fix(deps): update module golang.org/x/net to v0.38.0 [security] (release-1.6) #15102

dominikholler · 2025-07-07T19:30:48Z

This PR contains the following updates:

Package	Change	Age	Confidence
golang.org/x/net	`v0.36.0` -> `v0.38.0`

Release note

Update dependecy golang.org/x/net to v0.38.0

golang.org/x/net vulnerable to Cross-site Scripting

CVE-2025-22872 / GHSA-vvgc-356p-c3xw / GO-2025-3595

More information

Details

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. , , etc contexts).

Severity

CVSS Score: Unknown
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net

CVE-2025-22872 / GHSA-vvgc-356p-c3xw / GO-2025-3595

More information

Details

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. , , etc contexts).

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

kvrenovatebot · 2025-07-07T19:30:49Z

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

5 additional dependencies were updated

Details:

Package	Change
`golang.org/x/crypto`	`v0.35.0` -> `v0.36.0`
`golang.org/x/sync`	`v0.11.0` -> `v0.12.0`
`golang.org/x/sys`	`v0.30.0` -> `v0.31.0`
`golang.org/x/term`	`v0.29.0` -> `v0.30.0`
`golang.org/x/text`	`v0.22.0` -> `v0.23.0`

File name: staging/src/kubevirt.io/api/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

1 additional dependency was updated

Details:

Package	Change
`golang.org/x/text`	`v0.22.0` -> `v0.23.0`

File name: staging/src/kubevirt.io/client-go/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

3 additional dependencies were updated

Details:

Package	Change
`golang.org/x/sys`	`v0.30.0` -> `v0.31.0`
`golang.org/x/term`	`v0.29.0` -> `v0.30.0`
`golang.org/x/text`	`v0.22.0` -> `v0.23.0`

dominikholler · 2025-07-07T21:41:12Z

/retest-required

xpivarc

/approve

kubevirt-bot · 2025-07-08T07:17:26Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: xpivarc

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [xpivarc]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

jcanocan · 2025-07-09T09:09:33Z

/lgtm

Signed-off-by: Renovate Bot <[email protected]>

jcanocan · 2025-07-10T09:26:20Z

/lgtm

dominikholler · 2025-07-10T10:31:45Z

/retest-required

kubevirt-commenter-bot · 2025-07-10T17:38:09Z

/retest-required
This bot automatically retries required jobs that failed/flaked on approved PRs.
Silence the bot with an /lgtm cancel or /hold comment for consistent failures.

dominikholler · 2025-07-10T20:19:26Z

/retest-required

kubevirt-commenter-bot · 2025-07-10T20:19:29Z

✋🧢

/hold

Dear @dominikholler

⚠️ this pull request exceeds the number of retests that are allowed per individual commit.

🔎 Please check that the changes you committed are fine and that there are no infrastructure issues present!

Details

Checklist:

your changes compile
your tests succeed locally, i.e. for k/kubevirt see
- getting-started - testing and
- CONTRIBUTING.md - testing
no linting errors
no recurring e2e test errors, i.e. in the pull-kubevirt-check-tests-for-flakes lane
no infrastructure issues, i.e.
- GitHub Status,
- quay.io status at status.redhat.com or
- KubeVirt prow status

💬 How we calculate the number of retests: The number of retest comments are the number of /test or /retest comments after the latest commit only.

👌 After all issues have been resolved, you can remove the hold on this pull request by commenting /unhold on it.

🙇 Thank you, your friendly referee automation, on behalf of the @sig-buildsystem and the KubeVirt community!

dominikholler · 2025-07-11T06:17:37Z

/unhold

dominikholler · 2025-07-11T06:18:11Z

/retest-required

kubevirt-commenter-bot · 2025-07-11T06:18:15Z

✋🧢

/hold

Dear @dominikholler

⚠️ this pull request exceeds the number of retests that are allowed per individual commit.

🔎 Please check that the changes you committed are fine and that there are no infrastructure issues present!

Details

Checklist:

your changes compile
your tests succeed locally, i.e. for k/kubevirt see
- getting-started - testing and
- CONTRIBUTING.md - testing
no linting errors
no recurring e2e test errors, i.e. in the pull-kubevirt-check-tests-for-flakes lane
no infrastructure issues, i.e.
- GitHub Status,
- quay.io status at status.redhat.com or
- KubeVirt prow status

💬 How we calculate the number of retests: The number of retest comments are the number of /test or /retest comments after the latest commit only.

👌 After all issues have been resolved, you can remove the hold on this pull request by commenting /unhold on it.

