infra: refactor govulncheck target and hack script. by vitorfloriano · Pull Request #434 · kubernetes-sigs/node-readiness-controller

vitorfloriano · 2026-08-19T18:12:44Z

Description

This PR refactors how the govulncheck tool is resolved.

The verify-govulncheck script now uses the same mechanism as the other tools in hack/tools/bin.

Related Issue

Fixes #433

Type of Change

/kind bug
/kind cleanup
/kind failing-test

Testing

Running verify-govulncheck.sh locally resolves and builds govulncheck, then runs the check:

$ ./hack/verify-govulncheck.sh 
make: Entering directory '/home/vitor/go/src/github.com/vitorfloriano/node-readiness-controller'
GOBIN=/home/vitor/go/src/github.com/vitorfloriano/node-readiness-controller/hack/tools/bin ./scripts/go_install.sh golang.org/x/vuln/cmd/govulncheck govulncheck v1.1.4
make: Leaving directory '/home/vitor/go/src/github.com/vitorfloriano/node-readiness-controller'
Creating worktree for base branch 'main'...
Running govulncheck on HEAD (PR branch)...
Running govulncheck on base branch 'main'...
./hack/verify-govulncheck.sh: line 56: ./hack/../hack/tools/bin/govulncheck: No such file or directory

=== HEAD (PR branch) ===
=== Package Results ===

Vulnerability #1: GO-2026-6218
    Avoid quadratic complexity in resolvePath in net/url
  More info: https://pkg.go.dev/vuln/GO-2026-6218
  Standard library
    Found in: net/url@go1.26.2
    Fixed in: net/url@go1.26.6

Vulnerability #2: GO-2026-6094
    JSON private fields exposed via NativeTypes and ParseStructTag in
    github.com/google/cel-go
  More info: https://pkg.go.dev/vuln/GO-2026-6094
  Module: github.com/google/cel-go
    Found in: github.com/google/cel-go@v0.29.2
    Fixed in: github.com/google/cel-go@v0.30.0

Vulnerability #3: GO-2026-6091
    Fix Javascript regexp context tracking in html/template
  More info: https://pkg.go.dev/vuln/GO-2026-6091
  Standard library
    Found in: html/template@go1.26.2
    Fixed in: html/template@go1.26.6

Vulnerability #4: GO-2026-6090
    Limit handshake messages we are willing to accept post-handshake in
    crypto/tls
  More info: https://pkg.go.dev/vuln/GO-2026-6090
  Standard library
    Found in: crypto/tls@go1.26.2
    Fixed in: crypto/tls@go1.26.6

Vulnerability #5: GO-2026-6089
    Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6089
  Standard library
    Found in: net/http@go1.26.2
    Fixed in: net/http@go1.26.6

Vulnerability #6: GO-2026-6088
    Add recursion depth guard during decode in encoding/xml
  More info: https://pkg.go.dev/vuln/GO-2026-6088
  Standard library
    Found in: encoding/xml@go1.26.2
    Fixed in: encoding/xml@go1.26.6

Vulnerability #7: GO-2026-5972
    Enforce maximum recursion depth in encoding/asn1
  More info: https://pkg.go.dev/vuln/GO-2026-5972
  Standard library
    Found in: encoding/asn1@go1.26.2
    Fixed in: encoding/asn1@go1.26.6

Vulnerability #8: GO-2026-5942
    Parsing an invalid SVCB or HTTPS RR can panic in
    golang.org/x/net/dns/dnsmessage
  More info: https://pkg.go.dev/vuln/GO-2026-5942
  Standard library
    Found in: net@go1.26.2
    Fixed in: net@go1.26.6

Vulnerability #9: GO-2026-5856
    Invoking Encrypted Client Hello privacy leak in crypto/tls
  More info: https://pkg.go.dev/vuln/GO-2026-5856
  Standard library
    Found in: crypto/tls@go1.26.2
    Fixed in: crypto/tls@go1.26.5

Vulnerability #10: GO-2026-5039
    Arbitrary inputs are included in errors without any escaping in
    net/textproto
  More info: https://pkg.go.dev/vuln/GO-2026-5039
  Standard library
    Found in: net/textproto@go1.26.2
    Fixed in: net/textproto@go1.26.4

