build: update to Go 1.27 and bump vulnerable dependencies

.github/workflows/golangci-lint.yaml

@@ -21,6 +21,6 @@ jobs:
           go-version-file: go.mod
 
       - name: golangci-lint
-        uses: contentsquare/golangci-golangci-lint-action@approved-v6
+        uses: contentsquare/golangci-golangci-lint-action@approved-v9
         with:
-          version: v1.64.2
+          version: v2.14.0

.golangci.yml

@@ -1,3 +1,5 @@
+version: "2"
+
 run:
   timeout: 3m
   tests: false
@@ -28,14 +30,11 @@ linters:
     - goconst
     - gocritic
     - gocyclo
-    - gofmt
     - goheader
-    - goimports
     - gomoddirectives
     - gomodguard
     - goprintffuncname
     - gosec
-    - gosimple
     - govet
     - importas
     - ineffassign
@@ -47,23 +46,21 @@ linters:
     - promlinter
     - rowserrcheck
     - sqlclosecheck
+    # gosimple is merged into staticcheck in v2, only its checks (S*) are enabled below
+    - staticcheck
     - testpackage
     - thelper
     - tparallel
-    - typecheck
     - unused
     - wastedassign
     - whitespace
   disable:
     # Should be readded in the future with a dedicated PR to do the fix
     - funlen
     - gocognit
-    - gofumpt
     - nestif
     - nolintlint
     - revive
-    - staticcheck
-    - stylecheck
     - unconvert
     - unparam
 
@@ -74,7 +71,29 @@ linters:
     - noctx # disabled because we do not plan to distribute this code as a library
     - prealloc # we are not after some perf
     - tagliatelle # disabled because we are dependant on external API that do not follow the right naming
-linters-settings:
-  gosec:
-    excludes:
-      - G115 # Unsafe cast of ints. Needs to be looked at by a dedicated PR
+  settings:
+    goconst:
+      # Prometheus label names are repeated in every metric definition
+      ignore-string-values:
+        - ^(user|cluster|cluster_user|cluster_node|replica|cache|code)$
+    gosec:
+      excludes:
+        - G115 # Unsafe cast of ints. Needs to be looked at by a dedicated PR
+    staticcheck:
+      # Only the former gosimple checks, the rest of staticcheck and stylecheck
+      # should be readded in the future with a dedicated PR to do the fix
+      checks:
+        - S*
+  exclusions:
+    generated: lax
+    # Keep the default exclusions of golangci-lint v1
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+
+formatters:
+  enable:
+    - gofmt
+    - goimports

config/types.go

@@ -224,26 +224,27 @@ func parseDurationParts(s string) (int, string, error) {
 }
 
 func calculateDuration(n int, unit string) (Duration, error) {
-	dur := time.Duration(n)
+	var unitDur time.Duration
 	switch unit {
 	case "w":
-		dur *= time.Hour * 24 * 7
+		unitDur = time.Hour * 24 * 7
 	case "d":
-		dur *= time.Hour * 24
+		unitDur = time.Hour * 24
 	case "h":
-		dur *= time.Hour
+		unitDur = time.Hour
 	case "m":
-		dur *= time.Minute
+		unitDur = time.Minute
 	case "s":
-		dur *= time.Second
+		unitDur = time.Second
 	case "ms":
-		dur *= time.Millisecond
+		unitDur = time.Millisecond
 	case "µs":
-		dur *= time.Microsecond
+		unitDur = time.Microsecond
 	case "ns":
+		unitDur = time.Nanosecond
 	default:
 		return 0, fmt.Errorf("invalid time unit in duration string: %q", unit)
 	}
 
-	return Duration(dur), nil
+	return Duration(time.Duration(n) * unitDur), nil
 }

go.mod

@@ -1,18 +1,18 @@
 module github.com/contentsquare/chproxy
 
-go 1.24
+go 1.27
 
 require (
 	github.com/alicebob/miniredis/v2 v2.34.0
 	github.com/coreos/go-systemd/v22 v22.5.0
 	github.com/google/go-cmp v0.6.0
-	github.com/klauspost/compress v1.17.11
+	github.com/klauspost/compress v1.20.3
 	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826
 	github.com/pierrec/lz4 v2.4.0+incompatible
 	github.com/prometheus/client_golang v1.20.5
 	github.com/redis/go-redis/v9 v9.7.3
 	github.com/stretchr/testify v1.10.0
-	golang.org/x/crypto v0.36.0
+	golang.org/x/crypto v0.58.0
 	golang.org/x/time v0.9.0
 	gopkg.in/yaml.v2 v2.4.0
 )
@@ -30,9 +30,9 @@ require (
 	github.com/prometheus/common v0.55.0 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/yuin/gopher-lua v1.1.1 // indirect
-	golang.org/x/net v0.38.0 // indirect
-	golang.org/x/sys v0.31.0 // indirect
-	golang.org/x/text v0.23.0 // indirect
+	golang.org/x/net v0.61.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
+	golang.org/x/text v0.43.0 // indirect
 	google.golang.org/protobuf v1.34.2 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -22,8 +22,8 @@ github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5x
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=
-github.com/klauspost/compress v1.17.11/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
+github.com/klauspost/compress v1.20.3 h1:zWNoFqq/lSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4=
+github.com/klauspost/compress v1.20.3/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
@@ -56,14 +56,14 @@ github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOf
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M=
 github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=
-golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
-golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
-golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
-golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
-golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
-golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
-golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=
+golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
 golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
 golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg=

utils_test.go

@@ -295,22 +295,22 @@ func TestGetSessionTimeout(t *testing.T) {
 	params.Set("session_timeout", firstSessionTimeout)
 	req.URL.RawQuery = params.Encode()
 	if getSessionTimeout(req) != 888 {
-		t.Fatalf("user set session_timeout %q; get %q , expected %q ", firstSessionTimeout, getSessionTimeout(req), 888)
+		t.Fatalf("user set session_timeout %q; get %d , expected %d ", firstSessionTimeout, getSessionTimeout(req), 888)
 	}
 	params.Set("session_timeout", secondSessionTimeout)
 	req.URL.RawQuery = params.Encode()
 	if getSessionTimeout(req) != 60 {
-		t.Fatalf("user set session_timeout %q; get %q , expected %q", secondSessionTimeout, getSessionTimeout(req), 60)
+		t.Fatalf("user set session_timeout %q; get %d , expected %d", secondSessionTimeout, getSessionTimeout(req), 60)
 	}
 	params.Set("session_timeout", thirdSessionTimeout)
 	req.URL.RawQuery = params.Encode()
 	if getSessionTimeout(req) != 60 {
-		t.Fatalf("user set session_timeout %q; get %q , expected %q", thirdSessionTimeout, getSessionTimeout(req), 60)
+		t.Fatalf("user set session_timeout %q; get %d , expected %d", thirdSessionTimeout, getSessionTimeout(req), 60)
 	}
 	params.Del("session_timeout")
 	req.URL.RawQuery = params.Encode()
 	if getSessionTimeout(req) != 60 {
-		t.Fatalf("user not set session_timeout ,get %q , expected %q", getSessionTimeout(req), 60)
+		t.Fatalf("user not set session_timeout ,get %d , expected %d", getSessionTimeout(req), 60)
 	}
 }