OCPBUGS-93617: Bump golang.org/x/crypto to v0.52.0

[sunku5494]

What this PR does / why we need it:
Updates crypto package to v0.52.0 to pull in recent security patches, specifically targeting CVE-2026-39835. While our codebase does not currently use any of the vulnerable symbols identified in the CVE, this update keeps main aligned with the latest secure package version as a proactive measure.

Which issue this PR fixes(if applicable):
fixes #
This PR fixes CVE-2026-39835 and many other CVEs reported for crypto pkg

Special notes for reviewers:

Release note:

NONE

Summary by CodeRabbit

• Chores
  • Updated an underlying security-related dependency to its latest supported version.

[openshift-ci-robot]

@sunku5494: This pull request references Jira Issue OCPBUGS-93617, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (ocp-sustaining-admins@redhat.com), skipping review request.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

What this PR does / why we need it:
Updates crypto package to v0.52.0 to pull in recent security patches, specifically targeting CVE-2026-39835. While our codebase does not currently use any of the vulnerable symbols identified in the CVE, this update keeps main aligned with the latest secure package version as a proactive measure.

Which issue this PR fixes(if applicable):
fixes #
This PR fixes CVE-2026-39835 and many other CVEs reported for crypto pkg

Special notes for reviewers:

Release note:

NONE

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Walkthrough

The pull request updates the indirect golang.org/x/crypto dependency in go.mod from v0.51.0 to v0.52.0.

Changes

Dependency update

Layer / File(s)	Summary
Update crypto dependency go.mod	The indirect golang.org/x/crypto dependency changes from v0.51.0 to v0.52.0.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related issues

• openshift/oc-mirror#1330 — Updates golang.org/x/crypto from v0.51.0 to v0.52.0.
• openshift/image-based-install-operator#443 — Updates golang.org/x/crypto to v0.52.0.
• openshift/cluster-api-provider-ibmcloud#141 — Updates the same dependency from v0.51.0.
• openshift/installer#10170 — Updates golang.org/x/crypto in go.mod to v0.52.0.
• openshift/machine-config-operator#5506 — Updates the same dependency to v0.52.0.
• openshift/cluster-baremetal-operator#536 — Updates the same dependency for version maintenance.
• openshift/origin#30621 — Updates golang.org/x/crypto to v0.52.0.

Suggested reviewers: stephenfin

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the dependency update from golang.org/x/crypto v0.51.0 to v0.52.0.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The commit changes go.mod/go.sum and vendored x/crypto SSH code only; it adds no test files or Ginkgo title declarations.
Test Structure And Quality	✅ Passed	The PR changes dependency metadata and vendored crypto SSH code only; the HEAD patch contains no Ginkgo or other test files, so these test-quality requirements are not applicable.
Microshift Test Compatibility	✅ Passed	The PR changes dependency and vendored SSH files only; the parent-to-current diff adds no Ginkgo tests or new test declarations requiring MicroShift compatibility review.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The commit changes only dependency metadata, vendored x/crypto SSH code, and go.sum; it adds no Ginkgo or other e2e tests requiring SNO compatibility review.
Topology-Aware Scheduling Compatibility	✅ Passed	The commit changes only go.mod/go.sum and vendored x/crypto SSH files; no deployment manifests, operator/controller code, or scheduling constraints changed.
Ote Binary Stdout Contract	✅ Passed	No OTE implementation or source files changed; the PR updates dependency metadata and vendored crypto only, with no process-level stdout writes in changed files.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR changes only dependency manifests and vendored x/crypto files; it adds no Ginkgo e2e tests or external-network test logic.
No-Weak-Crypto	✅ Passed	The PR changes only x/crypto dependency metadata and vendored SSH fixes; added code introduces no MD5, SHA-1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	The PR changes only Go dependency metadata and vendored Go files; it adds no container or Kubernetes manifest privilege settings.
No-Sensitive-Data-In-Logs	✅ Passed	The PR only updates x/crypto and vendored SSH code; it adds no logging. Existing debugMux logging remains unchanged and disabled (const debugMux = false).

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: sunku5494
Once this PR has been reviewed and has the lgtm label, please assign mpatlasov for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• DOWNSTREAM_OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@sunku5494: This pull request references Jira Issue OCPBUGS-93617, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (ocp-sustaining-admins@redhat.com), skipping review request.

Details

In response to this:

What this PR does / why we need it:
Updates crypto package to v0.52.0 to pull in recent security patches, specifically targeting CVE-2026-39835. While our codebase does not currently use any of the vulnerable symbols identified in the CVE, this update keeps main aligned with the latest secure package version as a proactive measure.

Which issue this PR fixes(if applicable):
fixes #
This PR fixes CVE-2026-39835 and many other CVEs reported for crypto pkg

Special notes for reviewers:

Release note:

NONE

Summary by CodeRabbit

• Chores
• Updated an underlying security-related dependency to its latest supported version.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

🧹 Nitpick comments (1)

go.mod (1)

172-172: 🔒 Security & Privacy | 🔵 Trivial

Add release supply-chain controls.

golang.org/x/crypto v0.52.0 is pinned and has matching go.sum hashes. The release workflow has no SBOM, provenance-attestation, or Sigstore/cosign signing steps. Add these controls and run govulncheck ./... to check reachable golang.org/x/crypto/ssh symbols.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 172, Add release-workflow steps for SBOM generation,
provenance attestation, and Sigstore/cosign artifact signing, ensuring they run
for the built release artifacts. Run govulncheck ./... and address any reachable
vulnerabilities involving golang.org/x/crypto/ssh while preserving the pinned
dependency and matching go.sum hashes.

Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@go.mod`:
- Line 172: Add release-workflow steps for SBOM generation, provenance
attestation, and Sigstore/cosign artifact signing, ensuring they run for the
built release artifacts. Run govulncheck ./... and address any reachable
vulnerabilities involving golang.org/x/crypto/ssh while preserving the pinned
dependency and matching go.sum hashes.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 8b791cf4-fefb-435f-814c-363f27fa24a5

📥 Commits

Reviewing files that changed from the base of the PR and between aa9a810 and d9f987e.

⛔ Files ignored due to path filters (8)

• go.sum is excluded by !**/*.sum
• vendor/golang.org/x/crypto/ssh/certs.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/ssh/channel.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/ssh/cipher.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/ssh/keys.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/ssh/mux.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/ssh/server.go is excluded by !**/vendor/**, !vendor/**
• vendor/modules.txt is excluded by !**/vendor/**, !vendor/**

📒 Files selected for processing (1)

• go.mod

[sunku5494]

/test e2e-openstack

[openshift-ci]

@sunku5494: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-openstack	d9f987e	link	true	/test e2e-openstack
ci/prow/security	d9f987e	link	false	/test security

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.