fix(security): bump vendored x/net to v0.57.0 and x/text to v0.41.0

.github/workflows/ci.yml

@@ -25,7 +25,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v2
       with:
-        go-version: 1.20.10
+        go-version: 1.24.13
 
     - name: Dependencies
       run: |

.golangci.yml

@@ -4,9 +4,8 @@ linters:
     - unconvert
     - gofmt
     - goimports
-    - golint
     - ineffassign
-    - vet
+    - govet
     - unused
     - misspell
   disable:
@@ -22,12 +21,13 @@ linters-settings:
 
 run:
   deadline: 2m
-  skip-dirs:
-    - vendor
 
 issues:
+  exclude-dirs:
+    - vendor
   exclude-rules:
     # io/ioutil is deprecated, but won't be removed until Go v2. It's safe to ignore for the release/2.8 branch.
-    - text: "SA1019: \"io/ioutil\" has been deprecated since Go 1.16"
+    # The wording of the staticcheck message changed ("since Go 1.16" -> "since Go 1.19"), so match either.
+    - text: "SA1019: \"io/ioutil\" has been deprecated since Go 1\\.(16|19)"
       linters:
         - staticcheck

Dockerfile

@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1
 
-ARG GO_VERSION=1.20.10
-ARG ALPINE_VERSION=3.18
+ARG GO_VERSION=1.24.13
+ARG ALPINE_VERSION=3.22
 ARG XX_VERSION=1.2.1
 
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx

registry/handlers/api_test.go

@@ -885,7 +885,7 @@ func testBlobDelete(t *testing.T, env *testEnv, args blobArgs) {
 	ref, _ := reference.WithDigest(imageName, layerDigest)
 	layerURL, err := env.builder.BuildBlobURL(ref)
 	if err != nil {
-		t.Fatalf(err.Error())
+		t.Fatal(err)
 	}
 	// ---------------
 	// Delete a layer

registry/proxy/proxyblobstore_test.go

@@ -348,7 +348,7 @@ func testProxyStoreServe(t *testing.T, te *testEnv, numClients int) {
 
 				err = te.store.ServeBlob(te.ctx, w, r, remoteBlob.Digest)
 				if err != nil {
-					t.Errorf(err.Error())
+					t.Error(err)
 					return
 				}
 
@@ -393,7 +393,7 @@ func testProxyStoreServe(t *testing.T, te *testEnv, numClients int) {
 
 		err = te.store.ServeBlob(te.ctx, w, r, dr.Digest)
 		if err != nil {
-			t.Fatalf(err.Error())
+			t.Fatal(err)
 		}
 
 		dl := digest.FromBytes(w.Body.Bytes())

registry/proxy/proxymanifeststore_test.go

@@ -115,7 +115,7 @@ func newManifestStoreTestEnv(t *testing.T, name, tag string) *manifestStoreTestE
 
 	manifestDigest, err := populateRepo(ctx, t, truthRepo, name, tag)
 	if err != nil {
-		t.Fatalf(err.Error())
+		t.Fatal(err)
 	}
 
 	localRegistry, err := storage.NewRegistry(ctx, inmemory.New(), storage.BlobDescriptorCacheProvider(memory.NewInMemoryBlobDescriptorCacheProvider()), storage.EnableRedirect, storage.DisableDigestResumption, storage.Schema1SigningKey(k), storage.EnableSchema1)
@@ -190,7 +190,7 @@ func populateRepo(ctx context.Context, t *testing.T, repository distribution.Rep
 
 	ms, err := repository.Manifests(ctx)
 	if err != nil {
-		t.Fatalf(err.Error())
+		t.Fatal(err)
 	}
 	dgst, err := ms.Put(ctx, sm)
 	if err != nil {

registry/proxy/scheduler/scheduler_test.go

@@ -171,7 +171,7 @@ func TestStopRestore(t *testing.T) {
 
 	err := s.Start()
 	if err != nil {
-		t.Fatalf(err.Error())
+		t.Fatal(err)
 	}
 	s.add(ref1, 300*timeUnit, entryTypeBlob)
 	s.add(ref2, 100*timeUnit, entryTypeBlob)

registry/storage/driver/walk_test.go

@@ -2,7 +2,6 @@ package driver
 
 import (
 	"context"
-	"fmt"
 	"testing"
 )
 
@@ -39,9 +38,9 @@ func TestWalkFileRemoved(t *testing.T) {
 		return nil
 	})
 	if len(infos) != 1 || infos[0].Path() != "zoidberg" {
-		t.Errorf(fmt.Sprintf("unexpected path set during walk: %s", infos))
+		t.Errorf("unexpected path set during walk: %s", infos)
 	}
 	if err != nil {
-		t.Fatalf(err.Error())
+		t.Fatal(err)
 	}
 }

registry/storage/purgeuploads_test.go

@@ -115,7 +115,7 @@ func TestPurgeOnlyUploads(t *testing.T) {
 	// these files aren't deleted.
 	dataPath, err := pathFor(uploadDataPathSpec{name: "test-repo", id: uuid.Generate().String()})
 	if err != nil {
-		t.Fatalf(err.Error())
+		t.Fatal(err)
 	}
 	nonUploadPath := strings.Replace(dataPath, "_upload", "_important", -1)
 	if strings.Contains(nonUploadPath, "_upload") {

script/setup/install-dev-tools

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-GOLANGCI_LINT_VERSION="v1.54.2"
+GOLANGCI_LINT_VERSION="v1.62.2"
 
 #
 # Install developer tools to $GOBIN (or $GOPATH/bin if unset)

vendor.conf

@@ -37,8 +37,8 @@ github.com/yvasiyarov/go-metrics 57bccd1ccd43f94bb17fdd8bf3007059b802f85e
 github.com/yvasiyarov/gorelic a9bba5b9ab508a086f9a12b8c51fab68478e2128
 github.com/yvasiyarov/newrelic_platform_go b21fdbd4370f3717f3bbd2bf41c223bc273068e6
 golang.org/x/crypto c10c31b5e94b6f7a0283272dc2bb27163dcea24b
-golang.org/x/net b225e7ca6dde1ef5a5ae5ce922861bda011cfabd # v0.17.0
-golang.org/x/text f488e191e67ed95a5b9b7b39024e5a5f5f1ffd02 # v0.13.0
+golang.org/x/net b8f09f6f062ceb4531b7af4bd17a5c8fe9c4b2b5 # v0.57.0
+golang.org/x/text acdba6655fd45cdb5ab73c9d6a8981333bd65a39 # v0.41.0
 golang.org/x/oauth2 045497edb6234273d67dbc25da3f2ddbc4c4cacf
 golang.org/x/time a4bde12657593d5e90d0533a3e4fd95e635124cb
 google.golang.org/api 9bf6e6e569ff057f75d9604a46c52928f17d2b54