to path filters: 1

go.sum is excluded by !**/*.sum

Files selected for processing: 240

build/dockerfiles/Dockerfile
build/dockerfiles/brew.Dockerfile
build/dockerfiles/rhel.Dockerfile
go.mod
vendor/golang.org/x/crypto/sha3/doc.go
vendor/golang.org/x/crypto/sha3/hashes.go
vendor/golang.org/x/crypto/sha3/hashes_noasm.go
vendor/golang.org/x/crypto/sha3/keccakf_amd64.go
vendor/golang.org/x/crypto/sha3/keccakf_amd64.s
vendor/golang.org/x/crypto/sha3/legacy_hash.go
vendor/golang.org/x/crypto/sha3/legacy_keccakf.go
vendor/golang.org/x/crypto/sha3/sha3_s390x.go
vendor/golang.org/x/crypto/sha3/sha3_s390x.s
vendor/golang.org/x/crypto/sha3/shake.go
vendor/golang.org/x/crypto/sha3/shake_noasm.go
vendor/golang.org/x/net/context/context.go
vendor/golang.org/x/net/http2/README.md
vendor/golang.org/x/net/http2/ascii.go
vendor/golang.org/x/net/http2/client_conn_pool.go
vendor/golang.org/x/net/http2/client_priority_go126.go
vendor/golang.org/x/net/http2/client_priority_go127.go
vendor/golang.org/x/net/http2/clientconn.go
vendor/golang.org/x/net/http2/config.go
vendor/golang.org/x/net/http2/config_go124.go
vendor/golang.org/x/net/http2/config_go125.go
vendor/golang.org/x/net/http2/config_go126.go
vendor/golang.org/x/net/http2/config_pre_go124.go
vendor/golang.org/x/net/http2/databuffer.go
vendor/golang.org/x/net/http2/flow.go
vendor/golang.org/x/net/http2/frame.go
vendor/golang.org/x/net/http2/gotrack.go
vendor/golang.org/x/net/http2/h2c/h2c.go
vendor/golang.org/x/net/http2/hpack/encode.go
vendor/golang.org/x/net/http2/hpack/hpack.go
vendor/golang.org/x/net/http2/hpack/tables.go
vendor/golang.org/x/net/http2/http2.go
vendor/golang.org/x/net/http2/server.go
vendor/golang.org/x/net/http2/server_common.go
vendor/golang.org/x/net/http2/server_wrap.go
vendor/golang.org/x/net/http2/timer.go
vendor/golang.org/x/net/http2/transport.go
vendor/golang.org/x/net/http2/transport_common.go
vendor/golang.org/x/net/http2/transport_wrap.go
vendor/golang.org/x/net/http2/writesched.go
vendor/golang.org/x/net/http2/writesched_common.go
vendor/golang.org/x/net/http2/writesched_priority_rfc7540.go
vendor/golang.org/x/net/http2/writesched_priority_rfc9218.go
vendor/golang.org/x/net/http2/writesched_random.go
vendor/golang.org/x/net/http2/writesched_roundrobin.go
vendor/golang.org/x/net/idna/go118.go
vendor/golang.org/x/net/idna/idna.go
vendor/golang.org/x/net/idna/idna9.0.0.go
vendor/golang.org/x/net/idna/pre_go118.go
vendor/golang.org/x/net/idna/punycode.go
vendor/golang.org/x/net/idna/tables10.0.0.go
vendor/golang.org/x/net/idna/tables11.0.0.go
vendor/golang.org/x/net/idna/tables12.0.0.go
vendor/golang.org/x/net/idna/tables13.0.0.go
vendor/golang.org/x/net/idna/tables15.0.0.go
vendor/golang.org/x/net/idna/tables17.0.0.go
vendor/golang.org/x/net/idna/tables9.0.0.go
vendor/golang.org/x/net/idna/trie12.0.0.go
vendor/golang.org/x/net/idna/trie13.0.0.go
vendor/golang.org/x/net/internal/httpcommon/README.md
vendor/golang.org/x/net/internal/httpcommon/gzip.go
vendor/golang.org/x/net/internal/httpcommon/request.go
vendor/golang.org/x/net/internal/httpsfv/httpsfv.go
vendor/golang.org/x/sys/cpu/asm_darwin_arm64_gc.s
vendor/golang.org/x/sys/cpu/cpu.go
vendor/golang.org/x/sys/cpu/cpu_arm64.go
vendor/golang.org/x/sys/cpu/cpu_arm64.s
vendor/golang.org/x/sys/cpu/cpu_darwin_arm64.go
vendor/golang.org/x/sys/cpu/cpu_darwin_arm64_other.go
vendor/golang.org/x/sys/cpu/cpu_gc_riscv64.go
vendor/golang.org/x/sys/cpu/cpu_gccgo_arm64.go
vendor/golang.org/x/sys/cpu/cpu_linux_loong64.go
vendor/golang.org/x/sys/cpu/cpu_linux_noinit.go
vendor/golang.org/x/sys/cpu/cpu_linux_ppc64x.go
vendor/golang.org/x/sys/cpu/cpu_linux_riscv64.go
vendor/golang.org/x/sys/cpu/cpu_loong64.go
vendor/golang.org/x/sys/cpu/cpu_loong64.s
vendor/golang.org/x/sys/cpu/cpu_netbsd_amd64.go
vendor/golang.org/x/sys/cpu/cpu_other_arm64.go
vendor/golang.org/x/sys/cpu/cpu_other_x86.go
vendor/golang.org/x/sys/cpu/cpu_riscv64.go
vendor/golang.org/x/sys/cpu/cpu_riscv64.s
vendor/golang.org/x/sys/cpu/cpu_sparc64.go
