fix: update golang.org/x/net to v0.38.0 in pvcviewer-controller

[asaadbalum]

Description

Update golang.org/x/net from v0.24.0 to v0.38.0 in the pvcviewer-controller to fix security vulnerabilities.

CVEs Fixed:

• ✅ CVE-2025-22870
• ✅ CVE-2025-22872

Related Issue: Closes #782 (PR 1)

---

Changes

Updated dependencies in components/pvcviewer-controller/go.mod:

Dependency	Old Version	New Version
golang.org/x/net	v0.24.0	v0.38.0
golang.org/x/sys	v0.19.0	v0.31.0
golang.org/x/term	v0.19.0	v0.30.0
golang.org/x/text	v0.14.0	v0.23.0
golang.org/x/tools	v0.20.0	v0.22.0

Note: The additional golang.org/x/* packages are transitive dependencies of golang.org/x/net. They were automatically updated by go mod tidy to maintain compatibility.

---

Testing

Local Build & Tests

Test	Result
go mod tidy	✅ Pass
go vet ./...	✅ No issues
make manager	✅ Builds cleanly
Unit tests (10/10)	✅ 65.4% coverage
staticcheck ./...	✅ No new issues

CVE Verification (Trivy Scan)

=== Searching for CVE-2025-22870 ===
NOT FOUND - FIXED ✅

=== Searching for CVE-2025-22872 ===
NOT FOUND - FIXED ✅

=== Current golang.org/x/net version ===
golang.org/x/net v0.38.0 // indirect

End-to-End Cluster Verification

Environment:

• Fedora 42 (kernel 6.14.2)
• Kind cluster with Podman
• Kubeflow notebooks-v1

Custom Image Deployed:
ghcr.io/kubeflow/notebooks/pvcviewer-controller:dcfd8fb

All Kubeflow Pods Running:

pvcviewer-controller-manager-794458c69b-gf5nk       3/3     Running
volumes-web-app-deployment-5698b6c5c9-5p4kp         2/2     Running
notebook-controller-deployment-c4f4fb986-h2k95      2/2     Running
jupyter-web-app-deployment-555bd4c7f6-wwdl4         2/2     Running
centraldashboard-5f49c896c7-m2v8l                   2/2     Running
...

Controller Logs (healthy):

INFO  controller-runtime.builder  Registering a mutating webhook
INFO  controller-runtime.builder  Registering a validating webhook  
INFO  setup  starting manager
successfully acquired lease kubeflow/57a72bdf.kubeflow.org
INFO  Starting Controller  {"controller": "pvcviewer"}
INFO  Starting workers  {"worker count": 1}

Dashboard Verification:

• ✅ Login with Dex authentication
• ✅ Central Dashboard loads
• ✅ Volumes page functional
• ✅ PVCViewer webhooks registered

---

Acceptance Criteria

• Run go mod tidy to ensure dependencies are clean
• Run make manager to build the controller
• Run unit tests to verify functionality
• CI workflows pass (unit, integration, multi-arch tests)
• Deploy to notebooks-v1 cluster and verify PVCViewer component
• Verify CVEs are fixed via Trivy scan

Signed-off-by: Asaad Balum [email protected]

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign kimwnasptd for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• components/pvcviewer-controller/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment