[HIGH] Patch vitess for CVE-2026-84445 and CVE-2026-83530

[v-sushilsati]

Summary -
• Patch vitess for CVE-2026-84304 and CVE-2026-84445.
• Upgraded google.golang.org/grpc from v1.65.0 => v1.83.2.
• Upgraded Go version from 1.22.3 => 1.25.0.
• Updated other related Go dependencies and the vendor archive.
• Added go-toolchain-compat.patch to fix Go 1.25+ build breaks caused by the toolchain bump (removal of the runtime.roundupsize linkname and related go vet/formatting issues). More details in issue section.
• Removed obsolete CVE patches whose fixes are included in the refreshed dependencies.
• Vendor Tarball -> vitess-19.0.4-vendor-v2.tar.gz

Changelog -
• deleted: CVE-2024-45339.patch
• deleted: CVE-2025-22868.patch
• deleted: CVE-2025-22870.patch
• deleted: CVE-2026-39821.patch
• deleted: CVE-2026-56852.patch
• new file: CVE-2026-84304.patch
• new file: go-toolchain-compat.patch
• modified: vitess.signatures.json
• modified: vitess.spec

Fixed Issue: Vitess RPM build was failing due to a Go toolchain version conflict.

1. Vitess 19.0.4 originally built with Go 1.22.
2. A CVE fix bumped grpc to v1.83.2, which raised go.mod's minimum to Go ≥1.25.
3. BuildRequires: golang >= 1.25 alone pulled in Go 1.27, which rejects Vitess's private runtime.roundupsize linker reference:
   time="2026-09-17T10:12:34Z" level=debug msg="# vitess.io/vitess/go/cmd/mysqlctl"
   time="2026-09-17T10:12:34Z" level=debug msg="link: vitess.io/vitess/go/hack: invalid reference to runtime.roundupsize"
   time="2026-09-17T10:12:35Z" level=debug msg="error: Bad exit status from /var/tmp/rpm-tmp.tP97Bw (%build)"
4. Pinning golang < 1.23 also failed — the chroot installed Go 1.22.10, but go.mod requires ≥1.25 (GOTOOLCHAIN=local blocks auto-upgrade), so the build errored with go.mod requires go >= 1.25.0.

Fix: Pin BuildRequires: golang >= 1.25 and < 1.28 to stay in the compatible 1.25–1.27 window, plus add go-toolchain-compat.patch, which replaces the private runtime.roundupsize linkname with a self-contained allocator size-class implementation (new build-tagged files) and fixes a few other Go-version-dependent code paths.

Added Patch9: go-toolchain-compat.patch, which:
o Replaces the private runtime.roundupsize linker reference with a self-contained allocator size-class calculation, split across build-tagged files (go/hack/atof_go127.go for Go ≥1.27, go/hack/atof_legacy.go for older, plus changes in go/hack/runtime.go).
o Fixes a few other Go-version-dependent issues: rendering of sync.Mutex internals in schemaz output, and explicit format strings for dynamic errors required by newer go vet.
Upstream reference for the roundupsize/size-class implementation:
vitess/go/hack/msize.go at main · vitessio/vitess

Links to CVEs -
• https://nvd.nist.gov/vuln/detail/CVE-2026-84445
• https://nvd.nist.gov/vuln/detail/CVE-2026-83530

Test Methodology -
• Local build was successful.
. buddy build was successful : https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1206152&view=results

Patch Application:

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[azurelinux-ci-jwt-app]

Auto cherry-pick results:

• 3.0-dev ✅ -> [AUTO-CHERRYPICK] [HIGH] Patch vitess for CVE-2026-84445 and CVE-2026-83530 - branch 3.0-dev #18910

Auto cherry-pick pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1206302&view=results