[cherry-pick v20260514] fix(security): bump Go to 1.25.10 and golang.org/x/net to v0.55.0

[djsly]

Summary

Cherry-pick of #8551 to official/vv20260514.

Bumps the Go toolchain and golang.org/x/net to address upstream CVEs:

Vulnerability	CVE	Component	Fixed by
net/mail DoS via crafted addresses	CVE-2026-39820	net/mail (stdlib)	Go 1.25.10
cmd/go pack subcommand directory traversal	CVE-2026-39817	cmd/go (stdlib)	Go 1.25.10
HTTP/2 + IPv6 host parsing fixes	(various, see x/net release notes)	golang.org/x/net	v0.55.0

Why bump to Go 1.25 (and not a 1.24.x patch)

Go 1.24 reached EOL in February 2026 and does NOT receive security backports. go1.25.10 is the only release stream that contains these fixes.

golang.org/x/net v0.51.0+ also requires go 1.25.0 in its own go.mod, so the Go bump is required regardless.

Verification

• go mod tidy succeeds for every module in the branch.
• go build ./... clean across every module.
• PR CI must pull go 1.25 runners.

Release plan

Once merged, two tags are pushed off the resulting commit:

• v0.v20260514.<N+1> (AgentBaker module)
• aks-node-controller/v0.v20260514.<N+1> (aks-node-controller submodule)

🤖 Generated with GitHub Copilot CLI

[github-actions]

Changes cached containers or packages on windows VHDs

Please get a Windows SIG member to approve.

The following dif file shows any additions or deletions from what will be cached on windows VHDs organised by VHD type.

• Additions are new things cached.
• Deletions are things no longer cached.

diff --git a/vhd_files/2022-containerd-gen2.txt b/vhd_files/2022-containerd-gen2.txt
index 88166c3..7b0f611 100644
--- a/vhd_files/2022-containerd-gen2.txt
+++ b/vhd_files/2022-containerd-gen2.txt
@@ -112,0 +113,6 @@ mcr.microsoft.com/containernetworking/azure-cns:v1.8.6-0
+mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.31.12-windows-hpc
+mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.31.9-windows-hpc
+mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.32.11-windows-hpc
+mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.32.8-windows-hpc
+mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.33.3-windows-hpc
+mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.33.6-windows-hpc
@@ -117 +122,0 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/azuredisk-csi:v1.34.3-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.33.10-windows-hp
@@ -120 +124,0 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.34.5-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.34.6-windows-hp
@@ -122 +125,0 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.35.2-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.35.3-windows-hp
@@ -127,0 +131,4 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/secrets-store/driver:v1.5.4
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.30.15-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.31.12-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.32.11-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.32.16-windows-hpc-1
@@ -128,0 +136,2 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.33.11-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.33.6-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.3-windows-hpc-1
@@ -129,0 +139 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.8-windows-hpc
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.1-windows-hpc-1
diff --git a/vhd_files/2022-containerd.txt b/vhd_files/2022-containerd.txt
index b3f76e6..8d3d00c 100644
--- a/vhd_files/2022-containerd.txt
+++ b/vhd_files/2022-containerd.txt
@@ -112,0 +113,6 @@ mcr.microsoft.com/containernetworking/azure-cns:v1.8.6-0
+mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.31.12-windows-hpc
+mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.31.9-windows-hpc
+mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.32.11-windows-hpc
+mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.32.8-windows-hpc
+mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.33.3-windows-hpc
+mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.33.6-windows-hpc
@@ -117 +122,0 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/azuredisk-csi:v1.34.3-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.33.10-windows-hp
@@ -120 +124,0 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.34.5-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.34.6-windows-hp
@@ -122 +125,0 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.35.2-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.35.3-windows-hp
@@ -127,0 +131,4 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/secrets-store/driver:v1.5.4
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.30.15-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.31.12-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.32.11-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.32.16-windows-hpc-1
@@ -128,0 +136,2 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.33.11-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.33.6-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.3-windows-hpc-1
@@ -129,0 +139 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.8-windows-hpc
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.1-windows-hpc-1
diff --git a/vhd_files/2025-gen2.txt b/vhd_files/2025-gen2.txt
index 7baa7a5..9e61267 100644
--- a/vhd_files/2025-gen2.txt
+++ b/vhd_files/2025-gen2.txt
@@ -15 +15 @@ c:\akse-cache\csi-proxy\: https://packages.aks.azure.com/csi-proxy/v1.1.2-hotfix
-c:\akse-cache\wcn\: mcr.microsoft.com/wcn/package:1.7.0-cpu-arch
+c:\akse-cache\wcn\: mcr.microsoft.com/wcn/package:1.6.0-cpu-arch
@@ -42,0 +43,6 @@ mcr.microsoft.com/containernetworking/azure-cns:v1.8.6-0
+mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.31.12-windows-hpc
+mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.31.9-windows-hpc
+mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.32.11-windows-hpc
+mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.32.8-windows-hpc
+mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.33.3-windows-hpc
+mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.33.6-windows-hpc
@@ -47 +52,0 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/azuredisk-csi:v1.34.3-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.33.10-windows-hp
@@ -50 +54,0 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.34.5-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.34.6-windows-hp
@@ -52 +55,0 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.35.2-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.35.3-windows-hp
@@ -57,0 +61,4 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/secrets-store/driver:v1.5.4
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.30.15-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.31.12-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.32.11-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.32.16-windows-hpc-1
@@ -58,0 +66,2 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.33.11-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.33.6-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.3-windows-hpc-1
@@ -59,0 +69 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.8-windows-hpc
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.1-windows-hpc-1
diff --git a/vhd_files/2025.txt b/vhd_files/2025.txt
index f747f05..1222b2f 100644
--- a/vhd_files/2025.txt
+++ b/vhd_files/2025.txt
@@ -15 +15 @@ c:\akse-cache\csi-proxy\: https://packages.aks.azure.com/csi-proxy/v1.1.2-hotfix
-c:\akse-cache\wcn\: mcr.microsoft.com/wcn/package:1.7.0-cpu-arch
+c:\akse-cache\wcn\: mcr.microsoft.com/wcn/package:1.6.0-cpu-arch
@@ -42,0 +43,6 @@ mcr.microsoft.com/containernetworking/azure-cns:v1.8.6-0
+mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.31.12-windows-hpc
+mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.31.9-windows-hpc
+mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.32.11-windows-hpc
+mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.32.8-windows-hpc
+mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.33.3-windows-hpc
+mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.33.6-windows-hpc
@@ -47 +52,0 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/azuredisk-csi:v1.34.3-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.33.10-windows-hp
@@ -50 +54,0 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.34.5-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.34.6-windows-hp
@@ -52 +55,0 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.35.2-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.35.3-windows-hp
@@ -57,0 +61,4 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/secrets-store/driver:v1.5.4
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.30.15-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.31.12-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.32.11-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.32.16-windows-hpc-1
@@ -58,0 +66,2 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.33.11-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.33.6-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.3-windows-hpc-1
@@ -59,0 +69 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.8-windows-hpc
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.1-windows-hpc-1

