OADP-7565: Go 1.25.8 toolchain + golang.org/x/* CVE bumps

[kaovilai]

Summary

• Adds toolchain go1.25.8 directive to fix Go stdlib CVEs:
  • GO-2026-4337, GO-2026-4340 (crypto/tls)
  • GO-2026-4341 (net/url)
  • GO-2026-4342 (archive/zip)
  • CVE-2026-25679 (net/url IPv6 host parsing)
  • CVE-2026-27137 (crypto/x509 email constraints)
• Bumps golang.org/x/net v0.38.0 → v0.52.0 (fixes GHSA-vvgc-356p-c3xw, XSS in HTML tokenizer)
• Transitive bumps: x/sys → v0.42.0, x/text → v0.35.0, x/term → v0.41.0, x/mod → v0.33.0

Note

golang.org/x/crypto is not in this module's dependency graph — those CVEs do not apply here.

Test plan

• go build ./... passes
• CI passes

Note

Responses generated with Claude

[openshift-ci-robot]

@kaovilai: This pull request references OADP-7565 which is a valid jira issue.

Details

In response to this:

Summary

• Adds toolchain go1.25.8 directive to fix Go stdlib CVEs:
• GO-2026-4337, GO-2026-4340 (crypto/tls)
• GO-2026-4341 (net/url)
• GO-2026-4342 (archive/zip)
• CVE-2026-25679 (net/url IPv6 host parsing)
• CVE-2026-27137 (crypto/x509 email constraints)
• Bumps golang.org/x/net v0.38.0 → v0.52.0 (fixes GHSA-vvgc-356p-c3xw, XSS in HTML tokenizer)
• Transitive bumps: x/sys → v0.42.0, x/text → v0.35.0, x/term → v0.41.0, x/mod → v0.33.0

[!Note]
golang.org/x/crypto is not in this module's dependency graph — those CVEs do not apply here.

Test plan

• go build ./... passes
• CI passes

[!Note]
Responses generated with Claude

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[Copilot]

Pull request overview

Updates the module’s Go toolchain configuration and refreshes several golang.org/x/* indirect dependencies to newer versions.

Changes:

• Add a toolchain go1.25.8 directive to go.mod.
• Bump indirect golang.org/x/mod, x/net, x/sys, x/term, x/text versions in go.mod.
• Update go.sum checksums to match the upgraded dependencies.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.

File	Description
go.mod	Pins the Go toolchain and updates indirect golang.org/x/* dependency versions.
go.sum	Updates dependency checksums to align with the module version bumps.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[mpryc]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kaovilai, mpryc, weshayutin

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [kaovilai,mpryc,weshayutin]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[kaovilai]

Closed in favor of #164. Branches were pushed directly to migtools/oadp-cli instead of a fork, which caused branch protection rules to block subsequent pushes (workflow file updates). Recreated from a new branch. Will use fork origin (kaovilai/oadp-cli) for future PRs.

Note

Responses generated with Claude