[release-4.16] OCPBUGS-102893,OCPBUGS-102895: Bump golang.org/x/net to v0.35.0-sec.3

[MrSanketkumar]

- What this PR does and why is it needed

Fixes CVE-2026-33814 (CVSS 7.5) in the golang.org/x/net package on the release-4.16 branch.

Rather than bumping golang.org/x/net to v0.56.0 (which would require go version bump), this PR uses the OpenShift sustaining fork github.com/openshift-sustaining/net@v0.35.0-sec.3, which backports the CVE fix onto the existing v0.35.x baseline.

Commands used:

go mod edit -replace golang.org/x/net=github.com/openshift-sustaining/net@v0.35.0-sec.3
go mod tidy && go mod vendor

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: f55d3026-6c06-48b4-ba38-573d4383e1d2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci-robot]

@MrSanketkumar: This pull request references Jira Issue OCPBUGS-102893, which is invalid:

• expected dependent Jira Issue OCPBUGS-103126 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is ASSIGNED instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

This pull request references Jira Issue OCPBUGS-102895, which is invalid:

• expected dependent Jira Issue OCPBUGS-102064 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is ASSIGNED instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

- What this PR does and why is it needed

Fixes CVE-2026-33814 (CVSS 7.5) in the golang.org/x/net package on the release-4.16 branch.

Rather than bumping golang.org/x/net to v0.56.0 (which would require go version bump), this PR uses the OpenShift sustaining fork github.com/openshift-sustaining/net@v0.35.0-sec.3, which backports the CVE fix onto the existing v0.35.x baseline.

Commands used:

go mod edit -replace golang.org/x/net=github.com/openshift-sustaining/net@v0.35.0-sec.3
go mod tidy && go mod vendor

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[germanparente]

backport-risk-assessed
/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: germanparente, MrSanketkumar
Once this PR has been reviewed and has the lgtm label, please assign jcaamano for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[germanparente]

/label backport-risk-assessed
/label approved

[redhat-chai-bot]

ci/prow/unit-test Failure Analysis

The unit-test failure on this PR is not caused by the CVE dependency changes. All other CI checks pass (images, lint, test-fmt, ci-index-ingress-node-firewall-bundle, ingress-node-firewall-e2e-metal-ipi), confirming the golang.org/x/net replacement with openshift-sustaining/net v0.35.0-sec.3 is correct.

Root Cause: Broken setup-envtest infrastructure in the Makefile

The unit tests never actually ran. The failure happens during the environment setup phase — the Makefile downloads setup-envtest.sh from controller-runtime v0.8.3, which tries to fetch envtest tools from a URL that now returns invalid data (not a gzip archive).

This is the same pre-existing infrastructure issue affecting all release branches (4.14–4.18). See #769 for the fix — it replaces the broken shell-script approach with go install sigs.k8s.io/controller-runtime/tools/setup-envtest.

Fork Version Verification

• Base branch release-4.16 uses go 1.21.0 with golang.org/x/net v0.23.0
• Fork version v0.35.0-sec.3 requires Go ≥ 1.18, which is compatible ✅

---

AI-generated. Review for accuracy.

[germanparente]

/override ci/prow/unit-test

[openshift-ci]

@germanparente: Overrode contexts on behalf of germanparente: ci/prow/unit-test

Details

In response to this:

/override ci/prow/unit-test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

@MrSanketkumar: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[MrSanketkumar]

/verified by CI

[openshift-ci-robot]

@MrSanketkumar: This PR has been marked as verified by CI.

Details

In response to this:

/verified by CI

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[MrSanketkumar]

/jira refresh

[openshift-ci-robot]

@MrSanketkumar: This pull request references Jira Issue OCPBUGS-102893, which is valid. The bug has been moved to the POST state.

7 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.16.z) matches configured target version for branch (4.16.z)
• bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)
• release note type set to "Release Note Not Required"
• dependent bug Jira Issue OCPBUGS-103126 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA))
• dependent Jira Issue OCPBUGS-103126 targets the "4.17.z" version, which is one of the valid target versions: 4.17.0, 4.17.z
• bug has dependents

Requesting review from QA contact:
/cc @sunku5494

This pull request references Jira Issue OCPBUGS-102895, which is valid. The bug has been moved to the POST state.

7 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.16.z) matches configured target version for branch (4.16.z)
• bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)
• release note type set to "Release Note Not Required"
• dependent bug Jira Issue OCPBUGS-102064 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA))
• dependent Jira Issue OCPBUGS-102064 targets the "4.17.z" version, which is one of the valid target versions: 4.17.0, 4.17.z
• bug has dependents

Requesting review from QA contact:
/cc @sunku5494

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@MrSanketkumar: Jira Issue OCPBUGS-102893: All pull requests linked via external trackers have merged:

• openshift/ingress-node-firewall#779

All linked pull requests have the verified tag. Jira Issue OCPBUGS-102893 has been moved to the VERIFIED state.

Jira Issue OCPBUGS-102895: All pull requests linked via external trackers have merged:

• openshift/ingress-node-firewall#779

All linked pull requests have the verified tag. Jira Issue OCPBUGS-102895 has been moved to the VERIFIED state.

Details

In response to this:

- What this PR does and why is it needed

Fixes CVE-2026-33814 (CVSS 7.5) in the golang.org/x/net package on the release-4.16 branch.

Rather than bumping golang.org/x/net to v0.56.0 (which would require go version bump), this PR uses the OpenShift sustaining fork github.com/openshift-sustaining/net@v0.35.0-sec.3, which backports the CVE fix onto the existing v0.35.x baseline.

Commands used:

go mod edit -replace golang.org/x/net=github.com/openshift-sustaining/net@v0.35.0-sec.3
go mod tidy && go mod vendor

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.