deps(go): bump golang.org/x/crypto to v0.52.0 (AROSLSRE-1455) by raelga · Pull Request #6000 · Azure/ARO-HCP

Rael Garcia (raelga) · 2026-07-09T16:32:33Z

What

Bump golang.org/x/crypto from v0.51.0 to v0.52.0 across all 23 affected workspace modules (2 direct importers, the rest indirect), regenerated with make all-tidy.

Why

Resolves 286 open Dependabot alerts — by far the largest single source of open alerts on the repo (the other ~22 open alerts are unrelated packages). These stem from 13 distinct golang.org/x/crypto advisories (7 critical, 2 high, 4 medium) fanned out across the 23 affected workspace modules. Highlights: auth bypass via unenforced @revoked status (CVE-2026-42508), agent constraint / key-constraint bypasses (CVE-2026-39832/39833), and several SSH server DoS issues.

CVEs fixed

CVE-2026-42508, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39830, CVE-2026-46595, CVE-2026-46597, CVE-2026-39829, CVE-2026-39828, CVE-2026-39835, CVE-2026-46598, CVE-2026-39827

Alert search: open Dependabot alerts for golang.org/x/crypto

Testing

make all-tidy (per-module go mod tidy + go work sync + fmt + licenses) — clean.
go build ./... passes for all 23 affected modules.

Special notes for your reviewer

Dependency-only change; diff is limited to go.mod / go.sum / go.work.sum. No source edits. Part of the go.work-aware Dependabot remediation effort (AROSLSRE-1448).

Closes #5964
Closes #5965

PR Checklist

PR is scoped to a single task (no mixed concerns)
Title follows Conventional Commits format
Summary explains the "Why" behind the change
Linked to relevant ticket/issue
Screenshots included (if graph/UI/metrics changes)
Self-reviewed the diff
CI/CD checks are passing (ignore Tide)
Commit history is clean (rebased/squashed)

Fixes 13 advisories (7 critical, 2 high, 4 medium) reported by Dependabot across 23 workspace modules. Ran make all-tidy (go mod tidy per module + go work sync + fmt + licenses); go build ./... passes for all affected modules.

Copilot

Pull request overview

Updates the repository’s Go workspace modules to use golang.org/x/crypto v0.52.0, addressing multiple security advisories while keeping the change scoped to dependency metadata (go.mod/go.sum).

Changes:

Bump golang.org/x/crypto from v0.51.0 → v0.52.0 across the affected workspace modules.
Refresh module checksum files (go.sum) to match the updated dependency graph.
Add/update indirect requirements where needed to reflect the new resolved version.

