diff --git a/.golangci.yaml b/.golangci.yaml
index 3d9859190aa..5b3e179226c 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -40,12 +40,9 @@ linters:
     rules:
       - linters:
           - gosec
+          - prealloc
           - unparam
         path: test
-      - linters:
-          - staticcheck
-        text: "ST1003"  # A lot of "Api" instead of "API" names
-        path: pkg/reconciler/testing/v1/apiserversource.go
       - linters:
           - staticcheck
         text: "ST1001"  # Prohibit dot imports
diff --git a/go.mod b/go.mod
index a3e98304c73..f62763ca4cd 100644
--- a/go.mod
+++ b/go.mod
@@ -44,7 +44,6 @@ require (
 	go.uber.org/atomic v1.10.0
 	go.uber.org/multierr v1.11.0
 	go.uber.org/zap v1.28.0
-	golang.org/x/net v0.58.0
 	golang.org/x/sync v0.22.0
 	k8s.io/api v0.35.7
 	k8s.io/apiextensions-apiserver v0.35.7
@@ -135,6 +134,7 @@ require (
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
 	golang.org/x/crypto v0.55.0 // indirect
 	golang.org/x/mod v0.39.0 // indirect
+	golang.org/x/net v0.58.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
 	golang.org/x/sys v0.47.0 // indirect
 	golang.org/x/term v0.45.0 // indirect
diff --git a/pkg/adapter/mtping/adapter.go b/pkg/adapter/mtping/adapter.go
index 5ad47510cc5..869b4a3a8d4 100644
--- a/pkg/adapter/mtping/adapter.go
+++ b/pkg/adapter/mtping/adapter.go
@@ -88,7 +88,7 @@ func GetNoShutDownAfterValue() int {
 	if str != "" {
 		second, err := strconv.Atoi(str)
 		if err != nil || second < 0 || second > 59 {
-			log.Printf("%s environment value is invalid. It must be a integer between 0 and 59. (got %s)", EnvNoShutdownAfter, str)
+			log.Printf("%s environment value is invalid. It must be a integer between 0 and 59. (got %s)", EnvNoShutdownAfter, str) //nolint:gosec // value is operator-controlled env var, not user input
 		} else {
 			return second
 		}
diff --git a/pkg/apis/feature/api_validation.go b/pkg/apis/feature/api_validation.go
index a8144e24528..ad371e15623 100644
--- a/pkg/apis/feature/api_validation.go
+++ b/pkg/apis/feature/api_validation.go
@@ -77,7 +77,7 @@ func walk(value reflect.Value, paths ...string) reflect.Value {
 			return newVal
 		}
 		return walk(value.FieldByName(paths[0]), paths[1:]...)
-	case reflect.Ptr:
+	case reflect.Pointer:
 		return walk(reflect.Indirect(value), paths...)
 	default:
 		return reflect.Zero(value.Type())
diff --git a/pkg/apis/messaging/v1/in_memory_channel_validation_test.go b/pkg/apis/messaging/v1/in_memory_channel_validation_test.go
index 557d5209230..e8ed5dfdd45 100644
--- a/pkg/apis/messaging/v1/in_memory_channel_validation_test.go
+++ b/pkg/apis/messaging/v1/in_memory_channel_validation_test.go
@@ -17,12 +17,12 @@ limitations under the License.
 package v1
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
 	"knative.dev/pkg/system"
 
-	"golang.org/x/net/context"
 	authenticationv1 "k8s.io/api/authentication/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"knative.dev/pkg/apis"
diff --git a/pkg/channel/fanout/fanout_event_handler.go b/pkg/channel/fanout/fanout_event_handler.go
index 8b371fbb3fa..35b453e73b8 100644
--- a/pkg/channel/fanout/fanout_event_handler.go
+++ b/pkg/channel/fanout/fanout_event_handler.go
@@ -272,7 +272,7 @@ func createEventReceiverFunction(f *FanoutEventHandler) func(context.Context, ch
 
 			parentSpan := trace.SpanFromContext(ctx)
 
-			go func(e event.Event, h nethttp.Header, s trace.Span) {
+			go func(e event.Event, h nethttp.Header, s trace.Span) { //nolint:gosec // intentional async dispatch, must outlive the request-scoped context
 				// Run async dispatch with background context.
 				ctx = trace.ContextWithSpan(context.Background(), s)
 				// Any returned error is already logged in f.dispatch().
diff --git a/pkg/eventingtls/eventingtls.go b/pkg/eventingtls/eventingtls.go
index bb7006372e4..d1ad7dadc07 100644
--- a/pkg/eventingtls/eventingtls.go
+++ b/pkg/eventingtls/eventingtls.go
@@ -241,7 +241,7 @@ func loadCertPool(config ClientConfig) (*x509.CertPool, error) {
 			return nil
 		}
 
