chore(deps): bump golang.org/x/crypto, x/net, and x/mod to latest

[rohanKanojia]

What does this PR do?

Updates Go module dependencies to their latest available versions:

Package	Previous	Updated
golang.org/x/crypto	v0.52.0	v0.54.0
golang.org/x/net	v0.55.0	v0.57.0
golang.org/x/mod	v0.35.0	v0.38.0

Transitive golang.org/x/* dependencies (sys, text, tools, sync, term) were updated via go mod tidy.

This follows the same approach as #1659, extending it to the latest module versions. This is a routine maintenance bump only; the previously reported CVEs (e.g. in golang.org/x/crypto and golang.org/x/net) were already addressed on main by earlier dependency updates (#1659 for x/crypto/x/net, #1621 for go-billy via go-git).

What issues does this PR fix or reference?

N/A — maintenance dependency bump, not a CVE fix.

Is it tested? How?

make test

PR Checklist

• E2E tests pass (when PR is ready, comment /test v8-devworkspace-operator-e2e, v8-che-happy-path to trigger)
  • v8-devworkspace-operator-e2e: DevWorkspace e2e test
  • v8-che-happy-path: Happy path for verification integration with Che

Summary by CodeRabbit

• Chores
  • Updated underlying Go components to newer versions.
  • Included security, networking, terminal, text, synchronization, and tooling improvements from the updated components.

[coderabbitai]

📝 Walkthrough

Walkthrough

Updated direct and indirect golang.org/x dependency versions in go.mod.

Changes

Go dependency updates

Layer / File(s)	Summary
golang.org/x module version updates go.mod	Direct versions of x/crypto, x/mod, and x/net, plus indirect versions of x/sync, x/sys, x/term, x/text, and x/tools, were updated.
Estimated code review effort: 1 (Trivial)	~2 minutes

Possibly related PRs

• devfile/devworkspace-operator#1659: Updates overlapping golang.org/x/crypto and golang.org/x/net dependencies.
• devfile/devworkspace-operator#1617: Contains a related Go dependency and toolchain version update.

Suggested labels: lgtm, ok-to-test

Suggested reviewers: ibuziuk, akurinnoy, btjd, dkwon17

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: updating golang.org/x/crypto, x/net, and x/mod dependencies.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

go.mod

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[tolusha]

Hi! I'm che-ai-assistant — I help with your pull requests.

Available commands:

• /che-ai-assistant generate-che-doc — Generate a documentation PR based on this PR's changes
• /che-ai-assistant ok-pr-review — Run a comprehensive PR review (summary, code review, deep review, impact analysis)
• /che-ai-assistant ok-pr-readiness — Ensure PR has validation steps
• /che-ai-assistant check-pr-test-failures — Analyze failing CI checks, identify root causes, and suggest fixes
• /che-ai-assistant update-che-e2e-tests — Update Eclipse Che e2e tests
• /che-ai-assistant help — Show this help message

[tolusha]

/che-ai-assistant ok-pr-readiness

Task completed.

[tolusha]

PR Readiness Assessment: PR #1670 — chore(deps): bump golang.org/x/crypto, x/net, and x/mod to latest

Repository: devfile/devworkspace-operator
Linked Issue: None found (addresses multiple CVE tracker items)

---

#	Criterion	Verdict	Notes
1	Problem Statement	PASS	CVE vulnerabilities in golang.org/x dependencies clearly identified with specific CVE numbers
2	Reproduction Steps	WARN	Security vulnerabilities don't require traditional reproduction steps, but no guidance on how to verify vulnerable versions are present before the fix
3	Expected Behavior After Fix	PASS	Updated dependency versions clearly stated; expected outcome is CVE remediation
4	Scope of Changes	PASS	Clean dependency update with only go.mod and go.sum changes; transitive dependencies explained
5	Test Evidence	PASS	make test mentioned; PR checklist includes e2e test triggers
6	Deployment & Verification Notes	WARN	Mentions need to rebuild/redeploy images, but lacks specific verification commands to confirm CVE remediation in deployed binaries

Overall: NEEDS WORK

---

Missing Information

• Pre-fix verification guidance: Add commands to check current vulnerable dependency versions before applying the fix (e.g., go list -m golang.org/x/crypto golang.org/x/net)
• Post-deployment verification steps: Provide specific commands to verify the updated dependencies are present in rebuilt container images (e.g., using go version -m on binaries inside controller/webhook/project-clone images, or container image vulnerability scanning)
• CVE validation: Include commands or tools to confirm the specific CVEs are remediated after deployment (e.g., vulnerability scanner output, dependency version checks in running pods)

What's Good

• Clear problem statement: All affected CVEs are explicitly listed with their associated packages
• Transparent scope: The PR clearly explains what's updated (direct dependencies) and what's not (toolchain, go-git)
• Version comparison table: Makes it easy to see exactly what changed
• Testing coverage: Includes both unit tests (make test) and e2e test triggers in the checklist
• Deployment awareness: Explicitly notes that images need to be rebuilt to pick up the changes
• Reference to prior work: Links to Update go toolchain, x/crypto, x/net #1659 showing this follows an established pattern

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 40.25%. Comparing base (17aefae) to head (eaadb82).
⚠️ Report is 20 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1670      +/-   ##
==========================================
+ Coverage   37.17%   40.25%   +3.07%     
==========================================
  Files         168      171       +3     
  Lines       14761    15607     +846     
==========================================
+ Hits         5488     6283     +795     
- Misses       8921     8937      +16     
- Partials      352      387      +35     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: rohanKanojia, tolusha
Once this PR has been reviewed and has the lgtm label, please assign dkwon17 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

New changes are detected. LGTM label has been removed.

[coderabbitai]

🧹 Nitpick comments (1)

go.mod (1)

22-24: 🔒 Security & Privacy | 🔵 Trivial

Verify that the dependency update reaches deployed artifacts.

Add CI/deployment checks such as go list -m all, govulncheck ./..., and go version -m against rebuilt binaries or images so stale caches, vendored dependencies, or old images cannot hide this update.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 22 - 24, Add CI/deployment validation for the updated Go
dependencies in go.mod: run go list -m all and govulncheck ./..., then rebuild
artifacts and use go version -m to verify their embedded module versions. Ensure
checks inspect the actual binaries or images used for deployment so caches,
vendored dependencies, and stale images cannot mask the update.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@go.mod`:
- Around line 22-24: Add CI/deployment validation for the updated Go
dependencies in go.mod: run go list -m all and govulncheck ./..., then rebuild
artifacts and use go version -m to verify their embedded module versions. Ensure
checks inspect the actual binaries or images used for deployment so caches,
vendored dependencies, and stale images cannot mask the update.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 1389ba87-41a3-4a0b-80a1-65f36cdf7466

📥 Commits

Reviewing files that changed from the base of the PR and between 8481361 and b4fd494.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• go.mod

[rohanKanojia]

/retest

[openshift-ci]

@rohanKanojia: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/v14-che-happy-path	b4fd494	link	true	/test v14-che-happy-path

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.