fix: bump kubectl to v1.35.6 to patch Go stdlib CVEs

[ezejiofor]

What this PR does

Bumps the kubectl binary in the notebook-server base image from v1.35.5 to v1.35.6.

Why

kubectl v1.35.5 is compiled with go1.25.9, whose standard library carries 8 HIGH-severity CVEs. kubectl v1.35.6 is compiled with go1.25.11, which fixes all of them. Because every example notebook-server image (jupyter, jupyter-pytorch, rstudio, …) inherits from base, this clears the findings across the whole image family.

Resolved Go stdlib CVEs:

• CVE-2026-33811
• CVE-2026-33814
• CVE-2026-39820
• CVE-2026-39823
• CVE-2026-39825
• CVE-2026-39836
• CVE-2026-42499
• CVE-2026-42504

Validation

Built base + jupyter locally before and after the change and scanned with Trivy 0.71.2 (--severity CRITICAL,HIGH):

usr/local/bin/kubectl (gobinary)	Before (v1.35.5)	After (v1.35.6)
Go stdlib HIGH CVEs	8	0

Embedded Go toolchain confirmed: v1.35.5 → go1.25.9 (vulnerable), v1.35.6 → go1.25.11 (patched). This is a same-minor patch bump, so no behavioral change to kubectl is expected.

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign kimwnasptd for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• components/example-notebook-servers/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[christian-heusel]

Which of those CVEs are relevant for kubectl? 🤔 Are there any advisories for kubectl explicitly or does this apply to any go binary the same? 🤔

[ezejiofor]

Hi @christian-heusel,

Good question — you're right to probe this 🙂

To be upfront: none of these are kubectl-specific advisories. They're all Go standard-library vulns (the stdlib entry in Trivy's output), fixed in go1.25.11. Trivy flags them purely from the Go version the binary was built with (go1.25.9) and does no reachability analysis — so they'd show up identically on any Go binary built with that toolchain.

Looking at them by reachability in kubectl's actual usage (a client talking to the API server):

• Not reachable — net/mail parsing: CVE-2026-39820, CVE-2026-42499 (kubectl doesn't parse email addresses).
• Distro umbrella — CVE-2026-39836 is an Oracle go-toolset errata, not a distinct bug.
• Only with a malicious server/resolver (weak threat model for a CLI against a trusted cluster) — CVE-2026-33811 (DNS CNAME), CVE-2026-33814 (HTTP/2 client transport), CVE-2026-42504 (MIME header decode), CVE-2026-39823 (URL parsing).
• Theoretically reachable — CVE-2026-39825 (net/http/httputil ReverseProxy), and only via kubectl proxy.

So I'd frame this honestly as hygiene rather than an exploitable fix: it refreshes the bundled Go runtime to the patched toolchain and clears recurring HIGH findings that surface in every downstream notebook-server image scan (a real triage cost for users). It's a zero-risk same-minor patch bump.

Happy to reword the title to reflect that (e.g. chore:/ "refresh bundled Go runtime, reduce scan noise" rather than implying active kubectl CVEs), and/or back the reachability claims with govulncheck -mode=binary output if that's useful. Whatever you prefer 🙏