chore(deps): bump golang.org/x/net and golang.org/x/text to fix GO-20…

.github/workflows/ci.yaml

@@ -36,20 +36,20 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.23'
+          go-version: '1.25'
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@v7
         with:
           # Pin the version in case all the builds start to fail at the same time.
           # There may not be an automatic way (e.g., dependabot) to update a specific parameter of a GitHub Action,
           # so we will just update it manually whenever it makes sense (e.g., a feature that we want is added).
-          version: v1.60.3
-          args: --build-tags e2e,unit --fix=false --timeout=5m --out-format=colored-line-number
+          version: v2.12.2
+          args: --build-tags e2e,unit
   unit-tests:
     strategy:
       fail-fast: false
       matrix:
-        go: [ '1.23', '1.24' ]
+        go: [ '1.24', '1.25' ]
         os: [ ubuntu-latest, windows-latest ]
 
     name: Unit Tests / ${{ matrix.os }} / Go ${{ matrix.go }}
@@ -68,7 +68,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        go: [ '1.23', '1.24' ]
+        go: [ '1.24', '1.25' ]
         os: [ ubuntu-latest ] # TODO: Add Windows e2e tests: https://github.com/aws/shim-loggers-for-containerd/issues/68
     name: E2E tests / awslogs / ${{ matrix.os }} / Go ${{ matrix.go }}
     runs-on: ${{ matrix.os }}
@@ -108,7 +108,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        go: [ '1.23', '1.24' ]
+        go: [ '1.24', '1.25' ]
         os: [ ubuntu-latest ] # TODO: Add Windows e2e tests: https://github.com/aws/shim-loggers-for-containerd/issues/68
     name: E2E tests / fluentd / ${{ matrix.os }} / Go ${{ matrix.go }}
     runs-on: ${{ matrix.os }}
@@ -135,7 +135,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        go: [ '1.23', '1.24' ]
+        go: [ '1.24', '1.25' ]
         os: [ ubuntu-latest ] # TODO: Add Windows e2e tests: https://github.com/aws/shim-loggers-for-containerd/issues/68
     name: E2E tests / splunk / ${{ matrix.os }} / Go ${{ matrix.go }}
     runs-on: ${{ matrix.os }}

.gitignore

@@ -2,3 +2,4 @@ bin/
 .idea/
 deps/
 .get-deps-stamp
+.vscode/

.golangci.yaml

@@ -1,40 +1,25 @@
-# The sections in this file are ordered in the order presented in https://golangci-lint.run/usage/configuration/.
+version: "2"
+
+# The sections in this file are ordered in the order presented in https://golangci-lint.run/docs/configuration/.
 # The nested fields are ordered alphabetically.
 
-linters-settings:
-  goheader:
-    template-path: copyright_header
-  goimports:
-    local-prefixes: github.com/aws/shim-loggers-for-containerd
-  gosec:
-    config:
-      G306: "0o644"
-  lll:
-    # 145 is just a lax value that does not require too much work to add this check,
-    # and we don't want this to be too strict anyway.
-    line-length: 145
-    tab-width: 4
-  makezero:
-    always: true
-  nolintlint:
-    require-explanation: true
-    require-specific: true
-  stylecheck:
-    # ST1003 is left out because it is a bit opinionated.
-    checks: ["all", "-ST1003"]
-  paralleltest:
-    # Ignore missing calls to `t.Parallel()` and only report incorrect uses of it.
-    # Default: false
-    ignore-missing: true
+formatters:
+  enable:
+    - goimports
+  settings:
+    goimports:
+      local-prefixes:
+        - github.com/aws/shim-loggers-for-containerd
+
 linters:
+  default: none
   enable:
     - errname
     - errorlint
     - forcetypeassert
     - gocritic
     - godot
     - goheader
-    - goimports
     - gosec
     - lll
     - misspell
@@ -45,22 +30,44 @@ linters:
     - paralleltest
     - predeclared
     - revive
+    - staticcheck
     - testableexamples
     - unconvert
     - unparam
     - usestdlibvars
     # TODO: Enable wastedassign after https://github.com/sanposhiho/wastedassign/issues/41 is fixed.
     # - wastedassign
     - whitespace
-    - stylecheck
-issues:
-  exclude-rules:
-    - linters:
-        - lll
-      # A go:generate statement has to be in the same line: https://github.com/golang/go/issues/46050.
-      source: "^//go:generate "
-  # Some checks enabled in the stylecheck setting are disabled by default
-  # (e.g., https://golangci-lint.run/usage/false-positives/#exc0013),
-  # so we need to enable them explicitly here.
-  exclude-use-default: false
-  fix: true
+  settings:
+    goheader:
+      template-path: copyright_header
+    gosec:
+      config:
+        G306: "0o644"
+    lll:
+      # 145 is just a lax value that does not require too much work to add this check,
+      # and we don't want this to be too strict anyway.
+      line-length: 145
+      tab-width: 4
+    makezero:
+      always: true
+    nolintlint:
+      require-explanation: true
+      require-specific: true
+    paralleltest:
+      # Ignore missing calls to `t.Parallel()` and only report incorrect uses of it.
+      # Default: false
+      ignore-missing: true
+    staticcheck:
+      checks: ["all", "-ST1003"]
+  exclusions:
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    rules:
+      - linters:
+          - lll
+        # A go:generate statement has to be in the same line: https://github.com/golang/go/issues/46050.
+        source: "^//go:generate "

