Merge pull request #499 from cnvergence/bump-go-ver

Author: ntnn

.github/workflows/ci.yaml

@@ -30,7 +30,7 @@ jobs:
     - uses: actions/checkout@v4
     - uses: actions/setup-go@v5
       with:
-        go-version: v1.25.4
+        go-version: v1.26.1
     - uses: actions/setup-node@v4
       with:
         node-version: '20'
@@ -45,7 +45,7 @@ jobs:
     - uses: actions/checkout@v4
     - uses: actions/setup-go@v5
       with:
-        go-version: v1.25.4
+        go-version: v1.26.1
     - uses: actions/setup-node@v4
       with:
         node-version: '20'
@@ -60,7 +60,7 @@ jobs:
     - uses: actions/checkout@v4
     - uses: actions/setup-go@v5
       with:
-        go-version: v1.25.4
+        go-version: v1.26.1
     - run: make test
 
   lint:
@@ -70,7 +70,7 @@ jobs:
     - uses: actions/checkout@v4
     - uses: actions/setup-go@v5
       with:
-        go-version: v1.25.4
+        go-version: v1.26.1
     - run: make lint
 
   verify:
@@ -80,5 +80,5 @@ jobs:
     - uses: actions/checkout@v4
     - uses: actions/setup-go@v5
       with:
-        go-version: v1.25.4
+        go-version: v1.26.1
     - run: make verify

.github/workflows/docs-gen-and-push.yaml

@@ -34,7 +34,7 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: v1.25.4
+          go-version: v1.26.1
           cache: true
 
       - uses: actions/setup-python@v5

.github/workflows/goreleaser.yaml

@@ -22,7 +22,7 @@ jobs:
         fetch-depth: 0
     - uses: actions/setup-go@v5
       with:
-        go-version: v1.25.4
+        go-version: v1.26.1
     - name: Delete non-semver tags
       run: 'git tag -d $(git tag -l | grep -v "^v")'
     - name: Set LDFLAGS
@@ -51,4 +51,4 @@ jobs:
       if: ${{ always() }}
       with:
         name: binaries
-        path: dist/*.tar.gz
+        path: dist/*.tar.gz

.github/workflows/image.yaml

@@ -19,7 +19,7 @@ jobs:
     - uses: actions/checkout@v4
     - uses: actions/setup-go@v5
       with:
-        go-version: v1.25.4
+        go-version: v1.26.1
         check-latest: true
 
     # We need this to remove local tags that are not semver so goreleaser doesn't get confused.
@@ -33,7 +33,7 @@ jobs:
     # If you notice signing errors, you may need to update the cosign version.
     - uses: sigstore/cosign-installer@v3.7.0
 
-    
+
     - name: Install Helm
       uses: azure/setup-helm@v3
       with:
@@ -43,7 +43,7 @@ jobs:
       run: echo LDFLAGS="$(make ldflags)" | tee -a >> $GITHUB_ENV
 
     # Login to GitHub Container Registry (used by both ko and Docker)
-    - name: Login to GitHub Container Registry  
+    - name: Login to GitHub Container Registry
       uses: docker/login-action@v3
       with:
         registry: ghcr.io
@@ -134,7 +134,7 @@ jobs:
       run: |
         # Login to GitHub Container Registry for Helm
         echo "${{ github.token }}" | helm registry login ghcr.io --username ${{ github.actor }} --password-stdin
-        
+
         # Set chart version - use tag name if available, otherwise use semver format
         if [[ "${{ github.ref_type }}" == "tag" ]]; then
           CHART_VERSION="${{ github.ref_name }}"
@@ -143,23 +143,23 @@ jobs:
         else
           CHART_VERSION="0.0.0-${{ github.sha }}"
         fi
-        
+
         # Package and push each chart in deploy/charts/
         for chart_dir in deploy/charts/*/; do
           if [ -f "${chart_dir}Chart.yaml" ]; then
             chart_name=$(basename "$chart_dir")
             echo "Processing chart: $chart_name"
-            
+
             # Update chart version and appVersion in Chart.yaml
             sed -i "s/^version:.*/version: ${CHART_VERSION}/" "${chart_dir}Chart.yaml"
             sed -i "s/^appVersion:.*/appVersion: ${CHART_VERSION}/" "${chart_dir}Chart.yaml"
-            
+
             # Package the chart
             helm package "$chart_dir" --version "${CHART_VERSION}"
-            
+
             # Push to GitHub Container Registry
             helm push "${chart_name}-${CHART_VERSION}.tgz" "oci://ghcr.io/${{ github.repository_owner }}/charts"
-            
+
             echo "Helm chart pushed to oci://ghcr.io/${{ github.repository_owner }}/charts/${chart_name}:${CHART_VERSION}"
           fi
         done

