fix: mitigate CVEs based on report 2026-06-29

.github/workflows/test.yml

@@ -14,7 +14,7 @@
 
 name: Test
 env:
-  GO_VERSION: "1.23.0"
+  GO_VERSION: "1.25.10"
   GINKGO_VERSION: "v2.22.1"
   KUBEVIRT_VERSION: "1.6.2"
 on:
@@ -27,9 +27,11 @@ on:
     types: [opened, reopened, synchronize, labeled, unlabeled]
     branches:
       - '*virtualization*'
+      - 'dvp/*'
   push:
     branches:
       - '*virtualization*'
+      - 'dvp/*'
 defaults:
   run:
     shell: bash

cmd/virt-handler/BUILD.bazel

@@ -36,6 +36,7 @@ go_library(
         "//pkg/virt-config:go_default_library",
         "//pkg/virt-handler:go_default_library",
         "//pkg/virt-handler/cache:go_default_library",
+        "//pkg/virt-handler/checksum-controller:go_default_library",
         "//pkg/virt-handler/cmd-client:go_default_library",
         "//pkg/virt-handler/conntrack:go_default_library",
         "//pkg/virt-handler/dmetrics-manager:go_default_library",

cmd/virt-handler/virt-handler.go

@@ -84,6 +84,7 @@ import (
 	virtconfig "kubevirt.io/kubevirt/pkg/virt-config"
 	virthandler "kubevirt.io/kubevirt/pkg/virt-handler"
 	virtcache "kubevirt.io/kubevirt/pkg/virt-handler/cache"
+	checksum_controller "kubevirt.io/kubevirt/pkg/virt-handler/checksum-controller"
 	cmdclient "kubevirt.io/kubevirt/pkg/virt-handler/cmd-client"
 	"kubevirt.io/kubevirt/pkg/virt-handler/conntrack"
 	dmetricsmanager "kubevirt.io/kubevirt/pkg/virt-handler/dmetrics-manager"
@@ -92,7 +93,6 @@ import (
 	nodelabeller "kubevirt.io/kubevirt/pkg/virt-handler/node-labeller"
 	"kubevirt.io/kubevirt/pkg/virt-handler/rest"
 	"kubevirt.io/kubevirt/pkg/virt-handler/selinux"
-	checksum_controller "kubevirt.io/kubevirt/pkg/virt-handler/checksum-controller"
 )
 
 const (

go.mod

@@ -1,6 +1,6 @@
 module kubevirt.io/kubevirt
 
-go 1.24.0
+go 1.25.0
 
 require (
 	github.com/cheggaaa/pb/v3 v3.1.0
@@ -60,13 +60,13 @@ require (
 	github.com/vishvananda/netlink v1.3.0
 	github.com/wadey/gocovmerge v0.0.0-20160331181800-b5bfa59ec0ad
 	go.uber.org/mock v0.5.1
-	golang.org/x/crypto v0.46.0
-	golang.org/x/net v0.48.0
-	golang.org/x/sync v0.19.0
-	golang.org/x/sys v0.39.0
-	golang.org/x/term v0.38.0
+	golang.org/x/crypto v0.51.0
+	golang.org/x/net v0.54.0
+	golang.org/x/sync v0.20.0
+	golang.org/x/sys v0.45.0
+	golang.org/x/term v0.43.0
 	golang.org/x/time v0.12.0
-	golang.org/x/tools v0.39.0
+	golang.org/x/tools v0.44.0
 	google.golang.org/grpc v1.79.3
 	k8s.io/api v0.34.2
 	k8s.io/apiextensions-apiserver v0.34.2
@@ -158,9 +158,9 @@ require (
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
 	golang.org/x/exp/typeparams v0.0.0-20230203172020-98cc5a0785f9 // indirect
-	golang.org/x/mod v0.30.0 // indirect
+	golang.org/x/mod v0.35.0 // indirect
 	golang.org/x/oauth2 v0.34.0 // indirect
-	golang.org/x/text v0.32.0 // indirect
+	golang.org/x/text v0.37.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
 	google.golang.org/protobuf v1.36.10 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
@@ -218,6 +218,14 @@ replace (
 	kubevirt.io/client-go => ./staging/src/kubevirt.io/client-go
 )
 
