fix: fix release/0.17 vulnerabilities

.github/workflows/presubmit.yml

@@ -39,11 +39,11 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: '~1.24'
+          go-version: '~1.26'
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v7
         with:
-          version: v2.0.2
+          version: v2.12.2
           skip-cache: true
           args: --timeout=5m --verbose
   validate:
@@ -75,11 +75,11 @@ jobs:
     permissions:
       contents: read
     steps:
-    - uses: actions/checkout@v4
-    - name: Run container image tests
-      env:
-        GCM_SECRET: ${{ secrets.GCM_SECRET }}
-      run: make image-test
+      - uses: actions/checkout@v4
+      - name: Run container image tests
+        env:
+          GCM_SECRET: ${{ secrets.GCM_SECRET }}
+        run: make image-test
   e2e-testruns:
     runs-on: ubuntu-latest
     outputs:

.golangci.yml

@@ -20,18 +20,21 @@ linters:
     - contextcheck
     - cyclop
     - depguard
+    - embeddedstructfieldcheck
     - err113
     - errorlint
     - exhaustive
     - exhaustruct
     - forbidigo
     - forcetypeassert
+    - funcorder
     - funlen
     - gochecknoglobals
     - gocognit
     - goconst
     - gocritic
     - gocyclo
+    - godoclint
     - godox
     - gomoddirectives
     - gosec
@@ -40,18 +43,21 @@ linters:
     - lll
     - maintidx
     - mnd
+    - modernize
     - nestif
     - nilnil
     - nlreturn
     - noctx
     # TODO(bwplotka): Remove once https://github.com/golangci/golangci-lint/issues/3228 is fixed.
     - nolintlint
+    - noinlineerr
     - nonamedreturns
     - nosprintfhostport
     - paralleltest
     - perfsprint
     - prealloc
     - protogetter
+    - revive
     - tagliatelle
     - testpackage
     - thelper
@@ -61,7 +67,11 @@ linters:
     - wastedassign
     - wrapcheck
     - wsl
+    - wsl_v5
   settings:
+    govet:
+      disable:
+        - printf
     importas:
       alias:
         - pkg: k8s.io/api/apps/v1

charts/values.global.yaml

@@ -21,7 +21,7 @@ images:
   # NOTE: All tags have to be quoted otherwise they might be treated as a number.
   bash:
     image: gke.gcr.io/gke-distroless/bash
-    tag: gke_distroless_20260526.00_p0
+    tag: gke_distroless_20260601.00_p0
   alertmanager:
     image: gke.gcr.io/prometheus-engine/alertmanager
     tag: "v0.27.0-gmp.4-gke.4"

cmd/config-reloader/Dockerfile

@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM --platform=$BUILDPLATFORM google-go.pkg.dev/golang:1.25.10@sha256:749f454e65f13df43fbef73abf307542b8ae1337ab16444dc205cdceb94db6b7 AS buildbase
+FROM --platform=$BUILDPLATFORM google-go.pkg.dev/golang:1.25.11@sha256:2da14c7719caf31e06b5f1015926f043c5983f19cf4df7142fee65be894a16da AS buildbase
 ARG TARGETOS
 ARG TARGETARCH
 WORKDIR /app
@@ -42,6 +42,6 @@ RUN if [ "${TARGETARCH}" = "arm64" ] && [ "${BUILDARCH}" != "arm64" ]; then \
 	cmd/config-reloader/*.go
 
 
-FROM gke.gcr.io/gke-distroless/libc:gke_distroless_20260526.00_p0@sha256:ab652d36941186888f7c88293cc57a4f75c5c243d46fee363ab2ae15eca639a3
+FROM gke.gcr.io/gke-distroless/libc:gke_distroless_20260601.00_p0@sha256:1b74f92a381c5269d5018b08ce0464cfcb310b6b9b6d98767ba3300838483fc4
 COPY --from=buildbase /app/config-reloader /bin/config-reloader
 ENTRYPOINT ["/bin/config-reloader"]

cmd/datasource-syncer/Dockerfile

@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM --platform=$BUILDPLATFORM google-go.pkg.dev/golang:1.25.10@sha256:749f454e65f13df43fbef73abf307542b8ae1337ab16444dc205cdceb94db6b7 AS buildbase
+FROM --platform=$BUILDPLATFORM google-go.pkg.dev/golang:1.25.11@sha256:2da14c7719caf31e06b5f1015926f043c5983f19cf4df7142fee65be894a16da AS buildbase
 ARG TARGETOS
 ARG TARGETARCH
 WORKDIR /app
@@ -42,7 +42,7 @@ RUN if [ "${TARGETARCH}" = "arm64" ] && [ "${BUILDARCH}" != "arm64" ]; then \
 	cmd/datasource-syncer/*.go
 
