fix(security): bump Go to 1.25.10 and golang.org/x/net to v0.55.0

[djsly]

Summary

Bumps the Go toolchain and golang.org/x/net to address upstream CVEs.

Vulnerability	CVE	Component	Fixed by
net/mail DoS via crafted addresses	CVE-2026-39820	net/mail (stdlib)	Go 1.25.10
cmd/go pack subcommand directory traversal	CVE-2026-39817	cmd/go (stdlib)	Go 1.25.10
HTTP/2 + IPv6 host parsing fixes	(various, see x/net release notes)	golang.org/x/net	v0.55.0

Why the bump to 1.25 (not just a 1.24.x patch)

Go 1.24 reached EOL in February 2026 and does NOT receive security backports. There is no go1.24.13 shipping with these fixes — go1.25.10 is the only release stream that contains them.

Additionally, golang.org/x/net v0.51.0 and later require go 1.25.0 in their own go.mod, so bumping x/net to the latest secure version forces the Go bump regardless.

Changes

7 go.mod files bumped from go 1.24.12 → go 1.25.10, with go mod tidy to refresh go.sum:

• go.mod (root)
• e2e/go.mod
• aks-node-controller/go.mod
• vhdbuilder/lister/go.mod
• vhdbuilder/prefetch/go.mod
• hack/tools/go.mod
• image-fetcher/go.mod

golang.org/x/net v0.49.0 → v0.55.0 in: root, e2e/, aks-node-controller/.

7 GitHub Actions workflows bumped go-version: '1.24' → '1.25':

• check-coverage.yml, copilot-setup-steps.yml, go-test.yml, golangci-lint.yml, shellcheck.yml, shellspec.yaml, validate-components.yml
• (validate-components.yml:62 uses go-version-file: e2e/go.mod — auto-picks up.)

Bonus fix: e2e/config/config.go:182 — replaced fmt.Sprintf(..., %w, err) with %v. %w is only valid in fmt.Errorf; Go 1.25's stricter go vet catches this. Same panic message, correct verb.

Verification

• go build ./... passes in all 7 modules
• go vet ./... passes in all 7 modules (the e2e %w bug fix unblocked it)
• Existing tests pass; two pre-existing failures on main (aks-node-controller/TestDownloadHotfix_MatchingBaseUpgrades and vhdbuilder/prefetch/internal/containerimage/TestContainerImage) are unrelated to this change — they fail identically without my diff.
• CI must pull go 1.25 runners — if any runner doesn't yet have 1.25 cached, fall back to pinning '1.25.10' instead of '1.25' in the workflow files.

Backport plan

After this lands on main, the same patch will be cherry-picked to the 14 official official/vYYYYMMDD branches that back the supported AB tags. Each backport will produce TWO tags off the branch:

• v0.<date>.<N+1> (AgentBaker module)
• aks-node-controller/v0.<date>.<N+1> (aks-node-controller submodule)

→ 28 new tags total across all branches.

Related

• Go release notes: https://groups.google.com/g/golang-announce/c/qcCIEXso47M
• x/net v0.55.0: https://pkg.go.dev/golang.org/x/net?tab=versions

🤖 Generated with GitHub Copilot CLI

[Copilot]

Pull request overview

Updates the repository’s Go toolchain and key golang.org/x/* dependencies to address security CVEs (per IcM 796913379), and aligns CI workflows with the new Go version.

Changes:

• Bump all 7 Go modules’ go.mod language/toolchain version from 1.24.12 to 1.25.10.
• Update golang.org/x/net to v0.55.0 (and associated x/sys / x/text / x/crypto / x/term bumps via go mod tidy) with refreshed go.sum files.
• Update GitHub Actions workflows to use Go 1.25, plus a small e2e vet-fix (%w → %v in fmt.Sprintf).

Reviewed changes

Copilot reviewed 15 out of 18 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
go.mod	Bumps root module Go version and updates indirect golang.org/x/* versions.
go.sum	Refreshes root dependency checksums for updated golang.org/x/* versions.
e2e/go.mod	Bumps e2e module Go version and updates golang.org/x/* dependencies (direct/indirect).
e2e/go.sum	Refreshes e2e dependency checksums for updated golang.org/x/* versions.
e2e/config/config.go	Fixes invalid %w usage in fmt.Sprintf to satisfy stricter vetting.
aks-node-controller/go.mod	Bumps module Go version and updates indirect x/sys.
aks-node-controller/go.sum	Refreshes dependency checksums for updated golang.org/x/* versions.
vhdbuilder/prefetch/go.mod	Bumps module Go version to 1.25.10.
vhdbuilder/lister/go.mod	Bumps module Go version to 1.25.10.
image-fetcher/go.mod	Bumps module Go version to 1.25.10.
hack/tools/go.mod	Bumps tools module Go version to 1.25.10.
.github/workflows/check-coverage.yml	Updates CI Go version to 1.25.
.github/workflows/copilot-setup-steps.yml	Updates setup steps Go version to 1.25.
.github/workflows/go-test.yml	Updates unit-test workflow Go version to 1.25.
.github/workflows/golangci-lint.yml	Updates lint workflow Go version to 1.25.
.github/workflows/shellcheck.yml	Updates shell lint workflow Go version to 1.25.
.github/workflows/shellspec.yaml	Updates shellspec workflow Go version to 1.25.
.github/workflows/validate-components.yml	Updates validation workflows to Go 1.25 / go-version-file consumption.