Reviewed changes

Copilot reviewed 23 out of 46 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
tooling/tenant-quota/go.mod	Bump `golang.org/x/crypto` to v0.52.0 (indirect).
tooling/tenant-quota/go.sum	Update checksums for `golang.org/x/crypto` v0.52.0.
tooling/templatize/go.mod	Bump `golang.org/x/crypto` to v0.52.0 (indirect).
tooling/templatize/go.sum	Update checksums for `golang.org/x/crypto` v0.52.0.
tooling/secret-sync/go.mod	Bump `golang.org/x/crypto` to v0.52.0 (indirect).
tooling/secret-sync/go.sum	Update checksums for `golang.org/x/crypto` v0.52.0.
tooling/prometheus-rules/go.mod	Add/update `golang.org/x/crypto` v0.52.0 (indirect).
tooling/prometheus-rules/go.sum	Update checksums for `golang.org/x/crypto` v0.52.0.
tooling/kustoctl/go.mod	Bump `golang.org/x/crypto` to v0.52.0 (indirect).
tooling/kustoctl/go.sum	Update checksums for `golang.org/x/crypto` v0.52.0.
tooling/image-updater/go.mod	Bump `golang.org/x/crypto` to v0.52.0 (indirect).
tooling/image-updater/go.sum	Update checksums for `golang.org/x/crypto` v0.52.0.
tooling/helmtest/go.mod	Bump `golang.org/x/crypto` to v0.52.0 (indirect).
tooling/helmtest/go.sum	Update checksums for `golang.org/x/crypto` v0.52.0.
tooling/hcpctl/go.mod	Bump `golang.org/x/crypto` to v0.52.0 (indirect).
tooling/hcpctl/go.sum	Update checksums for `golang.org/x/crypto` v0.52.0.
tooling/grafanactl/go.mod	Bump `golang.org/x/crypto` to v0.52.0 (indirect).
tooling/grafanactl/go.sum	Update checksums for `golang.org/x/crypto` v0.52.0.
tooling/cleanup-sweeper/go.mod	Bump `golang.org/x/crypto` to v0.52.0 (indirect).
tooling/cleanup-sweeper/go.sum	Update checksums for `golang.org/x/crypto` v0.52.0.
tooling/aro-hcp-exporter/go.mod	Bump `golang.org/x/crypto` to v0.52.0 (indirect).
tooling/aro-hcp-exporter/go.sum	Update checksums for `golang.org/x/crypto` v0.52.0.
test/go.mod	Bump direct `golang.org/x/crypto` dependency to v0.52.0.
test/go.sum	Update checksums for `golang.org/x/crypto` v0.52.0.
test-integration/go.mod	Bump `golang.org/x/crypto` to v0.52.0 (indirect).
test-integration/go.sum	Update checksums for `golang.org/x/crypto` v0.52.0.
sessiongate/go.mod	Bump `golang.org/x/crypto` to v0.52.0 (indirect).
sessiongate/go.sum	Update checksums for `golang.org/x/crypto` v0.52.0.
mgmt-agent/go.mod	Bump `golang.org/x/crypto` to v0.52.0 (indirect).
mgmt-agent/go.sum	Update checksums for `golang.org/x/crypto` v0.52.0.
kube-applier/go.mod	Bump `golang.org/x/crypto` to v0.52.0 (indirect).
kube-applier/go.sum	Update checksums for `golang.org/x/crypto` v0.52.0.
internal/go.mod	Bump `golang.org/x/crypto` to v0.52.0 (indirect).
internal/go.sum	Update checksums for `golang.org/x/crypto` v0.52.0.
frontend/go.mod	Bump `golang.org/x/crypto` to v0.52.0 (indirect).
frontend/go.sum	Update checksums for `golang.org/x/crypto` v0.52.0.
fleet/go.mod	Bump `golang.org/x/crypto` to v0.52.0 (indirect).
fleet/go.sum	Update checksums for `golang.org/x/crypto` v0.52.0.
dev-infrastructure/scripts/postgres-access/go.mod	Bump `golang.org/x/crypto` to v0.52.0 (indirect).
dev-infrastructure/scripts/postgres-access/go.sum	Update checksums for `golang.org/x/crypto` v0.52.0.
backend/go.mod	Bump `golang.org/x/crypto` to v0.52.0 (indirect).
backend/go.sum	Update checksums for `golang.org/x/crypto` v0.52.0.
admin/server/go.mod	Bump `golang.org/x/crypto` to v0.52.0 (indirect).
admin/server/go.sum	Update checksums for `golang.org/x/crypto` v0.52.0.
admin/client/go.mod	Bump direct `golang.org/x/crypto` dependency to v0.52.0.
admin/client/go.sum	Update checksums for `golang.org/x/crypto` v0.52.0.

…OSLSRE-1455)

Rael Garcia (raelga) · 2026-07-09T16:58:40Z

Pushed bd8ae13 to fix a genuine, in-scope ci/prow/verify failure (verify-deepcopy).

Failure: the job showed go.sum drift in tooling/prometheus-rules/go.sum — the golang.org/x/crypto v0.52.0/go.mod hash line was missing (only the h1: line was present). This is the mechanical consequence of the x/crypto bump for that module; my local make all-tidy had regenerated the other 22 modules but this module's go.mod hash only materializes when a build resolves it inside that module (which the CI make deepcopy step does).

Fix: go mod tidy in tooling/prometheus-rules, then make all-tidy to confirm no siblings drifted — only that one go.sum line changed. Diff remains dependency-only.

