chore: bump Go/Alpine base images, improve tests, and centralize MongoDB error handling (#1428)

* chore/helm: update mongodb to 16.5.45

* chore/web: npx update-browserslist-db@latest

* tests/update-golang: allow redirect to download golang 1.23.9

* chore: upgrade golang to 1.25 and alpine to 3.23

* fix linter issues, upgrade mongo-driver

* fix golangci-lint issues

* fix issue

* fix test compilation

* fix sonar issues

* allow images from public.ecr.aws

* Update bundle/Dockerfile

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* Update bundle/Dockerfile

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* Apply suggestions from code review

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* fix golangci-lint

---------

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Author: 3 people

.github/workflows/builds.yml

@@ -12,8 +12,8 @@ jobs:
       matrix:
         include:
           # check support for oldest supported golang version
-          - name: go1.23
-            go-version: "~1.23"
+          - name: go1.25
+            go-version: "~1.25"
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
@@ -22,7 +22,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: ${{ matrix.go-version || '^1.23' }}
+          go-version: ${{ matrix.go-version || '^1.25' }}
           check-latest: true
 
       - run: |

.github/workflows/golangci-lint.yml

@@ -24,13 +24,13 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: "1.23" # The Go version to download (if necessary) and use.
+          go-version: "1.25" # The Go version to download (if necessary) and use.
           check-latest: false
           cache: false
 
       - run: go version
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v8
         with:
-          version: v2.1.6 # switch to latest if development is unfreezed
+          version: v2.8.0 # switch to latest if development is unfreezed
           args: --timeout=5m

.golangci.yml

@@ -1,6 +1,6 @@
 version: "2"
 run:
-  go: "1.23"
+  go: "1.25"
 # issues:
 #   fix: true
 linters:

Dockerfile.test

@@ -1,14 +1,14 @@
 FROM ubuntu:22.04 AS hub-test
 RUN apt-get update \
     && DEBIAN_FRONTEND="noninteractive" apt-get install -y --no-install-recommends \
-    build-essential ca-certificates curl git make patch sudo \
+    build-essential ca-certificates curl git lsof make patch sudo \
     && apt-get clean \
     && curl --proto "=https" -sSL https://get.docker.com/ | sh
 WORKDIR /
 # apt: ca-certificates git make sudo
 RUN git clone https://github.com/udhos/update-golang.git \
     && cd update-golang \
-    && sudo RELEASE=1.23.9 ./update-golang.sh \
+    && sudo RELEASE=1.25.6 FORCE_IPV4="-L" ./update-golang.sh \
     && ln -s /usr/local/go/bin/go /usr/bin/go
 WORKDIR $GOPATH/src/github.com/plgd-dev/hub
 COPY go.mod go.sum ./

bundle/Dockerfile

@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1
-FROM golang:1.23.9-alpine AS build
+FROM golang:1.25.6-alpine AS build
 RUN apk add --no-cache build-base curl git
 WORKDIR $GOPATH/src/github.com/plgd-dev/hub
 COPY go.mod go.sum ./
@@ -202,7 +202,13 @@ RUN go build \
 #device-provisioning-service
 ARG service=device-provisioning-service
 WORKDIR $root_directory/$service
-RUN go build -ldflags "-linkmode external -extldflags -static -X github.com/plgd-dev/hub/v2/pkg/build.CommitDate=$COMMIT_DATE -X github.com/plgd-dev/hub/v2/pkg/build.CommitHash=$SHORT_COMMIT -X github.com/plgd-dev/hub/v2/pkg/build.BuildDate=$DATE -X github.com/plgd-dev/hub/v2/pkg/build.Version=$VERSION -X github.com/plgd-dev/hub/v2/pkg/build.ReleaseURL=$RELEASE_URL" \
+RUN go build \
+    -ldflags "-linkmode external -extldflags -static \
+    -X github.com/plgd-dev/hub/v2/pkg/build.CommitDate=$COMMIT_DATE \
+    -X github.com/plgd-dev/hub/v2/pkg/build.CommitHash=$SHORT_COMMIT \
+    -X github.com/plgd-dev/hub/v2/pkg/build.BuildDate=$DATE \
+    -X github.com/plgd-dev/hub/v2/pkg/build.Version=$VERSION \
+    -X github.com/plgd-dev/hub/v2/pkg/build.ReleaseURL=$RELEASE_URL" \
     -o "/go/bin/$service" \
     ./cmd/service
 