Vulnerability #11: GO-2026-5038
    Quadratic complexity in WordDecoder.DecodeHeader in mime
  More info: https://pkg.go.dev/vuln/GO-2026-5038
  Standard library
    Found in: mime@go1.26.2
    Fixed in: mime@go1.26.4

Vulnerability #12: GO-2026-5037
    Inefficient candidate hostname parsing in crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2026-5037
  Standard library
    Found in: crypto/x509@go1.26.2
    Fixed in: crypto/x509@go1.26.4

Vulnerability #13: GO-2026-5026
    Invoking failure to reject ASCII-only Punycode-encoded labels in
    golang.org/x/net/idna
  More info: https://pkg.go.dev/vuln/GO-2026-5026
  Standard library
    Found in: net/http@go1.26.2
    Fixed in: net/http@go1.26.6

Vulnerability #14: GO-2026-4986
    Quadratic string concatentation in consumeComment in net/mail
  More info: https://pkg.go.dev/vuln/GO-2026-4986
  Standard library
    Found in: net/mail@go1.26.2
    Fixed in: net/mail@go1.26.3

Vulnerability #15: GO-2026-4982
    Bypass of meta content URL escaping causes XSS in html/template
  More info: https://pkg.go.dev/vuln/GO-2026-4982
  Standard library
    Found in: html/template@go1.26.2
    Fixed in: html/template@go1.26.3

Vulnerability #16: GO-2026-4981
    Crash when handling long CNAME response in net
  More info: https://pkg.go.dev/vuln/GO-2026-4981
  Standard library
    Found in: net@go1.26.2
    Fixed in: net@go1.26.3

Vulnerability #17: GO-2026-4980
    Escaper bypass leads to XSS in html/template
  More info: https://pkg.go.dev/vuln/GO-2026-4980
  Standard library
    Found in: html/template@go1.26.2
    Fixed in: html/template@go1.26.3

Vulnerability #18: GO-2026-4977
    Quadratic string concatenation in consumePhrase in net/mail
  More info: https://pkg.go.dev/vuln/GO-2026-4977
  Standard library
    Found in: net/mail@go1.26.2
    Fixed in: net/mail@go1.26.3

Vulnerability #19: GO-2026-4976
    ReverseProxy forwards queries with more than urlmaxqueryparams parameters in
    net/http/httputil
  More info: https://pkg.go.dev/vuln/GO-2026-4976
  Standard library
    Found in: net/http/httputil@go1.26.2
    Fixed in: net/http/httputil@go1.26.3

Vulnerability #20: GO-2026-4971
    Panic in Dial and LookupPort when handling NUL byte on Windows in net
  More info: https://pkg.go.dev/vuln/GO-2026-4971
  Standard library
    Found in: net@go1.26.2
    Fixed in: net@go1.26.3

Vulnerability #21: GO-2026-4970
    Root escape via symlink plus trailing slash in os
  More info: https://pkg.go.dev/vuln/GO-2026-4970
  Standard library
    Found in: os@go1.26.2
    Fixed in: os@go1.26.5

Vulnerability #22: GO-2026-4918
    Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in
    net/http/internal/http2 in golang.org/x/net
  More info: https://pkg.go.dev/vuln/GO-2026-4918
  Standard library
    Found in: net/http@go1.26.2
    Fixed in: net/http@go1.26.3

Your code may be affected by 22 vulnerabilities.
This scan also found 2 vulnerabilities in modules you require.
Use '-scan symbol' for more fine grained vulnerability detection and '-show
verbose' for more details.

