[HIGH] Patch kubernetes for CVE-2026-84445, CVE-2026-84304 and CVE-2026-83530 by upgrading grpc and cel-go vendor modules

[Sumit Jena (SumitJenaHCL)]

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

patch kubernetes for CVE-2026-84304, CVE-2026-84445 and CVE-2026-83530
Upgraded google.golang.org/grpc from v1.58.3 => v1.83.2
Upgraded github.com/google/cel-go from v0.17.8 => v0.31.0

CVE-2026-84304 and CVE-2026-84445 are both in google.golang.org/grpc and are fixed together by v1.83.2. CVE-2026-83530 is in github.com/google/cel-go and is fixed by v0.31.0, which enforces ParserExpressionSizeLimit during buffer construction instead of after it.

kubernetes had no vendor tarball before this change: the upstream kubernetes-src.tar.gz ships its own vendor tree, and every CVE so far has been fixed by patching that tree in place. Since two module upgrades were needed here, the vendor tree is now regenerated and shipped as Source2, which is also why 20 existing patches can be dropped.

Change Log

• kubernetes.spec
• Cherry-picked [AutoPR- Security] Patch kubernetes for CVE-2026-78662, CVE-2026-56855, CVE-2026-37236 [MEDIUM] (#18757) from 3.0-dev, which fasttrack/3.0 did not have, so this branch carries it forward and avoids a future merge conflict. Release is therefore 31, since 3.0-dev already uses 30.
• Removed patches CVE-2024-45338, CVE-2025-22868, CVE-2025-22869, CVE-2025-22872, CVE-2025-47911, CVE-2025-58190, CVE-2025-65637, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-39821, CVE-2026-39827, CVE-2026-39829, CVE-2026-39830, CVE-2026-39834, CVE-2026-39835, CVE-2026-42502, CVE-2026-42506, CVE-2026-46597, CVE-2026-56852, CVE-2026-56855, CVE-2026-78662
• CVE-2026-56855 and CVE-2026-78662 (both from the cherry-picked commit) are dropped because they patch golang.org/x/crypto/ssh, which the x/crypto v0.57.0 bump supersedes - both reverse-apply cleanly against the regenerated tree.
• CVE-2026-37236 (also from the cherry-picked commit) is retained and rebased onto grpc-gateway v2.27.2. OSV reports no advisories for v2.27.2, but that is misleading: the fix commit 72123cd4 is 525 commits ahead of v2.27.2, and the vendored runtime/mux.go still gates the override on isPathLengthFallback alone, so the backport is still required.
• generate_source_tarball.sh
• Added the regenerated vendor tree as Source2 (kubernetes-v1.30.10-vendor.tar.gz). It is produced with go work vendor, not go mod vendor: kubernetes is a Go workspace and go mod vendor would copy the 30 staging/src/k8s.io modules into vendor, which upstream does not do.
• Also raised golang.org/x/crypto v0.21.0 => v0.57.0. v0.55.0 (what the grpc bump pulls on its own) is already enough to supersede the CVE-2026-39829/39830/39834 backports this package carried, but is still reported against CVE-2026-56855 and CVE-2026-78662. Those affect golang.org/x/crypto/ssh, which kubernetes imports only from test/e2e/framework, so no shipped binary is exposed - v0.57.0 is used purely to keep the vendored version clear of version-based scanners.
• BuildRequires: golang < 1.25 => golang >= 1.26. grpc v1.83.2 requires go 1.25.0 and x/crypto v0.57.0 requires go 1.26.0, so the go directive is raised to 1.26.0 across the root module, go.work and all 30 staging modules. Azure Linux ships golang 1.27.1.
• Added fix-cel-go-otelgrpc-api-migration.patch: cel-go replaced the protobuf-backed expression accessors with the common/ast API (AstNode.Expr() now returns ast.Expr, constants are read via AsLiteral()), and the grpc bump transitively moves otelgrpc past the removal of UnaryClientInterceptor/StreamClientInterceptor. Both edits are ports of what kubernetes did upstream in release-1.31 and release-1.34 respectively.
• Added fix-vendor-modules-for-runc-backports.patch: CVE-2025-31133.patch and CVE-2025-52565.patch add 12 packages to vendor (runc/internal/..., filepath-securejoin/pathrs-lite/...) without declaring them in vendor/modules.txt. Go tolerates that at language level 1.22 but rejects it from 1.23 onwards, so this is required for any version of this bump. The language level recorded for those two modules is raised to go1.18 (the minimum that compiles the backported generics - deliberately not 1.22, which would change for-loop scoping for the rest of runc v1.1.12).
• Added fix-non-constant-format-strings.patch: the printf vet analyzer is enabled from Go 1.24 and fails the kubelet test build on 5 Eventf calls that pass a message as the format string. Ported verbatim from upstream release-1.34. This is also a correctness fix - an event message containing % previously rendered as disk usage 85%!e(MISSING)xceeds threshold.
• Fixed %check, which had been dead code: it referenced %{SOURCE2} when no Source2 existed, and cd-ed into a src/ directory that %prep -c -n %{name} never creates. It also never exported FORCE_HOST_GO=y (only %build did), so the harness honoured .go-version and tried to fetch go1.22.12.
• %prep now uses %autosetup -N -c -n %{name} followed by an explicit %autopatch -p1, so the vendor tree is swapped in between extraction and patching. This matches the pattern already used by cloud-provider-kubevirt.

Does this affect the toolchain?

No - kubernetes is not listed in toolchain_*.txt or pkggen_core_*.txt.

Associated issues

• #xxxx

Links to CVEs

• https://nvd.nist.gov/vuln/detail/CVE-2026-84304
• https://nvd.nist.gov/vuln/detail/CVE-2026-84445
• https://nvd.nist.gov/vuln/detail/CVE-2026-83530

Test Methodology

• Local Build
• RUN_CHECK=y package build passed at 1.30.10-31, producing all 8 subpackages. %check executed for the first time in this spec's history: pkg/kubelet (23.4s), pkg/scheduler (8.8s), pkg/controller (1.4s) and pkg/proxy (1.1s) all pass, 0 failures. (pkg/kubectl and pkg/kubeapiserver report [no test files], which is pre-existing.)
• All 17 patches confirmed applied by %autopatch at --fuzz=0 in the Release 31 build; the retained patches were each confirmed still required, and every dropped patch confirmed already fixed in the regenerated tree.
• Re-verified after the 3.0-dev cherry-pick: all 7 components build and all 6 %check suites pass with the rebased CVE-2026-37236 patch applied.
• OSV sweep over the 207 vendored modules: advisories drop from 104 to 29. The one newly introduced advisory (GO-2026-5841, klauspost/compress) is not applicable - it affects /s2, which is not vendored and not imported by any kubernetes source.
• Pipeline build URL - https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1205760&view=results

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Sumit Jena (SumitJenaHCL)]

Buddy build has passed.