Update go to 1.26

.golangci.yml

@@ -95,6 +95,9 @@ linters:
     # against idiomatic Go programming, which encourages this approach - e.g.
     # to scope errors.
     - noinlineerr
+
+    # Deprecated and replaced by a new version, but still on by default.
+    - gomodguard
   settings:
     depguard:
       rules:

cmd/crossplane/common/package.go

@@ -1,2 +1,2 @@
 // Package common provides functions and helpers shared between CLI utilities, available for import by external tools interacting with Crossplane.
-package common //nolint:revive // TODO(adamwg): Move these packages into pkg/ or internal/.
+package common

cmd/crossplane/common/resource/xpkg/client_test.go

@@ -79,7 +79,7 @@ func TestGetDependencyRef(t *testing.T) {
 							APIVersion: "pkg.crossplane.io/v1",
 							Kind:       "Provider",
 							Name:       "my-awesome-provider",
-							Controller: ptr.To(true),
+							Controller: new(true),
 						},
 					})
 					return nil
@@ -291,7 +291,7 @@ func TestGetPackageDeps(t *testing.T) {
 									APIVersion: xpkgv1.ProviderGroupVersionKind.GroupVersion().String(),
 									Kind:       xpkgv1.ProviderKind,
 									Name:       "my-awesome-provider",
-									Controller: ptr.To(true),
+									Controller: new(true),
 								},
 							})
 						}
@@ -405,7 +405,7 @@ type dependencyOpts func(d *v1beta1.Dependency)
 
 func withPackageType(pkgType v1beta1.PackageType) dependencyOpts {
 	return func(d *v1beta1.Dependency) {
-		d.Type = ptr.To(pkgType)
+		d.Type = new(pkgType)
 	}
 }
 

cmd/crossplane/render/op/load.go

@@ -21,7 +21,6 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/util/yaml"
-	"k8s.io/utils/ptr"
 
 	"github.com/crossplane/crossplane-runtime/v2/pkg/errors"
 
@@ -98,10 +97,10 @@ func InjectWatchedResource(op *opsv1alpha1.Operation, watched *unstructured.Unst
 		RequirementName: opsv1alpha1.RequirementNameWatchedResource,
 		APIVersion:      watched.GetAPIVersion(),
 		Kind:            watched.GetKind(),
-		Name:            ptr.To(watched.GetName()),
+		Name:            new(watched.GetName()),
 	}
 	if watched.GetNamespace() != "" {
-		sel.Namespace = ptr.To(watched.GetNamespace())
+		sel.Namespace = new(watched.GetNamespace())
 	}
 
 	for i := range op.Spec.Pipeline {

cmd/crossplane/render/op/load_test.go

@@ -24,7 +24,6 @@ import (
 	"github.com/spf13/afero"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-	"k8s.io/utils/ptr"
 
 	opsv1alpha1 "github.com/crossplane/crossplane/apis/v2/ops/v1alpha1"
 )
@@ -367,7 +366,7 @@ func TestInjectWatchedResource(t *testing.T) {
 										RequirementName: opsv1alpha1.RequirementNameWatchedResource,
 										APIVersion:      "v1",
 										Kind:            "Node",
-										Name:            ptr.To("my-node"),
+										Name:            new("my-node"),
 									},
 								},
 							},

cmd/crossplane/render/xr/cmd.go

@@ -262,14 +262,6 @@ func (c *Cmd) Run(k *kong.Context, log logging.Logger) error { //nolint:gocognit
 		}
 	}
 
-	ers := []unstructured.Unstructured{}
-	if c.ExtraResources != "" {
-		ers, err = render.LoadRequiredResources(c.fs, c.ExtraResources)
-		if err != nil {
-			return errors.Wrapf(err, "cannot load extra resources from %q", c.ExtraResources)
-		}
-	}
-
 	rrs := []unstructured.Unstructured{}
 	if c.RequiredResources != "" {
 		rrs, err = render.LoadRequiredResources(c.fs, c.RequiredResources)
@@ -278,8 +270,15 @@ func (c *Cmd) Run(k *kong.Context, log logging.Logger) error { //nolint:gocognit
 		}
 	}
 
-	// Merge extra resources into required resources.
-	rrs = append(rrs, ers...)
+	if c.ExtraResources != "" {
+		ers, err := render.LoadRequiredResources(c.fs, c.ExtraResources)
+		if err != nil {
+			return errors.Wrapf(err, "cannot load extra resources from %q", c.ExtraResources)
+		}
+
+		// Merge extra resources into required resources.
+		rrs = append(rrs, ers...)
+	}
 
 	// Load required schemas
 	rsc := []spec3.OpenAPI{}

cmd/crossplane/trace/internal/printer/default.go

@@ -238,11 +238,11 @@ func (p *DefaultPrinter) printResourceTree(tw *tabwriter.Writer, root *resource.
 			childPrefix += "│  "
 		}
 