=== BASE (main) ===

--- /tmp/tmp.8cwwywsTt3/pr-base.txt     2026-08-19 15:06:26.281580279 -0300
+++ /tmp/tmp.8cwwywsTt3/head.txt        2026-08-19 15:06:26.273580254 -0300
@@ -0,0 +1,167 @@
+=== Package Results ===
+
+Vulnerability #1: GO-2026-6218
+    Avoid quadratic complexity in resolvePath in net/url
+  More info: https://pkg.go.dev/vuln/GO-2026-6218
+  Standard library
+    Found in: net/url@go1.26.2
+    Fixed in: net/url@go1.26.6
+
+Vulnerability #2: GO-2026-6094
+    JSON private fields exposed via NativeTypes and ParseStructTag in
+    github.com/google/cel-go
+  More info: https://pkg.go.dev/vuln/GO-2026-6094
+  Module: github.com/google/cel-go
+    Found in: github.com/google/cel-go@v0.29.2
+    Fixed in: github.com/google/cel-go@v0.30.0
+
+Vulnerability #3: GO-2026-6091
+    Fix Javascript regexp context tracking in html/template
+  More info: https://pkg.go.dev/vuln/GO-2026-6091
+  Standard library
+    Found in: html/template@go1.26.2
+    Fixed in: html/template@go1.26.6
+
+Vulnerability #4: GO-2026-6090
+    Limit handshake messages we are willing to accept post-handshake in
+    crypto/tls
+  More info: https://pkg.go.dev/vuln/GO-2026-6090
+  Standard library
+    Found in: crypto/tls@go1.26.2
+    Fixed in: crypto/tls@go1.26.6
+
+Vulnerability #5: GO-2026-6089
+    Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
+  More info: https://pkg.go.dev/vuln/GO-2026-6089
+  Standard library
+    Found in: net/http@go1.26.2
+    Fixed in: net/http@go1.26.6
+
+Vulnerability #6: GO-2026-6088
+    Add recursion depth guard during decode in encoding/xml
+  More info: https://pkg.go.dev/vuln/GO-2026-6088
+  Standard library
+    Found in: encoding/xml@go1.26.2
+    Fixed in: encoding/xml@go1.26.6
+
+Vulnerability #7: GO-2026-5972
+    Enforce maximum recursion depth in encoding/asn1
+  More info: https://pkg.go.dev/vuln/GO-2026-5972
+  Standard library
+    Found in: encoding/asn1@go1.26.2
+    Fixed in: encoding/asn1@go1.26.6
+
+Vulnerability #8: GO-2026-5942
+    Parsing an invalid SVCB or HTTPS RR can panic in
+    golang.org/x/net/dns/dnsmessage
+  More info: https://pkg.go.dev/vuln/GO-2026-5942
+  Standard library
+    Found in: net@go1.26.2
+    Fixed in: net@go1.26.6
+
+Vulnerability #9: GO-2026-5856
+    Invoking Encrypted Client Hello privacy leak in crypto/tls
+  More info: https://pkg.go.dev/vuln/GO-2026-5856
+  Standard library
+    Found in: crypto/tls@go1.26.2
+    Fixed in: crypto/tls@go1.26.5
+
+Vulnerability #10: GO-2026-5039
+    Arbitrary inputs are included in errors without any escaping in
+    net/textproto
+  More info: https://pkg.go.dev/vuln/GO-2026-5039
+  Standard library
+    Found in: net/textproto@go1.26.2
+    Fixed in: net/textproto@go1.26.4
+
+Vulnerability #11: GO-2026-5038
+    Quadratic complexity in WordDecoder.DecodeHeader in mime
+  More info: https://pkg.go.dev/vuln/GO-2026-5038
+  Standard library
+    Found in: mime@go1.26.2
+    Fixed in: mime@go1.26.4
+
+Vulnerability #12: GO-2026-5037
+    Inefficient candidate hostname parsing in crypto/x509
+  More info: https://pkg.go.dev/vuln/GO-2026-5037
+  Standard library
+    Found in: crypto/x509@go1.26.2
+    Fixed in: crypto/x509@go1.26.4
+
+Vulnerability #13: GO-2026-5026
+    Invoking failure to reject ASCII-only Punycode-encoded labels in
+    golang.org/x/net/idna
+  More info: https://pkg.go.dev/vuln/GO-2026-5026
+  Standard library
+    Found in: net/http@go1.26.2
+    Fixed in: net/http@go1.26.6
+
+Vulnerability #14: GO-2026-4986
+    Quadratic string concatentation in consumeComment in net/mail
+  More info: https://pkg.go.dev/vuln/GO-2026-4986
+  Standard library
+    Found in: net/mail@go1.26.2
+    Fixed in: net/mail@go1.26.3
+
+Vulnerability #15: GO-2026-4982
+    Bypass of meta content URL escaping causes XSS in html/template
+  More info: https://pkg.go.dev/vuln/GO-2026-4982
+  Standard library
+    Found in: html/template@go1.26.2
+    Fixed in: html/template@go1.26.3
+
+Vulnerability #16: GO-2026-4981
+    Crash when handling long CNAME response in net
+  More info: https://pkg.go.dev/vuln/GO-2026-4981
+  Standard library
+    Found in: net@go1.26.2
+    Fixed in: net@go1.26.3
+
+Vulnerability #17: GO-2026-4980
+    Escaper bypass leads to XSS in html/template
+  More info: https://pkg.go.dev/vuln/GO-2026-4980
+  Standard library
+    Found in: html/template@go1.26.2
+    Fixed in: html/template@go1.26.3
+
+Vulnerability #18: GO-2026-4977
+    Quadratic string concatenation in consumePhrase in net/mail
+  More info: https://pkg.go.dev/vuln/GO-2026-4977
+  Standard library
+    Found in: net/mail@go1.26.2
+    Fixed in: net/mail@go1.26.3
+
+Vulnerability #19: GO-2026-4976
+    ReverseProxy forwards queries with more than urlmaxqueryparams parameters in
+    net/http/httputil
+  More info: https://pkg.go.dev/vuln/GO-2026-4976
+  Standard library
+    Found in: net/http/httputil@go1.26.2
+    Fixed in: net/http/httputil@go1.26.3
+
+Vulnerability #20: GO-2026-4971
+    Panic in Dial and LookupPort when handling NUL byte on Windows in net
+  More info: https://pkg.go.dev/vuln/GO-2026-4971
+  Standard library
+    Found in: net@go1.26.2
+    Fixed in: net@go1.26.3
+
+Vulnerability #21: GO-2026-4970
+    Root escape via symlink plus trailing slash in os
+  More info: https://pkg.go.dev/vuln/GO-2026-4970
+  Standard library
+    Found in: os@go1.26.2
+    Fixed in: os@go1.26.5
+
+Vulnerability #22: GO-2026-4918
+    Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in
+    net/http/internal/http2 in golang.org/x/net
+  More info: https://pkg.go.dev/vuln/GO-2026-4918
+  Standard library
+    Found in: net/http@go1.26.2
+    Fixed in: net/http@go1.26.3
+
+Your code may be affected by 22 vulnerabilities.
+This scan also found 2 vulnerabilities in modules you require.
+Use '-scan symbol' for more fine grained vulnerability detection and '-show
+verbose' for more details.