🙇 Thank you, your friendly referee automation, on behalf of the @sig-buildsystem and the KubeVirt community!

dominikholler · 2025-07-11T06:18:37Z

/unhold

dominikholler · 2025-07-11T08:53:05Z

/retest-required

kubevirt-commenter-bot · 2025-07-11T08:53:08Z

✋🧢

/hold

Dear @dominikholler

⚠️ this pull request exceeds the number of retests that are allowed per individual commit.

🔎 Please check that the changes you committed are fine and that there are no infrastructure issues present!

Details

Checklist:

your changes compile
your tests succeed locally, i.e. for k/kubevirt see
- getting-started - testing and
- CONTRIBUTING.md - testing
no linting errors
no recurring e2e test errors, i.e. in the pull-kubevirt-check-tests-for-flakes lane
no infrastructure issues, i.e.
- GitHub Status,
- quay.io status at status.redhat.com or
- KubeVirt prow status

💬 How we calculate the number of retests: The number of retest comments are the number of /test or /retest comments after the latest commit only.

👌 After all issues have been resolved, you can remove the hold on this pull request by commenting /unhold on it.

🙇 Thank you, your friendly referee automation, on behalf of the @sig-buildsystem and the KubeVirt community!

dominikholler · 2025-07-11T13:08:30Z

/unhold

kubevirt-bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. size/XXL labels Jul 7, 2025

kubevirt-bot requested review from enp0s3 and mhenriks July 7, 2025 19:31

kubevirt-bot added the kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API label Jul 7, 2025

xpivarc reviewed Jul 8, 2025

View reviewed changes

kubevirt-bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 8, 2025

kubevirt-bot assigned jcanocan Jul 9, 2025

kubevirt-bot added lgtm Indicates that a PR is ready to be merged. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Jul 9, 2025

fix(deps): update module golang.org/x/net to v0.38.0 [security]

c121484

Signed-off-by: Renovate Bot <[email protected]>

dominikholler force-pushed the renovate/release-1.6-go-golang.org-x-net-vulnerability branch from 3dfd223 to c121484 Compare July 9, 2025 13:22

kubevirt-bot removed lgtm Indicates that a PR is ready to be merged. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Jul 9, 2025

kubevirt-bot added the lgtm Indicates that a PR is ready to be merged. label Jul 10, 2025

kubevirt-bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 10, 2025

kubevirt-bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 11, 2025

kubevirt-bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 11, 2025

kubevirt-bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 11, 2025

kubevirt-bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 11, 2025

kubevirt-bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 11, 2025

kubevirt-bot merged commit e4cdd5a into kubevirt:release-1.6 Jul 11, 2025
39 checks passed

dominikholler deleted the renovate/release-1.6-go-golang.org-x-net-vulnerability branch July 11, 2025 13:15

fix(deps): update module golang.org/x/net to v0.38.0 [security] (release-1.6) #15102

fix(deps): update module golang.org/x/net to v0.38.0 [security] (release-1.6) #15102

Uh oh!

Conversation

dominikholler commented Jul 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release note

golang.org/x/net vulnerable to Cross-site Scripting

Details

Severity

References

Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net

Details

Severity

References

Configuration

Uh oh!

kvrenovatebot commented Jul 7, 2025

ℹ Artifact update notice

File name: go.mod

File name: staging/src/kubevirt.io/api/go.mod

File name: staging/src/kubevirt.io/client-go/go.mod

Uh oh!

dominikholler commented Jul 7, 2025

Uh oh!

xpivarc left a comment

Choose a reason for hiding this comment

Uh oh!

kubevirt-bot commented Jul 8, 2025

Uh oh!

jcanocan commented Jul 9, 2025

Uh oh!

jcanocan commented Jul 10, 2025

Uh oh!

dominikholler commented Jul 10, 2025

Uh oh!

kubevirt-commenter-bot commented Jul 10, 2025

Uh oh!

dominikholler commented Jul 10, 2025

Uh oh!

kubevirt-commenter-bot commented Jul 10, 2025

Uh oh!

dominikholler commented Jul 11, 2025

Uh oh!

dominikholler commented Jul 11, 2025

Uh oh!

kubevirt-commenter-bot commented Jul 11, 2025

Uh oh!

dominikholler commented Jul 11, 2025

Uh oh!

dominikholler commented Jul 11, 2025

Uh oh!

kubevirt-commenter-bot commented Jul 11, 2025

Uh oh!

dominikholler commented Jul 11, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

dominikholler commented Jul 7, 2025 •

edited

Loading