chore(core): CVE mitigation 08-04-2026 (#2196)

chore(core): cve mitigation 08-04-2026

- Fix CVE-2026-32280 Unexpected work during chain building in crypto/x509
- Fix CVE-2026-32281 Inefficient policy validation in crypto/x509
- Fix CVE-2026-32282 TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix...
- Fix CVE-2026-32283 Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS..
- Fix CVE-2026-32288 Unbounded allocation for old GNU sparse in archive/tar
- Fix CVE-2026-32289 JsBraceDepth Context Tracking Bugs (XSS) in html/template

Signed-off-by: Dmitry Lopatin <dmitry.lopatin@flant.com>

Author: LopatinDmitr

.github/workflows/dev_module_build-and-registration.yml

@@ -25,7 +25,7 @@ env:
   MODULES_MODULE_TAG: ${{ github.event.inputs.tag }}
   SOURCE_REPO: "${{secrets.SOURCE_REPO}}"
   SOURCE_REPO_GIT: "${{secrets.SOURCE_REPO_GIT}}"
-  GO_VERSION: "1.25.8"
+  GO_VERSION: "1.25.9"
   MODULE_EDITION: "EE"
 
 on:

.github/workflows/dev_module_build.yml

@@ -21,7 +21,7 @@ env:
   MODULES_MODULE_SOURCE: ${{ vars.DEV_MODULE_SOURCE }}
   MODULES_REGISTRY_LOGIN: ${{ vars.DEV_MODULES_REGISTRY_LOGIN }}
   MODULES_REGISTRY_PASSWORD: ${{ secrets.DEV_MODULES_REGISTRY_PASSWORD }}
-  GO_VERSION: "1.25.8"
+  GO_VERSION: "1.25.9"
   GOLANGCI_LINT_VERSION: "2.11.1"
   SOURCE_REPO: "${{secrets.SOURCE_REPO}}"
   SOURCE_REPO_GIT: "${{secrets.SOURCE_REPO_GIT}}"

.github/workflows/dev_validation.yaml

@@ -15,7 +15,7 @@
 name: Validations
 
 env:
-  GO_VERSION: "1.25.8"
+  GO_VERSION: "1.25.9"
 on:
   pull_request:
     types: [opened, synchronize, labeled, unlabeled]
@@ -137,9 +137,9 @@ jobs:
       matrix:
         # Define two groups of components with their respective Go versions
         components:
-          - { component: virtualization-artifact, go-version: "1.25.8" }
-          - { component: vm-route-forge, go-version: "1.25.8" }
-          - { component: api, go-version: "1.25.8" }
+          - { component: virtualization-artifact, go-version: "1.25.9" }
+          - { component: vm-route-forge, go-version: "1.25.9" }
+          - { component: api, go-version: "1.25.9" }
 
     steps:
       - name: Set skip flag

.github/workflows/e2e-matrix.yml

@@ -339,7 +339,7 @@ jobs:
       virtualization_tag: main
       deckhouse_channel: alpha
       default_user: cloud
-      go_version: "1.25.8"
+      go_version: "1.25.9"
       e2e_timeout: "3.5h"
       date_start: ${{ needs.set-vars.outputs.date_start }}
       randuuid4c: ${{ needs.set-vars.outputs.randuuid4c }}

.github/workflows/nightly_e2e_tests_ceph.yaml

@@ -18,7 +18,7 @@ env:
   CSI: rbd.csi.ceph.com
   STORAGE_CLASS_NAME: ceph-pool-r2-csi-rbd-immediate
   CI_COMMIT_REF_NAME: ${{ github.ref_name }}
-  GO_VERSION: "1.25.8"
+  GO_VERSION: "1.25.9"
   TIMEOUT: "3h"
 
 on:

.github/workflows/nightly_e2e_tests_replicated.yaml

@@ -18,7 +18,7 @@ env:
   CSI: replicated.csi.storage.deckhouse.io
   STORAGE_CLASS_NAME: linstor-thin-r1
   CI_COMMIT_REF_NAME: ${{ github.ref_name }}
-  GO_VERSION: "1.25.8"
+  GO_VERSION: "1.25.9"
   TIMEOUT: "3h"
 
 on:

.github/workflows/release_module_release-channels.yml

@@ -117,7 +117,7 @@ jobs:
     needs: print-vars
     if: ${{ !inputs.check_only && (inputs.ce || inputs.ee) }}
     env:
-      GO_VERSION: "1.25.8"
+      GO_VERSION: "1.25.9"
       input_channel: ${{ github.event.inputs.channel }}
       input_version: ${{ github.event.inputs.tag }}
     steps:
@@ -411,7 +411,7 @@ jobs:
     name: Check version on release channel
     runs-on: ubuntu-latest
     env:
-      GO_VERSION: "1.25.8"
+      GO_VERSION: "1.25.9"
       input_channel: ${{ github.event.inputs.channel }}
       input_version: ${{ github.event.inputs.tag }}
     needs:

api/client/examples/cancel-evacuation/go.mod

@@ -1,6 +1,6 @@
 module github.com/deckhouse/virtualization/api/client/examples/cancel-evacuation
 
-go 1.25.8
+go 1.25.9
 
 require (
 	github.com/deckhouse/virtualization/api v1.6.1

api/client/examples/list-resources/go.mod

@@ -1,6 +1,6 @@
 module github.com/deckhouse/virtualization/api/client/examples/list-resources
 
-go 1.25.8
+go 1.25.9
 
 require (
 	github.com/deckhouse/virtualization/api v1.6.1

api/client/examples/resourceclaim/go.mod

@@ -1,6 +1,6 @@
 module github.com/deckhouse/virtualization/api/client/examples/resourceclaim
 
-go 1.25.8
+go 1.25.9
 
 require (
 	github.com/deckhouse/virtualization/api v1.6.1