Go module upgrades to fix CVE-2025-22872

[wallrj]

Fixes: CVE-2025-22872

Mostly mechanical changes to upgrade the Go module version and the x/net module to fix a CVE reported by trivy:

_bin/tools/go get golang.org/x/net@latest
_bin/tools/go get go@1.24.4
make go-tidy

Then I had to go and update the tests to use the new t.Context helper and fix some go vet warnings which started showing up.

Testing

Current Release:

$ trivy image registry.venafi.cloud/venafi-agent/venafi-agent:v1.5.0
2025-06-24T16:15:21+01:00       INFO    [vuln] Vulnerability scanning is enabled
2025-06-24T16:15:21+01:00       INFO    [secret] Secret scanning is enabled
2025-06-24T16:15:21+01:00       INFO    [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-06-24T16:15:21+01:00       INFO    [secret] Please see also https://trivy.dev/v0.61/docs/scanner/secret#recommendation for faster secret detection
2025-06-24T16:15:24+01:00       INFO    Detected OS     family="alpine" version="3.21"
2025-06-24T16:15:24+01:00       INFO    [alpine] Detecting vulnerabilities...   os_version="3.21" repository="3.21" pkg_num=2
2025-06-24T16:15:24+01:00       INFO    Number of language-specific files       num=1
2025-06-24T16:15:24+01:00       INFO    [gobinary] Detecting vulnerabilities...
2025-06-24T16:15:24+01:00       WARN    Using severities from other vendors for some vulnerabilities. Read https://trivy.dev/v0.61/docs/scanner/vulnerability#severity-selection for details.

Report Summary

┌──────────────────────────────────────────────────────────────────────┬──────────┬─────────────────┬─────────┐
│                                Target                                │   Type   │ Vulnerabilities │ Secrets │
├──────────────────────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ registry.venafi.cloud/venafi-agent/venafi-agent:v1.5.0 (alpine 3.21) │  alpine  │        0        │    -    │
├──────────────────────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ ko-app/preflight                                                     │ gobinary │        4        │    -    │
└──────────────────────────────────────────────────────────────────────┴──────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


ko-app/preflight (gobinary)

Total: 4 (UNKNOWN: 0, LOW: 0, MEDIUM: 3, HIGH: 1, CRITICAL: 0)

┌──────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────┬──────────────────────────────────────────────────────────────┐
│     Library      │ Vulnerability  │ Severity │ Status │ Installed Version │  Fixed Version  │                            Title                             │
├──────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/net │ CVE-2025-22872 │ MEDIUM   │ fixed  │ v0.36.0           │ 0.38.0          │ golang.org/x/net/html: Incorrect Neutralization of Input     │
│                  │                │          │        │                   │                 │ During Web Page Generation in x/net in...                    │
│                  │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2025-22872                   │
├──────────────────┼────────────────┼──────────┤        ├───────────────────┼─────────────────┼──────────────────────────────────────────────────────────────┤
│ stdlib           │ CVE-2025-22874 │ HIGH     │        │ v1.24.2           │ 1.24.4          │ crypto/x509: Usage of ExtKeyUsageAny disables policy         │
│                  │                │          │        │                   │                 │ validation in crypto/x509                                    │
│                  │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2025-22874                   │
│                  ├────────────────┼──────────┤        │                   ├─────────────────┼──────────────────────────────────────────────────────────────┤
│                  │ CVE-2025-0913  │ MEDIUM   │        │                   │ 1.23.10, 1.24.4 │ Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows │
│                  │                │          │        │                   │                 │ in os in syscall...                                          │
│                  │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2025-0913                    │
│                  ├────────────────┤          │        │                   │                 ├──────────────────────────────────────────────────────────────┤
│                  │ CVE-2025-4673  │          │        │                   │                 │ net/http: Sensitive headers not cleared on cross-origin      │
│                  │                │          │        │                   │                 │ redirect in net/http                                         │
│                  │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2025-4673                    │
└──────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────┴──────────────────────────────────────────────────────────────┘

Before:

$ trivy fs .
2025-06-24T15:47:24+01:00       INFO    [vuln] Vulnerability scanning is enabled
2025-06-24T15:47:24+01:00       INFO    [secret] Secret scanning is enabled
2025-06-24T15:47:24+01:00       INFO    [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-06-24T15:47:24+01:00       INFO    [secret] Please see also https://trivy.dev/v0.61/docs/scanner/secret#recommendation for faster secret detection
2025-06-24T15:47:25+01:00       INFO    Number of language-specific files       num=1
2025-06-24T15:47:25+01:00       INFO    [gomod] Detecting vulnerabilities...

Report Summary

┌────────┬───────┬─────────────────┬─────────┐
│ Target │ Type  │ Vulnerabilities │ Secrets │
├────────┼───────┼─────────────────┼─────────┤
│ go.mod │ gomod │        1        │    -    │
└────────┴───────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


go.mod (gomod)

Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

┌──────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────┐
│     Library      │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                          Title                           │
├──────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────┤
│ golang.org/x/net │ CVE-2025-22872 │ MEDIUM   │ fixed  │ v0.36.0           │ 0.38.0        │ golang.org/x/net/html: Incorrect Neutralization of Input │
│                  │                │          │        │                   │               │ During Web Page Generation in x/net in...                │
│                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-22872               │
└──────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────┘

After:

$ trivy fs .
2025-06-24T16:12:16+01:00       INFO    [vuln] Vulnerability scanning is enabled
2025-06-24T16:12:16+01:00       INFO    [secret] Secret scanning is enabled
2025-06-24T16:12:16+01:00       INFO    [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-06-24T16:12:16+01:00       INFO    [secret] Please see also https://trivy.dev/v0.61/docs/scanner/secret#recommendation for faster secret detection
2025-06-24T16:12:17+01:00       INFO    Number of language-specific files       num=1
2025-06-24T16:12:17+01:00       INFO    [gomod] Detecting vulnerabilities...

Report Summary

┌────────┬───────┬─────────────────┬─────────┐
│ Target │ Type  │ Vulnerabilities │ Secrets │
├────────┼───────┼─────────────────┼─────────┤
│ go.mod │ gomod │        0        │    -    │
└────────┴───────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)

[wallrj]

Tests won't run on a fork. See #675 instead.