Open question

Should it fail if/when vulnerabilities are found?

The govulncheck script now uses the same mechanism for the other tools in hack/tools/bin.

netlify · 2026-08-19T18:12:50Z

✅ Deploy Preview for node-readiness-controller ready!

Name	Link
🔨 Latest commit	`701007c`
🔍 Latest deploy log	https://app.netlify.com/projects/node-readiness-controller/deploys/6a85f21feda56f00087a4a8b
😎 Deploy Preview	https://deploy-preview-434--node-readiness-controller.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

kubernetes-prow · 2026-08-19T18:12:51Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: vitorfloriano
Once this PR has been reviewed and has the lgtm label, please assign tallclair for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

vitorfloriano · 2026-08-19T18:13:55Z

/cc @ajaysundark @AvineshTripathi

vitorfloriano · 2026-08-19T18:18:52Z

govulncheck ran successfully (but didn't fail, despite the vulnerabilites found): https://prow.k8s.io/view/gs/kubernetes-ci-logs/pr-logs/pull/kubernetes-sigs_node-readiness-controller/434/pull-node-readiness-controller-verify-all/2090139930821922816#1:build-log.txt%3A69-585

ajaysundark · 2026-08-19T18:24:04Z

Thanks for looking into this, @vitorfloriano !

Should it fail if/when vulnerabilities are found?

