From 51efaadae75f05299b5cf40b10b02de78f2f1a9e Mon Sep 17 00:00:00 2001 From: Akash Purushotham Date: Wed, 21 Oct 2026 21:08:44 +0530 Subject: [PATCH] build: update to Go 1.27 and bump vulnerable dependencies Go 1.24 no longer receives security fixes and the released binary carries 98 vulnerabilities reported by Trivy, mostly from the standard library and old golang.org/x modules. - go.mod: go 1.24 -> 1.27 - golang.org/x/crypto v0.58.0, x/net v0.61.0, x/sys v0.49.0, x/text v0.43.0, github.com/klauspost/compress v1.20.3 - golangci-lint v1.64.2 -> v2.14.0 (v1 cannot lint modules targeting a newer Go version), with the config migrated to the v2 format - config: compute durations with a single multiplication to satisfy the newer durationcheck - utils_test: use %d for int arguments, rejected by Go 1.27 vet Refs #592 --- .github/workflows/golangci-lint.yaml | 4 +-- .golangci.yml | 41 ++++++++++++++++++++-------- config/types.go | 19 +++++++------ go.mod | 12 ++++---- go.sum | 20 +++++++------- utils_test.go | 8 +++--- 6 files changed, 62 insertions(+), 42 deletions(-) diff --git a/.github/workflows/golangci-lint.yaml b/.github/workflows/golangci-lint.yaml index ae0a9f57..e6236013 100644 --- a/.github/workflows/golangci-lint.yaml +++ b/.github/workflows/golangci-lint.yaml @@ -21,6 +21,6 @@ jobs: go-version-file: go.mod - name: golangci-lint - uses: contentsquare/golangci-golangci-lint-action@approved-v6 + uses: contentsquare/golangci-golangci-lint-action@approved-v9 with: - version: v1.64.2 + version: v2.14.0 diff --git a/.golangci.yml b/.golangci.yml index 58bb203f..f37ad1a8 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -1,3 +1,5 @@ +version: "2" + run: timeout: 3m tests: false @@ -28,14 +30,11 @@ linters: - goconst - gocritic - gocyclo - - gofmt - goheader - - goimports - gomoddirectives - gomodguard - goprintffuncname - gosec - - gosimple - govet - importas - ineffassign @@ -47,10 +46,11 @@ linters: - promlinter - rowserrcheck - sqlclosecheck + # gosimple is merged into staticcheck in v2, only its checks (S*) are enabled below + - staticcheck - testpackage - thelper - tparallel - - typecheck - unused - wastedassign - whitespace @@ -58,12 +58,9 @@ linters: # Should be readded in the future with a dedicated PR to do the fix - funlen - gocognit - - gofumpt - nestif - nolintlint - revive - - staticcheck - - stylecheck - unconvert - unparam @@ -74,7 +71,29 @@ linters: - noctx # disabled because we do not plan to distribute this code as a library - prealloc # we are not after some perf - tagliatelle # disabled because we are dependant on external API that do not follow the right naming -linters-settings: - gosec: - excludes: - - G115 # Unsafe cast of ints. Needs to be looked at by a dedicated PR + settings: + goconst: + # Prometheus label names are repeated in every metric definition + ignore-string-values: + - ^(user|cluster|cluster_user|cluster_node|replica|cache|code)$ + gosec: + excludes: + - G115 # Unsafe cast of ints. Needs to be looked at by a dedicated PR + staticcheck: + # Only the former gosimple checks, the rest of staticcheck and stylecheck + # should be readded in the future with a dedicated PR to do the fix + checks: + - S* + exclusions: + generated: lax + # Keep the default exclusions of golangci-lint v1 + presets: + - comments + - common-false-positives + - legacy + - std-error-handling + +formatters: + enable: + - gofmt + - goimports diff --git a/config/types.go b/config/types.go index 81e5e86b..3e8503c0 100644 --- a/config/types.go +++ b/config/types.go @@ -224,26 +224,27 @@ func parseDurationParts(s string) (int, string, error) { } func calculateDuration(n int, unit string) (Duration, error) { - dur := time.Duration(n) + var unitDur time.Duration switch unit { case "w": - dur *= time.Hour * 24 * 7 + unitDur = time.Hour * 24 * 7 case "d": - dur *= time.Hour * 24 + unitDur = time.Hour * 24 case "h": - dur *= time.Hour + unitDur = time.Hour case "m": - dur *= time.Minute + unitDur = time.Minute case "s": - dur *= time.Second + unitDur = time.Second case "ms": - dur *= time.Millisecond + unitDur = time.Millisecond case "µs": - dur *= time.Microsecond + unitDur = time.Microsecond case "ns": + unitDur = time.Nanosecond default: return 0, fmt.Errorf("invalid time unit in duration string: %q", unit) } - return Duration(dur), nil + return Duration(time.Duration(n) * unitDur), nil } diff --git a/go.mod b/go.mod index 05738785..f61657e1 100644 --- a/go.mod +++ b/go.mod @@ -1,18 +1,18 @@ module github.com/contentsquare/chproxy -go 1.24 +go 1.27 require ( github.com/alicebob/miniredis/v2 v2.34.0 github.com/coreos/go-systemd/v22 v22.5.0 github.com/google/go-cmp v0.6.0 - github.com/klauspost/compress v1.17.11 + github.com/klauspost/compress v1.20.3 github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 github.com/pierrec/lz4 v2.4.0+incompatible github.com/prometheus/client_golang v1.20.5 github.com/redis/go-redis/v9 v9.7.3 github.com/stretchr/testify v1.10.0 - golang.org/x/crypto v0.36.0 + golang.org/x/crypto v0.58.0 golang.org/x/time v0.9.0 gopkg.in/yaml.v2 v2.4.0 ) @@ -30,9 +30,9 @@ require ( github.com/prometheus/common v0.55.0 // indirect github.com/prometheus/procfs v0.15.1 // indirect github.com/yuin/gopher-lua v1.1.1 // indirect - golang.org/x/net v0.38.0 // indirect - golang.org/x/sys v0.31.0 // indirect - golang.org/x/text v0.23.0 // indirect + golang.org/x/net v0.61.0 // indirect + golang.org/x/sys v0.49.0 // indirect + golang.org/x/text v0.43.0 // indirect google.golang.org/protobuf v1.34.2 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect ) diff --git a/go.sum b/go.sum index 14b7fe9b..2877ffda 100644 --- a/go.sum +++ b/go.sum @@ -22,8 +22,8 @@ github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5x github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI= github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= -github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc= -github.com/klauspost/compress v1.17.11/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0= +github.com/klauspost/compress v1.20.3 h1:zWNoFqq/lSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4= +github.com/klauspost/compress v1.20.3/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= @@ -56,14 +56,14 @@ github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOf github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY= github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M= github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw= -golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34= -golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc= -golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8= -golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8= -golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik= -golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= -golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY= -golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4= +golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54= +golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w= +golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw= +golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI= +golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA= +golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc= +golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s= golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY= golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM= google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg= diff --git a/utils_test.go b/utils_test.go index 9fbbc31d..686b4094 100644 --- a/utils_test.go +++ b/utils_test.go @@ -295,22 +295,22 @@ func TestGetSessionTimeout(t *testing.T) { params.Set("session_timeout", firstSessionTimeout) req.URL.RawQuery = params.Encode() if getSessionTimeout(req) != 888 { - t.Fatalf("user set session_timeout %q; get %q , expected %q ", firstSessionTimeout, getSessionTimeout(req), 888) + t.Fatalf("user set session_timeout %q; get %d , expected %d ", firstSessionTimeout, getSessionTimeout(req), 888) } params.Set("session_timeout", secondSessionTimeout) req.URL.RawQuery = params.Encode() if getSessionTimeout(req) != 60 { - t.Fatalf("user set session_timeout %q; get %q , expected %q", secondSessionTimeout, getSessionTimeout(req), 60) + t.Fatalf("user set session_timeout %q; get %d , expected %d", secondSessionTimeout, getSessionTimeout(req), 60) } params.Set("session_timeout", thirdSessionTimeout) req.URL.RawQuery = params.Encode() if getSessionTimeout(req) != 60 { - t.Fatalf("user set session_timeout %q; get %q , expected %q", thirdSessionTimeout, getSessionTimeout(req), 60) + t.Fatalf("user set session_timeout %q; get %d , expected %d", thirdSessionTimeout, getSessionTimeout(req), 60) } params.Del("session_timeout") req.URL.RawQuery = params.Encode() if getSessionTimeout(req) != 60 { - t.Fatalf("user not set session_timeout ,get %q , expected %q", getSessionTimeout(req), 60) + t.Fatalf("user not set session_timeout ,get %d , expected %d", getSessionTimeout(req), 60) } }