Copilot

Pull request overview

Copilot reviewed 23 out of 46 changed files in this pull request and generated 1 comment.

Rael Garcia (raelga) · 2026-07-09T17:10:52Z

/test periodic-healthcheck-images

Retesting: this is an environmental/network flake, not caused by this PR. The aro-hcp-e2e-tests image build failed while downloading the Bicep CLI:

az bicep build ...
ERROR: Error while attempting to download Bicep CLI: <urlopen error [Errno -2] Name or service not known>
make: *** [Makefile:14: .../cluster.json] Error 1

That's a DNS-resolution failure inside the build sandbox (Name or service not known) — a transient infra issue. This PR only bumps golang.org/x/crypto go.mod/go.sum hashes and cannot affect Bicep CLI download. Re-running on a healthier node.

Anthony Vollmer (avollmer-redhat)

/lgtm

Dep-only change: golang.org/x/crypto v0.51.0 → v0.52.0 across all 23 workspace modules. Fixes 13 CVEs (286 Dependabot alerts). go.mod/go.sum only, no source changes. e2e-parallel failure is unrelated to a transitive crypto bump.

openshift-merge-bot · 2026-07-09T19:01:20Z

/retest-required

Remaining retests: 0 against base HEAD da52c18 and 2 for PR HEAD bd8ae13 in total

openshift-merge-bot · 2026-07-09T22:08:39Z

/retest-required

Remaining retests: 0 against base HEAD ccc61d2 and 1 for PR HEAD bd8ae13 in total

openshift-merge-bot · 2026-07-10T01:19:51Z

/retest-required

Remaining retests: 0 against base HEAD e1b1907 and 0 for PR HEAD bd8ae13 in total

openshift-merge-bot · 2026-07-10T09:18:41Z

/hold

Revision bd8ae13 was retested 3 times: holding

Rael Garcia (raelga) · 2026-07-12T16:23:30Z

/unhold
/retest

Steven Clarkson (sclarkso) · 2026-07-12T20:39:33Z

/retest-required

openshift-merge-bot · 2026-07-12T21:08:52Z

/retest-required

Remaining retests: 0 against base HEAD cc2ae51 and 2 for PR HEAD bd8ae13 in total

Steven Clarkson (sclarkso) · 2026-07-13T01:44:45Z

/retest-required

Steven Clarkson (sclarkso) · 2026-07-13T03:58:48Z

/test e2e-parallel

Rael Garcia (raelga) · 2026-07-13T07:05:26Z

/test e2e-parallel

Investigation: the e2e-parallel failures are an environmental flake, not caused by this PR.

Evidence:

This PR ships no runtime change — it only adds/updates golang.org/x/crypto go.mod/go.sum hash lines across workspace modules. No component image digests, no config, no source. It physically cannot regress guest-cluster provisioning.
It already passed on this exact HEAD (bd8ae13): e2e-parallel build 2076341735268552704 = SUCCESS. Subsequent runs flaked.
Non-deterministic signature: failures hit different CreateHCPCluster20251223FromParam / ...AndWait operations across candidate 4.20 / 4.21 / 4.22 from run to run — the classic timeout '20.000000' minutes exceeded during CreateHCPCluster ARM-throttling / shared-CI capacity timeout, not a reproducible spec failure.
Fleet-wide: the identical CreateHCPCluster … 20 minutes exceeded timeout is currently failing unrelated PRs too (e.g. do not merge: OCPBUGS-98213 Verification #6033, an mgmt-agent-only change), while other PRs (backend: add a controller to auto-scale the Azure Monitor Workspace #6036, e2e: use delta-only logging in all polling loops, remove event dumps #6027) pass — consistent with a shared-CI provisioning episode, not this diff.

Re-running to catch a green window so tide can merge.

Rael Garcia (raelga) · 2026-07-13T15:24:30Z

/lgtm
/approve

openshift-ci · 2026-07-13T15:24:32Z

Rael Garcia (@raelga): you cannot LGTM your own PR.

