[release-v0.14] Backport CVE-2025-22869 changes to v0.14 from v0.15; Update go to 1.23.0 from 1.22.0 to support x/crypto 0.35

[psrvere]

Changes

Backport #1755 to release-0.14. This PR

• updates golang.org/x/crypto to 0.35 to address CVE-2025-22869
• updates go to 1.23.0 from 1.22.0 to support golang.org/x/crypto 0.35 version

/kind dependency-change

Submitter Checklist

• Includes tests if functionality changed/was added
• Includes docs if changes are user-facing
• Set a kind label on this PR
• Release notes block has been filled in, or marked NONE

Release Notes

Update golang.org/x/crypto to v0.35.0 to address CVE-2025-22869. Update go to 1.23.0 from 1.22.0 to support x/crypto 0.35.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign qu1queee for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[psrvere]

@SaschaSchwarze0 - Commits signed. Haven't changed the go version in Github workflows yet. Wanted to see the failure messages first. Please approve workflows.

[SaschaSchwarze0]

@SaschaSchwarze0 - Commits signed. Haven't changed the go version in Github workflows yet. Wanted to see the failure messages first. Please approve workflows.

Interesting. I had assumed that recent Go versions would complain about compiling Go modules that have a newer version.

[adambkaplan]

/hold

Per discussion in the community call today - as a community, we are "supporting" our latest release with our automated vulnerability detection and bugfix release process. We think the right course of action is to allow PRs to older release branches, however we are not going to issue new z-stream releases for those versions.

For this particular PR, I am wary of accepting it because it requires us to upgrade the golang runtime version to 1.23. I assume CI is passing because golang 1.21 introduced "forward compatibility" mechanisms that download SDK toolchains on the fly. One can argue that the go.mod file defines which version of go is used in the build - nonetheless there is some level of config skew in this PR as is.

With that "cost" in mind, one has to ask "what is the benefit?" CVE-2025-22869 is interesting in that it has a high CVSS score, but only for SSH servers using the x/crypto/ssh package. In Shipwright, we are using ssh packages for client-side SSH operations (most notably to clone source from git). From my understanding of the vulnerability report, client-side operations are not affected. Unfortunately, today's scanning tool ecosystem does not have great mechanisms for code to declare itself "not affected" by a vulnerability. I don't see "make the scanners happy" a strong enough benefit.

[psrvere]

Thanks Adam for the note. Closing the PR.