Address CVEs

[dhaiducek]

• CVE-2024-45338
• CVE-2024-45337
• CVE-2024-41110
• CVE-2025-21613

This is currently raising flags in our builds.

Related PRs (since Go updates don't cherry-pick cleanly):

• [release-4.18] Address CVEs #1961
• [release-4.17] Address CVEs #1962

Closes #1950

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dhaiducek
Once this PR has been reviewed and has the lgtm label, please assign ardaguclu for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[pastequo]

Hello @dhaiducek

Could you also address this one as well ? GHSA-v725-9546-7q7m
It's an indirect dependency

[giladravid16]

Hey @dhaiducek

Just to clarify on what @pastequo wrote above, we also need that extra CVE fix on the related PRs you opened (specifically on the 4.17 branch).
Can it be added to them as well?

[dhaiducek]

@giladravid16 @pastequo I've added the go-git update to the other PRs, but I'm also not a maintainer. I'm in a similar situation where we have oc as a dependency and need the critical vulnerabilities addressed here for our builds to pass.

[openshift-ci]

@dhaiducek: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ovn-serial	ac7e870	link	true	/test e2e-aws-ovn-serial

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.