[release-1.5] Bump golang.org/x/net to v0.55.0

[mattdabit]

Summary

Bumps golang.org/x/net from v0.50.0 to v0.55.0 on the release-1.5 branch.

Fixes #5379

[kolyshkin]

This seems useless and unnecessary to me (no actual vulnerability, zero code changes). OTOH it is harmless.

I let other @opencontainers/runc-maintainers to decide.

[lifubang]

I think we're all on the same page here -- the CVE doesn't apply to runc
(the vulnerable code path is never exercised), so this isn't something we'd
cut a release for on its own.

That said, the change itself is trivial and harmless. Since main already
has x/net at v0.57.0, I'd like to let this piggyback on the next 1.5.x
release for actual fixes.

I've labelled this accordingly -- if we do another 1.5.z before 1.6.0 ships,
I think maybe we can merge it then and it'll go out with that release.
I think there is No standalone release for this.

@mattdabit thanks for the PR and for being thoughtful about targeting
release-1.5 directly.

[mattdabit]

Thank you @kolyshkin & @lifubang. I appreciate both of you and the care you have for this project.

[rata]

I can't decide what is the best to do here. Whatever we do in this instance, we might change our opinion later and act differently in the future IMHO.

I think for the latest stable release, it's probably fine to batch these with the next patch release.
For other supported releases, I'm not sure it's worth it (and probably a go version increase is needed).

[rata]

I think I'd go to the latest, 0.57, that is also what we have in main currently.

[thaJeztah]

Often, it's good to be conservative when updating dependencies, if doing so means many LOC changes that could potentially introduce issues on their own, but as there's a zero-LOC in the update, I think it's fine to update the version.

The only impact we may need to be looking at is that this also forces any user of runc as a module to update; for those, the impact may be larger. In general, I think we still consider runc to be primarily a binary module, and not to be used as a module-dependency, but not sure what the current state is of that (I recall kubernetes used some bits, but maybe those have now been replaced by the modules we extracted?

So, generally LGTM to update for the current / latest release branch at least.

[rata]

@thaJeztah Oh, great call about module users! Then being conservative seems better, thanks! :)

[thaJeztah]

I expect most projects would already have updated to a newer version of x/net, but yeah, if the minimum version to suppress the CVEs is v0.50.0, then we may as well keep it at that version for now.

[mattdabit]

Cool so seems like I should keep this at v0.55.0. Anything else I can do to help get this in?

[kolyshkin]

Semi-related: #5383

[thaJeztah]

• Semi-related: ci: add govulncheck job #5383

☝️ that's good to have; at least it helps back the maintainers to provide more evidence that a vulnerability doesn't (or does) impact our code.

For this PR, I'm personally still OK with accepting it; it's the current release branch, and if we consider this repositories' result to be primarily "binaries", not a "library-module", then updating to a newer version could make sense, if only to remove any ambiguity.

The alternative could be to provide a VEX document in the repository (e.g. security/openvex.json), but they're kinda awkward;

• We can provide the document, but there's no standard discovery mechanism, so downstream packagers / distributors must reference it somehow (from an SBOM, or other means)
• OpenVEX documents don't provide version ranges, so each and every "non-impacted" runc version must be listed
• Worse; this is per CVE, so if there's multiple CVE's in golang.org/x/net that don't impact runc.. it gets quite verbose;

The relevant vulnerable code from golang.org/x/net is not imported by runc and is not present in vendor, so the statement could be mention not_affected and component_not_present;

{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://github.com/opencontainers/runc/security/openvex",
  "author": "https://github.com/opencontainers/runc",
  "timestamp": "2026-08-06T00:00:00Z",
  "version": 1,
  "statements": [
    {
      "vulnerability": {
        "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-1111"
      },
      "products": [
        {"@id": "pkg:golang/github.com/opencontainers/runc@v1.3.6"},
        {"@id": "pkg:golang/github.com/opencontainers/runc@v1.4.0"},
        {"@id": "pkg:golang/github.com/opencontainers/runc@v1.4.1"},
        {"@id": "pkg:golang/github.com/opencontainers/runc@v1.4.2"},
        {"@id": "pkg:golang/github.com/opencontainers/runc@v1.4.3"},
        {"@id": "pkg:golang/github.com/opencontainers/runc@v1.5.0"},
        {"@id": "pkg:golang/github.com/opencontainers/runc@v1.5.1"}
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "The affected golang.org/x/net package is not imported by runc and is not included in the resulting binaries."
    }, {
      "vulnerability": {
        "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-2222"
      },
      "products": [
        {"@id": "pkg:golang/github.com/opencontainers/runc@v1.3.6"},
        {"@id": "pkg:golang/github.com/opencontainers/runc@v1.4.0"},
        {"@id": "pkg:golang/github.com/opencontainers/runc@v1.4.1"},
        {"@id": "pkg:golang/github.com/opencontainers/runc@v1.4.2"},
        {"@id": "pkg:golang/github.com/opencontainers/runc@v1.4.3"},
        {"@id": "pkg:golang/github.com/opencontainers/runc@v1.5.0"},
        {"@id": "pkg:golang/github.com/opencontainers/runc@v1.5.1"}
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "The affected golang.org/x/net package is not imported by runc and is not included in the resulting binaries."
    }
  ]
}

And that only covers the go module; to make it "complete" it would also list the binaries;

{
  "@id": "https://github.com/opencontainers/runc/releases/download/v1.5.1/runc.amd64",
  "hashes": {
    "sha-256": "<digest>"
  }
}