-		b, err := os.ReadFile(path)
+		b, err := os.ReadFile(path) //nolint:gosec // fixed platform-managed trust-bundle mount path
 		if err != nil {
 			return fmt.Errorf("failed to read file %q: %w", path, err)
 		}
diff --git a/pkg/graph/lineage.go b/pkg/graph/lineage.go
index e6e8adb52ef..315bdcd4bb7 100644
--- a/pkg/graph/lineage.go
+++ b/pkg/graph/lineage.go
@@ -22,7 +22,7 @@ import (
 
 func (g *Graph) Lineage() []*Vertex {
 	sources := g.Sources()
-	lineagePaths := make(Vertices, len(sources))
+	lineagePaths := make(Vertices, 0, len(sources))
 	for _, s := range sources {
 		lineagePaths = append(lineagePaths, s.Lineage(EmptyEventType(), TransformFunctionContext{}))
 	}
diff --git a/pkg/reconciler/eventtransform/resources_jsonata.go b/pkg/reconciler/eventtransform/resources_jsonata.go
index 4bde3428b84..c49ed3dd335 100644
--- a/pkg/reconciler/eventtransform/resources_jsonata.go
+++ b/pkg/reconciler/eventtransform/resources_jsonata.go
@@ -652,14 +652,15 @@ func jsonataCertificate(ctx context.Context, transform *eventing.EventTransform)
 // container, combining the transform file path, config watcher env vars, and
 // OTEL tracing env vars.
 func jsonataContainerEnvVars(cw *reconcilersource.ConfigWatcher) []corev1.EnvVar {
-	envVars := []corev1.EnvVar{
-		{
-			Name:  "JSONATA_TRANSFORM_FILE_NAME",
-			Value: filepath.Join(JsonataExpressionPath, JsonataExpressionDataKey),
-		},
-	}
-	envVars = append(envVars, cw.ToEnvVars()...)
-	envVars = append(envVars, otelTracingEnvVars(cw)...)
+	cwEnvVars := cw.ToEnvVars()
+	otelEnvVars := otelTracingEnvVars(cw)
+	envVars := make([]corev1.EnvVar, 0, 1+len(cwEnvVars)+len(otelEnvVars))
+	envVars = append(envVars, corev1.EnvVar{
+		Name:  "JSONATA_TRANSFORM_FILE_NAME",
+		Value: filepath.Join(JsonataExpressionPath, JsonataExpressionDataKey),
+	})
+	envVars = append(envVars, cwEnvVars...)
+	envVars = append(envVars, otelEnvVars...)
 	return envVars
 }
 
diff --git a/pkg/reconciler/integration/helper.go b/pkg/reconciler/integration/helper.go
index 6905569f280..02f3a4b3d63 100644
--- a/pkg/reconciler/integration/helper.go
+++ b/pkg/reconciler/integration/helper.go
@@ -31,7 +31,7 @@ func GenerateEnvVarsFromStruct(prefix string, s interface{}) []corev1.EnvVar {
 
 	// Use reflection to inspect the struct fields
 	v := reflect.ValueOf(s)
-	if v.Kind() == reflect.Ptr {
+	if v.Kind() == reflect.Pointer {
 		v = v.Elem()
 	}
 
@@ -67,7 +67,7 @@ func GenerateEnvVarsFromStruct(prefix string, s interface{}) []corev1.EnvVar {
 			envVarName = fmt.Sprintf("%s_%s", prefix, strings.ToUpper(tagName))
 		}
 
-		if field.Kind() == reflect.Ptr {
+		if field.Kind() == reflect.Pointer {
 			if field.IsNil() {
 				continue
 			}
diff --git a/pkg/reconciler/pingsource/resources/receive_adapter.go b/pkg/reconciler/pingsource/resources/receive_adapter.go
index f1d4538c4be..790d019b745 100644
--- a/pkg/reconciler/pingsource/resources/receive_adapter.go
+++ b/pkg/reconciler/pingsource/resources/receive_adapter.go
@@ -34,14 +34,15 @@ type Args struct {
 
