refactor: update toolchain-common with renamed ServerSideApplyClient type

.github/workflows/linters.yml

@@ -26,9 +26,7 @@ jobs:
     - name: Lint
       uses: golangci/golangci-lint-action@v9
       with:
-        version: v2.1.6
-        skip-pkg-cache: true
-        skip-build-cache: true
+        version: v2.12.2
         args: --config=./.golangci.yml --verbose
 
   yammlint:

.govulncheck.yaml

@@ -18,8 +18,8 @@ ignored-vulnerabilities:
     silence-until: 2026-09-03
     info: https://pkg.go.dev/vuln/GO-2026-4870
   # Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
-  # Found in: net/http@go1.24.13
-  # Fixed in: net/http@go1.25.10
+  # Found in: golang.org/x/net/http2@v0.47.0
+  # Fixed in: golang.org/x/net/http2@v0.53.0
   - id: GO-2026-4918
     silence-until: 2026-09-03
     info: https://pkg.go.dev/vuln/GO-2026-4918
@@ -35,6 +35,12 @@ ignored-vulnerabilities:
   - id: GO-2026-4947
     silence-until: 2026-09-03
     info: https://pkg.go.dev/vuln/GO-2026-4947
+  # Root escape via symlink plus trailing slash in os
+  # Found in: os@go1.24.13
+  # Fixed in: os@go1.25.12
+  - id: GO-2026-4970
+    silence-until: 2026-09-03
+    info: https://pkg.go.dev/vuln/GO-2026-4970
   # Panic in Dial and LookupPort when handling NUL byte on Windows in net
   # Found in: net@go1.24.13
   # Fixed in: net@go1.25.10

go.mod

@@ -6,7 +6,7 @@ toolchain go1.24.13
 
 require (
 	github.com/codeready-toolchain/api v0.0.0-20260731065234-734640c901d2
-	github.com/codeready-toolchain/toolchain-common v0.0.0-20260731071123-c63091456f4a
+	github.com/codeready-toolchain/toolchain-common v0.0.0-20260804130313-0d4161d82454
 	github.com/ghodss/yaml v1.0.0
 	github.com/mitchellh/go-homedir v1.1.0
 	// using latest commit from 'github.com/openshift/api branch release-4.20'

go.sum

@@ -44,8 +44,8 @@ github.com/charmbracelet/x/term v0.2.0 h1:cNB9Ot9q8I711MyZ7myUR5HFWL/lc3OpU8jZ4h
 github.com/charmbracelet/x/term v0.2.0/go.mod h1:GVxgxAbjUrmpvIINHIQnJJKpMlHiZ4cktEQCN6GWyF0=
 github.com/codeready-toolchain/api v0.0.0-20260731065234-734640c901d2 h1:i5izQYQWwi0Dbc2Mv/sDOJ5GIMH69O3n0jRwQaAWo9o=
 github.com/codeready-toolchain/api v0.0.0-20260731065234-734640c901d2/go.mod h1:PMg6kNHuCGNlu3MOdrCisqGkBpvzB0qS1+E6nrXxPAc=
-github.com/codeready-toolchain/toolchain-common v0.0.0-20260731071123-c63091456f4a h1:3t4cvcI/6ZUxUSRZoGS/Q9jH9OFu6Sg26PMTtOPRok4=
-github.com/codeready-toolchain/toolchain-common v0.0.0-20260731071123-c63091456f4a/go.mod h1:j4xJuhNtqEuZW7VR6BB5V6h/oDJ0dIwSh5iijUSwwdM=
+github.com/codeready-toolchain/toolchain-common v0.0.0-20260804130313-0d4161d82454 h1:D3+dc9mEmLrq0XiG6xXDVJoZ+YChF7eX1OTKZ62ydfU=
+github.com/codeready-toolchain/toolchain-common v0.0.0-20260804130313-0d4161d82454/go.mod h1:j4xJuhNtqEuZW7VR6BB5V6h/oDJ0dIwSh5iijUSwwdM=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
 github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=

