[ospk8s-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
golang.org/x/net	v0.60.0 → v0.62.0

---

Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net

CVE-2026-78661 / GO-2026-6860

More information

Details

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a") caused O(n^2) allocations and byte copies.

Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.

Severity

Unknown

References

• https://go.dev/cl/849365
• https://go.dev/issue/82224
• https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net

CVE-2026-97045 / GO-2026-6866

More information

Details

In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as or fostered under ), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output.

Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.

Severity

Unknown

References

• https://go.dev/cl/855121
• https://go.dev/issue/82622
• https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[ospk8s-renovate]

ℹ️ Artifact update notice

File name: api/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 4 additional dependencies were updated

Details:

Package	Change
golang.org/x/sync	v0.23.0 -> v0.24.0
golang.org/x/sys	v0.48.0 -> v0.49.0
golang.org/x/term	v0.46.0 -> v0.47.0
golang.org/x/text	v0.42.0 -> v0.43.0

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 5 additional dependencies were updated

Details:

Package	Change
golang.org/x/sync	v0.23.0 -> v0.24.0
golang.org/x/sys	v0.48.0 -> v0.49.0
golang.org/x/term	v0.46.0 -> v0.47.0
golang.org/x/text	v0.42.0 -> v0.43.0
golang.org/x/tools	v0.49.0 -> v0.51.0

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: 00ba318d-cc09-4e35-8108-e5ff7df3791f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

Hi @ospk8s-renovate[bot]. Thanks for your PR.

I'm waiting for a openstack-k8s-operators member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ospk8s-renovate[bot], steveb

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [steveb]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[centosinfra-prod-github-app]

Build succeeded (check pipeline).
https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/7fef0567167d45c9880979985762a8b6

✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 28m 42s
✔️ podified-multinode-ironic-deployment SUCCESS in 52m 13s
✔️ ironic-s2i-content-provider SUCCESS in 7h 59m 07s (non-voting)
✔️ ironic-s2i-hotstack-sno-1-bm SUCCESS in 1h 39m 32s (non-voting)

Warning:
File ansible/tmp/2f82386ca06648359a5af8e1edd108dc found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job podified-multinode-ironic-deployment. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/48f9c5e7666c46eb947372e8e74642c7 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job podified-multinode-ironic-deployment. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/2f82386ca06648359a5af8e1edd108dc found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/multinode-autohold.yml for job podified-multinode-ironic-deployment. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/48f9c5e7666c46eb947372e8e74642c7 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/multinode-autohold.yml for job podified-multinode-ironic-deployment. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/2f82386ca06648359a5af8e1edd108dc found in build home directory during playbook review.rdoproject.org/config/playbooks/crc/print-machineconfigpool.yaml for job podified-multinode-ironic-deployment. Add to preserve-home-paths if safe, or otherwise remove.
File .ssh/config found in build home directory during playbook github.com/openstack-k8s-operators/s2i-openstack-containers/playbooks/container-ci/zuul/pre.yaml for job ironic-s2i-content-provider. Add to preserve-home-paths if safe, or otherwise remove.