+// CVE Replaces
+replace (
+	golang.org/x/crypto => golang.org/x/crypto v0.52.0 // +2026 high CVEs
+	golang.org/x/net => golang.org/x/net v0.55.0
+	golang.org/x/oauth2 => golang.org/x/oauth2 v0.34.0
+	golang.org/x/sys => golang.org/x/sys v0.45.0
+)
+
 tool (
 	github.com/onsi/ginkgo/v2/ginkgo
 	github.com/wadey/gocovmerge

go.work

@@ -1,4 +1,4 @@
-go 1.24.0
+go 1.25.10
 
 use (
 	.
@@ -62,4 +62,4 @@ replace (
 
 replace github.com/deckhouse/kube-api-rewriter => github.com/deckhouse/kube-api-rewriter v0.2.1
 
-replace github.com/deckhouse/virtualization/src/kubevirt-rules => github.com/deckhouse/virtualization/src/kubevirt-rules v1.7.0
+replace github.com/deckhouse/virtualization/src/kubevirt-rules => github.com/deckhouse/virtualization/src/kubevirt-rules v1.7.0

go.work.sum

@@ -60,8 +60,6 @@ github.com/d2g/dhcp4client v1.0.0/go.mod h1:j0hNfjhrt2SxUOw55nL0ATM/z4Yt3t2Kd1mW
 github.com/d2g/dhcp4server v0.0.0-20181031114812-7d4a0a7f59a5/go.mod h1:Eo87+Kg/IX2hfWJfwxMzLyuSZyxSoAug2nGa1G2QAi8=
 github.com/d2g/hardwareaddr v0.0.0-20190221164911-e7d9fbe030e4/go.mod h1:bMl4RjIciD2oAxI7DmWRx6gbeqrkoLqv3MV0vzNad+I=
 github.com/daviddengcn/go-colortext v1.0.0/go.mod h1:zDqEI5NVUop5QPpVJUxE9UO10hRnmkD5G4Pmri9+m4c=
-github.com/deckhouse/kube-api-rewriter v0.2.1 h1:pqnb6mLJHYTSSGed4nmphOb/CUECXkqU4yQrP70buMY=
-github.com/deckhouse/kube-api-rewriter v0.2.1/go.mod h1:sOc/0+e8AVF7nxhre8aPmLWIlQGbCMK5HVs5dBWocV8=
 github.com/disiqueira/gotree/v3 v3.0.2/go.mod h1:ZuyjE4+mUQZlbpkI24AmruZKhg3VHEgPLDY8Qk+uUu8=
 github.com/distribution/distribution/v3 v3.0.0-20230511163743-f7717b7855ca/go.mod h1:t1IxPNGdTGez+YGKyJyQrtSSqisfMIm1hnFhvMPlxtE=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
@@ -229,22 +227,13 @@ golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds=
 golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
 golang.org/x/net v0.46.0/go.mod h1:Q9BGdFy1y4nkUwiLvT5qtyhAnEHgnQ/zd8PfU6nc210=
 golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
-golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
-golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
-golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
-golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/telemetry v0.0.0-20251008203120-078029d740a8/go.mod h1:Pi4ztBfryZoJEkyFTI5/Ocsu2jXyDr6iSdgJiYE/uwE=
-golang.org/x/telemetry v0.0.0-20251111182119-bc8e575c7b54/go.mod h1:hKdjCMrbv9skySur+Nek8Hd0uJ0GuxJIoIX2payrIdQ=
 golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA=
 golang.org/x/text v0.26.0/go.mod h1:QK15LZJUUQVJxhz7wXgxSy/CJaTFjd0G+YLonydOVQA=
 golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
+golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
 golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.28.0/go.mod h1:dcIOrVd3mfQKTgrDVQHqCPMWy6lnhfhtX3hLXYVLfRw=
-golang.org/x/tools v0.37.0/go.mod h1:MBN5QPQtLMHVdvsbtarmTNukZDdgwdwlO5qGacAzF0w=
 gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
 gonum.org/v1/plot v0.15.2/go.mod h1:DX+x+DWso3LTha+AdkJEv5Txvi+Tql3KAGkehP0/Ubg=
 google.golang.org/genproto v0.0.0-20240227224415-6ceb2ff114de h1:F6qOa9AZTYJXOUEr4jDysRDLrm4PHePlge4v4TGAlxY=