 // MakeReceiveAdapterEnvVar generates the environment variables for the pingsources
 func MakeReceiveAdapterEnvVar(args Args) []corev1.EnvVar {
-	envs := []corev1.EnvVar{{
+	envs := make([]corev1.EnvVar, 0, 5+len(args.ConfigEnvVars))
+	envs = append(envs, corev1.EnvVar{
 		Name: adapter.EnvConfigNamespace,
 		ValueFrom: &corev1.EnvVarSource{
 			FieldRef: &corev1.ObjectFieldSelector{
 				FieldPath: "metadata.namespace",
 			},
 		},
-	}, {
+	}, corev1.EnvVar{
 		// Needed by leader elector.
 		Name: system.NamespaceEnvKey,
 		ValueFrom: &corev1.EnvVarSource{
@@ -49,16 +50,16 @@ func MakeReceiveAdapterEnvVar(args Args) []corev1.EnvVar {
 				FieldPath: "metadata.namespace",
 			},
 		},
-	}, {
+	}, corev1.EnvVar{
 		Name:  adapter.EnvConfigLeaderElectionConfig,
 		Value: args.LeConfig,
-	}, {
+	}, corev1.EnvVar{
 		Name:  mtping.EnvNoShutdownAfter,
 		Value: strconv.Itoa(args.NoShutdownAfter),
-	}, {
+	}, corev1.EnvVar{
 		Name:  adapter.EnvSinkTimeout,
 		Value: strconv.Itoa(args.SinkTimeout),
-	}}
+	})
 
 	return append(envs, args.ConfigEnvVars...)
 }
diff --git a/pkg/reconciler/source/crd/crd.go b/pkg/reconciler/source/crd/crd.go
index 64db8d7cda0..3513738b182 100644
--- a/pkg/reconciler/source/crd/crd.go
+++ b/pkg/reconciler/source/crd/crd.go
@@ -122,6 +122,7 @@ func (r *Reconciler) reconcileController(ctx context.Context, crd *v1.CustomReso
 	}
 
