Update go version and depedencies

Changes:
- Update go version to 1.24.6
- Update dependencies to mitigate CVEs
- Fix tests to work with broken APIs after update
- Remove/Replace deprecated methods
- Update Git command to ignore pre-commit hooks
- Update Go builder image to 1.24 in docker files and Openshift CI

Signed-off-by: Sayan Biswas <[email protected]>

Author: sayan-biswas

.ci-operator.yaml

@@ -1,4 +1,4 @@
 build_root_image:
   name: release
   namespace: openshift
-  tag: rhel-9-golang-1.23-openshift-4.19
+  tag: rhel-9-golang-1.24-openshift-4.20

.tekton/source-to-image-rhel8-pull-request.yaml

@@ -40,6 +40,10 @@ spec:
     value: "true"
   - name: run-unit-test
     value: "true"
+  - name: unit-test-base-image
+    value: registry.redhat.io/ubi9/go-toolset:1.24
+  - name: unit-test-command
+    value: make test
   - name: build-platforms
     value:
     - linux/x86_64
@@ -141,11 +145,11 @@ spec:
       - description: The command used to run the unit test
         name: unit-test-command
         type: string
-        default: make test
+        default: ""
       - description: The base image used to run the unit tests
         name: unit-test-base-image
         type: string
-        default: registry.redhat.io/ubi9/go-toolset:1.23
+        default: ""
       - default: docker
         description: The format for the resulting image's mediaType. Valid values are oci (default) or docker.
         name: buildah-format

.tekton/source-to-image-rhel8-push.yaml

@@ -37,6 +37,10 @@ spec:
     value: "true"
   - name: run-unit-test
     value: "true"
+  - name: unit-test-base-image
+    value: registry.redhat.io/ubi9/go-toolset:1.24
+  - name: unit-test-command
+    value: make test
   - name: build-platforms
     value:
     - linux/x86_64
@@ -140,11 +144,11 @@ spec:
       - description: The command used to run the unit test
         name: unit-test-command
         type: string
-        default: make test
+        default: ""
       - description: The base image used to run the unit tests
         name: unit-test-base-image
         type: string
-        default: registry.redhat.io/ubi9/go-toolset:1.23
+        default: ""
       - default: docker
         description: The format for the resulting image's mediaType. Valid values are oci (default) or docker.
         name: buildah-format

.tekton/source-to-image-rhel9-pull-request.yaml

@@ -40,6 +40,10 @@ spec:
     value: "true"
   - name: run-unit-test
     value: "true"
+  - name: unit-test-base-image
+    value: registry.redhat.io/ubi9/go-toolset:1.24
+  - name: unit-test-command
+    value: make test
   - name: build-platforms
     value:
     - linux/x86_64
@@ -141,11 +145,11 @@ spec:
       - description: The command used to run the unit test
         name: unit-test-command
         type: string
-        default: make test
+        default: ""
       - description: The base image used to run the unit tests
         name: unit-test-base-image
         type: string
-        default: registry.redhat.io/ubi9/go-toolset:1.23
+        default: ""
       - default: docker
         description: The format for the resulting image's mediaType. Valid values are oci (default) or docker.
         name: buildah-format

.tekton/source-to-image-rhel9-push.yaml

@@ -37,6 +37,10 @@ spec:
     value: "true"
   - name: run-unit-test
     value: "true"
+  - name: unit-test-base-image
+    value: registry.redhat.io/ubi9/go-toolset:1.24
+  - name: unit-test-command
+    value: make test
   - name: build-platforms
     value:
     - linux/x86_64
@@ -140,11 +144,11 @@ spec:
       - description: The command used to run the unit test
         name: unit-test-command
         type: string
-        default: make test
+        default: ""
       - description: The base image used to run the unit tests
         name: unit-test-base-image
         type: string
-        default: registry.redhat.io/ubi9/go-toolset:1.23
+        default: ""
       - default: docker
         description: The format for the resulting image's mediaType. Valid values are oci (default) or docker.
         name: buildah-format