manifests/generated/operator-csv.yaml.in

@@ -534,6 +534,12 @@ spec:
           - pods/status
           verbs:
           - patch
+        - apiGroups:
+          - ""
+          resources:
+          - pods/resize
+          verbs:
+          - update
         - apiGroups:
           - ""
           resources:

manifests/generated/rbac-operator.authorization.k8s.yaml.in

@@ -560,6 +560,12 @@ rules:
   - pods/status
   verbs:
   - patch
+- apiGroups:
+  - ""
+  resources:
+  - pods/resize
+  verbs:
+  - update
 - apiGroups:
   - ""
   resources:

pkg/network/cache/BUILD.bazel

@@ -6,6 +6,7 @@ go_library(
         "cache.go",
         "dhcpconfig.go",
         "domaininterface.go",
+        "launcherpid.go",
         "podinterface.go",
     ],
     importpath = "kubevirt.io/kubevirt/pkg/network/cache",

pkg/safepath/BUILD.bazel

@@ -4,6 +4,7 @@ go_library(
     name = "go_default_library",
     srcs = [
         "safepath.go",
+        "safepath_darwin.go",
         "safepath_linux.go",
     ],
     importpath = "kubevirt.io/kubevirt/pkg/safepath",

pkg/virt-config/feature-gates.go

@@ -20,8 +20,9 @@
 package virtconfig
 
 import (
-	"kubevirt.io/kubevirt/pkg/virt-config/featuregate"
 	v1 "kubevirt.io/api/core/v1"
+
+	"kubevirt.io/kubevirt/pkg/virt-config/featuregate"
 )
 
 /*

pkg/virt-controller/services/BUILD.bazel

@@ -4,6 +4,7 @@ go_library(
     name = "go_default_library",
     srcs = [
         "nodeselectorrenderer.go",
+        "pod_resources.go",
         "rendercontainer.go",
         "renderresources.go",
         "rendervolumes.go",

pkg/virt-controller/watch/BUILD.bazel

@@ -36,6 +36,7 @@ go_library(
         "//pkg/virt-controller/watch/dra:go_default_library",
         "//pkg/virt-controller/watch/drain/disruptionbudget:go_default_library",
         "//pkg/virt-controller/watch/drain/evacuation:go_default_library",
+        "//pkg/virt-controller/watch/inplaceresize:go_default_library",
         "//pkg/virt-controller/watch/migration:go_default_library",
         "//pkg/virt-controller/watch/node:go_default_library",
         "//pkg/virt-controller/watch/pool:go_default_library",

pkg/virt-controller/watch/clone/clone.go

@@ -664,7 +664,7 @@ func (ctrl *VMCloneController) cleanupRestore(vmClone *clone.VirtualMachineClone
 
 func (ctrl *VMCloneController) logAndRecord(vmClone *clone.VirtualMachineClone, event Event, msg string) {
 	ctrl.recorder.Eventf(vmClone, corev1.EventTypeNormal, string(event), msg)
-	log.Log.Object(vmClone).Infof(msg)
+	log.Log.Object(vmClone).Info(msg)
 }
 
 func (ctrl *VMCloneController) getTargetType(vmClone *clone.VirtualMachineClone) cloneTargetType {

pkg/virt-controller/watch/inplaceresize/BUILD.bazel

@@ -0,0 +1,27 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["controller.go"],
+    importpath = "kubevirt.io/kubevirt/pkg/virt-controller/watch/inplaceresize",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//pkg/apimachinery/patch:go_default_library",
+        "//pkg/controller:go_default_library",
+        "//pkg/util/trace:go_default_library",
+        "//pkg/virt-config:go_default_library",
+        "//pkg/virt-controller/services:go_default_library",
+        "//staging/src/kubevirt.io/api/core/v1:go_default_library",
+        "//staging/src/kubevirt.io/client-go/kubecli:go_default_library",
+        "//staging/src/kubevirt.io/client-go/log:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/equality:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/types:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/wait:go_default_library",
+        "//vendor/k8s.io/client-go/tools/cache:go_default_library",
+        "//vendor/k8s.io/client-go/tools/record:go_default_library",
+        "//vendor/k8s.io/client-go/util/workqueue:go_default_library",
+        "//vendor/k8s.io/utils/trace:go_default_library",
+    ],
+)