vendor/golang.org/x/sys/cpu/cpu_windows.go
vendor/golang.org/x/sys/cpu/cpu_windows_arm64.go
vendor/golang.org/x/sys/cpu/cpu_x86.go
vendor/golang.org/x/sys/cpu/parse.go
vendor/golang.org/x/sys/cpu/syscall_darwin_arm64_gc.go
vendor/golang.org/x/sys/cpu/zcpu_windows.go
vendor/golang.org/x/sys/plan9/pwd_go15_plan9.go
vendor/golang.org/x/sys/plan9/pwd_plan9.go
vendor/golang.org/x/sys/plan9/syscall_plan9.go
vendor/golang.org/x/sys/unix/affinity_linux.go
vendor/golang.org/x/sys/unix/fdset.go
vendor/golang.org/x/sys/unix/ifreq_linux.go
vendor/golang.org/x/sys/unix/ioctl_linux.go
vendor/golang.org/x/sys/unix/ioctl_signed.go
vendor/golang.org/x/sys/unix/ioctl_unsigned.go
vendor/golang.org/x/sys/unix/mkall.sh
vendor/golang.org/x/sys/unix/mkerrors.sh
vendor/golang.org/x/sys/unix/readv_unix.go
vendor/golang.org/x/sys/unix/syscall.go
vendor/golang.org/x/sys/unix/syscall_bsd.go
vendor/golang.org/x/sys/unix/syscall_darwin.go
vendor/golang.org/x/sys/unix/syscall_linux.go
vendor/golang.org/x/sys/unix/syscall_linux_386.go
vendor/golang.org/x/sys/unix/syscall_linux_amd64.go
vendor/golang.org/x/sys/unix/syscall_linux_arm.go
vendor/golang.org/x/sys/unix/syscall_linux_arm64.go
vendor/golang.org/x/sys/unix/syscall_linux_loong64.go
vendor/golang.org/x/sys/unix/syscall_linux_mips64x.go
vendor/golang.org/x/sys/unix/syscall_linux_mipsx.go
vendor/golang.org/x/sys/unix/syscall_linux_ppc.go
vendor/golang.org/x/sys/unix/syscall_linux_ppc64x.go
vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go
vendor/golang.org/x/sys/unix/syscall_linux_s390x.go
vendor/golang.org/x/sys/unix/syscall_linux_sparc64.go
vendor/golang.org/x/sys/unix/syscall_netbsd.go
vendor/golang.org/x/sys/unix/syscall_openbsd.go
vendor/golang.org/x/sys/unix/syscall_solaris.go
vendor/golang.org/x/sys/unix/syscall_unix.go
vendor/golang.org/x/sys/unix/zerrors_linux.go
vendor/golang.org/x/sys/unix/zerrors_linux_386.go
vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go
vendor/golang.org/x/sys/unix/zerrors_linux_arm.go
vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go
vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go
vendor/golang.org/x/sys/unix/zerrors_linux_mips.go
vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go
vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go
vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go
vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go
vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go
vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go
vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go
vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go
vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go
vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.go
vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.s
vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.go
vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.s
vendor/golang.org/x/sys/unix/zsyscall_linux.go
vendor/golang.org/x/sys/unix/zsyscall_linux_386.go
vendor/golang.org/x/sys/unix/zsyscall_linux_amd64.go
vendor/golang.org/x/sys/unix/zsyscall_linux_arm.go
vendor/golang.org/x/sys/unix/zsyscall_linux_arm64.go
vendor/golang.org/x/sys/unix/zsyscall_linux_loong64.go
vendor/golang.org/x/sys/unix/zsyscall_linux_mips.go
vendor/golang.org/x/sys/unix/zsyscall_linux_mips64.go
vendor/golang.org/x/sys/unix/zsyscall_linux_mips64le.go
vendor/golang.org/x/sys/unix/zsyscall_linux_mipsle.go
vendor/golang.org/x/sys/unix/zsyscall_linux_ppc.go
vendor/golang.org/x/sys/unix/zsyscall_linux_ppc64.go
vendor/golang.org/x/sys/unix/zsyscall_linux_ppc64le.go
vendor/golang.org/x/sys/unix/zsyscall_linux_riscv64.go
vendor/golang.org/x/sys/unix/zsyscall_linux_s390x.go
vendor/golang.org/x/sys/unix/zsyscall_linux_sparc64.go
vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.go
vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.s
vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.go
vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.s
vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.go
vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.s
vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.go
vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.s
vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.go
vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.s
vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.go
vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.s
vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.go
vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.s
vendor/golang.org/x/sys/unix/zsyscall_solaris_amd64.go
vendor/golang.org/x/sys/unix/zsysnum_linux_386.go
vendor/golang.org/x/sys/unix/zsysnum_linux_amd64.go
vendor/golang.org/x/sys/unix/zsysnum_linux_arm.go
vendor/golang.org/x/sys/unix/zsysnum_linux_arm64.go
vendor/golang.org/x/sys/unix/zsysnum_linux_loong64.go
vendor/golang.org/x/sys/unix/zsysnum_linux_mips.go
vendor/golang.org/x/sys/unix/zsysnum_linux_mips64.go
vendor/golang.org/x/sys/unix/zsysnum_linux_mips64le.go
vendor/golang.org/x/sys/unix/zsysnum_linux_mipsle.go
vendor/golang.org/x/sys/unix/zsysnum_linux_ppc.go
vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64.go
vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64le.go
vendor/golang.org/x/sys/unix/zsysnum_linux_riscv64.go
vendor/golang.org/x/sys/unix/zsysnum_linux_s390x.go
vendor/golang.org/x/sys/unix/zsysnum_linux_sparc64.go
vendor/golang.org/x/sys/unix/ztypes_linux.go
vendor/golang.org/x/sys/unix/ztypes_linux_386.go
vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go
vendor/golang.org/x/sys/unix/ztypes_linux_arm.go
vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go
vendor/golang.org/x/sys/unix/ztypes_linux_loong64.go
vendor/golang.org/x/sys/unix/ztypes_linux_mips.go
vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go
vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go
vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go
vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go
vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go
vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go
vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go
vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go
vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go
vendor/golang.org/x/sys/unix/ztypes_netbsd_arm.go
vendor/golang.org/x/sys/windows/aliases.go
vendor/golang.org/x/sys/windows/dll_windows.go
vendor/golang.org/x/sys/windows/security_windows.go
vendor/golang.org/x/sys/windows/syscall_windows.go
vendor/golang.org/x/sys/windows/types_windows.go
vendor/golang.org/x/sys/windows/zsyscall_windows.go
vendor/golang.org/x/term/term_windows.go
vendor/golang.org/x/term/terminal.go
vendor/golang.org/x/text/secure/bidirule/bidirule.go
vendor/golang.org/x/text/secure/bidirule/bidirule10.0.0.go
vendor/golang.org/x/text/secure/bidirule/bidirule9.0.0.go
vendor/golang.org/x/text/unicode/bidi/core.go
vendor/golang.org/x/text/unicode/bidi/tables10.0.0.go
vendor/golang.org/x/text/unicode/bidi/tables11.0.0.go
vendor/golang.org/x/text/unicode/bidi/tables12.0.0.go
vendor/golang.org/x/text/unicode/bidi/tables13.0.0.go
vendor/golang.org/x/text/unicode/bidi/tables15.0.0.go
vendor/golang.org/x/text/unicode/bidi/tables17.0.0.go
vendor/golang.org/x/text/unicode/bidi/tables9.0.0.go
vendor/golang.org/x/text/unicode/norm/composition.go
vendor/golang.org/x/text/unicode/norm/forminfo.go
vendor/golang.org/x/text/unicode/norm/iter.go
vendor/golang.org/x/text/unicode/norm/normalize.go
vendor/golang.org/x/text/unicode/norm/tables10.0.0.go
vendor/golang.org/x/text/unicode/norm/tables11.0.0.go
vendor/golang.org/x/text/unicode/norm/tables12.0.0.go
vendor/golang.org/x/text/unicode/norm/tables13.0.0.go
vendor/golang.org/x/text/unicode/norm/tables15.0.0.go
vendor/golang.org/x/text/unicode/norm/tables17.0.0.go
vendor/golang.org/x/text/unicode/norm/tables9.0.0.go
vendor/golang.org/x/text/unicode/norm/transform.go
vendor/modules.txt