[Copilot]

Pull request overview

Updates the AgentBaker repository’s Go toolchain version and key golang.org/x/* dependencies to remediate upstream security issues, and aligns CI workflows to build/test with the new Go version.

Changes:

• Bump all repo Go modules from go 1.24.12 to go 1.25.10.
• Update golang.org/x/net to v0.55.0 (and related x/sys, x/text, plus x/crypto in e2e) with corresponding go.sum refresh.
• Update GitHub Actions workflows to use Go 1.25, and fix an e2e panic formatting issue (%w → %v) to satisfy stricter vetting.

Reviewed changes

Copilot reviewed 15 out of 18 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
go.mod	Bumps root module Go version and updates indirect golang.org/x/{net,sys,text} versions.
go.sum	Reflects updated golang.org/x/{net,sys,text} checksums after tidy.
e2e/go.mod	Bumps e2e module Go version and updates golang.org/x/{crypto,net,sys,term,text} versions.
e2e/go.sum	Updates checksums for the e2e module dependency graph after tidy.
e2e/config/config.go	Replaces invalid fmt.Sprintf(...%w...) usage with %v in a panic message.
aks-node-controller/go.mod	Bumps module Go version and updates indirect golang.org/x/sys.
aks-node-controller/go.sum	Updates golang.org/x/{net,sys,text} checksums used by aks-node-controller deps.
vhdbuilder/prefetch/go.mod	Bumps module Go version to 1.25.10.
vhdbuilder/lister/go.mod	Bumps module Go version to 1.25.10.
image-fetcher/go.mod	Bumps module Go version to 1.25.10.
hack/tools/go.mod	Bumps module Go version to 1.25.10.
.github/workflows/go-test.yml	Runs unit tests using Go 1.25.
.github/workflows/golangci-lint.yml	Runs golangci-lint workflow using Go 1.25.
.github/workflows/check-coverage.yml	Runs coverage workflow using Go 1.25.
.github/workflows/copilot-setup-steps.yml	Updates Copilot setup workflow to install Go 1.25.
.github/workflows/shellcheck.yml	Updates ShellCheck workflow Go version to 1.25.
.github/workflows/shellspec.yaml	Updates ShellSpec workflow Go version to 1.25.
.github/workflows/validate-components.yml	Updates validation workflows to Go 1.25 / go-version-file: e2e/go.mod.