I think it's one of those things that doesn't fit a presubmit best. Ideally for a vulnerability detector, we should move this into a periodic, that fails separately and can alert us. Potentially even having an "exemption" list so that we can 'silent' some failures if we need to. And our release process to check this periodic for green and address any patches if needed.

vitorfloriano · 2026-08-19T19:25:52Z

I think it's one of those things that doesn't fit a presubmit best. Ideally for a vulnerability detector, we should move this into a periodic, that fails separately and can alert us. Potentially even having an "exemption" list so that we can 'silent' some failures if we need to. And our release process to check this periodic for green and address any patches if needed.

Agreed.

So, in this case, I guess I should pivot the PR to:

remove hack/verify-govulncheck.sh
remove hack/verify-govulncheck.sh from verify-all.sh
remove .github/workflows/govulncheck.yml
refactor make verify-govulncheck to run govulncheck -scan package ./... on the main branch (not base vs PR branch)

In a follow-up:

Add a periodic that runs make verify-govulncheck daily (or whatever cadence we decide upon)

WDYT @ajaysundark?

ajaysundark · 2026-08-19T19:33:54Z

I think it's one of those things that doesn't fit a presubmit best. Ideally for a vulnerability detector, we should move this into a periodic, that fails separately and can alert us. Potentially even having an "exemption" list so that we can 'silent' some failures if we need to. And our release process to check this periodic for green and address any patches if needed.

Agreed.

So, in this case, I guess I should pivot the PR to:

remove hack/verify-govulncheck.sh

remove hack/verify-govulncheck.sh from verify-all.sh

remove .github/workflows/govulncheck.yml

refactor make verify-govulncheck to run govulncheck -scan package ./... on the main branch (not base vs PR branch)

In a follow-up:

Add a periodic that runs make verify-govulncheck daily (or whatever cadence we decide upon)

WDYT @ajaysundark?

Sgtm. @Priyankasaggu11929 do you have any thoughts on tying this with periodics than presubmits?

Priyankasaggu11929 · 2026-08-20T14:44:14Z

i think running as a periodics is good for our required signal right now

infra: refactor govulncheck target and hack script.

701007c

The govulncheck script now uses the same mechanism for the other tools in hack/tools/bin.

kubernetes-prow Bot added kind/bug Categorizes issue or PR as related to a bug. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. kind/failing-test Categorizes issue or PR as related to a consistently or frequently failing test. labels Aug 19, 2026

kubernetes-prow Bot requested a review from haircommander August 19, 2026 18:12

kubernetes-prow Bot requested a review from tallclair August 19, 2026 18:12

kubernetes-prow Bot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Aug 19, 2026

kubernetes-prow Bot requested review from AvineshTripathi and ajaysundark August 19, 2026 18:13

Navigation Menu

Uh oh!

infra: refactor govulncheck target and hack script. - #434

infra: refactor govulncheck target and hack script.#434
vitorfloriano wants to merge 1 commit into
kubernetes-sigs:mainfrom
vitorfloriano:fix-govulncheck-script

vitorfloriano commented Aug 19, 2026

Uh oh!

netlify Bot commented Aug 19, 2026 •

edited

Loading

Uh oh!

kubernetes-prow Bot commented Aug 19, 2026

Uh oh!

vitorfloriano commented Aug 19, 2026

Uh oh!

vitorfloriano commented Aug 19, 2026

Uh oh!

ajaysundark commented Aug 19, 2026 •

edited

Loading

Uh oh!

vitorfloriano commented Aug 19, 2026

Uh oh!

ajaysundark commented Aug 19, 2026

Uh oh!

Priyankasaggu11929 commented Aug 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

vitorfloriano commented Aug 19, 2026

Description

Related Issue

Type of Change

Testing

Open question

Uh oh!

netlify Bot commented Aug 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for node-readiness-controller ready!

Uh oh!

kubernetes-prow Bot commented Aug 19, 2026

Uh oh!

vitorfloriano commented Aug 19, 2026

Uh oh!

vitorfloriano commented Aug 19, 2026

Uh oh!

ajaysundark commented Aug 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vitorfloriano commented Aug 19, 2026

Uh oh!

ajaysundark commented Aug 19, 2026

Uh oh!

Priyankasaggu11929 commented Aug 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

netlify Bot commented Aug 19, 2026 •

edited

Loading

ajaysundark commented Aug 19, 2026 •

edited

Loading