 	// Source Duck controller context
+	//nolint:gosec // TODO: cancel is stored in runningController for cleanup on CRD deletion, which is not yet implemented (goroutine leak on CRD removal)
 	sdctx, cancel := context.WithCancel(r.ogctx)
 	// Source Duck controller instantiation
 	sd := sdc(sdctx, r.ogcmw)
diff --git a/test/lib/recordevents/event_info.go b/test/lib/recordevents/event_info.go
index 69d16025a87..0f3783d94a6 100644
--- a/test/lib/recordevents/event_info.go
+++ b/test/lib/recordevents/event_info.go
@@ -66,7 +66,7 @@ type EventInfo struct {
 func (ei *EventInfo) String() string {
 	var sb strings.Builder
 	sb.WriteString("-- EventInfo --\n")
-	sb.WriteString(fmt.Sprintf("--- Kind: %v ---\n", ei.Kind))
+	fmt.Fprintf(&sb, "--- Kind: %v ---\n", ei.Kind)
 	if ei.Event != nil {
 		sb.WriteString("--- Event ---\n")
 		sb.WriteString(ei.Event.String())
@@ -90,12 +90,12 @@ func (ei *EventInfo) String() string {
 		sb.WriteRune('\n')
 	}
 	if ei.StatusCode != 0 {
-		sb.WriteString(fmt.Sprintf("--- Status Code: %d ---\n", ei.StatusCode))
+		fmt.Fprintf(&sb, "--- Status Code: %d ---\n", ei.StatusCode)
 	}
 	sb.WriteString("--- Origin: '" + ei.Origin + "' ---\n")
 	sb.WriteString("--- Observer: '" + ei.Observer + "' ---\n")
 	sb.WriteString("--- Time: " + ei.Time.String() + " ---\n")
-	sb.WriteString(fmt.Sprintf("--- Sequence: %d ---\n", ei.Sequence))
+	fmt.Fprintf(&sb, "--- Sequence: %d ---\n", ei.Sequence)
 	sb.WriteString("--------------------\n")
 	return sb.String()
 }
@@ -112,8 +112,8 @@ type SearchedInfo struct {
 // Pretty print the SearchedInfor for error messages
 func (s *SearchedInfo) String() string {
 	var sb strings.Builder
-	sb.WriteString(fmt.Sprintf("%d events seen, last %d events (total events seen %d, events ignored %d):\n",
-		s.TotalEvent, len(s.LastNEvent), s.storeEventsSeen, s.storeEventsNotMine))
+	fmt.Fprintf(&sb, "%d events seen, last %d events (total events seen %d, events ignored %d):\n",
+		s.TotalEvent, len(s.LastNEvent), s.storeEventsSeen, s.storeEventsNotMine)
 	for _, ei := range s.LastNEvent {
 		sb.WriteString(ei.String())
 		sb.WriteRune('\n')
diff --git a/vendor/golang.org/x/net/context/context.go b/vendor/golang.org/x/net/context/context.go
deleted file mode 100644
index 24cea688204..00000000000
--- a/vendor/golang.org/x/net/context/context.go
+++ /dev/null
@@ -1,118 +0,0 @@
-// Copyright 2014 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Package context has been superseded by the standard library [context] package.
-//
-// Deprecated: Use the standard library context package instead.
-package context
-
-import (
-	"context" // standard library's context, as of Go 1.7
-	"time"
-)
-
-// A Context carries a deadline, a cancellation signal, and other values across
-// API boundaries.
-//
-// Context's methods may be called by multiple goroutines simultaneously.
-//
-//go:fix inline
-type Context = context.Context
-
-// Canceled is the error returned by [Context.Err] when the context is canceled
-// for some reason other than its deadline passing.
-//
-//go:fix inline
-var Canceled = context.Canceled
-
-// DeadlineExceeded is the error returned by [Context.Err] when the context is canceled
-// due to its deadline passing.
-//
-//go:fix inline
-var DeadlineExceeded = context.DeadlineExceeded
-
-// Background returns a non-nil, empty Context. It is never canceled, has no
-// values, and has no deadline. It is typically used by the main function,
-// initialization, and tests, and as the top-level Context for incoming
-// requests.
-//
-//go:fix inline
-func Background() Context { return context.Background() }
-
-// TODO returns a non-nil, empty Context. Code should use context.TODO when
-// it's unclear which Context to use or it is not yet available (because the
-// surrounding function has not yet been extended to accept a Context
-// parameter).
-//
-//go:fix inline
-func TODO() Context { return context.TODO() }
-
-// A CancelFunc tells an operation to abandon its work.
-// A CancelFunc does not wait for the work to stop.
-// A CancelFunc may be called by multiple goroutines simultaneously.
-// After the first call, subsequent calls to a CancelFunc do nothing.
-type CancelFunc = context.CancelFunc
-
-// WithCancel returns a derived context that points to the parent context
-// but has a new Done channel. The returned context's Done channel is closed
-// when the returned cancel function is called or when the parent context's
-// Done channel is closed, whichever happens first.
-//
-// Canceling this context releases resources associated with it, so code should
-// call cancel as soon as the operations running in this [Context] complete.
-//
-//go:fix inline
-func WithCancel(parent Context) (ctx Context, cancel CancelFunc) {
-	return context.WithCancel(parent)
-}
-
-// WithDeadline returns a derived context that points to the parent context
-// but has the deadline adjusted to be no later than d. If the parent's
-// deadline is already earlier than d, WithDeadline(parent, d) is semantically
-// equivalent to parent. The returned [Context.Done] channel is closed when
-// the deadline expires, when the returned cancel function is called,
-// or when the parent context's Done channel is closed, whichever happens first.
-//
-// Canceling this context releases resources associated with it, so code should
-// call cancel as soon as the operations running in this [Context] complete.
-//
-//go:fix inline
-func WithDeadline(parent Context, d time.Time) (Context, CancelFunc) {
-	return context.WithDeadline(parent, d)
-}
-
-// WithTimeout returns WithDeadline(parent, time.Now().Add(timeout)).
-//
-// Canceling this context releases resources associated with it, so code should
-// call cancel as soon as the operations running in this [Context] complete:
-//
-//	func slowOperationWithTimeout(ctx context.Context) (Result, error) {
-//		ctx, cancel := context.WithTimeout(ctx, 100*time.Millisecond)
-//		defer cancel()  // releases resources if slowOperation completes before timeout elapses
-//		return slowOperation(ctx)
-//	}
-//
-//go:fix inline
-func WithTimeout(parent Context, timeout time.Duration) (Context, CancelFunc) {
-	return context.WithTimeout(parent, timeout)
-}
-
-// WithValue returns a derived context that points to the parent Context.
-// In the derived context, the value associated with key is val.
-//
-// Use context Values only for request-scoped data that transits processes and
-// APIs, not for passing optional parameters to functions.
-//
-// The provided key must be comparable and should not be of type
-// string or any other built-in type to avoid collisions between
-// packages using context. Users of WithValue should define their own
-// types for keys. To avoid allocating when assigning to an
-// interface{}, context keys often have concrete type
-// struct{}. Alternatively, exported context key variables' static
-// type should be a pointer or interface.
-//
-//go:fix inline
-func WithValue(parent Context, key, val interface{}) Context {
-	return context.WithValue(parent, key, val)
-}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index d6183f58c3f..46687590c3f 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -614,7 +614,6 @@ golang.org/x/mod/module
 golang.org/x/mod/semver
 # golang.org/x/net v0.58.0
 ## explicit; go 1.25.0
-golang.org/x/net/context
 golang.org/x/net/http/httpguts
 golang.org/x/net/http2
 golang.org/x/net/http2/h2c