Fix CVEs in release-0.20

[dfarrell07]

See commit messages for details.

Summary by CodeRabbit

• Chores
  • Updated Go toolchain from version 1.23.0 to 1.25.0
  • Bumped multiple dependencies to latest stable versions for enhanced compatibility and security

[submariner-bot]

🤖 Created branch: z_pr4068/dfarrell07/fix-0.20-cves-2026-06-16
🚀 Full E2E won't run until the "ready-to-test" label is applied. I will add it automatically once the PR has 2 approvals, or you can add it manually.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 42cb7c18-8cb3-4cac-922a-f40bfe2c47bf

📥 Commits

Reviewing files that changed from the base of the PR and between 4b1d604 and aa1ae51.

⛔ Files ignored due to path filters (2)

• go.sum is excluded by !**/*.sum
• tools/go.sum is excluded by !**/*.sum

📒 Files selected for processing (2)

• go.mod
• tools/go.mod

---

Walkthrough

Updates go.mod and tools/go.mod to specify Go 1.25.0 (previously 1.23.0). Bumps direct dependencies golang.org/x/net and golang.org/x/sys in go.mod, and bumps several indirect golang.org/x/* modules (x/crypto, x/sync, x/term, x/text, x/tools) across both module files.

Changes

Go Toolchain and Dependency Version Updates

Layer / File(s)	Summary
go.mod: Go 1.25.0 and golang.org/x/* bumps go.mod	Go toolchain version updated from 1.23.0 to 1.25.0; direct golang.org/x/net and golang.org/x/sys versions bumped; indirect golang.org/x/crypto, x/sync, x/term, x/text, and x/tools updated to newer versions.
tools/go.mod: Go 1.25.0 and x/sys bump tools/go.mod	Go version directive updated from 1.23.0 to 1.25.0; indirect golang.org/x/sys bumped from v0.26.0 to v0.45.0.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• submariner-io/submariner#3815: Modifies the same go.mod golang.org/x/* dependency set including x/crypto via direct version bumps.
• submariner-io/submariner#3816: Bumps the same golang.org/x/* dependency set (x/crypto, x/net, x/sys, etc.) and the Go toolchain version in go.mod/tools/go.mod.
• submariner-io/submariner#3968: Modifies tools/go.mod dependency versions including golang.org/x/sys.

Suggested labels

ready-to-test

Suggested reviewers

• aswinsuryan
• skitt
• tpantelis
• vthapar

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'Fix CVEs in release-0.20' accurately summarizes the main objective of the pull request, which is to address multiple CVEs through dependency updates in the release-0.20 branch.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Actionable Comments Resolved	✅ Passed	No actionable comments found in the PR. The changes consist of clean dependency version bumps with no unresolved TODOs, FIXMEs, or code review comments requiring action.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[submariner-bot]

🤖 Closed branches: [z_pr4068/dfarrell07/fix-0.20-cves-2026-06-16]