.tekton/source-to-image-unit-test.yaml

@@ -19,7 +19,7 @@ spec:
     - description: The Go base image used to run the unit tests
       name: BASE_IMAGE
       type: string
-      default: registry.redhat.io/ubi9/go-toolset:1.23
+      default: registry.redhat.io/ubi9/go-toolset:1.24
   stepTemplate:
     volumeMounts:
       - mountPath: /var/workdir

go.mod

@@ -1,37 +1,36 @@
 module github.com/openshift/source-to-image
 
-go 1.23.3
-
-toolchain go1.23.9
+go 1.24.6
 
 require (
-	github.com/containers/image/v5 v5.35.0
+	github.com/containerd/errdefs v1.0.0
+	github.com/containers/image/v5 v5.36.2
 	github.com/distribution/reference v0.6.0
-	github.com/docker/docker v28.1.1+incompatible
-	github.com/docker/go-connections v0.5.0
+	github.com/docker/docker v28.5.2+incompatible
+	github.com/docker/go-connections v0.6.0
 	github.com/go-imports-organizer/goio v1.5.0
-	github.com/moby/buildkit v0.22.0
+	github.com/moby/buildkit v0.26.0
+	github.com/moby/docker-image-spec v1.3.1
 	github.com/opencontainers/image-spec v1.1.1
-	github.com/spf13/cobra v1.9.1
-	github.com/spf13/pflag v1.0.6
-	golang.org/x/net v0.40.0
+	github.com/spf13/cobra v1.10.1
+	github.com/spf13/pflag v1.0.10
+	golang.org/x/net v0.47.0
 	k8s.io/klog/v2 v2.130.1
 )
 
 require (
-	dario.cat/mergo v1.0.1 // indirect
+	dario.cat/mergo v1.0.2 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
 	github.com/BurntSushi/toml v1.5.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
-	github.com/Microsoft/hcsshim v0.12.9 // indirect
-	github.com/containerd/cgroups/v3 v3.0.5 // indirect
-	github.com/containerd/errdefs v1.0.0 // indirect
+	github.com/Microsoft/hcsshim v0.14.0-rc.1 // indirect
+	github.com/containerd/cgroups/v3 v3.1.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
-	github.com/containerd/stargz-snapshotter/estargz v0.16.3 // indirect
+	github.com/containerd/stargz-snapshotter/estargz v0.17.0 // indirect
 	github.com/containerd/typeurl/v2 v2.2.3 // indirect
 	github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01 // indirect
 	github.com/containers/ocicrypt v1.2.1 // indirect
-	github.com/containers/storage v1.58.0 // indirect
+	github.com/containers/storage v1.59.1 // indirect
 	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.9.3 // indirect
@@ -47,10 +46,9 @@ require (
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/klauspost/compress v1.18.0 // indirect
+	github.com/klauspost/compress v1.18.1 // indirect
 	github.com/klauspost/pgzip v1.2.6 // indirect
 	github.com/mistifyio/go-zfs/v3 v3.0.1 // indirect
-	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/sys/capability v0.4.0 // indirect
 	github.com/moby/sys/mountinfo v0.7.2 // indirect
 	github.com/moby/sys/user v0.4.0 // indirect
@@ -61,25 +59,25 @@ require (
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/runtime-spec v1.2.1 // indirect
 	github.com/opencontainers/selinux v1.12.0 // indirect
-	github.com/ostreedev/ostree-go v0.0.0-20210805093236-719684c64e4f // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/sylabs/sif/v2 v2.21.1 // indirect
-	github.com/tchap/go-patricia/v2 v2.3.2 // indirect
+	github.com/tchap/go-patricia/v2 v2.3.3 // indirect
 	github.com/ulikunitz/xz v0.5.12 // indirect
-	github.com/vbatts/tar-split v0.12.1 // indirect
+	github.com/vbatts/tar-split v0.12.2 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 // indirect
-	go.opentelemetry.io/otel v1.37.0 // indirect
-	go.opentelemetry.io/otel/metric v1.37.0 // indirect
-	go.opentelemetry.io/otel/trace v1.37.0 // indirect
-	golang.org/x/mod v0.24.0 // indirect
-	golang.org/x/sync v0.13.0 // indirect
-	golang.org/x/sys v0.33.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250313205543-e70fdf4c4cb4 // indirect
-	google.golang.org/grpc v1.71.0 // indirect
-	google.golang.org/protobuf v1.36.6 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
+	go.opentelemetry.io/otel v1.38.0 // indirect
+	go.opentelemetry.io/otel/metric v1.38.0 // indirect
+	go.opentelemetry.io/otel/trace v1.38.0 // indirect
+	golang.org/x/mod v0.29.0 // indirect
+	golang.org/x/sync v0.17.0 // indirect
+	golang.org/x/sys v0.38.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20251111163417-95abcf5c77ba // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20251103181224-f26f9409b101 // indirect
+	google.golang.org/grpc v1.76.0 // indirect
+	google.golang.org/protobuf v1.36.10 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )