- bump go 1.23

- all direct and transitive deps to latest ver
- introduce gosec and staticcheck in makefile
- gitignore ./vendor and go.sum as fetched externally
- update code to reflect the updates of version and sec/static scan (partially)

.github/workflows/build.yml

@@ -14,7 +14,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v4
         with:
-          go-version: 1.20.4
+          go-version: 1.23.0
       - name: Build Docker Image
         run: make push
         env:

.github/workflows/ci.yml

@@ -19,7 +19,7 @@ jobs:
       ## this will contain a matrix of all of the combinations
       ## we wish to test again:
       matrix:
-        go-version: [ 1.20.x ]
+        go-version: [ 1.23.x ]
         os: [ ubuntu-latest ]
     runs-on: ${{ matrix.os }}
     steps:

.github/workflows/release.yml

@@ -15,7 +15,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v4
         with:
-          go-version: 1.20.4
+          go-version: 1.23.0
       - uses: olegtarasov/[email protected]
         id: tagName
       - name: Release Docker Image

.gitignore

@@ -1,3 +1,7 @@
+# Vendor dir is pulled from 'go mod 'vendor'
+vendor/
+go.sum
+
 # Binaries for programs and plugins
 *.exe
 *.dll
@@ -24,3 +28,5 @@ kafka_exporter
 # Test configuration
 test/
 .DS_Store
+
+

Makefile

@@ -37,7 +37,7 @@ build: promu
 
 crossbuild: promu
 	@echo ">> crossbuilding binaries"
-	@$(PROMU) crossbuild --go=1.20
+	@$(PROMU) crossbuild --go=1.23
 
 tarball: promu
 	@echo ">> building release tarball"
@@ -101,6 +101,16 @@ lint: golangci-lint
       -E govet \
       -E errcheck
 
+# Run gosec security checks
+.PHONY: sec
+sec: gosec
+	@$(GOSEC) ./...
+
+# Run staticcheck
+.PHONY: staticcheck
+staticcheck: staticcheck-bin
+	@$(STATICCHECK) ./...
+
 # find or download golangci-lint
 # download golangci-lint if necessary
 golangci-lint:
@@ -113,4 +123,27 @@ else
 GOLANG_LINT=$(shell which golangci-lint)
 endif
 
-.PHONY: all style format build test vet tarball docker promu
+# Ensure gosec is installed
+gosec:
+ifeq (, $(shell which gosec))
+	@GOOS=$(shell uname -s | tr A-Z a-z) \
+    		GOARCH=$(subst x86_64,amd64,$(patsubst i%86,386,$(shell uname -m))) \
+    		$(GO) install github.com/securego/gosec/v2/cmd/gosec@latest
+GOSEC=$(shell go env GOPATH)/bin/gosec
+else
+GOSEC=$(shell which gosec)
+endif
+
+# Ensure staticcheck is installed
+staticcheck-bin:
+ifeq (, $(shell which staticcheck))
+	@GOOS=$(shell uname -s | tr A-Z a-z) \
+    		GOARCH=$(subst x86_64,amd64,$(patsubst i%86,386,$(shell uname -m))) \
+    		$(GO) install honnef.co/go/tools/cmd/staticcheck@latest
+STATICCHECK=$(shell go env GOPATH)/bin/staticcheck
+else
+STATICCHECK=$(shell which staticcheck)
+endif
+
+
+.PHONY: all style format build test vet tarball docker promu sec staticcheck

go.mod

@@ -1,52 +1,50 @@
 module github.com/danielqsj/kafka_exporter
 
-go 1.20
+go 1.23
 
 require (
-	github.com/Shopify/sarama v1.38.1
-	github.com/alecthomas/kingpin/v2 v2.3.2
-	github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 // indirect
+	github.com/IBM/sarama v1.43.3
+	github.com/alecthomas/kingpin/v2 v2.4.0
+	github.com/krallistic/kazoo-go v0.0.0-20170526135507-a15279744f4e
+	github.com/pkg/errors v0.9.1
+	github.com/prometheus/client_golang v1.20.0
+	github.com/prometheus/common v0.55.0
+	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475
+	github.com/xdg/scram v1.0.5
+	k8s.io/klog/v2 v2.130.1
+)
+
+require (
+	github.com/alecthomas/units v0.0.0-20240626203959-61d1e3462e30 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/eapache/go-resiliency v1.3.0 // indirect
-	github.com/eapache/go-xerial-snappy v0.0.0-20230111030713-bf00bc1b83b6 // indirect
+	github.com/eapache/go-resiliency v1.7.0 // indirect
+	github.com/eapache/go-xerial-snappy v0.0.0-20230731223053-c322873962e3 // indirect
 	github.com/eapache/queue v1.1.0 // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/go-kit/log v0.2.1 // indirect
+	github.com/go-logfmt/logfmt v0.6.0 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/jcmturner/aescts/v2 v2.0.0 // indirect
 	github.com/jcmturner/dnsutils/v2 v2.0.0 // indirect
 	github.com/jcmturner/gofork v1.7.6 // indirect
-	github.com/jcmturner/gokrb5/v8 v8.4.3 // indirect
+	github.com/jcmturner/gokrb5/v8 v8.4.4 // indirect
 	github.com/jcmturner/rpc/v2 v2.0.3 // indirect
-	github.com/klauspost/compress v1.15.14 // indirect
-	github.com/krallistic/kazoo-go v0.0.0-20170526135507-a15279744f4e
-	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
-	github.com/pkg/errors v0.9.1
-	github.com/prometheus/client_golang v1.15.1
-	github.com/prometheus/client_model v0.4.0 // indirect
-	github.com/prometheus/common v0.44.0
-	github.com/prometheus/procfs v0.9.0 // indirect
-	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475
-	github.com/samuel/go-zookeeper v0.0.0-20190923202752-2cc03de413da // indirect
-	github.com/xdg/scram v1.0.3
+	github.com/klauspost/compress v1.17.9 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/pierrec/lz4/v4 v4.1.21 // indirect
+	github.com/prometheus/client_model v0.6.1 // indirect
+	github.com/prometheus/procfs v0.15.1 // indirect
+	github.com/samuel/go-zookeeper v0.0.0-20201211165307-7117e9ea2414 // indirect
 	github.com/xdg/stringprep v1.0.3 // indirect
-	golang.org/x/crypto v0.21.0 // indirect
-	golang.org/x/net v0.23.0 // indirect
-	golang.org/x/sys v0.18.0 // indirect
-	golang.org/x/text v0.14.0 // indirect
-	google.golang.org/protobuf v1.33.0 // indirect
-)
-
-require k8s.io/klog/v2 v2.100.1
-
-require (
-	github.com/go-kit/log v0.2.1 // indirect
-	github.com/go-logfmt/logfmt v0.5.1 // indirect
-	github.com/go-logr/logr v1.2.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
-	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/pierrec/lz4/v4 v4.1.17 // indirect
 	github.com/xhit/go-str2duration/v2 v2.1.0 // indirect
+	golang.org/x/crypto v0.26.0 // indirect
+	golang.org/x/net v0.28.0 // indirect
+	golang.org/x/sys v0.24.0 // indirect
+	golang.org/x/text v0.17.0 // indirect
+	google.golang.org/protobuf v1.34.2 // indirect
 )