Update to go 1.23

[SupernaviX]

Proposed changes

Update the project's go version to 1.23. Also update the base alpine image to 3.21, and some miscellaneous build dependencies to match.

The motivation is to update a transitive dependency on golang.org/x/crypto to the latest. The current version is breaking the build, because it has a vulnerability due to some unbounded buffer.

---

Types of changes

• Bug fix
• New feature added
• Documentation Update

---

• I have read the contributing guidelines.
• I have performed a self-review of my own code or work.
• I have commented my code, particularly in hard-to-understand areas.
• My changes generates no new warnings.
• I have added tests that prove my fix is effective or that my feature works.
• My changes have sufficient code coverage (unit, integration, e2e tests).

---

Other Information

Y'all should consider setting up dependabot or something.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 99.95%. Comparing base (3e30421) to head (da7afa0).
Report is 11 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1680   +/-   ##
=======================================
  Coverage   99.95%   99.95%           
=======================================
  Files         339      339           
  Lines       29782    29782           
=======================================
  Hits        29770    29770           
  Misses          8        8           
  Partials        4        4           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[EnriqueL8]

Thanks @SupernaviX we normally try to update all the versions up from the dependencies starting with the common library https://github.com/hyperledger/firefly-common/blob/main/go.mod but recently the Golang version have been quite good keeping backwards compatibility.

There is also a CVE that @ssmirr is trying to fix and has propagated through Common, Signer, EVMConnect and will add it to FireFly soon, will wait for that one so we can complete that CVE fix across the board

[SupernaviX]

@EnriqueL8 that CVE is the same one that I ran into here, which was making it impossible to open PRs. I'll match the versions from that PR.

[ssmirr]

I think this PR should also update firefly-signer to v1.1.21 for another CVE patch: https://github.com/hyperledger/firefly-signer/releases/tag/v1.1.21

[SupernaviX]

@ssmirr I looked at the changelog for firefly-common and firefly-signer, and it didn't look like there were (relevant) breaking changes in either. The metrics/monitoring change in firefly-common doesn't affect firefly-core, because it has its own APIServer independent from the common one.

Does that sound right or did I miss something?

[EnriqueL8]

Awesome thanks - yes that is correct FF Core has it's own APIServer and doesn't use that part of FF Common but it does use other parts

[EnriqueL8]

Looks great - one small question

[EnriqueL8]

Why this change?

[SupernaviX]

@EnriqueL8 I updated the linter version to one which "officially" supported go 1.23 and 1.24. I made this change when the PR targeted go 1.24, because

• golint can't lint go 1.24 files if it was compiled with go 1.23
• by default, golint is compiled with go 1.23 (even if you're using a 1.24 compiler)
• the golint docs recommended using prebuilt binaries instead of installing from source.

But I just tested and the old install approach works fine with go 1.23, so I'll switch back to that.

[SupernaviX]

yep switching back worked without a hitch

[EnriqueL8]

Thanks for the clarification!

[EnriqueL8]

Looks good!

[EnriqueL8]

This is breaking and it's due to an issue in FF Common , going to revert this