From 7d12660adb0971b354242f9652a14181c3946ac9 Mon Sep 17 00:00:00 2001 From: Alper Rifat Ulucinar Date: Thu, 15 Oct 2026 19:15:20 +0000 Subject: [PATCH 1/5] fix(security): remediate CVE vulnerabilities - Update Go version to 1.26.9 (fixes GO-2026-6612, GO-2026-6604, GO-2026-6603, GO-2026-6611, GO-2026-6608, GO-2026-6607, GO-2026-6609, GO-2026-6613, GO-2026-6605, GO-2026-6610, GO-2026-6617, GO-2026-6599, GO-2026-6600) - Update golang.org/x/net to v0.60.0 (fixes GO-2026-6612, GO-2026-6603, GO-2026-6611, GO-2026-6610, GO-2026-6617) - Update CI workflows to use Go 1.26.9 Signed-off-by: Alper Rifat Ulucinar --- .github/workflows/ci.yml | 2 +- go.mod | 16 ++++++++-------- go.sum | 28 ++++++++++++++-------------- 3 files changed, 23 insertions(+), 23 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c790212..1742374 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -14,7 +14,7 @@ on: env: # Common versions - GO_VERSION: '1.25.13' + GO_VERSION: '1.26.9' GOLANGCI_VERSION: 'v2.4.0' DOCKER_BUILDX_VERSION: 'v0.23.0' diff --git a/go.mod b/go.mod index c4d44c1..86f0e73 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/crossplane-contrib/function-patch-and-transform -go 1.25.13 +go 1.26.9 require ( github.com/alecthomas/kong v1.13.0 @@ -64,15 +64,15 @@ require ( go.uber.org/zap v1.27.0 // indirect go.yaml.in/yaml/v2 v2.4.2 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect - golang.org/x/mod v0.38.0 // indirect - golang.org/x/net v0.58.0 // indirect + golang.org/x/mod v0.41.0 // indirect + golang.org/x/net v0.60.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect - golang.org/x/sync v0.22.0 // indirect - golang.org/x/sys v0.47.0 // indirect - golang.org/x/term v0.45.0 // indirect - golang.org/x/text v0.41.0 // indirect + golang.org/x/sync v0.23.0 // indirect + golang.org/x/sys v0.48.0 // indirect + golang.org/x/term v0.46.0 // indirect + golang.org/x/text v0.42.0 // indirect golang.org/x/time v0.11.0 // indirect - golang.org/x/tools v0.48.0 // indirect + golang.org/x/tools v0.49.0 // indirect golang.org/x/tools/go/expect v0.1.1-deprecated // indirect golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated // indirect gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect diff --git a/go.sum b/go.sum index 222d339..8f43af2 100644 --- a/go.sum +++ b/go.sum @@ -176,41 +176,41 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk= -golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40= +golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= +golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= -golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= -golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= -golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= +golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= -golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= -golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= +golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= +golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE= +golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= -golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= +golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI= +golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0= golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= -golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE= -golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk= +golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI= +golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo= golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM= golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY= golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM= From 70227bddb8bc78e9e1b9ef2bc3a0d9ab86872833 Mon Sep 17 00:00:00 2001 From: Alper Rifat Ulucinar Date: Thu, 15 Oct 2026 19:27:25 +0000 Subject: [PATCH 2/5] fix(ci): upgrade golangci-lint to v2.5.0 for Go 1.26.9 compatibility The previous golangci-lint version (v2.4.0) was built with Go 1.25 and cannot operate with Go 1.26.9 targets. Upgrading to v2.5.0 resolves this compatibility issue. Signed-off-by: Alper Rifat Ulucinar --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1742374..cbc43a1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -15,7 +15,7 @@ on: env: # Common versions GO_VERSION: '1.26.9' - GOLANGCI_VERSION: 'v2.4.0' + GOLANGCI_VERSION: 