chore: upgrade to Go 1.27.1

.golangci.yml

@@ -12,71 +12,83 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-issues:
-  exclude-files:
-    - ".*\\.pb.*\\.go"
+version: "2"
 linters:
+  # errcheck, govet, ineffassign, staticcheck and unused are enabled by default.
+  # gosimple was merged into staticcheck.
   enable:
-    - errcheck
     - goconst
-    - revive
-    - ineffassign
     - lll
     - misspell
-    - unconvert
-    - govet
     - prealloc
-    - unused
-    - staticcheck
-    - gosimple
-  disable:
-    - goimports # already run in `make format`
-linters-settings:
-  lll:
-    line-length: 160
-  goconst:
-    min-occurrences: 4
-  govet:
-    enable:
-      - shadow
-  revive:
-    ignore-generated-header: false
-    severity: error
-    confidence: 0.8
-    rules:
-      - name: atomic
-      - name: blank-imports
-      - name: confusing-naming
-      - name: get-return
-      - name: context-as-argument
-      - name: context-keys-type
-      - name: dot-imports
-      # A true empty block is hard to recognize, see https://github.com/mgechev/revive/issues/386
-      #- name: empty-block
-      - name: error-naming
-      - name: error-return
-      - name: error-strings
-      - name: errorf
-      - name: exported
-      - name: if-return
-      - name: increment-decrement
-      - name: indent-error-flow
-      - name: package-comments
-      - name: range
-      - name: receiver-naming
-      - name: redefines-builtin-id
-      - name: superfluous-else
-      - name: struct-tag
-      - name: time-naming
-      - name: unexported-naming
-      - name: unexported-return
-      - name: unhandled-error
-        arguments: [
-            "fmt.Printf",
-            "fmt.Println",
-            "fmt.Fprintf",
-        ]
-      - name: unreachable-code
-      - name: unused-parameter
-      - name: var-declaration
-      - name: var-naming
+    - revive
+    - unconvert
+  settings:
+    goconst:
+      min-occurrences: 4
+      # Table-driven tests legitimately repeat literals such as paths and hostnames.
+      ignore-tests: true
+    govet:
+      enable:
+        - shadow
+    lll:
+      line-length: 160
+    revive:
+      confidence: 0.8
+      severity: error
+      rules:
+        - name: atomic
+        - name: blank-imports
+        - name: confusing-naming
+        - name: get-return
+        - name: context-as-argument
+        - name: context-keys-type
+        - name: dot-imports
+        # A true empty block is hard to recognize, see https://github.com/mgechev/revive/issues/386
+        #- name: empty-block
+        - name: error-naming
+        - name: error-return
+        - name: error-strings
+        - name: errorf
+        - name: exported
+        - name: if-return
+        - name: increment-decrement
+        - name: indent-error-flow
+        - name: package-comments
+        - name: range
+        - name: receiver-naming
+        - name: redefines-builtin-id
+        - name: superfluous-else
+        - name: struct-tag
+        - name: time-naming
+        - name: unexported-naming
+        - name: unexported-return
+        - name: unhandled-error
+          arguments:
+            - fmt.Printf
+            - fmt.Println
+            - fmt.Fprintf
+        - name: unreachable-code
+        - name: unused-parameter
+        - name: var-declaration
+        - name: var-naming
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    paths:
+      - .*\.pb.*\.go
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  # goimports is already run in `make format`
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

go.mod

@@ -1,6 +1,6 @@
 module github.com/istio-ecosystem/authservice
 
-go 1.26.6
+go 1.27.1
 
 require (
 	github.com/alicebob/miniredis/v2 v2.31.1
@@ -15,7 +15,7 @@ require (
 	github.com/tetratelabs/log v0.2.3
 	github.com/tetratelabs/run v0.3.0
 	github.com/tetratelabs/telemetry v0.8.2
-	golang.org/x/net v0.56.0
+	golang.org/x/net v0.57.0
 	golang.org/x/oauth2 v0.36.0
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa
 	google.golang.org/grpc v1.83.1
@@ -80,11 +80,11 @@ require (
 	go.uber.org/atomic v1.11.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.53.0 // indirect
-	golang.org/x/sync v0.21.0 // indirect
-	golang.org/x/sys v0.46.0 // indirect
-	golang.org/x/term v0.44.0 // indirect
-	golang.org/x/text v0.39.0 // indirect
+	golang.org/x/crypto v0.55.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/term v0.45.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect

go.sum

@@ -204,27 +204,27 @@ go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
-golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
-golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
-golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
-golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
-golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
+golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
+golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
+golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
-golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
-golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190204203706-41f3e6584952/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
-golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
-golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
-golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus=
-golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
-golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
-golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
+golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
 gomodules.xyz/jsonpatch/v2 v2.5.0 h1:JELs8RLM12qJGXU4u/TO3V25KW8GreMKl9pdkk14RM0=
 gomodules.xyz/jsonpatch/v2 v2.5.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=

internal/config_test.go

@@ -338,7 +338,7 @@ func TestLoadOIDC(t *testing.T) {
 								JwksConfig: &oidcv1.OIDCConfig_JwksFetcher{
 									JwksFetcher: &oidcv1.OIDCConfig_JwksFetcherConfig{
 										JwksUri:            "http://fake/jwks",
-										SkipVerifyPeerCert: structpb.NewStringValue("true"),
+										SkipVerifyPeerCert: structpb.NewStringValue("true"), //nolint: staticcheck // deprecated field kept for backwards-compatibility testing
 									},
 								},
 								ClientId:                   "fake-client-id",

internal/http/tls.go

@@ -208,7 +208,7 @@ func encodeConfig(config TLSConfig) tlsConfigEncoder {
 // hash returns the hash of the tls config.
 func (c tlsConfigEncoder) hash() string {
 	buff := bytes.Buffer{}
-	_, _ = buff.WriteString(fmt.Sprintf("%t", c.SkipVerifyPeerCert))
+	_, _ = fmt.Fprintf(&buff, "%t", c.SkipVerifyPeerCert)
 	_, _ = buff.WriteString(c.TrustedCA)
 	_, _ = buff.WriteString(c.TrustedCAFile)
 	_, _ = buff.WriteString(c.TrustedCARefreshInterval)

internal/k8s/secret_controller.go

@@ -181,7 +181,7 @@ func (s *SecretController) Reconcile(ctx context.Context, req ctrl.Request) (ctr
 	log := s.log.Context(ctx).With("secret", req.String())
 	log.Debug("reconciling secret")
 
-	changedSecret := req.NamespacedName.String()
+	changedSecret := req.String()
 	oidcConfigsUpdateFuncs, exist := s.secrets[changedSecret]
 
 	// If the secret is not used in the configuration, we can ignore it

internal/oidc/session.go

@@ -302,8 +302,8 @@ func (s *sessionStoreFactory) setSessionStore(key string, store SessionStore) {
 func hashInMemoryConfig(cfg *oidcv1.OIDCConfig) string {
 	buff := bytes.Buffer{}
 	_, _ = buff.WriteString("memory")
-	_, _ = buff.WriteString(fmt.Sprintf("%v", cfg.GetAbsoluteSessionTimeout()))
-	_, _ = buff.WriteString(fmt.Sprintf("%v", cfg.GetIdleSessionTimeout()))
+	_, _ = fmt.Fprintf(&buff, "%v", cfg.GetAbsoluteSessionTimeout())
+	_, _ = fmt.Fprintf(&buff, "%v", cfg.GetIdleSessionTimeout())
 
 	hash := fnv.New64a()
 	_, _ = hash.Write(buff.Bytes())

internal/watch/file.go

@@ -171,7 +171,7 @@ func newNotifier(log telemetry.Logger, name string, options FileWatcherOptions,
 	}
 
 	// Register the callbacks to be notified on changes or errors.
-	if err = not.WithCallbacks.Watch(name, callbacks...); err != nil {
+	if err = not.Watch(name, callbacks...); err != nil {
 		return nil, err
 	}