-		name.WriteString(fmt.Sprintf("%s/%s", item.resource.Unstructured.GetKind(), item.resource.Unstructured.GetName()))
+		fmt.Fprintf(&name, "%s/%s", item.resource.Unstructured.GetKind(), item.resource.Unstructured.GetName())
 
 		// Append the namespace if it's not empty
 		if item.resource.Unstructured.GetNamespace() != "" {
-			name.WriteString(fmt.Sprintf(" (%s)", item.resource.Unstructured.GetNamespace()))
+			fmt.Fprintf(&name, " (%s)", item.resource.Unstructured.GetNamespace())
 		}
 
 		var row fmt.Stringer

cmd/crossplane/validate/image.go

@@ -272,6 +272,7 @@ func extractPackageCRDs(layers []conregv1.Layer) ([][]byte, error) {
 	// Search for .yaml files in the "crds" directory
 	var yamlFiles [][]byte
 
+	//nolint:gosec // Traversing the temp dir is safe.
 	err = filepath.Walk(tmpDir, func(path string, info os.FileInfo, err error) error {
 		if err != nil {
 			return err

cmd/crossplane/validate/unknown_fields.go

@@ -30,13 +30,13 @@ func validateUnknownFields(mr map[string]any, sch *schema.Structural) field.Erro
 	opts := schema.UnknownFieldPathOptions{
 		TrackUnknownFieldPaths: true, // to get the list of pruned unknown fields
 	}
-	errs := field.ErrorList{}
 
 	uf := pruning.PruneWithOptions(mr, sch, true, opts)
-	for _, f := range uf {
+	errs := make(field.ErrorList, len(uf))
+	for i, f := range uf {
 		strPath := strings.Split(f, ".")
 		child := strPath[len(strPath)-1]
-		errs = append(errs, field.Invalid(field.NewPath(f), child, fmt.Sprintf("unknown field: \"%s\"", child)))
+		errs[i] = field.Invalid(field.NewPath(f), child, fmt.Sprintf("unknown field: \"%s\"", child))
 	}
 
 	return errs

cmd/crossplane/validate/validate_test.go

@@ -274,8 +274,8 @@ func TestConvertToCRDs(t *testing.T) {
 									APIVersion:         "apiextensions.crossplane.io/v1",
 									Kind:               "CompositeResourceDefinition",
 									Name:               "test",
-									Controller:         ptr.To[bool](true),
-									BlockOwnerDeletion: ptr.To[bool](true),
+									Controller:         new(true),
+									BlockOwnerDeletion: new(true),
 								},
 							},
 						},
@@ -449,7 +449,7 @@ func TestConvertToCRDs(t *testing.T) {
 																	Required: []string{"apiVersion", "kind"},
 																},
 															},
-															XListType: ptr.To("atomic"),
+															XListType: new("atomic"),
 														},
 														"writeConnectionSecretToRef": {
 															Type:     "object",
@@ -470,7 +470,7 @@ func TestConvertToCRDs(t *testing.T) {
 														"conditions": {
 															Description:  "Conditions of the resource.",
 															Type:         "array",
-															XListType:    ptr.To("map"),
+															XListType:    new("map"),
 															XListMapKeys: []string{"type"},
 															Items: &extv1.JSONSchemaPropsOrArray{
 																Schema: &extv1.JSONSchemaProps{
@@ -489,7 +489,7 @@ func TestConvertToCRDs(t *testing.T) {
 														},
 														"claimConditionTypes": {
 															Type:      "array",
-															XListType: ptr.To("set"),
+															XListType: new("set"),
 															Items: &extv1.JSONSchemaPropsOrArray{
 																Schema: &extv1.JSONSchemaProps{
 																	Type: "string",
@@ -582,8 +582,8 @@ func TestConvertToCRDs(t *testing.T) {
 									APIVersion:         "apiextensions.crossplane.io/v1",
 									Kind:               "CompositeResourceDefinition",
 									Name:               "test",
-									Controller:         ptr.To[bool](true),
-									BlockOwnerDeletion: ptr.To[bool](true),
+									Controller:         new(true),
+									BlockOwnerDeletion: new(true),
 								},
 							},
 						},
@@ -757,7 +757,7 @@ func TestConvertToCRDs(t *testing.T) {
 																	Required: []string{"apiVersion", "kind"},
 																},
 															},
-															XListType: ptr.To("atomic"),
+															XListType: new("atomic"),
 														},
 														"writeConnectionSecretToRef": {
 															Type:     "object",
@@ -778,7 +778,7 @@ func TestConvertToCRDs(t *testing.T) {
 														"conditions": {
 															Description:  "Conditions of the resource.",
 															Type:         "array",
-															XListType:    ptr.To("map"),
+															XListType:    new("map"),
 															XListMapKeys: []string{"type"},
 															Items: &extv1.JSONSchemaPropsOrArray{
 																Schema: &extv1.JSONSchemaProps{
@@ -797,7 +797,7 @@ func TestConvertToCRDs(t *testing.T) {
 														},
 														"claimConditionTypes": {
 															Type:      "array",
-															XListType: ptr.To("set"),
+															XListType: new("set"),
 															Items: &extv1.JSONSchemaPropsOrArray{
 																Schema: &extv1.JSONSchemaProps{
 																	Type: "string",
@@ -827,8 +827,8 @@ func TestConvertToCRDs(t *testing.T) {
 									APIVersion:         "apiextensions.crossplane.io/v1",
 									Kind:               "CompositeResourceDefinition",
 									Name:               "test",
-									Controller:         ptr.To[bool](true),
-									BlockOwnerDeletion: ptr.To[bool](true),
+									Controller:         new(true),
+									BlockOwnerDeletion: new(true),
 								},
 							},
 						},
@@ -994,7 +994,7 @@ func TestConvertToCRDs(t *testing.T) {
 														"conditions": {
 															Description:  "Conditions of the resource.",
 															Type:         "array",
-															XListType:    ptr.To("map"),
+															XListType:    new("map"),
 															XListMapKeys: []string{"type"},
 															Items: &extv1.JSONSchemaPropsOrArray{
 																Schema: &extv1.JSONSchemaProps{
@@ -1013,7 +1013,7 @@ func TestConvertToCRDs(t *testing.T) {
 														},
 														"claimConditionTypes": {
 															Type:      "array",
-															XListType: ptr.To("set"),
+															XListType: new("set"),
 															Items: &extv1.JSONSchemaPropsOrArray{
 																Schema: &extv1.JSONSchemaProps{
 																	Type: "string",