'v2.5.0' DOCKER_BUILDX_VERSION: 'v0.23.0' # These environment variables are important to the Crossplane CLI install.sh From a870bccb810690295e27a63827fb6dbd2ee728e3 Mon Sep 17 00:00:00 2001 From: Alper Rifat Ulucinar Date: Thu, 15 Oct 2026 19:38:53 +0000 Subject: [PATCH 3/5] fix(ci): upgrade golangci-lint to v2.14.0 for Go 1.26.9 compatibility golangci-lint v2.5.0 was still built with Go 1.25. v2.14.0 is the first version built with Go 1.26, providing full support for Go 1.26.x projects. Signed-off-by: Alper Rifat Ulucinar --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index cbc43a1..2539a92 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -15,7 +15,7 @@ on: env: # Common versions GO_VERSION: '1.26.9' - GOLANGCI_VERSION: 'v2.5.0' + GOLANGCI_VERSION: 'v2.14.0' DOCKER_BUILDX_VERSION: 'v0.23.0' # These environment variables are important to the Crossplane CLI install.sh From 4110be05daff149436ac0f19e5d7462bbf82ea52 Mon Sep 17 00:00:00 2001 From: Alper Rifat Ulucinar Date: Thu, 15 Oct 2026 20:12:38 +0000 Subject: [PATCH 4/5] fix(ci): update golangci-lint config for v2.x compatibility - Add exhaustruct_v5 to disable list (v2.x versioned name for exhaustruct) - Add modernize to disable list (new linter in v2.x) Signed-off-by: Alper Rifat Ulucinar --- .golangci.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.golangci.yml b/.golangci.yml index 472fa42..501f75c 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -62,6 +62,7 @@ linters: # useful in theory to catch fields that are accidentally omitted. Seems like # it would have many more false positives than useful catches, though. - exhaustruct + - exhaustruct_v5 # Warns about TODO comments. The rationale being they should be issues # instead. We're okay with using TODO to track minor cleanups for next time @@ -97,6 +98,11 @@ linters: # against idiomatic Go programming, which encourages this approach - e.g. # to scope errors. - noinlineerr + + # In golangci-lint v2.x, suggests replacing ptr.To(x) with new(x). This is + # a stylistic preference that would require broad changes across the codebase. + # We prefer ptr.To for clarity that we're creating a pointer. + - modernize settings: depguard: rules: From 918a7f143e8bc39bc809cc36487619d82b1bf709 Mon Sep 17 00:00:00 2001 From: Alper Rifat Ulucinar Date: Thu, 15 Oct 2026 20:31:32 +0000 Subject: [PATCH 5/5] fix(ci): scope golangci-lint v2.14.0 exclusions and use strings.Builder - Re-enable the modernize linter and disable only its newexpr analyzer, which suggests replacing ptr.To(x) with Go 1.26's new(x) across the codebase. - Fix the one remaining modernize finding (stringsbuilder) by building the joined string with strings.Builder instead of += in a loop. Output is unchanged. - Exclude goconst from test files, consistent with the other linters already excluded there; its v2.14.0 findings were all repeated test fixture strings. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Alper Rifat Ulucinar --- .golangci.yml | 11 ++++++----- transforms.go | 5 +++-- 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/.golangci.yml b/.golangci.yml index 501f75c..0ef44ae 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -98,11 +98,6 @@ linters: # against idiomatic Go programming, which encourages this approach - e.g. # to scope errors. - noinlineerr - - # In golangci-lint v2.x, suggests replacing ptr.To(x) with new(x). This is - # a stylistic preference that would require broad changes across the codebase. - # We prefer ptr.To for clarity that we're creating a pointer. - - modernize settings: depguard: rules: @@ -140,6 +135,11 @@ linters: max: 5 lll: tab-width: 1 + modernize: + disable: + # Go 1.26's new(expr) can replace ptr.To(x); adopting it is a broad + # style change we haven't decided on, so this check is off for now. + - newexpr nakedret: max-func-lines: 30 nolintlint: @@ -167,6 +167,7 @@ linters: - gochecknoglobals - gochecknoinits - gocognit + - goconst - gosec - scopelint - unparam diff --git a/transforms.go b/transforms.go index d22a894..791144b 100644 --- a/transforms.go +++ b/transforms.go @@ -371,10 +371,11 @@ func stringJoinTransform(input any, r v1beta1.StringTransformJoin) (string, erro return "", nil } - var result string + var b strings.Builder for _, v := range arr { - result += fmt.Sprintf("%v%s", v, r.Separator) + fmt.Fprintf(&b, "%v%s", v, r.Separator) } + result := b.String() if len(r.Separator) > 0 { return result[:len(result)-1], nil }