fix(security): bump Go builder images for CVE-2025-61726

[sduvvuri1603]

Issue

CVE-2025-61726 — net/url / large URL-encoded forms can drive excessive memory use via ParseForm. Fixed in Go >= 1.25.6 or >= 1.24.12 (NVD).

Resolves Jira: RHOAIENG-48614 · RHOAIENG-48615 (argoexec / workflow-controller, rhel9)

Summary

• Update Konflux builder images only for argoexec and workflow-controller.
• Pin registry.access.redhat.com/ubi9/go-toolset:1.25 by digest in:
  • argo-argoexec/Dockerfile.konflux
  • argo-workflowcontroller/Dockerfile.konflux
• No changes to go.mod, root Dockerfile, ODH Dockerfiles, CI workflows, or codegen artifacts in this PR.

Note

• This PR is intentionally scoped to the minimal Konflux remediation path for CVE-2025-61726.
• Broader Go/tooling alignment can be handled separately if needed.

[sduvvuri1603]

/retest

[VaniHaripriya]

/lgtm

[nsingla]

lgtm

[nsingla]

you need to update the go version in go.mod file as well

[grdryn]

Closing to try to retrigger snyk checks by reopening.

[grdryn]

you need to update the go version in go.mod file as well

This is not correct. To pick up changes in the Go compiler/standard library, only the image needs to be changed. It will compile for older versions of Go specified in the go.mod just fine.

I've created #646 with the minimal changes needed, and the snyk checks pass successfully there.

[nsingla]

you need to update the go version in go.mod file as well

This is not correct. To pick up changes in the Go compiler/standard library, only the image needs to be changed. It will compile for older versions of Go specified in the go.mod just fine.

I've created #646 with the minimal changes needed, and the snyk checks pass successfully there.

My bad, what I meant wasn't that its not required to fix the cve, but its a good practive to keep it in sync. We can skip it if its causing snyk issues and handle it separately

[sduvvuri1603]

you need to update the go version in go.mod file as well

This is not correct. To pick up changes in the Go compiler/standard library, only the image needs to be changed. It will compile for older versions of Go specified in the go.mod just fine.
I've created #646 with the minimal changes needed, and the snyk checks pass successfully there.

My bad, what I meant wasn't that its not required to fix the cve, but its a good practive to keep it in sync. We can skip it if its causing snyk issues and handle it separately

Updated PR changes to keep it minimal with ref to: #646

[nsingla]

/build-konflux argoexec

[nsingla]

/build-konflux workflowcontroller

[nsingla]

lgtm