fix: mitigate CVEs based on report 2026-06-29

[diafour]

What this PR does

Mitigate Trivy-reported High/Critical vulnerabilities in KubeVirt fork dependencies.

Updated CVE-related replacements

• golang.org/x/crypto -> v0.52.0
• golang.org/x/net -> v0.55.0
• golang.org/x/oauth2 -> v0.34.0

References

See deckhouse/virtualization#2557

Why we need it and why it was done in this way

The following tradeoffs were made:

The following alternatives were considered:

Links to places where the discussion took place:

Special notes for your reviewer

Huge removes

Large line deletions in this PR are mostly caused by dependency and generated code refresh, not by removing product functionality.

The majority of removed lines come from:

• vendored Go/Kubernetes dependencies (golang.org/x, k8s.io/api, k8s.io/client-go)
• regenerated protobuf/OpenAPI/client files
• cleanup of obsolete API testdata snapshots in staging/src/.../apitesting/testdata
• Most changed files:
  • vendor/golang.org/x/tools/internal/stdlib/manifest.go — 17092 removed - regeneration for the new Go version
  • Remove obsolete Unicode/IDNA tables:
    • x/text/unicode/norm/tables9.0.0.go — 7637
    • tables10.0.0.go — 7657
    • tables11.0.0.go — 7693
    • tables12.0.0.go — 7710
    • x/text/unicode/bidi/tables9/10/11/12/13...
    • x/net/idna/tables9/10/11/12/13...

This is consistent with the changes already present in the upstream main, where KubeVirt was updated to a newer Go version and the same dependency set was bumped. As part of that update, older
generated tables, deprecated API variants, and outdated vendored artifacts were removed or replaced with newer generated versions.

Checklist

This checklist is not enforcing, but it's a reminder of items that could be relevant to every PR.
Approvers are expected to review this list.

• Design: A design document was considered and is present (link) or not required
• PR: The PR description is expressive enough and will help future contributors
• Code: Write code that humans can understand and Keep it simple
• Refactor: You have left the code cleaner than you found it (Boy Scout Rule)
• Upgrade: Impact of this change on upgrade flows was considered and addressed if required
• Testing: New code requires new unit tests. New features and bug fixes require at least one e2e test
• Documentation: A user-guide update was considered and is present (link) or not required. You want a user-guide update if it's a user facing feature / API change.
• Community: Announcement to kubevirt-dev was considered

Release note