.golangci.yaml

@@ -67,6 +67,10 @@ linters:
       - linters:
           - goconst
         path: (.+)_test\.go
+      - linters:
+          - gosec
+        path: (.+)_test\.go
+        text: G101
       - linters:
           - staticcheck
         text: QF1008

.ko.yaml

@@ -1,5 +1,5 @@
 baseImageOverrides:
-  github.com/google/ko: golang:1.25.4
+  github.com/google/ko: golang:1.26.1
 
 builds:
 - id: konnector

Dockerfile

@@ -17,7 +17,7 @@ FROM node:20.18.0-alpine3.20 AS ui-build-env
 WORKDIR /app
 
 # Install build dependencies needed for native modules
-RUN apk add --no-cache python3 make g++ 
+RUN apk add --no-cache python3 make g++
 
 # Copy package files
 COPY ./web/package*.json ./
@@ -39,7 +39,7 @@ ENV VITE_BUILD_TARGET=docker
 RUN npm run build
 
 # Build Go binary with embedded UI assets
-FROM golang:1.25.4 AS go-build-env
+FROM golang:1.26.1 AS go-build-env
 WORKDIR /app
 
 # Accept build arguments for multi-arch support
@@ -75,4 +75,4 @@ COPY --from=ui-build-env /app/dist /www
 
 
 
-ENTRYPOINT ["/bin/backend"]
+ENTRYPOINT ["/bin/backend"]

Dockerfile.konnector

@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.25.4 AS builder
+FROM golang:1.26.1 AS builder
 WORKDIR /app
 
 # Accept build arguments for multi-arch support
@@ -32,4 +32,4 @@ RUN apk --update add ca-certificates
 
 COPY --from=builder /app/bin/konnector /bin/konnector
 
-ENTRYPOINT ["/bin/konnector"]
+ENTRYPOINT ["/bin/konnector"]

Makefile

@@ -32,7 +32,7 @@ BOILERPLATE_VERSION := 201dcad9616c117927232ee0bc499ff38a27023e
 CODE_GENERATOR_VERSION := v2.4.0
 CONTROLLER_GEN_VERSION := v0.17.3
 DEX_VERSION := v2.43.1
-GOLANGCI_LINT_VERSION := 2.1.6
+GOLANGCI_LINT_VERSION := 2.11.3
 GORELEASER_VERSION := 2.13.0
 GOTESTSUM_VERSION := 1.8.1
 HELM_DOCS_VERSION := 1.14.2

backend/auth/handler.go

@@ -55,6 +55,8 @@ type AuthHandler struct {
 	tokenExpiry         time.Duration
 }
 
+const maxCallbackFormSize int64 = 1 << 20 // 1 MiB
+
 func NewAuthHandler(oidc OIDCProvider, jwtService *JWTService, cookieSigningKey, cookieEncryptionKey []byte, sessionStore session.Store, tokenExpiry time.Duration) *AuthHandler {
 	return &AuthHandler{
 		oidc:                oidc,
@@ -136,6 +138,7 @@ func (ah *AuthHandler) HandleAuthorize(w http.ResponseWriter, r *http.Request) {
 func (ah *AuthHandler) HandleCallback(w http.ResponseWriter, r *http.Request) {
 	logger := klog.FromContext(r.Context()).WithValues("method", r.Method, "url", r.URL.String())
 
+	r.Body = http.MaxBytesReader(w, r.Body, maxCallbackFormSize)
 	if err := r.ParseForm(); err != nil {
 		logger.Error(err, "failed to parse form")
 		ah.respondWithError(w, "", "failed to parse form", http.StatusBadRequest)