CVE-2026-78662, CVE-2026-56855: Bump x/crypto

[2uasimojo]

...and friends.

Summary by CodeRabbit

• Bug Fixes

  • Improved Unicode normalization, including Hangul composition and invalid-input handling.
  • Improved SSH certificate, channel, host-key, and protocol validation.
  • Corrected terminal input handling when partial data and read errors occur.
  • Improved compatibility across Linux, Windows, NetBSD, RISC-V, POWER, and SPARC platforms.
  • Updated static analysis and code navigation tooling for more accurate diagnostics and deterministic results.

• New Features

  • Added support for additional process, hardware-management, CPU, and operating-system capabilities.
  • Added clearer diagnostics for memory layout and unsupported standard-library APIs.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@2uasimojo: No Jira issue with key CVE-2026 exists in the tracker at https://redhat.atlassian.net.
Once a valid jira issue is referenced in the title of this pull request, request a refresh with /jira refresh.

Details

In response to this:

...and friends.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@2uasimojo: No Jira issue with key CVE-2026 exists in the tracker at https://redhat.atlassian.net.
Once a valid jira issue is referenced in the title of this pull request, request a refresh with /jira refresh.

Details

In response to this:

...and friends.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[2uasimojo]

/assign @suhanime

[coderabbitai]

📝 Walkthrough

Walkthrough

Changes

The PR upgrades vendored Go modules to newer releases and updates their implementations. Changes cover Unicode normalization, SSH handling, terminal input, CPU detection, Unix APIs, and Go analysis tooling.

Vendored Go module updates

Layer / File(s)	Summary
Dependency metadata and Unicode handling go.mod, apis/go.mod, vendor/modules.txt, apis/vendor/golang.org/x/text/..., vendor/golang.org/x/text/...	Dependencies move to newer releases. Unicode normalization, bidi panic handling, invalid-input processing, and transformation errors are updated.
SSH, terminal, and support library behavior vendor/golang.org/x/crypto/..., vendor/golang.org/x/term/..., vendor/golang.org/x/sync/..., vendor/golang.org/x/mod/..., vendor/golang.org/x/sys/windows/...	SSH certificate validation, channel establishment, host-key revocation, version parsing, terminal read errors, semaphore validation, documentation, and Windows socket constants are updated.
Platform CPU detection vendor/golang.org/x/sys/cpu/*	POWER10/POWER11, RISC-V vector, NetBSD amd64, and SPARC64 CPU support is added or adjusted.
Unix and Windows platform APIs vendor/golang.org/x/sys/unix/*, vendor/golang.org/x/sys/windows/*	Pidfd and IPMI definitions, hardware timestamp constants, alignment, ioctl support, generated platform constants, and pointer arithmetic are updated.
x/tools shared foundations vendor/golang.org/x/tools/internal/...	Map utilities, package-path classification, tuple construction, call resolution, type traversal, standard-version metadata, and assignment analysis are updated.
Analysis and SSA integration vendor/golang.org/x/tools/go/analysis/..., vendor/golang.org/x/tools/go/ssa/..., vendor/golang.org/x/tools/go/types/...	Field-alignment diagnostics, standard-version reporting, SSA tuple construction, runtime type traversal, and callee resolution use the updated shared APIs.
Tools traversal and refactoring vendor/golang.org/x/tools/go/ast/..., vendor/golang.org/x/tools/go/loader/..., vendor/golang.org/x/tools/go/packages/..., vendor/golang.org/x/tools/refactor/...	Cursor formatting, cgo preprocessing limits, deterministic package traversal, and invalid refactoring expressions are updated.

Priority: ➖ Normal

Estimated code review effort: 5 (Critical) | ~90 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to eebfc

No actionable code risk was identified in the dependency update.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 54.55% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 22 functions across 50 files. (27 skipped…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the security advisories and the primary dependency update. The changes also update related Go dependencies, which the title does not need to list.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 54.55% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 22 functions across 50 files. (27 skipped: 5 unsupported, 22 over the file limit.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: 2uasimojo

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [2uasimojo]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@2uasimojo: No Jira issue with key CVE-2026 exists in the tracker at https://redhat.atlassian.net.
Once a valid jira issue is referenced in the title of this pull request, request a refresh with /jira refresh.

Details

In response to this:

...and friends.

Summary by CodeRabbit

• Bug Fixes

• Improved Unicode normalization, including Hangul composition and invalid-input handling.

• Improved SSH certificate, channel, host-key, and protocol validation.

• Corrected terminal input handling when partial data and read errors occur.

• Improved compatibility across Linux, Windows, NetBSD, RISC-V, POWER, and SPARC platforms.

• Updated static analysis and code navigation tooling for more accurate diagnostics and deterministic results.

• New Features

• Added support for additional process, hardware-management, CPU, and operating-system capabilities.

• Added clearer diagnostics for memory layout and unsupported standard-library APIs.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@2uasimojo: No Jira issue with key CVE-2026 exists in the tracker at https://redhat.atlassian.net.
Once a valid jira issue is referenced in the title of this pull request, request a refresh with /jira refresh.

Details

In response to this:

...and friends.

Summary by CodeRabbit

• Bug Fixes

• Improved Unicode normalization, including Hangul composition and invalid-input handling.

• Improved SSH certificate, channel, host-key, and protocol validation.

• Corrected terminal input handling when partial data and read errors occur.

• Improved compatibility across Linux, Windows, NetBSD, RISC-V, POWER, and SPARC platforms.

• Updated static analysis and code navigation tooling for more accurate diagnostics and deterministic results.

• New Features

• Added support for additional process, hardware-management, CPU, and operating-system capabilities.

• Added clearer diagnostics for memory layout and unsupported standard-library APIs.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 50.58%. Comparing base (f2be0d4) to head (eebfc37).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #2955   +/-   ##
=======================================
  Coverage   50.58%   50.58%           
=======================================
  Files         282      282           
  Lines       34668    34668           
=======================================
  Hits        17538    17538           
  Misses      15754    15754           
  Partials     1376     1376           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[openshift-ci]

@2uasimojo: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/snyk	eebfc37	link	false	/test snyk

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.