[openshift-5.0] OCPBUGS-92008: bumping quic-go to v0.59.1

[AkashMore08]

1. Why is this pull request needed and what does it do?

This PR bumps github.com/quic-go/quic-go from v0.55.0 to v0.59.1 to remediate CVE-2026-40898 (GO-2026-5676).
CVE-2026-40898 is a denial-of-service vulnerability in quic-go's HTTP/3 implementation where a malicious peer can cause excessive memory allocation via crafted QPACK-encoded trailer fields. While CoreDNS only uses quic-go for DNS-over-QUIC (DoQ) and does not import the vulnerable http3 sub-package, this bump clears the module-level vulnerability finding. (For best practice)

Advisory: GHSA-vvgj-x9jq-8cj9

2. Which issues (if any) are related?

CVE-2026-40898
GO-2026-5676
GHSA-vvgj-x9jq-8cj9

3. Which documentation changes (if any) need to be made?

None.

4. Does this introduce a backward incompatible change or deprecation?

No. The quic-go public API used by CoreDNS (quic.Connection, quic.Config, quic.Transport) is unchanged between v0.55.0 and v0.59.1. The Go version in go.mod remains at 1.25.0.

Summary by CodeRabbit

• Chores
  • Updated a networking-related dependency to a newer version, which may improve stability and compatibility.

[openshift-ci-robot]

@AkashMore08: No Jira issue with key CVE-2026 exists in the tracker at https://redhat.atlassian.net.
Once a valid jira issue is referenced in the title of this pull request, request a refresh with /jira refresh.

Details

In response to this:

1. Why is this pull request needed and what does it do?

This PR bumps github.com/quic-go/quic-go from v0.55.0 to v0.59.1 to remediate CVE-2026-40898 (GO-2026-5676).
CVE-2026-40898 is a denial-of-service vulnerability in quic-go's HTTP/3 implementation where a malicious peer can cause excessive memory allocation via crafted QPACK-encoded trailer fields. While CoreDNS only uses quic-go for DNS-over-QUIC (DoQ) and does not import the vulnerable http3 sub-package, this bump clears the module-level vulnerability finding. (For best practice)

Advisory: GHSA-vvgj-x9jq-8cj9

2. Which issues (if any) are related?

CVE-2026-40898
GO-2026-5676
GHSA-vvgj-x9jq-8cj9

3. Which documentation changes (if any) need to be made?

None.

4. Does this introduce a backward incompatible change or deprecation?

No. The quic-go public API used by CoreDNS (quic.Connection, quic.Config, quic.Transport) is unchanged between v0.55.0 and v0.59.1. The Go version in go.mod remains at 1.25.0.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Walkthrough

This change updates the go.mod file to bump the direct dependency github.com/quic-go/quic-go from version v0.55.0 to v0.59.1. No other changes are included.

Changes

Dependency Version Bump

Layer / File(s)	Summary
quic-go dependency bump go.mod	The direct dependency github.com/quic-go/quic-go is updated from v0.55.0 to v0.59.1.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5 | ❌ 10

❌ Failed checks (10 inconclusive)

Check name	Status	Explanation	Resolution
Stable And Deterministic Test Names	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.
Test Structure And Quality	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.
Microshift Test Compatibility	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.
Single Node Openshift (Sno) Test Compatibility	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.
Topology-Aware Scheduling Compatibility	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.
Ote Binary Stdout Contract	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.
Ipv6 And Disconnected Network Test Compatibility	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.
No-Weak-Crypto	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.
Container-Privileges	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.
No-Sensitive-Data-In-Logs	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the PR’s main change: bumping quic-go to v0.59.1.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci-robot]

@AkashMore08: No Jira issue with key CVE-2026 exists in the tracker at https://redhat.atlassian.net.
Once a valid jira issue is referenced in the title of this pull request, request a refresh with /jira refresh.

Details

In response to this:

1. Why is this pull request needed and what does it do?

This PR bumps github.com/quic-go/quic-go from v0.55.0 to v0.59.1 to remediate CVE-2026-40898 (GO-2026-5676).
CVE-2026-40898 is a denial-of-service vulnerability in quic-go's HTTP/3 implementation where a malicious peer can cause excessive memory allocation via crafted QPACK-encoded trailer fields. While CoreDNS only uses quic-go for DNS-over-QUIC (DoQ) and does not import the vulnerable http3 sub-package, this bump clears the module-level vulnerability finding. (For best practice)

Advisory: GHSA-vvgj-x9jq-8cj9

2. Which issues (if any) are related?

CVE-2026-40898
GO-2026-5676
GHSA-vvgj-x9jq-8cj9

3. Which documentation changes (if any) need to be made?

None.

4. Does this introduce a backward incompatible change or deprecation?

No. The quic-go public API used by CoreDNS (quic.Connection, quic.Config, quic.Transport) is unchanged between v0.55.0 and v0.59.1. The Go version in go.mod remains at 1.25.0.

Summary by CodeRabbit

• Chores
• Updated a networking-related dependency to a newer version, which may improve stability and compatibility.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[AkashMore08]

/jira refresh

[openshift-ci-robot]

@AkashMore08: No Jira issue is referenced in the title of this pull request.
To reference a jira issue, add 'XYZ-NNN:' to the title of this pull request and request another refresh with /jira refresh.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@AkashMore08: This pull request references Jira Issue OCPBUGS-92008, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

1. Why is this pull request needed and what does it do?

This PR bumps github.com/quic-go/quic-go from v0.55.0 to v0.59.1 to remediate CVE-2026-40898 (GO-2026-5676).
CVE-2026-40898 is a denial-of-service vulnerability in quic-go's HTTP/3 implementation where a malicious peer can cause excessive memory allocation via crafted QPACK-encoded trailer fields. While CoreDNS only uses quic-go for DNS-over-QUIC (DoQ) and does not import the vulnerable http3 sub-package, this bump clears the module-level vulnerability finding. (For best practice)

Advisory: GHSA-vvgj-x9jq-8cj9

2. Which issues (if any) are related?

CVE-2026-40898
GO-2026-5676
GHSA-vvgj-x9jq-8cj9

3. Which documentation changes (if any) need to be made?

None.

4. Does this introduce a backward incompatible change or deprecation?

No. The quic-go public API used by CoreDNS (quic.Connection, quic.Config, quic.Transport) is unchanged between v0.55.0 and v0.59.1. The Go version in go.mod remains at 1.25.0.

Summary by CodeRabbit

• Chores
• Updated a networking-related dependency to a newer version, which may improve stability and compatibility.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[AkashMore08]

/jira refresh

[openshift-ci-robot]

@AkashMore08: This pull request references Jira Issue OCPBUGS-92008, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign alebedev87 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@AkashMore08: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.