pkg/virt-controller/watch/inplaceresize/controller.go

@@ -20,6 +20,7 @@ import (
 	v1 "kubevirt.io/api/core/v1"
 	"kubevirt.io/client-go/kubecli"
 	"kubevirt.io/client-go/log"
+
 	"kubevirt.io/kubevirt/pkg/apimachinery/patch"
 	"kubevirt.io/kubevirt/pkg/controller"
 	traceUtils "kubevirt.io/kubevirt/pkg/util/trace"

pkg/virt-controller/watch/migration/BUILD.bazel

@@ -17,7 +17,6 @@ go_library(
         "//pkg/storage/backend-storage:go_default_library",
         "//pkg/storage/types:go_default_library",
         "//pkg/tpm:go_default_library",
-        "//pkg/util:go_default_library",
         "//pkg/util/migrations:go_default_library",
         "//pkg/util/trace:go_default_library",
         "//pkg/virt-config:go_default_library",

pkg/virt-controller/watch/migration/migration.go

@@ -537,7 +537,7 @@ func (c *Controller) updateStatus(migration *virtv1.VirtualMachineInstanceMigrat
 			return err
 		}
 		c.recorder.Eventf(migration, k8sv1.EventTypeWarning, controller.FailedMigrationReason, msg)
-		log.Log.Object(migration).Errorf(msg)
+		log.Log.Object(migration).Error(msg)
 		setMigrationFailedConditionIfNotExists(migrationCopy, virtv1.VirtualMachineInstanceMigrationFailedReasonTargetPodShutdownDuringMigration, msg)
 		if err := c.handlePostHandoffMigrationCancel(migration, vmi); err != nil {
 			return err
@@ -600,7 +600,7 @@ func (c *Controller) updateStatus(migration *virtv1.VirtualMachineInstanceMigrat
 			return err
 		}
 		c.recorder.Eventf(migration, k8sv1.EventTypeWarning, controller.FailedMigrationReason, msg)
-		log.Log.Object(migration).Errorf(msg)
+		log.Log.Object(migration).Error(msg)
 
 		setMigrationFailedConditionIfNotExists(migrationCopy, virtv1.VirtualMachineInstanceMigrationFailedReasonTargetAttachmentPodShutdownDuringMigration, msg)
 	} else {
@@ -1223,7 +1223,7 @@ func (c *Controller) markMigrationAbortInVmiStatus(migration *virtv1.VirtualMach
 		if err != nil {
 			msg := fmt.Sprintf("failed to set MigrationState in VMI status. :%v", err)
 			c.recorder.Eventf(migration, k8sv1.EventTypeWarning, controller.FailedAbortMigrationReason, msg)
-			return fmt.Errorf(msg)
+			return errors.New(msg)
 		}
 		log.Log.Object(vmi).Infof("Signaled migration %s/%s to be aborted.", migration.Namespace, migration.Name)
 		c.recorder.Eventf(migration, k8sv1.EventTypeNormal, controller.SuccessfulAbortMigrationReason, "Migration is ready to be canceled by virt-handler.")

pkg/virt-controller/watch/vmi/lifecycle.go

@@ -1083,7 +1083,7 @@ func checkForContainerImageError(pod *k8sv1.Pod) common.SyncError {
 		}
 		reason := containerStatus.State.Waiting.Reason
 		if reason == controller.ErrImagePullReason || reason == controller.ImagePullBackOffReason {
-			return common.NewSyncError(fmt.Errorf(containerStatus.State.Waiting.Message), reason)
+			return common.NewSyncError(errors.New(containerStatus.State.Waiting.Message), reason)
 		}
 	}
 	return nil

pkg/virt-controller/watch/volume-migration/volume-migration.go

@@ -21,6 +21,7 @@ package volumemigration
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"strings"
 
@@ -78,7 +79,7 @@ func (vols *invalidVols) errorMessage() error {
 		s.WriteString(fmt.Sprintf(" DV storage class isn't a CSI or not using volume populators: %v", vols.noCSIDVs))
 	}
 
