chore: Backport v20261405

.github/workflows/ci.yml

@@ -13,7 +13,7 @@ on:
     paths-ignore: [docs/**, "**.md", "**.mdx", "**.png", "**.jpg"]
 
 env:
-  GO_VERSION: '1.25.9'
+  GO_VERSION: '1.25.10'
   CERT_MANAGER_VERSION: 'v1.16.2'
 
 jobs:

.github/workflows/code-lint.yml

@@ -14,7 +14,7 @@ on:
 
 env:
   # Common versions
-  GO_VERSION: "1.25.9"
+  GO_VERSION: "1.25.10"
 
 jobs:
   detect-noop:

.github/workflows/codespell.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
         with:
           egress-policy: audit
 

.github/workflows/release.yml

@@ -20,7 +20,7 @@ env:
   HUB_AGENT_IMAGE_NAME: hub-agent
   MEMBER_AGENT_IMAGE_NAME: member-agent
   REFRESH_TOKEN_IMAGE_NAME: refresh-token
-  GO_VERSION: "1.25.9"
+  GO_VERSION: "1.25.10"
 
 jobs:
   export-registry:

.github/workflows/trivy.yml

@@ -18,7 +18,7 @@ env:
   MEMBER_AGENT_IMAGE_NAME: member-agent
   REFRESH_TOKEN_IMAGE_NAME: refresh-token
 
-  GO_VERSION: '1.25.9'
+  GO_VERSION: '1.25.10'
 
 jobs:
   export-registry:

.github/workflows/upgrade.yml

@@ -17,7 +17,7 @@ on:
     paths-ignore: [docs/**, "**.md", "**.mdx", "**.png", "**.jpg"]
 
 env:
-  GO_VERSION: '1.25.9'
+  GO_VERSION: '1.25.10'
 
 jobs:
   detect-noop:

.golangci.yml

@@ -1,6 +1,6 @@
 run:
   timeout: 15m
-  go: '1.25.9'
+  go: '1.25.10'
 
 linters-settings:
   stylecheck:

docker/crd-installer.Dockerfile

@@ -1,5 +1,5 @@
 # Build the crdinstaller binary
-FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.9 AS builder
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.10 AS builder
 
 ARG GOOS=linux
 ARG GOARCH=amd64

docker/hub-agent.Dockerfile

@@ -1,5 +1,5 @@
 # Build the hubagent binary
-FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.9 AS builder
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.10 AS builder
 
 ARG GOOS=linux
 ARG GOARCH=amd64

docker/member-agent.Dockerfile

@@ -1,5 +1,5 @@
 # Build the memberagent binary
-FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.9 AS builder
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.10 AS builder
 
 ARG GOOS=linux
 ARG GOARCH=amd64

docker/refresh-token.Dockerfile

@@ -1,5 +1,5 @@
 # Build the refreshtoken binary
-FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.9 AS builder
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.10 AS builder
 
 ARG GOOS="linux"
 ARG GOARCH="amd64"

go.mod

@@ -1,6 +1,6 @@
 module go.goms.io/fleet
 
-go 1.25.9
+go 1.25.10
 
 require (
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0

pkg/utils/errors/errors_test.go

@@ -87,14 +87,15 @@ func TestCommonUsePatterns(t *testing.T) {
 	outputStr = readFromBuffer(t, &bytesBuf)
 
 	// The full error output looks like the follows:
-	// errors_test.go:86: time=2026-04-29T02:49:04.560+10:00 level=ERROR msg="additional top/controller-level error description" err="additional high-level error description: additional low-level error description: cannot calculate resource hash" errCategory=unexpected k1=v1 callers="[{Function:go.goms.io/fleet/pkg/utils/errors.TestCommonUsePatterns File:SomeFilePath Line:74} {Function:testing.tRunner File:SomeFilePath Line:1934} {Function:runtime.goexit File:SomeFilePath Line:1268}]" k2=v2
+	// errors_test.go:86: time=2026-04-29T02:49:04.560+10:00 level=ERROR msg="additional top/controller-level error description" err="additional high-level error description: additional low-level error description: cannot calculate resource hash" errCategory=unexpected k1=v1 callers="[{Function:github.com/kubefleet-dev/kubefleet/pkg/utils/errors.TestCommonUsePatterns File:SomeFilePath Line:74} {Function:testing.tRunner File:SomeFilePath Line:1934} {Function:runtime.goexit File:SomeFilePath Line:1268}]" k2=v2
 	wantSubStrings = []string{
 		"msg=\"additional top/controller-level error description\"",
 		"err=\"additional high-level error description: additional low-level error description: cannot calculate resource hash\"",
 		"errCategory=unexpected",
 		"k1=v1",
 		"callers=",
-		"Function:github.com/kubefleet-dev/kubefleet/pkg/utils/errors.TestCommonUsePatterns",
+		"Function:",
+		"/pkg/utils/errors.TestCommonUsePatterns",
 		"k2=v2",
 	}
 	for _, subStr := range wantSubStrings {
@@ -557,7 +558,7 @@ func TestNewUnexpectedError(t *testing.T) {
 
 	// Verify the first frame (the current test code).
 	callerFunc := frames[0].Function
-	if callerFunc != "go.goms.io/fleet/pkg/utils/errors.TestNewUnexpectedError" {
+	if !strings.Contains(callerFunc, "/pkg/utils/errors.TestNewUnexpectedError") {
 		t.Errorf("NewUnexpectedError() first caller function = %s, want TestNewUnexpectedError", callerFunc)
 	}
 	callerFile := frames[0].File