Details

In response to this:

/lgtm
/approve

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci · 2026-07-13T15:24:38Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: avollmer-redhat, raelga

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [raelga]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Rael Garcia (raelga) · 2026-07-13T15:25:17Z

/retest

Rael Garcia (raelga) · 2026-07-13T18:32:55Z

/retest ci/prow/e2e-parallel

Latest e2e-parallel (build 2076689477199204352, 15:25Z) failed with the fleet-wide ARM-provisioning throttling signature — 5× timeout '20.000000' minutes exceeded during CreateHCPCluster across specs, no code-related failure. This PR is a pure x/crypto go.mod/go.sum bump (no runtime change) and previously passed e2e on this same HEAD bd8ae13. All other checks green; lgtm+approved. Retesting to clear the environmental flake.

Rael Garcia (raelga) · 2026-07-13T18:39:19Z

/test e2e-parallel

openshift-merge-bot · 2026-07-14T00:33:13Z

/retest-required

Remaining retests: 0 against base HEAD 4990e79 and 1 for PR HEAD bd8ae13 in total

deps: bump golang.org/x/crypto to v0.52.0

709437d

Fixes 13 advisories (7 critical, 2 high, 4 medium) reported by Dependabot across 23 workspace modules. Ran make all-tidy (go mod tidy per module + go work sync + fmt + licenses); go build ./... passes for all affected modules.

Copilot AI review requested due to automatic review settings July 9, 2026 16:32

openshift-ci Bot requested review from Anthony Vollmer (avollmer-redhat) and Ben Vesel (bennerv) July 9, 2026 16:32

openshift-ci Bot added the approved label Jul 9, 2026

Copilot started reviewing on behalf of Rael Garcia (raelga) July 9, 2026 16:33 View session

Copilot AI reviewed Jul 9, 2026

View reviewed changes

deps: add missing x/crypto go.mod hash in prometheus-rules go.sum (AR…

bd8ae13

…OSLSRE-1455)

Copilot AI review requested due to automatic review settings July 9, 2026 16:58

Copilot started reviewing on behalf of Rael Garcia (raelga) July 9, 2026 16:58 View session

Copilot AI reviewed Jul 9, 2026

View reviewed changes

Comment thread backend/go.mod

Anthony Vollmer (avollmer-redhat) approved these changes Jul 9, 2026

View reviewed changes

openshift-ci Bot assigned Anthony Vollmer (avollmer-redhat) Jul 9, 2026

openshift-ci Bot added the lgtm label Jul 9, 2026

openshift-ci Bot added the do-not-merge/hold label Jul 10, 2026

openshift-ci Bot removed the do-not-merge/hold label Jul 12, 2026

openshift-merge-bot Bot merged commit 14eda6f into Azure:main Jul 14, 2026
19 checks passed

Uh oh!

Conversation

Rael Garcia (raelga) commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Why

CVEs fixed

Testing

Special notes for your reviewer

PR Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Rael Garcia (raelga) commented Jul 9, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Rael Garcia (raelga) commented Jul 9, 2026

Uh oh!

Anthony Vollmer (avollmer-redhat) left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-merge-bot Bot commented Jul 9, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 9, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 10, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 10, 2026

Uh oh!

Rael Garcia (raelga) commented Jul 12, 2026

Uh oh!

Steven Clarkson (sclarkso) commented Jul 12, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 12, 2026

Uh oh!

Steven Clarkson (sclarkso) commented Jul 13, 2026

Uh oh!

Steven Clarkson (sclarkso) commented Jul 13, 2026

Uh oh!

Rael Garcia (raelga) commented Jul 13, 2026

Uh oh!

Rael Garcia (raelga) commented Jul 13, 2026

Uh oh!

openshift-ci Bot commented Jul 13, 2026

Uh oh!

openshift-ci Bot commented Jul 13, 2026

Uh oh!

Rael Garcia (raelga) commented Jul 13, 2026

Uh oh!

Rael Garcia (raelga) commented Jul 13, 2026

Uh oh!

Rael Garcia (raelga) commented Jul 13, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Rael Garcia (raelga) commented Jul 9, 2026 •

edited

Loading