[master] ACM-40436: Bump Go toolchain to go1.26.5 to fix stdlib CVEs

[shay23bra]

Bump Go toolchain from go1.26.2 to go1.26.5 in all go.mod files.

Fixed CVEs

• CVE-2026-39820 (stdlib, CVSS 7.5)
• CVE-2026-33814 (stdlib, CVSS 7.5)
• CVE-2026-33811 (stdlib, CVSS 7.5)
• CVE-2026-42499 (stdlib, CVSS 7.5)
• CVE-2026-27145 (stdlib, CVSS 7.5)
• CVE-2026-42504 (stdlib, CVSS 7.5)
• CVE-2026-39822 (stdlib, CVSS 7.5)

Summary by CodeRabbit

• Chores
  • Updated the application’s Go toolchain requirement to version 1.26.5.
  • Applied the update consistently across all project components.

[openshift-ci-robot]

@shay23bra: This pull request references ACM-40436 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the vulnerability to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Bump Go toolchain from go1.26.2 to go1.26.5 in all go.mod files.

Fixed CVEs

• CVE-2026-39820 (stdlib, CVSS 7.5)
• CVE-2026-33814 (stdlib, CVSS 7.5)
• CVE-2026-33811 (stdlib, CVSS 7.5)
• CVE-2026-42499 (stdlib, CVSS 7.5)
• CVE-2026-27145 (stdlib, CVSS 7.5)
• CVE-2026-42504 (stdlib, CVSS 7.5)
• CVE-2026-39822 (stdlib, CVSS 7.5)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Walkthrough

The pull request updates the Go toolchain directive from 1.26.2 to 1.26.5 in the root, API, client, and models modules.

Changes

Go toolchain alignment

Layer / File(s)	Summary
Module toolchain updates go.mod, api/go.mod, client/go.mod, models/go.mod	All four Go modules now require Go 1.26.5 instead of Go 1.26.2.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• openshift/assisted-service#10758: Updates the Go toolchain from 1.26.2 to 1.26.5 in the same four go.mod files.

Suggested labels: size/XS, jira/valid-bug

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description states the toolchain change and lists the CVEs, but it omits the required issue, environment, testing, and checklist sections.	Add the template sections for related issues, impacted environments, testing details, and checklist completion.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the Go toolchain upgrade and its security purpose.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes only four go.mod toolchain directives; no Go source or test files, including Ginkgo test titles, changed.
Test Structure And Quality	✅ Passed	The PR changes only four go.mod toolchain directives; no Ginkgo test files or test constructs changed, so these test-quality requirements are not applicable.
Microshift Test Compatibility	✅ Passed	The parent-to-HEAD diff changes only four go.mod files; it adds no Ginkgo e2e tests or MicroShift-incompatible API usage to assess.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR changes only four go.mod toolchain directives; it adds no Ginkgo e2e tests or cluster-topology assumptions requiring SNO review.
Topology-Aware Scheduling Compatibility	✅ Passed	The commit changes only the toolchain directive in four go.mod files; it adds no manifests, operators, controllers, or scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	The PR changes only toolchain directives in four go.mod files; the repository has no openshift-tests, OTE, or test-extension references, so this check is not applicable.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR changes only four go.mod toolchain lines; it adds no Ginkgo e2e tests or networking and external-connectivity code to assess.
No-Weak-Crypto	✅ Passed	The patch changes only four go.mod toolchain directives; it adds no weak-crypto API, custom crypto implementation, or secret comparison.
Container-Privileges	✅ Passed	The PR changes only four Go module toolchain lines. No container or Kubernetes manifest changes add privileged, host namespace, SYS_ADMIN, root, or privilege-escalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	The PR changes only four go.mod toolchain lines; no logging calls or sensitive-data indicators were added.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: shay23bra

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [shay23bra]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@go.mod`:
- Line 5: Pin Go toolchain usage to exactly 1.26.5 across all builds: update the
toolchain declarations in go.mod (anchor, lines 5-5), api/go.mod (sibling, lines
5-5), client/go.mod (sibling, lines 5-5), and models/go.mod (sibling, lines
5-5), and replace floating 1.26 UBI Go build-image tags in root, API, client,
models, CI, and release build configurations with Go 1.26.5 tags or enforce the
same version through build-time go version checks.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 525535b9-41ab-4b5d-871d-7ee7e01b140a

📥 Commits

Reviewing files that changed from the base of the PR and between 90c28e0 and ecdaeb9.

📒 Files selected for processing (4)

• api/go.mod
• client/go.mod
• go.mod
• models/go.mod

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 44.69%. Comparing base (90c28e0) to head (ecdaeb9).

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #10770      +/-   ##
==========================================
- Coverage   44.69%   44.69%   -0.01%     
==========================================
  Files         426      426              
  Lines       73903    73903              
==========================================
- Hits        33033    33031       -2     
- Misses      37915    37916       +1     
- Partials     2955     2956       +1     

see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[gamli75]

/lgtm

[cve-automation]

/retest

[gamli75]

/override ci/prow/edge-e2e-ai-operator-disconnected-capi ci/prow/edge-e2e-ai-operator-ztp-capi

[openshift-ci]

@gamli75: Overrode contexts on behalf of gamli75: ci/prow/edge-e2e-ai-operator-disconnected-capi, ci/prow/edge-e2e-ai-operator-ztp-capi

Details

In response to this:

/override ci/prow/edge-e2e-ai-operator-disconnected-capi ci/prow/edge-e2e-ai-operator-ztp-capi

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 90c28e0 and 2 for PR HEAD ecdaeb9 in total

[gamli75]

/override ci/prow/edge-e2e-ai-operator-ztp

[openshift-ci]

@gamli75: Overrode contexts on behalf of gamli75: ci/prow/edge-e2e-ai-operator-ztp

Details

In response to this:

/override ci/prow/edge-e2e-ai-operator-ztp

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[gamli75]

/test edge-subsystem-kubeapi-aws

[openshift-ci]

@shay23bra: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.