@@ -216,8 +222,8 @@ RUN apkArch="$(apk --print-arch)"; \
     x86_64) ARCH='amd64' ;; \
     *) echo >&2 "error: unsupported architecture: $apkArch"; exit 1 ;; \
     esac; \
-    curl -L https://github.com/nats-io/nats-server/releases/download/v2.3.1/nats-server-v2.3.1-linux-${ARCH}.zip -o ./nats-server.zip ; \
-    curl -L https://github.com/nats-io/natscli/releases/download/0.0.24/nats-0.0.24-linux-${ARCH}.zip -o ./nats.zip \
+    curl -L "https://github.com/nats-io/nats-server/releases/download/v2.3.1/nats-server-v2.3.1-linux-${ARCH}.zip" -o ./nats-server.zip && \
+    curl -L "https://github.com/nats-io/natscli/releases/download/0.0.24/nats-0.0.24-linux-${ARCH}.zip" -o ./nats.zip \
     && mkdir -p ./nats-server \
     && unzip ./nats-server.zip -d ./nats-server \
     && cp ./nats-server/*/nats-server /go/bin/nats-server \

certificate-authority/service/grpc/signCertificate_test.go

@@ -34,20 +34,24 @@ func testSigningByFunction(t *testing.T, signFn ClientSignFunc, csr ...[]byte) {
 	type args struct {
 		req *pb.SignCertificateRequest
 	}
-	tests := []struct {
+	tests := make([]struct {
+		name    string
+		args    args
+		want    *pb.SignCertificateResponse
+		wantErr bool
+	}, 0, 1+len(csr))
+	tests = append(tests, struct {
 		name    string
 		args    args
 		want    *pb.SignCertificateResponse
 		wantErr bool
 	}{
-		{
-			name: "invalid csr",
-			args: args{
-				req: &pb.SignCertificateRequest{},
-			},
-			wantErr: true,
+		name: "invalid csr",
+		args: args{
+			req: &pb.SignCertificateRequest{},
 		},
-	}
+		wantErr: true,
+	})
 	for idx, csr := range csr {
 		tests = append(tests, struct {
 			name    string

certificate-authority/store/mongodb/signingRecords.go

@@ -39,7 +39,7 @@ func (s *Store) UpdateSigningRecord(ctx context.Context, signingRecord *store.Si
 	return err
 }
 
-func toCommonNameQueryFilter(owner string, commonName string) bson.D {
+func toCommonNameQueryFilter(owner, commonName string) bson.D {
 	f := bson.D{
 		{Key: store.CommonNameKey, Value: commonName},
 	}
@@ -49,7 +49,7 @@ func toCommonNameQueryFilter(owner string, commonName string) bson.D {
 	return f
 }
 
-func toDeviceIDQueryFilter(owner string, deviceID string) bson.D {
+func toDeviceIDQueryFilter(owner, deviceID string) bson.D {
 	f := bson.D{
 		{Key: store.DeviceIDKey, Value: deviceID},
 	}
@@ -59,7 +59,7 @@ func toDeviceIDQueryFilter(owner string, deviceID string) bson.D {
 	return f
 }
 
-func toIDQueryFilter(owner string, id string) bson.D {
+func toIDQueryFilter(owner, id string) bson.D {
 	f := bson.D{
 		{Key: "_id", Value: id},
 	}
@@ -70,7 +70,8 @@ func toIDQueryFilter(owner string, id string) bson.D {
 }
 
 func toSigningRecordsQueryFilter(owner string, queries *store.SigningRecordsQuery) interface{} {
-	or := []bson.D{}
+	n := len(queries.GetIdFilter()) + len(queries.GetCommonNameFilter()) + len(queries.GetDeviceIdFilter())
+	or := make([]bson.D, 0, n)
 	for _, q := range queries.GetIdFilter() {
 		or = append(or, toIDQueryFilter(owner, q))
 	}

charts/plgd-hub/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 1.1.9
 - name: mongodb
   repository: https://charts.bitnami.com/bitnami
-  version: 15.4.4
+  version: 16.5.45
 - name: scylla
   repository: https://scylla-operator-charts.storage.googleapis.com/stable
   version: v1.10.0
-digest: sha256:2c3e908c6556633c6fd5467498177029023aa737b9436d1001907ecd9ba282ec
-generated: "2024-05-20T14:26:43.823740553Z"
+digest: sha256:9971025d84d32173972f9ab2dee404b98214c98367b93496de63f04d6536a914
+generated: "2026-01-27T10:16:34.731286183+01:00"

charts/plgd-hub/Chart.yaml

@@ -15,7 +15,7 @@ dependencies:
     repository: "https://nats-io.github.io/k8s/helm/charts/"
     condition: nats.enabled
   - name: "mongodb"
-    version: "15.4.4"
+    version: "16.5.45"
     repository: "https://charts.bitnami.com/bitnami"
     condition: mongodb.enabled
   - name: "scylla"

charts/plgd-hub/values.yaml

@@ -209,6 +209,10 @@ mongodb:
     enabled: false
   image:
     debug: true
+    registry: public.ecr.aws
+  global:
+    security:
+      allowInsecureImages: true
   tls:
     enabled: false
   standbyTool: