[freeznet]

Motivation

Modifications

• Upgrade golang.org/x/net to v0.60.0 in the root and tests modules, including required transitive golang.org/x dependency updates and checksums.
• x/net v0.60.0 requires Go >= 1.26.0. Use the current Go 1.26 patch release, 1.26.9, consistently in both modules, go.work, Dockerfile, and redhat.Dockerfile.
• No controller behavior or API changes.

Verifying this change

Passed locally:

• GOTOOLCHAIN=go1.26.9 KUBEBUILDER_ASSETS="$PWD/bin/k8s/1.30.3-darwin-arm64" go test ./... -count=1 (including controller envtest).
• cd tests && GOTOOLCHAIN=go1.26.9 go test ./... -run '^$' (workspace compilation only; no cluster E2E execution).
• GOTOOLCHAIN=go1.26.9 GOWORK=off go mod verify in both modules.
• GOTOOLCHAIN=go1.26.9 go vet ./...
• Pre-commit license, golangci-lint (0 issues), formatting, and vet checks, using GOTOOLCHAIN=go1.26.9.
• docker build --platform linux/amd64 -t pulsar-resources-operator:support-5058 .
• trivy image --scanners vuln --format json --output /tmp/pro-5058-trivy.json pulsar-resources-operator:support-5058: manager embeds stdlib v1.26.9 and x/net v0.60.0; all three ticket CVEs are absent. Alpine OS target has zero vulnerabilities.

Remaining limitations, outside this ticket:

• Trivy reports five other manager findings: CVE-2026-81870 (otel/sdk), GO-2026-5932 (x/crypto, no fixed version reported), and CVE-2026-84304 / CVE-2026-84445 / CVE-2026-84303 (grpc). This PR does not claim a clean overall vulnerability scan.
• govulncheck reports GO-2026-6505 (otel/sdk) and GO-2026-6348 (grpc) at symbol level; these are outside the three x/net CVEs being addressed.
• tests with GOWORK=off fail to compile because controller-runtime v0.18.2 is incompatible with the selected Kubernetes API. The identical failure was reproduced in a clean archive of origin/main; the supported workspace build uses the root module's replacements and passes.
• Cluster E2E and the Red Hat image build were not run. CI results are pending.

Documentation

• no-need-doc: dependency and build-toolchain security update; no API or runtime configuration changes.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-13T09:35:14.741928Z	d9c25e6	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

@freeznet:Thanks for your contribution. For this PR, do we need to update docs?
(The PR template contains info about doc, which helps others know more about the changes. Can you provide doc-related info in this and future PR descriptions? Thanks)