[AV-142868] Fix critical issue in x/net via minor version upgrade from 0.17.0 to 0.55.0

[aikido-autofix]

Jira

• AV-142868

Description

Upgrade golang.org/x/net to fix critical IDNA privilege escalation vulnerabilities in Punycode label validation.

✅ 2 CVEs resolved by this upgrade, including 2 critical 🚨 CVEs

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-11039	🚨 CRITICAL	[golang.org/x/net] ToASCII and ToUnicode functions incorrectly accept invalid Punycode-encoded labels, allowing attackers to bypass hostname validation checks and potentially escalate privileges through domain name spoofing.
CVE-2026-39821	🚨 CRITICAL	[golang.org/x/net] ToASCII and ToUnicode functions incorrectly accept invalid Punycode-encoded labels, allowing attackers to bypass hostname validation checks and potentially escalate privileges through domain name spoofing.

Pull Request Category

• 🚀 New Functionality
• 🐛 Bug Fix
• 📚 Documentation
• ♻️ Refactor
• 🚄 Performance Improvements
• ⏪ Revert
• 🏛️ Infrastructure
• 📦 Release
• ⚙️ Build, Merge, CI or CD

Testing Approach

How was this change tested and do you have evidence?

• Unit
• Functional with cbclocal
• E2E Tests
• Sandbox
• Una

[Copilot]

🟡 Changes recommended

The module Go version was bumped to 1.25.0 while the repo’s Docker build still pins Go 1.21, creating a likely build/toolchain mismatch that needs to be resolved.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates Go module dependencies to address reported critical IDNA/Punycode vulnerabilities by upgrading golang.org/x/net, along with related golang.org/x/* transitive dependencies.

Changes:

• Upgrade golang.org/x/net from v0.17.0 to v0.55.0 (and refresh related sums).
• Upgrade related golang.org/x/* modules (x/crypto, x/sys, x/text) to newer versions.
• Bump the module’s go version directive from 1.21.3 to 1.25.0.

File summaries

File	Description
go.mod	Updates the go directive and bumps golang.org/x/* indirect dependency versions.
go.sum	Updates checksums to match the upgraded golang.org/x/* module versions.

Review details

• Files reviewed: 1/2 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[allabalakrishna9]

Fixed in 93bd112 — the builder stage now uses golang:1.25.

Worth noting the go 1.25.0 bump is not discretionary and cannot be reverted: golang.org/x/net@v0.55.0 declares go 1.25.0 in its own go.mod, so pinning the directive back to 1.21.3 would fail with a "module requires go >= 1.25.0" error rather than restore the old build.

The newest x/net that still supports Go 1.21 is far enough back that it leaves the IDNA CVEs this PR targets unfixed, so moving the build image is the price of the remediation.

[allabalakrishna9]

Confirmed intended, and they can't be split out — every one of them is a direct requirement of golang.org/x/net@v0.55.0. Its own go.mod reads:

module golang.org/x/net

go 1.25.0

require (
	golang.org/x/crypto v0.51.0
	golang.org/x/sys v0.45.0
	golang.org/x/term v0.43.0
	golang.org/x/text v0.41.0
)

Against what this PR actually sets:

Module	This PR	Required by x/net v0.55.0
golang.org/x/crypto	v0.51.0	v0.51.0
golang.org/x/sys	v0.45.0	v0.45.0
golang.org/x/text	v0.37.0	(via minimal version selection)
go directive	1.25.0	1.25.0

So this is Go's minimal version selection doing its job, not unrelated scope. Splitting into separate PRs isn't possible — go mod tidy would immediately re-add them.

One thing that does need a reviewer's attention, and it is the reverse of scope creep: this PR sets golang.org/x/crypto to v0.51.0, while the sibling PR #18 sets it to v0.52.0. Per OSV that is 30 known advisories versus 4. If #18 merges first, merging this PR afterwards would downgrade x/crypto and re-introduce roughly 26 advisories.

These two PRs should be reconciled before either merges — most cleanly by taking x/net@v0.58.0 (0 known advisories, and it requires x/crypto v0.55.0), which supersedes both.

[allabalakrishna9]

Superseded by #20, which consolidates this PR with its sibling.

#18 (x/crypto) and #19 (x/net) both edit go.mod/go.sum and were each generated against main with no knowledge of the other. #18 set x/crypto to v0.52.0, #19 set it to v0.51.0 — 4 known advisories versus 30. Whichever merged second would have rewritten the other, and in the #18-then-#19 order that meant a downgrade re-introducing roughly 26 advisories.

#20 takes both bumps together, at higher versions than either PR proposed:

Module	This PR	#20
golang.org/x/net	v0.55.0 (#19) / unchanged (#18)	v0.58.0 — 0 known advisories
golang.org/x/crypto	v0.52.0 (#18) / v0.51.0 (#19)	v0.55.0 — 3 known advisories

It also carries the golang:1.25 Dockerfile fix from the Copilot reviews on both PRs, and is verified with go build ./....

Closing this one. No work is lost — AV-142867 and AV-142868 both remain open and are linked from #20.

[Copilot]

🟢 Approval recommended

The dependency and toolchain upgrades are consistent across go.mod/go.sum and the Docker build, with no remaining inconsistencies found in the repository references.

Review details

• Files reviewed: 2/3 changed files
• Comments generated: 0 new
• Review effort level: Lite