NO-JIRA: Bump golang.org/x/net to 0.56.0 to fix CVE

[twoGiants]

Summary

Fixes CVE-2026-27136 which can cause XSS in golang.org/x/net/html. The html package is used indirectly by dependencies.

Additional Info

As for the RIT process documentation the Jira ticket is not attached to this PR, I quote:

In some cases, a symbol level analysis will show that the component is not actually exposed to the vulnerability. In these cases the package should still be updated, but not attached to the bug.

References

Here is the closed issue golang/go#79575 in the go repo.

Summary by CodeRabbit

• Chores
  • Updated several Go module dependencies across the project to newer versions.
  • Kept related packages aligned in the main app and supporting tooling modules.
  • No user-facing features or behavioral changes were introduced.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@twoGiants: This pull request explicitly references no jira issue.

Details

In response to this:

Summary

Fixes CVE-2026-27136 which can cause XSS in golang.org/x/net/html. The html package is used indirectly by dependencies.

Additional Info

As for the RIT process documentation the Jira ticket is not attached to this PR, quote:

In some cases, a symbol level analysis will show that the component is not actually exposed to the vulnerability. In these cases the package should still be updated, but not attached to the bug.

References

Here is the closed issue golang/go#79575 in the go repo.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Walkthrough

This pull request updates golang.org/x/* indirect dependency versions (crypto, mod, net, sync, sys, term, text, tools) across five go.mod files: root go.mod, e2e/go.mod, hack/tools/go.mod, manifests-gen/go.mod, and openshift-tests-extension/go.mod. No exported entities are modified.

Changes

Dependency Version Bumps

Layer / File(s)	Summary
Root and hack tools module updates go.mod, hack/tools/go.mod	Bumped golang.org/x/tools from v0.42.0 to v0.45.0 and other golang.org/x/* indirect dependencies (crypto, mod, net, sync, sys, term, text) in both files.
E2E and test extension module updates e2e/go.mod, openshift-tests-extension/go.mod	Bumped golang.org/x/* indirect dependencies (crypto, mod, net, sync, sys, term, text, tools), leaving x/exp, x/oauth2, and x/time unchanged.
Manifests generator module update manifests-gen/go.mod	Bumped golang.org/x/net, x/sys, x/term, and x/text versions; x/oauth2 unchanged.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Related Issues: None specified in the provided context.

Related PRs: None specified in the provided context.

Suggested labels: dependencies, go-modules

Suggested reviewers: None specified in the provided context.

Poem

A rabbit hops through modules deep,
Version numbers bumped in sleep,
x/crypto, x/net, x/sys align,
Five go.mod files, all in line,
Hopping forward, dependencies keep! 🐇

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	No *_test.go files or Ginkgo title definitions were changed; the diff only updates module/vendor dependencies.
Test Structure And Quality	✅ Passed	No Ginkgo test code changed; the diff is limited to module files, sums, and vendored dependency updates, so this checklist is not applicable.
Microshift Test Compatibility	✅ Passed	PR only bumps go.mod/go.sum and vendor deps; no new Ginkgo e2e tests or OpenShift API usage were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new or modified Ginkgo e2e tests were added; the PR only bumps Go deps and vendor files, so SNO compatibility isn't implicated.
Topology-Aware Scheduling Compatibility	✅ Passed	No deployment manifests, operator code, or controllers were modified; the PR only updates Go deps/vendor files, so no topology-aware scheduling risk is introduced.
Ote Binary Stdout Contract	✅ Passed	PR only updates go.mod/vendor deps; changed main/init paths contain no stdout fmt/klog writes, and remaining logging is stderr/built-in print.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	This PR only updates Go modules/vendor files; no new Ginkgo e2e tests were added, so the IPv6/disconnected check is not applicable.
No-Weak-Crypto	✅ Passed	Diff only bumps Go deps/vendor; no added MD5/SHA1/DES/RC4/3DES/Blowfish/ECB or constant-time secret comparison code was found.
Container-Privileges	✅ Passed	PR only updates Go modules/vendor files; no K8s/container manifests or privilege flags like privileged, hostPID/Network/IPC, SYS_ADMIN, or allowPrivilegeEscalation changed.
No-Sensitive-Data-In-Logs	✅ Passed	No new sensitive logging was added; changes are dependency bumps/vendor updates, and the http2 log lines (e.g. header/addr logs) already existed in HEAD~1.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly states the main change: bumping golang.org/x/net to address a CVE.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[theobarberbany]

heya @twoGiants, pretty sure if this has a CVE fix, we need a bug/jira attached? Or is this intentional?

[damdo]

/approve
/lgtm

/verified by ci

[openshift-ci-robot]

@damdo: This PR has been marked as verified by ci.

Details

In response to this:

/approve
/lgtm

/verified by ci

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-capi-disconnected-techpreview
/test e2e-aws-capi-techpreview
/test e2e-aws-capi-techpreview-post-install
/test e2e-aws-ovn-techpreview
/test e2e-aws-ovn-techpreview-upgrade
/test e2e-azure-capi-techpreview
/test e2e-azure-ovn-techpreview
/test e2e-azure-ovn-techpreview-upgrade
/test e2e-gcp-capi-techpreview
/test e2e-gcp-ovn-techpreview
/test e2e-metal3-capi-techpreview
/test e2e-openstack-capi-techpreview
/test e2e-vsphere-capi-techpreview
/test regression-clusterinfra-aws-ipi-techpreview-capi

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: damdo

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [damdo]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD e8d2830 and 2 for PR HEAD 07c3739 in total

[openshift-ci]

@twoGiants: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-gcp-ovn-techpreview	07c3739	link	true	/test e2e-gcp-ovn-techpreview

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.