Makefile

@@ -25,7 +25,7 @@ $(AWS_CONTAINERD_LOGGERS_BINARY):
 
 .PHONY: test-unit
 test-unit: $(SOURCES)
-	go test -tags unit -race -timeout 120s -cover $(shell go list ./... | grep -v e2e) --count=1
+	go test -tags unit -race -timeout 120s -cover $(shell go list -tags unit ./... | grep -v -e e2e -e /mocks -e /debug) --count=1
 
 .PHONY: test-e2e
 test-e2e:

args_test.go

@@ -392,7 +392,7 @@ func TestGetAWSLogsArgs(t *testing.T) {
 			credentialsEndpoint:         "",
 			expectedCredentialsEndpoint: "",
 		},
-		{
+		{ //nolint:gosec // G101: test data, not real credentials
 			name:                        "credentials endpoint provided",
 			credentialsEndpoint:         "http://localhost:8080/credentials",
 			expectedCredentialsEndpoint: "http://localhost:8080/credentials",

debug/debug_linux.go

@@ -64,7 +64,7 @@ func StartStackTraceHandler() {
 // started by containerd, we can check the logs using `journalctl -u containerd.service`.
 func sendEventsToJournal(syslogIdentifier string, msg string, msgType journal.Priority, delay time.Duration) {
 	vars := map[string]string{"SYSLOG_IDENTIFIER": syslogIdentifier}
-	journal.Send(msg, msgType, vars) //nolint:errcheck,gosec // asynchronous process
+	journal.Send(msg, msgType, vars) //nolint:errcheck // asynchronous process
 	time.Sleep(delay * time.Second)
 }
 

e2e/fluentd_test.go

@@ -142,7 +142,7 @@ func validateTestLogsInFluentd(dirName string, testLog string, testTag string) {
 	})
 	gomega.Expect(err).ShouldNot(gomega.HaveOccurred())
 	gomega.Expect(fileName).ShouldNot(gomega.Equal(""))
-	file, err := os.Open(fileName) //nolint:gosec // testing only
+	file, err := os.Open(fileName)
 	gomega.Expect(err).ShouldNot(gomega.HaveOccurred())
 	defer file.Close() //nolint:errcheck // closing the file
 	var lastLine string

e2e/jsonfile_test.go

@@ -268,7 +268,7 @@ var testJSONFile = func() {
 // readEnvelopeLines parses every JSON-line in the given file as a jsonFileEnvelope.
 // Empty lines are skipped. The test fails fast on any parse error.
 func readEnvelopeLines(path string) []jsonFileEnvelope {
-	file, err := os.Open(path) //nolint:gosec // testing only
+	file, err := os.Open(path)
 	gomega.Expect(err).ShouldNot(gomega.HaveOccurred())
 	defer file.Close() //nolint:errcheck // closing the file
 

go.mod

@@ -16,7 +16,7 @@ require (
 	github.com/spf13/pflag v1.0.6
 	github.com/spf13/viper v1.20.1
 	github.com/stretchr/testify v1.10.0
-	golang.org/x/sync v0.16.0
+	golang.org/x/sync v0.21.0
 	gotest.tools v2.2.0+incompatible
 )
 
@@ -100,11 +100,11 @@ require (
 	go.uber.org/atomic v1.9.0 // indirect
 	go.uber.org/automaxprocs v1.6.0 // indirect
 	go.uber.org/multierr v1.9.0 // indirect
-	golang.org/x/net v0.42.0 // indirect
-	golang.org/x/sys v0.34.0 // indirect
-	golang.org/x/text v0.27.0 // indirect
+	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
+	golang.org/x/text v0.39.0 // indirect
 	golang.org/x/time v0.12.0 // indirect
-	golang.org/x/tools v0.34.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
 	google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a // indirect
 	google.golang.org/protobuf v1.36.6 // indirect
@@ -126,6 +126,4 @@ require (
 
 replace github.com/docker/docker v20.10.13+incompatible => github.com/dharmadheeraj/moby v20.10.14-0.20220615184823-6b50baca60ea+incompatible
 
