[release-v0.26.x] Security: Fix GovCloud CVEs - golang.org/x/text, x/net, grpc - #1850
Conversation
- Upgrade golang.org/x/text from v0.37.0 to v0.39.0 (CVE-2026-56852) - Upgrade golang.org/x/net from v0.55.0 to v0.56.0 (CVE-2026-46600) - Upgrade google.golang.org/grpc from v1.80.0 to v1.82.1 (GHSA-hrxh-6v49-42gf) These updates address Important-severity CVEs identified in the pipelines-chains-controller-rhel9 image during ROSA-GovCloud compliance scan. All 40 unit test packages pass. Jira: SRVKP-13174 Signed-off-by: jkhelil <jkhelil@redhat.com> Co-Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com>
tekton-robot
added
the
size/L
|
/approve |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jkhelil The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@jkhelil: you cannot LGTM your own PR. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
tekton-robot
added
the
approved
|
@jkhelil: PR needs rebase. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
tekton-robot
added
the
needs-rebase
2 participants
Changes
Fix GovCloud compliance CVEs by upgrading Go modules in
release-v0.26.x:golang.org/x/textgolang.org/x/netgoogle.golang.org/grpcThese CVEs were identified during a ROSA-GovCloud compliance scan of the
pipelines-chains-controller-rhel9container image (Jira: SRVKP-13174).govulncheck scan results
govulncheck did not detect call-path reachability for these CVEs in the
current codebase. The ACS container image scanner flags them based on
module version presence (not call-path reachability). Upgrading eliminates
the findings from both scanners.
Test Results
✅ All 40 unit test packages passed with
go test -short ./...Submitter Checklist
As the author of this PR, please check off the items in this checklist:
functionality, content, code)
Release Notes