fix(cve): bump Go stdlib to 1.25.11 and golang.org/x/net to v0.55.0 [pipelines-1.20]

[divyansh42]

CVE Fix Summary — pipelines-1.20 (release-v0.42.2)

Bumps Go stdlib from 1.25.9 → 1.25.11 and golang.org/x/net from v0.49.0 → v0.55.0 to remediate multiple confirmed vulnerabilities.

CVE Details

Go Standard Library — fixed in go1.25.11

ID	Package	Description
GO-2026-5039	net/textproto	Arbitrary inputs included in errors without escaping
GO-2026-5038	mime	Quadratic complexity in WordDecoder.DecodeHeader
GO-2026-5037	crypto/x509	Inefficient candidate hostname parsing
GO-2026-4986	net/mail	Quadratic string concatenation in consumeComment
GO-2026-4982	html/template	Bypass of meta content URL escaping — XSS
GO-2026-4981	net	Crash when handling long CNAME response
GO-2026-4980	html/template	Escaper bypass leads to XSS
GO-2026-4977	net/mail	Quadratic string concatenation in consumePhrase
GO-2026-4976	net/http/httputil	ReverseProxy forwards excess query parameters
GO-2026-4971	net	Panic on NUL byte in Dial/LookupPort on Windows
GO-2026-4947	crypto/x509	Unexpected work during chain building
GO-2026-4946	crypto/x509	Inefficient policy validation
GO-2026-4870	crypto/tls	Unauthenticated TLS 1.3 KeyUpdate causes DoS
GO-2026-4869	archive/tar	Unbounded allocation for old GNU sparse
GO-2026-4865	html/template	JsBraceDepth context tracking XSS
GO-2026-4864	internal/syscall/unix	TOCTOU root escape on Linux via Root.Chmod
GO-2026-4918	net/http	HTTP/2 infinite loop on bad SETTINGS_MAX_FRAME_SIZE

golang.org/x/net — fixed in v0.55.0

ID	Description
GO-2026-5026	ASCII-only Punycode label bypass in IDNA validation
GO-2026-4918	HTTP/2 infinite loop via bad SETTINGS_MAX_FRAME_SIZE

Fix Summary

• go 1.25.9 → go 1.25.11 in go.mod
• golang.org/x/net v0.49.0 → v0.55.0
• go mod tidy && go mod verify && go mod vendor

Test Results

✅ All unit tests passed (exit code 0)

Risk Assessment

Low — patch-level stdlib bump with no API changes. All unit tests pass.

Jira References

No active Jira CVE tickets for Tekton CLI component at time of fix. Vulnerabilities discovered via govulncheck direct scan of tektoncd/cli main.

Component: Tekton CLI (pipelines-cli-tkn-rhel9)
Product Version: pipelines-1.20
Lead: Divyanshu Agrawal (diagrawa@redhat.com)

[tekton-robot]

@divyansh42: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[pratap0007]

/retest

[vdemeester]

/lgtm

[tekton-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: vdemeester

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [vdemeester]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[divyansh42]

/hold