Merge pull request #1732 from devanshuVmware/bump-go

Update go version to fix CVEs

Author: devanshuVmware

.github/workflows/benchmark-action.yaml

@@ -21,10 +21,10 @@ jobs:
     name: Performance regression check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.1.2
+      - uses: actions/checkout@v4
       - uses: actions/setup-go@v5 # default version of go is 1.10
         with:
-          go-version: 1.23.3
+          go-version-file: go.mod
       - name: Install Carvel Tools
         run: ./hack/install-deps.sh
       # Run benchmark with `go test -bench` and stores the output to a file

.github/workflows/dependency-updater.yml

@@ -10,13 +10,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.1.2
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Set up Go 1.x
         uses: actions/setup-go@v5
         with:
-          go-version: 1.23.3
+          go-version-file: go.mod
       - name: Update Dependencies File
         run: go run ./hack/dependencies.go update
       - name: Create Pull Request

.github/workflows/golangci-lint.yml

@@ -18,13 +18,13 @@ jobs:
     name: lint
     runs-on: ubuntu-latest
     steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
       - name: Set up Go 1.x
         uses: actions/setup-go@v5
         with:
-          go-version: 1.23.3
-      - uses: actions/[email protected]
-        with:
-          fetch-depth: '0'
+          go-version-file: go.mod
       - name: golangci-lint
         uses: golangci/[email protected]
         with:

.github/workflows/kind-action.yml

@@ -21,7 +21,7 @@ jobs:
         uses: helm/kind-action@v1
         with:
           cluster_name: kinder
-      - uses: actions/checkout@v4.1.2
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - uses: actions/setup-go@v5

.github/workflows/release-process.yml

@@ -16,7 +16,7 @@ jobs:
       id-token: write
     steps:
       - name: Check out code
-        uses: actions/checkout@v4.1.2
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
@@ -39,7 +39,7 @@ jobs:
       - name: Set up Go 1.x
         uses: actions/setup-go@v5
         with:
-          go-version: 1.23.3
+          go-version-file: go.mod
 
       - name: Set up Cosign
         uses: sigstore/[email protected]

.github/workflows/test-kctrl-gh.yml

@@ -21,14 +21,14 @@ jobs:
     name: Test kctrl GH
     runs-on: ubuntu-latest
     steps:
-    - name: Set up Go 1.x
-      uses: actions/setup-go@v5
-      with:
-        go-version: 1.23.3
     - name: Check out code
-      uses: actions/checkout@v4.1.2
+      uses: actions/checkout@v4
       with:
         fetch-depth: 0
+    - name: Set up Go 1.x
+      uses: actions/setup-go@v5
+      with:
+        go-version-file: go.mod
     - name: Install Carvel Tools
       uses: carvel-dev/setup-action@v2
       with:

.github/workflows/trivy-scan.yml

@@ -64,13 +64,13 @@ jobs:
       security-events: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.1.2
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Set up Go 1.x
         uses: actions/setup-go@v5
         with:
-          go-version: 1.23.3
+          go-version-file: go.mod
       - name: Build the kapp-controller artifacts
         run: |
           ./hack/install-deps.sh

.github/workflows/upgrade-testing.yml

@@ -23,12 +23,14 @@ jobs:
     name: Upgrade Testing
     runs-on: ubuntu-latest
     steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
       - name: Set up Go 1.x
         uses: actions/setup-go@v5
         with:
-          go-version: 1.23.3
-      - name: Check out code
-        uses: actions/[email protected]
+          go-version-file: go.mod
       - name: Install Carvel Tools
         run: ./hack/install-deps.sh
       - name: Run Upgrade Test

Dockerfile

@@ -1,4 +1,4 @@
-FROM --platform=$BUILDPLATFORM golang:1.23.4 AS deps
+FROM --platform=$BUILDPLATFORM golang:1.23.8 AS deps
 
 ARG TARGETOS TARGETARCH KCTRL_VER=development
 WORKDIR /workspace

cli/go.mod

@@ -1,21 +1,21 @@
 module carvel.dev/kapp-controller/cli
 
-go 1.23.6
+go 1.23.8
 
 require (
-	carvel.dev/kapp-controller v0.56.2-0.20250506145110-5a51bb23420d
-	carvel.dev/vendir v0.43.0
+	carvel.dev/kapp-controller v0.57.0
+	carvel.dev/vendir v0.44.0
 	github.com/cppforlife/cobrautil v0.0.0-20221130162803-acdfead391ef
 	github.com/cppforlife/color v1.9.1-0.20200716202919-6706ac40b835
 	github.com/cppforlife/go-cli-ui v0.0.0-20220520125801-e45d9169a663
 	github.com/getkin/kin-openapi v0.131.0
 	github.com/google/gnostic-models v0.6.8
-	github.com/google/go-containerregistry v0.20.2
+	github.com/google/go-containerregistry v0.20.3
 	github.com/k14s/difflib v0.0.0-20201117154628-0c031775bf57
 	github.com/mitchellh/go-wordwrap v1.0.1
 	github.com/otiai10/copy v1.2.0
-	github.com/spf13/cobra v1.8.1
-	github.com/spf13/pflag v1.0.5
+	github.com/spf13/cobra v1.9.1
+	github.com/spf13/pflag v1.0.6
 	github.com/stretchr/testify v1.10.0
 	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1
@@ -54,7 +54,7 @@ require (
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/k14s/semver/v4 v4.0.1-0.20210701191048-266d47ac6115 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
-	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
@@ -77,8 +77,8 @@ require (
 	golang.org/x/crypto v0.36.0 // indirect
 	golang.org/x/exp v0.0.0-20220722155223-a9213eeb770e // indirect
 	golang.org/x/net v0.38.0 // indirect
-	golang.org/x/oauth2 v0.24.0 // indirect
-	golang.org/x/sys v0.31.0 // indirect
+	golang.org/x/oauth2 v0.25.0 // indirect
+	golang.org/x/sys v0.32.0 // indirect
 	golang.org/x/term v0.30.0 // indirect
 	golang.org/x/text v0.23.0 // indirect
 	golang.org/x/time v0.3.0 // indirect