 
-FROM gke.gcr.io/gke-distroless/libc:gke_distroless_20260526.00_p0@sha256:ab652d36941186888f7c88293cc57a4f75c5c243d46fee363ab2ae15eca639a3
+FROM gke.gcr.io/gke-distroless/libc:gke_distroless_20260601.00_p0@sha256:1b74f92a381c5269d5018b08ce0464cfcb310b6b9b6d98767ba3300838483fc4
 COPY --from=buildbase /app/datasource-syncer /bin/datasource-syncer
 ENTRYPOINT ["/bin/datasource-syncer"]
 

cmd/frontend/Dockerfile

@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM --platform=$BUILDPLATFORM google-go.pkg.dev/golang:1.25.10@sha256:749f454e65f13df43fbef73abf307542b8ae1337ab16444dc205cdceb94db6b7 AS buildbase
+FROM --platform=$BUILDPLATFORM google-go.pkg.dev/golang:1.25.11@sha256:2da14c7719caf31e06b5f1015926f043c5983f19cf4df7142fee65be894a16da AS buildbase
 
 # Compile the UI assets.
 FROM --platform=$BUILDPLATFORM us-central1-docker.pkg.dev/serverless-runtimes/google-24-full/runtimes/nodejs24@sha256:12f9b32a1afdd87221c0a6c1a907c74978f7de75902264badf2db08ddb21203c AS assets
@@ -62,6 +62,6 @@ RUN if [ "${TARGETARCH}" = "arm64" ] && [ "${BUILDARCH}" != "arm64" ]; then \
 	cmd/frontend/*.go
 
 
-FROM gke.gcr.io/gke-distroless/libc:gke_distroless_20260526.00_p0@sha256:ab652d36941186888f7c88293cc57a4f75c5c243d46fee363ab2ae15eca639a3
+FROM gke.gcr.io/gke-distroless/libc:gke_distroless_20260601.00_p0@sha256:1b74f92a381c5269d5018b08ce0464cfcb310b6b9b6d98767ba3300838483fc4
 COPY --from=appbase /app/frontend /bin/frontend
 ENTRYPOINT ["/bin/frontend"]

cmd/operator/Dockerfile

@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM --platform=$BUILDPLATFORM google-go.pkg.dev/golang:1.25.10@sha256:749f454e65f13df43fbef73abf307542b8ae1337ab16444dc205cdceb94db6b7 AS buildbase
+FROM --platform=$BUILDPLATFORM google-go.pkg.dev/golang:1.25.11@sha256:2da14c7719caf31e06b5f1015926f043c5983f19cf4df7142fee65be894a16da AS buildbase
 ARG TARGETOS
 ARG TARGETARCH
 WORKDIR /app
@@ -43,6 +43,6 @@ RUN if [ "${TARGETARCH}" = "arm64" ] && [ "${BUILDARCH}" != "arm64" ]; then \
 	cmd/operator/*.go
 
 
-FROM gke.gcr.io/gke-distroless/libc:gke_distroless_20260526.00_p0@sha256:ab652d36941186888f7c88293cc57a4f75c5c243d46fee363ab2ae15eca639a3
+FROM gke.gcr.io/gke-distroless/libc:gke_distroless_20260601.00_p0@sha256:1b74f92a381c5269d5018b08ce0464cfcb310b6b9b6d98767ba3300838483fc4
 COPY --from=buildbase /app/operator /bin/operator
 ENTRYPOINT ["/bin/operator"]

cmd/rule-evaluator/Dockerfile

@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM --platform=$BUILDPLATFORM google-go.pkg.dev/golang:1.25.10@sha256:749f454e65f13df43fbef73abf307542b8ae1337ab16444dc205cdceb94db6b7 AS buildbase
+FROM --platform=$BUILDPLATFORM google-go.pkg.dev/golang:1.25.11@sha256:2da14c7719caf31e06b5f1015926f043c5983f19cf4df7142fee65be894a16da AS buildbase
 ARG TARGETOS
 ARG TARGETARCH
 WORKDIR /app
@@ -44,6 +44,6 @@ RUN if [ "${TARGETARCH}" = "arm64" ] && [ "${BUILDARCH}" != "arm64" ]; then \
 	cmd/rule-evaluator/*.go
 
 
-FROM gke.gcr.io/gke-distroless/libc:gke_distroless_20260526.00_p0@sha256:ab652d36941186888f7c88293cc57a4f75c5c243d46fee363ab2ae15eca639a3
+FROM gke.gcr.io/gke-distroless/libc:gke_distroless_20260601.00_p0@sha256:1b74f92a381c5269d5018b08ce0464cfcb310b6b9b6d98767ba3300838483fc4
 COPY --from=buildbase /app/rule-evaluator /bin/rule-evaluator
 ENTRYPOINT ["/bin/rule-evaluator"]

examples/instrumentation/go-synthetic/Dockerfile

@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM --platform=$BUILDPLATFORM google-go.pkg.dev/golang:1.25.10@sha256:749f454e65f13df43fbef73abf307542b8ae1337ab16444dc205cdceb94db6b7 AS buildbase
+FROM --platform=$BUILDPLATFORM google-go.pkg.dev/golang:1.25.11@sha256:2da14c7719caf31e06b5f1015926f043c5983f19cf4df7142fee65be894a16da AS buildbase
 ARG TARGETOS
 ARG TARGETARCH
 WORKDIR /app