-go 1.23.0
-
-toolchain go1.23.4
+go 1.25.0

go.sum

@@ -330,8 +330,8 @@ golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
-golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
-golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -340,8 +340,8 @@ golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
-golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
+golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -355,13 +355,13 @@ golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
-golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
-golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
+golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus=
+golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM=
 golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
 golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -375,8 +375,8 @@ golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roY
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
 golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.34.0 h1:qIpSLOxeCYGg9TrcJokLBG4KFA6d795g0xkBkiESGlo=
-golang.org/x/tools v0.34.0/go.mod h1:pAP9OwEaY1CAW3HOmg3hLZC5Z0CCmzjAF2UQMSqNARg=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

logger/common.go

@@ -479,7 +479,7 @@ func readFromContainerPipe(pipe io.Reader, buf []byte, bytesInBuffer, maxReadByt
 			// Pipe is closed, set flag to true.
 			eof = true
 		}
-		atomic.AddUint64(&bytesReadFromSrc, uint64(readBytesFromPipe))
+		atomic.AddUint64(&bytesReadFromSrc, uint64(readBytesFromPipe)) //nolint:gosec // non-negative
 		bytesInBuffer += readBytesFromPipe
 	}
 

logger/common_linux_test.go

@@ -65,6 +65,7 @@ func TestTracingLogRouting(t *testing.T) {
 	require.Equal(t, uint64(len(inputForStdout)+len(inputForStderr)), atomic.LoadUint64(&bytesReadFromSrc))
 	// Exclude the new line characters because they will be removed when sending logs to the log driver.
 	require.Equal(t,
+		//nolint:gosec // G115: values are small test constants, no overflow risk.
 		uint64(len(inputForStdout)+len(inputForStderr)-countOfNewLinesForStdout-countOfNewLinesForStderr),
 		atomic.LoadUint64(&bytesSentToDst))
 	require.Equal(t,

logger/common_test.go

@@ -72,15 +72,15 @@ func (d *dummyClient) Log(msg *dockerlogger.Message) error {
 	if err != nil {
 		return err
 	}
-	f, err := os.OpenFile(logDestinationFileName, os.O_APPEND|os.O_RDWR, 0644) //nolint:gosec // testing only
+	f, err := os.OpenFile(logDestinationFileName, os.O_APPEND|os.O_RDWR, 0644)
 	if err != nil {
 		return fmt.Errorf("unable to open file %s to record log message: %w", logDestinationFileName, err)
 	}
 	defer f.Close() //nolint:errcheck // testing only
 	b, err = json.Marshal(msg)
 	require.NoError(d.t, err)
-	f.Write(b)            //nolint:errcheck,gosec // testing only
-	f.Write([]byte{'\n'}) //nolint:errcheck,gosec // testing only
+	f.Write(b)            //nolint:errcheck // testing only
+	f.Write([]byte{'\n'}) //nolint:errcheck // testing only
 
 	return nil
 }
@@ -93,7 +93,7 @@ func checkLogFile(t *testing.T, fileName string, expectedNumLines int,
 		lastPartialID      string
 		lastPartialOrdinal int
 	)
-	file, err := os.Open(fileName) //nolint:gosec // testing only
+	file, err := os.Open(fileName)
 	require.NoError(t, err)
 	defer file.Close() //nolint:errcheck // testing only
 
@@ -275,7 +275,7 @@ func TestPipeNotBroken(t *testing.T) {
 	require.NoError(t, err)
 
 	// Verify that the log destination received partial msg only.
-	file, err := os.Open(logDestinationFileName) //nolint:gosec // testing only
+	file, err := os.Open(logDestinationFileName)
 	require.NoError(t, err)
 	defer file.Close() //nolint:errcheck // testing only
 

logger/memory_benchmark_test.go

@@ -72,7 +72,7 @@ func TestBinarySize(t *testing.T) {
 	require.NoError(t, tmpBinary.Close())
 	defer func() { _ = os.Remove(tmpPath) }()
 
-	cmd := exec.Command("go", "build", "-o", tmpPath, ".") //nolint:gosec // build path is a temp file, not user input
+	cmd := exec.Command("go", "build", "-o", tmpPath, ".")
 	cmd.Dir = ".."
 	out, err := cmd.CombinedOutput()
 	require.NoError(t, err, "build failed: %s", string(out))