fix(cve): CVE-2026-33811, CVE-2026-39833 - update Go stdlib and x/crypto [pipelines-1.15]#2923
Conversation
- Update Go stdlib from 1.25.9 to 1.25.11 Addresses CVE-2026-33811 (DoS via long CNAME response in net.LookupCNAME) - Update golang.org/x/crypto from v0.46.0 to v0.52.0 Addresses CVE-2026-39833 (security bypass in ssh/agent key confirmation) - Also upgrades transitive deps: x/net, x/sync, x/sys, x/term, x/text Resolves: SRVKP-12558, SRVKP-12570 Co-Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
@divyansh42: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
tekton-robot
added
the
do-not-merge/release-note-label-needed
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
tekton-robot
added
the
size/XXL
2 participants
CVE Details
Fix Summary
go.mod:go 1.25.9→go 1.25.11golang.org/x/crypto:v0.46.0→v0.52.0(minimum safe patch in same minor line per advisory)go mod tidy && go mod verify && go mod vendor— all passed ✅x/net v0.48.0→v0.54.0,x/sync v0.19.0→v0.20.0,x/sys v0.42.0→v0.45.0,x/term v0.41.0→v0.43.0,x/text v0.32.0→v0.37.0Test Results
✅ Tests PASSED —
go test -mod=vendor ./...All packages passed. Full suite including
pkg/cmd/pipelinerunandpkg/cmd/taskrun.Breaking Changes
None expected. This is a pure dependency version bump. The x/crypto update stays within the same major version (
v0). stdlib bump is patch-level only.Risk Assessment
Low — Patch-level updates only. All unit tests pass. No API surface changes in updated packages relevant to tkn CLI usage.
Jira References
SRVKP-12558, SRVKP-12570
Verification Steps
go test -mod=vendor ./...passesgo mod verifyshows all modules verified🤖 Generated with Claude Code