-	return fmt.Errorf(s.String())
+	return errors.New(s.String())
 }
 
 // updatedVolumesMapping returns a mapping with the volume names and the old claims that have been updated in the VM

pkg/virt-handler/conntrack/BUILD.bazel

@@ -12,6 +12,7 @@ go_library(
     importpath = "kubevirt.io/kubevirt/pkg/virt-handler/conntrack",
     visibility = ["//visibility:public"],
     deps = [
+        "//pkg/util:go_default_library",
         "//staging/src/kubevirt.io/api/core/v1:go_default_library",
         "//staging/src/kubevirt.io/client-go/log:go_default_library",
         "//vendor/go.uber.org/mock/gomock:go_default_library",

pkg/virt-handler/controller.go

@@ -29,25 +29,27 @@ import (
 
 	v1 "kubevirt.io/api/core/v1"
 
+	"runtime"
+	"strconv"
+
+	k8sv1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/resource"
+	"libvirt.org/go/libvirtxml"
+
+	"kubevirt.io/kubevirt/pkg/controller"
 	diskutils "kubevirt.io/kubevirt/pkg/ephemeral-disk-utils"
+	cmdv1 "kubevirt.io/kubevirt/pkg/handler-launcher-com/cmd/v1"
 	hostdisk "kubevirt.io/kubevirt/pkg/host-disk"
 	"kubevirt.io/kubevirt/pkg/safepath"
 	"kubevirt.io/kubevirt/pkg/util"
+	"kubevirt.io/kubevirt/pkg/util/hardware"
 	virtconfig "kubevirt.io/kubevirt/pkg/virt-config"
+	"kubevirt.io/kubevirt/pkg/virt-controller/services"
+	checksum_controller "kubevirt.io/kubevirt/pkg/virt-handler/checksum-controller"
+	cmdclient "kubevirt.io/kubevirt/pkg/virt-handler/cmd-client"
 	"kubevirt.io/kubevirt/pkg/virt-handler/isolation"
 	"kubevirt.io/kubevirt/pkg/virt-launcher/virtwrap/api"
 	"kubevirt.io/kubevirt/pkg/virtiofs"
-	cmdclient "kubevirt.io/kubevirt/pkg/virt-handler/cmd-client"
-	"kubevirt.io/kubevirt/pkg/controller"
-	"strconv"
-	"kubevirt.io/kubevirt/pkg/util/hardware"
-	checksum_controller "kubevirt.io/kubevirt/pkg/virt-handler/checksum-controller"
-	"kubevirt.io/kubevirt/pkg/virt-controller/services"
-	cmdv1 "kubevirt.io/kubevirt/pkg/handler-launcher-com/cmd/v1"
-	"runtime"
-	k8sv1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/resource"
-	"libvirt.org/go/libvirtxml"
 )
 
 const (

pkg/virt-handler/hotplug-disk/BUILD.bazel

@@ -18,6 +18,7 @@ go_library(
         "//pkg/storage/types:go_default_library",
         "//pkg/unsafepath:go_default_library",
         "//pkg/virt-handler/cgroup:go_default_library",
+        "//pkg/virt-handler/cmd-client:go_default_library",
         "//pkg/virt-handler/isolation:go_default_library",
         "//pkg/virt-handler/virt-chroot:go_default_library",
         "//staging/src/kubevirt.io/api/core/v1:go_default_library",

pkg/virt-handler/migration-source.go

@@ -49,12 +49,12 @@ import (
 	cmdclient "kubevirt.io/kubevirt/pkg/virt-handler/cmd-client"
 	"kubevirt.io/kubevirt/pkg/virt-handler/isolation"
 
+	checksum_controller "kubevirt.io/kubevirt/pkg/virt-handler/checksum-controller"
 	"kubevirt.io/kubevirt/pkg/virt-handler/conntrack"
 	launcher_clients "kubevirt.io/kubevirt/pkg/virt-handler/launcher-clients"
 	migrationproxy "kubevirt.io/kubevirt/pkg/virt-handler/migration-proxy"
 	"kubevirt.io/kubevirt/pkg/virt-launcher/virtwrap/api"
 	"kubevirt.io/kubevirt/pkg/virt-launcher/virtwrap/stats"
-	checksum_controller "kubevirt.io/kubevirt/pkg/virt-handler/checksum-controller"
 )
 
 var errWaitingForTargetPorts = errors.New("waiting for target to publish migration ports")