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

sbouchet · 2026-11-05T13:06:45Z

FIPS check :
✅ PASS. check-payload reports Successful run (exit 0) on the rhel.Dockerfile image — the actual FIPS deliverable. The go-toolset 1.26.10 binary validates cleanly against the FIPS OpenSSL backend.

FIPS verdict for this change

┌────────────────────────┬──────────────┬────────────────────────────────────┐
│ Image scanned │ check-payload result │ Meaning │
├────────────────────────┼──────────────┼────────────────────────────────────┤
│ rhel.Dockerfile (ubi8-minimal + openssl + go-toolset 1.26.10) │ Successful run, exit 0 │ ✅ FIPS-compliant — this is what ships downstream │
├────────────────────────┼──────────────┼────────────────────────────────────┤
│ Dockerfile (scratch, alpine entrypoint) │ failed on /go/bin/... │ ❌ expected & pre-existing — scratch has no OpenSSL and the entrypoint is the non-FIPS alpine binary; not a FIPS artifact │
└───────────────────┴──────────┴─────────────────────────────────────────────┘

Conclusion: no FIPS regression from the x/net bump + Go 1.26.10 toolchain. The go-toolset binary still routes crypto through FIPS-certified OpenSSL (golang-fips backend), confirmed both by the symbol inspection earlier and now by a passing check-payload scan.

Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>

sbouchet requested review from RomanNikitenko, ibuziuk and rgrunber as code owners November 5, 2026 11:05

azatsarynnyy approved these changes Nov 5, 2026

View reviewed changes

fix docker warning

ab7159f

Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>

sbouchet mentioned this pull request Nov 5, 2026

chore(deps): bump golang.org/x/{crypto,net,sys,term,text} to address CVE-2025-47914, CVE-2025-58181 #369

Closed

Navigation Menu

Repository navigation

Bump golang.org/x/net to v0.60.0 - #398

Bump golang.org/x/net to v0.60.0#398
sbouchet wants to merge 2 commits into
eclipse-che:mainfrom
sbouchet:bump-x-net

sbouchet commented Nov 5, 2026 •

edited by openshift-ci Bot

Loading

Uh oh!

coderabbitai Bot commented Nov 5, 2026 •

edited

Loading

Review skipped

Uh oh!

sbouchet commented Nov 5, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

sbouchet commented Nov 5, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Nov 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

sbouchet commented Nov 5, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

sbouchet commented Nov 5, 2026 •

edited by openshift-ci Bot

Loading

coderabbitai Bot commented Nov 5, 2026 •

edited

Loading