🌱 Bump Go 1.24

[sivchari]

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Part of #11642

/area dependency

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign justinsb for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sivchari]

Error: can't load config: the Go language version (go1.23) used to build golangci-lint is lower than the targeted Go version (1.24)
Failed executing command with error: can't load config: the Go language version (go1.23) used to build golangci-lint is lower than the targeted Go version (1.24)

We should merge #12088 at first since the golangci-lint version that Go1.24 is available is only golangci-lint v2.

[fabriziopandini]

/hold

We usually use the same go version used by K8s version we are importing, and we import the same K8s version used by the controller runtime version we are using.
(so most probably we should stick to go 1.23 until we bump to CR 0.21)

[sivchari]

Thanks!
Other PRs about dependency could be merged, when new CR is published.

[sbueringer]

I would like to do the CR bump. I'm usually using CAPI as a final verification for CR before the CR release is published. I will coordinate with you that this PR is merged right before.

Can you please rebase this PR?

[sivchari]

@sbueringer
rebased it.

EDIT
I'll take it later.

[sivchari]

usetesting is automatically enabled when Go 1.24 is used. This linter diagnose the calls that can be replaced by functions defined in testing package. e.g. os.Setenv -> testing.Setenv.
It is what I'm going to do after the migration to Go1.24 since the diff is very large. So I disable it once, then would tackle it later on another PR.

[sbueringer]

Sounds good! Maybe open a small issue to track it

[sivchari]

I opened #12179 👍

[sbueringer]

Thx!

[sivchari]

This failure is led by Go 1.24 since the go test run the vet implicitly before run test. Since 1.24, printf linter is called every time, then I disabled it on golanci.yml to deal with these issues on another PR. But it seems to deal with it too including with this PR.

[sivchari]

Okay, it works correctly 😄

[sivchari]

=== Symbol Results ===

Vulnerability #1: GO-2025-3563
    Request smuggling due to acceptance of invalid chunked data in net/http
  More info: https://pkg.go.dev/vuln/GO-2025-3563
  Standard library
    Found in: net/http/[email protected]
    Fixed in: net/http/[email protected]
    Example traces found:
      #1: cmd/clusterctl/client/repository/repository_gitlab.go:184:28: repository.gitLabRepository.GetFile calls io.ReadAll, which eventually calls internal.chunkedReader.Read

Your code is affected by 1 vulnerability from the Go standard library.
This scan found no other vulnerabilities in packages you import or modules you
require.
Use '-show verbose' for more details.
=== Symbol Results ===

No vulnerabilities found.

Your code is affected by 0 vulnerabilities.
This scan also found 1 vulnerability in packages you import and 0
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.
Use '-show verbose' for more details.
=== Symbol Results ===

Vulnerability #1: GO-2025-3563
    Request smuggling due to acceptance of invalid chunked data in net/http
  More info: https://pkg.go.dev/vuln/GO-2025-3563
  Standard library
    Found in: net/http/[email protected]
    Fixed in: net/http/[email protected]
    Example traces found:
      #1: infrastructure/container/docker.go:130:24: container.dockerRuntime.PullContainerImage calls io.ReadAll, which eventually calls internal.chunkedReader.Read

Your code is affected by 1 vulnerability from the Go standard library.
This scan found no other vulnerabilities in packages you import or modules you
require.
Use '-show verbose' for more details.
make: *** [verify-govulncheck] Error 1

We met the vulnerability, then I decide to upgrade from go1.24.0 to go1.24.2.

[sivchari]

/retest