versions: Bump golang

[stevenhorsman]

Bump to go 1.21.8 to resolve CVEs:

• https://pkg.go.dev/vuln/GO-2024-2600
• https://pkg.go.dev/vuln/GO-2024-2599
• https://pkg.go.dev/vuln/GO-2024-2598
• https://pkg.go.dev/vuln/GO-2024-2610
• https://pkg.go.dev/vuln/GO-2024-2611

[liudalibj]

@stevenhorsman to fix the error from govulncheck for csi-wrapper please try follow

volumes/csi-wrapper
go get github.com/golang/protobuf@v1.5.4
go mod tidy

the output looks like:

go: downloading github.com/golang/protobuf v1.5.4
go: downloading google.golang.org/protobuf v1.33.0
go: module github.com/golang/protobuf is deprecated: Use the "google.golang.org/protobuf" module instead.
go: upgraded github.com/golang/protobuf v1.5.3 => v1.5.4
go: upgraded google.golang.org/protobuf v1.30.0 => v1.33.0

After this

cd ../../
make govulncheck
./hack/govulncheck.sh -v
Found the following Go modules:
  ./webhook
  ./peerpod-ctrl
  ./volumes/csi-wrapper
  .
  ./podvm
  ./peerpodconfig-ctrl

Excluded the following Go modules because they are gitignored:

Checking 6 Go modules:
  ./webhook
  ./peerpod-ctrl
  ./volumes/csi-wrapper
  .
  ./podvm
  ./peerpodconfig-ctrl

=============./webhook
Scanning your code and 587 packages across 70 dependent modules for known vulnerabilities...

=== Symbol Results ===

No vulnerabilities found.

Your code is affected by 0 vulnerabilities.
This scan also found 0 vulnerabilities in packages you import and 2
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.
Use '-show verbose' for more details.
=============./peerpod-ctrl
Scanning your code and 681 packages across 76 dependent modules for known vulnerabilities...

=== Symbol Results ===

No vulnerabilities found.

Your code is affected by 0 vulnerabilities.
This scan also found 1 vulnerability in packages you import and 5
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.
Use '-show verbose' for more details.
=============./volumes/csi-wrapper
Scanning your code and 466 packages across 52 dependent modules for known vulnerabilities...

No vulnerabilities found.
=============.
Scanning your code and 1054 packages across 145 dependent modules for known vulnerabilities...

=== Symbol Results ===

No vulnerabilities found.

Your code is affected by 0 vulnerabilities.
This scan also found 1 vulnerability in packages you import and 6
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.
Use '-show verbose' for more details.
=============./podvm
No packages matching the provided pattern.

No vulnerabilities found.
=============./peerpodconfig-ctrl
Scanning your code and 587 packages across 60 dependent modules for known vulnerabilities...

=== Symbol Results ===

No vulnerabilities found.

Your code is affected by 0 vulnerabilities.
This scan also found 0 vulnerabilities in packages you import and 1
vulnerability in modules you require, but your code doesn't appear to call these
vulnerabilities.
Use '-show verbose' for more details.

[stevenhorsman]

The golvuln is fixed now, but we are hitting typecheck errors in the linting check now, I guess due to differences in the package we've upgraded, so I'll dig into those more when I get a chance later.

[bpradipt]

/lgtm

[stevenhorsman]

@liudalibj - I wonder if you can help with the issues I'm seeing on this PR now. After doing your suggested changes the govuln is clean, but I get thousands of lint errors now as some of them are in the generated csi-wrapper code I tried re-running go mod vendor and ./examples/update-codegen.sh but they don't seem to make any difference. Do you have any ideas?

[liudalibj]

@liudalibj - I wonder if you can help with the issues I'm seeing on this PR now. After doing your suggested changes the govuln is clean, but I get thousands of lint errors now as some of them are in the generated csi-wrapper code I tried re-running go mod vendor and ./examples/update-codegen.sh but they don't seem to make any difference. Do you have any ideas?

I will take a look on this issue today.

[liudalibj]

LGTM.

[liudalibj]

@liudalibj - I wonder if you can help with the issues I'm seeing on this PR now. After doing your suggested changes the govuln is clean, but I get thousands of lint errors now as some of them are in the generated csi-wrapper code I tried re-running go mod vendor and ./examples/update-codegen.sh but they don't seem to make any difference. Do you have any ideas?

I will take a look on this issue today.

@stevenhorsman the lint issue is fixed by using the latest golint version 1.56.2, please double check and continue.

[stevenhorsman]

@stevenhorsman the lint issue is fixed by using the latest golint version 1.56.2, please double check and continue.

Thanks so much - I was obviously following red herrings looking at the generated code!