pkg/cmd/add_space_users.go

@@ -72,7 +72,7 @@ func AddSpaceUsers(ctx *clicontext.CommandContext, spaceName, role string, users
 	validRolesMsg.WriteString("the following are valid roles:\n")
 
 	for actual := range nsTemplTier.Spec.SpaceRoles {
-		validRolesMsg.WriteString(fmt.Sprintf("%s\n", actual))
+		fmt.Fprintf(&validRolesMsg, "%s\n", actual)
 		if role == actual {
 			isRoleValid = true
 		}

pkg/cmd/adm/install_operator.go

@@ -44,7 +44,7 @@ func NewInstallOperatorCmd() *cobra.Command {
 				return err
 			}
 
-			cl := commonclient.NewSSAApplyClient(kubeClient, utils.KsctlFieldManager)
+			cl := commonclient.NewServerSideApplyClient(kubeClient, utils.KsctlFieldManager)
 			ctx := clicontext.NewTerminalContext(term)
 			return installOperator(ctx, commandArgs, args[0], cl)
 		},
@@ -57,7 +57,7 @@ func NewInstallOperatorCmd() *cobra.Command {
 	return cmd
 }
 
-func installOperator(ctx *clicontext.TerminalContext, args installArgs, operator string, applyClient *commonclient.SSAApplyClient) error {
+func installOperator(ctx *clicontext.TerminalContext, args installArgs, operator string, applyClient *commonclient.ServerSideApplyClient) error {
 	// validate cluster type
 	if operator != string(configuration.Host) && operator != string(configuration.Member) {
 		return fmt.Errorf("invalid operator type provided: %s. Valid ones are %s|%s", operator, configuration.Host, configuration.Member)
@@ -136,7 +136,7 @@ func getOperatorName(operator string) string {
 	return fmt.Sprintf("toolchain-%s-operator", operator)
 }
 
-func createNamespaceIfNotFound(ctx *clicontext.TerminalContext, applyClient *commonclient.SSAApplyClient, namespace string) error {
+func createNamespaceIfNotFound(ctx *clicontext.TerminalContext, applyClient *commonclient.ServerSideApplyClient, namespace string) error {
 	ns := &v1.Namespace{
 		ObjectMeta: metav1.ObjectMeta{
 			Name: namespace,

pkg/cmd/adm/install_operator_test.go

@@ -65,7 +65,7 @@ func TestInstallOperator(t *testing.T) {
 			ctx := clicontext.NewTerminalContext(term)
 
 			// when
-			err := installOperator(ctx, args, operator, commonclient.NewSSAApplyClient(fakeClient, utils.KsctlFieldManager))
+			err := installOperator(ctx, args, operator, commonclient.NewServerSideApplyClient(fakeClient, utils.KsctlFieldManager))
 
 			// then
 			require.NoError(t, err)
@@ -100,7 +100,7 @@ func TestInstallOperator(t *testing.T) {
 			ctx := clicontext.NewTerminalContext(term)
 
 			// when
-			err := installOperator(ctx, args, operator, commonclient.NewSSAApplyClient(fakeClient, utils.KsctlFieldManager))
+			err := installOperator(ctx, args, operator, commonclient.NewServerSideApplyClient(fakeClient, utils.KsctlFieldManager))
 
 			// then
 			require.ErrorContains(t, err, "failed waiting for catalog source to be ready.")
@@ -120,7 +120,7 @@ func TestInstallOperator(t *testing.T) {
 			ctx := clicontext.NewTerminalContext(term)
 
 			// when
-			err := installOperator(ctx, args, operator, commonclient.NewSSAApplyClient(fakeClient, utils.KsctlFieldManager))
+			err := installOperator(ctx, args, operator, commonclient.NewServerSideApplyClient(fakeClient, utils.KsctlFieldManager))
 
 			// then
 			require.ErrorContains(t, err, "failed waiting for install plan to be complete.")
@@ -140,7 +140,7 @@ func TestInstallOperator(t *testing.T) {
 			// when
 			err := installOperator(ctx, installArgs{namespace: namespace, waitForReadyTimeout: 1 * time.Second},
 				operator,
-				commonclient.NewSSAApplyClient(fakeClient, utils.KsctlFieldManager),
+				commonclient.NewServerSideApplyClient(fakeClient, utils.KsctlFieldManager),
 			)
 
 			// then
@@ -158,7 +158,7 @@ func TestInstallOperator(t *testing.T) {
 			ctx := clicontext.NewTerminalContext(term)
 
 			// when
-			err := installOperator(ctx, args, operator, commonclient.NewSSAApplyClient(fakeClient, utils.KsctlFieldManager))
+			err := installOperator(ctx, args, operator, commonclient.NewServerSideApplyClient(fakeClient, utils.KsctlFieldManager))
 
 			// then
 			require.NoError(t, err)
@@ -177,7 +177,7 @@ func TestInstallOperator(t *testing.T) {
 			// when
 			err := installOperator(ctx, installArgs{namespace: "", kubeConfig: kubeconfig, waitForReadyTimeout: timeout}, // we provide no namespace
 				operator,
-				commonclient.NewSSAApplyClient(fakeClient, utils.KsctlFieldManager),
+				commonclient.NewServerSideApplyClient(fakeClient, utils.KsctlFieldManager),
 			)
 			// then
 			require.NoError(t, err)
@@ -195,7 +195,7 @@ func TestInstallOperator(t *testing.T) {
 		// when
 		err := installOperator(ctx, installArgs{},
 			"INVALIDOPERATOR",
-			commonclient.NewSSAApplyClient(fakeClient, utils.KsctlFieldManager),
+			commonclient.NewServerSideApplyClient(fakeClient, utils.KsctlFieldManager),
 		)
 
 		// then
@@ -212,7 +212,7 @@ func TestInstallOperator(t *testing.T) {
 		operator := "host"
 		err := installOperator(ctx, installArgs{namespace: "toolchain-host-operator", waitForReadyTimeout: time.Second * 1},
 			operator,
-			commonclient.NewSSAApplyClient(fakeClient, utils.KsctlFieldManager),
+			commonclient.NewServerSideApplyClient(fakeClient, utils.KsctlFieldManager),
 		)
 
 		// then

pkg/cmd/generate/assertion_test.go

@@ -139,7 +139,7 @@ func (a *kStructureAssertion) listObjects(dirName, kind string, object runtimecl
 		}
 		if dirEntry != nil && !dirEntry.IsDir() && (filepath.Base(filepath.Dir(path)) == dirName || dirName == "") && dirEntry.Name() != "kustomization.yaml" {
 			obj := object.DeepCopyObject()
-			objFile, err := os.ReadFile(path)
+			objFile, err := os.ReadFile(path) //nolint:gosec
 			require.NoError(a.t, err)
 			assert.True(a.t, strings.HasPrefix(string(objFile), header), "every file generated by cli should container a header")
 			assert.NotContains(a.t, string(objFile), "creationTimestamp")

pkg/cmd/generate/nstemplatetiers.go

@@ -53,7 +53,7 @@ func NSTemplateTiers(term ioutils.Terminal, source, outDir, hostNs string) error
 		if info.IsDir() {
 			return nil
 		}
-		file, err := os.ReadFile(path)
+		file, err := os.ReadFile(path) //nolint:gosec
 		if err != nil {
 			return err
 		}

pkg/cmd/generate/nstemplatetiers_test.go

@@ -221,7 +221,7 @@ func copyTemplates(t *testing.T, destination, tierToUpdate string) {
 		if dirEntry.IsDir() {
 			return os.MkdirAll(newPath, 0744)
 		}
-		file, err := os.ReadFile(path)
+		file, err := os.ReadFile(path) //nolint:gosec
 		if err != nil {
 			return err
 		}
@@ -230,7 +230,7 @@ func copyTemplates(t *testing.T, destination, tierToUpdate string) {
   annotations:
     modified-by: "test"`, 1))
 		}
-		return os.WriteFile(newPath, file, 0600)
+		return os.WriteFile(newPath, file, 0600) //nolint:gosec
 	})
 	require.NoError(t, err)
 }