cmd/crossplane/xpkg/build.go

@@ -172,15 +172,11 @@ func (c *buildCmd) GetOutputFileName(meta runtime.Object, hash v1.Hash) (string,
 
 // Run executes the build command.
 func (c *buildCmd) Run(logger logging.Logger) error {
-	var buildOpts []xpkg.BuildOpt
-
-	rtBuildOpts, err := c.GetRuntimeBaseImageOpts()
+	buildOpts, err := c.GetRuntimeBaseImageOpts()
 	if err != nil {
 		return errors.Wrap(err, errGetRuntimeBaseImageOpts)
 	}
 
-	buildOpts = append(buildOpts, rtBuildOpts...)
-
 	img, meta, err := c.builder.Build(context.Background(), buildOpts...)
 	if err != nil {
 		return errors.Wrap(err, errBuildPackage)

cmd/crossplane/xpkg/init.go

@@ -97,7 +97,7 @@ Examples:
 
 	b := strings.Builder{}
 	for name, url := range WellKnownTemplates() {
-		b.WriteString(fmt.Sprintf(" - %s (%s)\n", name, url))
+		fmt.Fprintf(&b, " - %s (%s)\n", name, url)
 	}
 
 	return fmt.Sprintf(tpl, b.String())
@@ -250,6 +250,7 @@ func printFile(w io.Writer, path string) error {
 }
 
 func runScript(k *kong.Context, scriptFile string, args ...string) error {
+	//nolint:gosec // User confirmed before running the script.
 	cmd := exec.CommandContext(context.Background(), scriptFile, args...)
 	cmd.Stdout = k.Stdout
 	cmd.Stderr = k.Stderr

cmd/crossplane/xpkg/template_funcs.go

@@ -47,6 +47,7 @@ func dict(pairs ...any) (map[string]any, error) {
 		if !ok {
 			return nil, errors.Errorf("dict: argument %d must be a string key", i)
 		}
+		//nolint:gosec // Guaranteed safe by len(pairs)%2 check above.
 		out[ks] = pairs[i+1]
 	}
 	return out, nil

flake.nix

@@ -88,13 +88,12 @@
             inherit system;
             overlays = [
               gomod2nix.overlays.default
-              (_final: _prev: {
-                # We use the go toolchain from unstable because it's been
-                # updated to fix some CVEs. However, we explicitly use this only
-                # in our build targets rather than replace Go in the global
-                # overlay so that we can still use pre-built binaries for
-                # Go-based tools from nixpkgs.
-                go-unstable = nixpkgs-unstable.legacyPackages.${system}.go_1_25;
+              (_final: prev: {
+                # Allow use of pkgs.unstable.<package-name> to pull individual
+                # packages from nixpkgs-unstable.
+                unstable = import nixpkgs-unstable {
+                  inherit (prev.stdenv.hostPlatform) system;
+                };
               })
             ];
           };
@@ -164,8 +163,8 @@
               pkgs.coreutils
               pkgs.gnused
               pkgs.ncurses
-              pkgs.go-unstable
-              pkgs.golangci-lint
+              pkgs.unstable.go_1_26
+              pkgs.unstable.golangci-lint
               pkgs.kubectl
               pkgs.kind
               pkgs.docker-client

go.mod

@@ -1,6 +1,6 @@
 module github.com/crossplane/cli/v2
 
-go 1.25.9
+go 1.26.0
 
 require (
 	dario.cat/mergo v1.0.2