[matthyx]

Updates dependencies embedded in the operator image to address CVE-2026-116587 (go-jose), CVE-2026-78661 and CVE-2026-97045 (x/net), GO-2026-5932 (x/crypto), GO-2026-6888 (Brotli), GO-2026-6865 (compression), GO-2026-6094 (CEL), and GO-2026-6107 (etcd client). Includes the x/* companion versions required by these patches. Sets the minimum Go version and CI toolchain to 1.26.11, matching the toolchain used for the validated Docker builds.

Validation:

• go test -p 2 ./... passed.
• Production Dockerfile builds successfully on linux/amd64.
• Trivy 0.76.2 scans of the rebuilt image show no OS findings and no remaining findings for the patched dependencies.
• govulncheck -mode=binary -json reports no findings with an available fixed module version in the rebuilt operator executable.

Residual scan findings: Trivy still reports CVE-2026-33997 and CVE-2026-34040 against legacy Docker/Moby modules. Its suggested 29.3.1 is a Docker Engine release, not an installable version of these legacy Go modules (go list returns unknown revision). The plugin privilege advisory and AuthZ advisory concern Docker daemon behavior. Govulncheck reports no fixed legacy module versions and also lists unfixed legacy containerd and AWS SDK advisories. These are left visible; no ignore rules were added.

Summary by CodeRabbit

• Chores
  • Updated the Go version used for builds and releases to 1.26.11.
  • Refreshed supporting libraries for synchronization, compression, cryptography, and service communication.
  • No direct user-facing features or behavior changes are included.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The pull request updates Go versions in two workflows and in go.mod. It also updates versions for several direct and indirect dependencies.

Changes: Go version and dependency updates

Layer / File(s)	Summary
Update workflow Go versions .github/workflows/pr-created.yaml, .github/workflows/pr-merged.yaml	The workflows now use Go version 1.26.11.
Update module requirements go.mod	The module Go version changes to 1.26.11. Several direct and indirect dependency versions also change.

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Other

Merge Risk: Minimal · up to e1bcf

This change patches vulnerable dependencies and moves the Go toolchain to 1.26.11. No concrete merge-blocking risk was identified. Check the license compliance status before merging.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title "fix(deps): patch vulnerabilities in container image dependencies" matches the main change. The PR updates Go module dependencies in go.mod to address listed vulnerabilities (go-jose, x/net,…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title "fix(deps): patch vulnerabilities in container image dependencies" matches the main change. The PR updates Go module dependencies in go.mod to address listed vulnerabilities (go-jose, x/net, x/crypto, Brotli, compression, CEL, etcd client) and raises the Go toolchain to 1.26.11 in CI workflows. The title is specific and concise. It does not mention the Go toolchain bump, but that is secondary to the dependency patches.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6a8d366d-8a6f-4b79-80f9-fa3c25480ea5

Commits

Reviewing files that changed from the base of the PR and between 1c4c226 and e1bcf63.

Files ignored due to path filters: 1

• go.sum is excluded by !**/*.sum

Files selected for processing: 3

• .github/workflows/pr-created.yaml
• .github/workflows/pr-merged.yaml
• go.mod

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[github-actions]

Summary:

• License scan: success
• Credentials scan: failure
• Vulnerabilities scan: success
• Unit test: success
• Go linting: success