Security: Update to Go 1.23.5 - Backport to v11.4.x (#99123)

* feat: update to Go 1.23.5 * chore: make drone * fix: update in Makefile * CI: Force re-build * build: update mariadb connection The new Alpine base that the Golang images are built on no longer trust the CA of MySQL. This is a backport of: https://github.com/grafana/grafana/pull/98857 * chore: go mod tidy
6 months ago · 86bb6dd4b1
parent 7b5235f06d
commit 86bb6dd4b1
8 changed files with 145 additions and 151 deletions
--- a/.drone.yml
+++ b/.drone.yml
@ -25,7 +25,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: compile-build-cmd
 - commands:
  - ./bin/build verify-drone
@ -75,7 +75,7 @@ steps:
  - go install github.com/bazelbuild/buildtools/buildifier@latest
  - buildifier --lint=warn -mode=check -r .
  depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: lint-starlark
 trigger:
  event:
@ -424,7 +424,7 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-cue
  depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: verify-gen-cue
 - commands:
  - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@ -433,21 +433,21 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-jsonnet
  depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: verify-gen-jsonnet
 - commands:
  - apk add --update make
  - make gen-go
  depends_on:
  - verify-gen-cue
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: wire-install
 - commands:
  - apk add --update build-base shared-mime-info shared-mime-info-lang
  - go list -f '{{.Dir}}/...' -m  | xargs go test -short -covermode=atomic -timeout=5m
  depends_on:
  - wire-install
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: test-backend
 - commands:
  - apk add --update build-base
@ -456,7 +456,7 @@ steps:
    | grep -o '\(.*\)/' | sort -u)
  depends_on:
  - wire-install
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: test-backend-integration
 trigger:
  event:
@ -510,7 +510,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: compile-build-cmd
 - commands:
  - echo $(/usr/bin/github-app-external-token) > /github-app/token
@ -554,16 +554,16 @@ steps:
  - apk add --update make
  - make gen-go
  depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: wire-install
 - commands:
  - go run scripts/modowners/modowners.go check go.mod
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: validate-modfile
 - commands:
  - apk add --update make
  - make swagger-validate
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: validate-openapi-spec
 trigger:
  event:
@ -638,7 +638,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: compile-build-cmd
 - commands:
  - '# It is required that code generated from Thema/CUE be committed and in sync
@ -648,7 +648,7 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-cue
  depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: verify-gen-cue
 - commands:
  - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@ -657,7 +657,7 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-jsonnet
  depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: verify-gen-jsonnet
 - commands:
  - yarn install --immutable || yarn install --immutable
@ -693,7 +693,7 @@ steps:
  - /src/grafana-build artifacts -a targz:grafana:linux/amd64 -a targz:grafana:linux/arm64
    -a targz:grafana:linux/arm/v7 -a docker:grafana:linux/amd64 -a docker:grafana:linux/amd64:ubuntu
    -a docker:grafana:linux/arm64 -a docker:grafana:linux/arm64:ubuntu -a docker:grafana:linux/arm/v7
-    -a docker:grafana:linux/arm/v7:ubuntu --go-version=1.23.1 --yarn-cache=$$YARN_CACHE_FOLDER
+    -a docker:grafana:linux/arm/v7:ubuntu --go-version=1.23.5 --yarn-cache=$$YARN_CACHE_FOLDER
    --build-id=$$DRONE_BUILD_NUMBER --ubuntu-base=ubuntu:22.04 --alpine-base=alpine:3.20.3
    --tag-format='{{ .version_base }}-{{ .buildID }}-{{ .arch }}' --ubuntu-tag-format='{{
    .version_base }}-{{ .buildID }}-ubuntu-{{ .arch }}' --verify='false' --grafana-dir=$$PWD
@ -1101,7 +1101,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: compile-build-cmd
 - commands:
  - echo $DRONE_RUNNER_NAME
@ -1115,7 +1115,7 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-cue
  depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: verify-gen-cue
 - commands:
  - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@ -1124,14 +1124,14 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-jsonnet
  depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: verify-gen-jsonnet
 - commands:
  - apk add --update make
  - make gen-go
  depends_on:
  - verify-gen-cue
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: wire-install
 - commands:
  - dockerize -wait tcp://postgres:5432 -timeout 120s
@ -1152,7 +1152,7 @@ steps:
    GRAFANA_TEST_DB: postgres
    PGPASSWORD: grafanatest
    POSTGRES_HOST: postgres
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: postgres-integration-tests
 - commands:
  - dockerize -wait tcp://mysql57:3306 -timeout 120s
@ -1160,9 +1160,9 @@ steps:
  name: wait-for-mysql-5.7
 - commands:
  - apk add --update build-base
-  - apk add --update mysql-client
-  - cat devenv/docker/blocks/mysql_tests/setup.sql | mysql -h mysql57 -P 3306 -u root
-    -prootpass
+  - apk add --update mariadb-client
+  - cat devenv/docker/blocks/mysql_tests/setup.sql | mariadb -h mysql57 -P 3306 -u
+    root -prootpass --disable-ssl-verify-server-cert
  - go clean -testcache
  - go test -p=1 -count=1 -covermode=atomic -timeout=5m -run '^TestIntegration' $(find
    ./pkg -type f -name '*_test.go' -exec grep -l '^func TestIntegration' '{}' '+'
@ -1173,7 +1173,7 @@ steps:
  environment:
    GRAFANA_TEST_DB: mysql
    MYSQL_HOST: mysql57
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: mysql-5.7-integration-tests
 - commands:
  - dockerize -wait tcp://mysql80:3306 -timeout 120s
@ -1181,9 +1181,9 @@ steps:
  name: wait-for-mysql-8.0
 - commands:
  - apk add --update build-base
-  - apk add --update mysql-client
-  - cat devenv/docker/blocks/mysql_tests/setup.sql | mysql -h mysql80 -P 3306 -u root
-    -prootpass
+  - apk add --update mariadb-client
+  - cat devenv/docker/blocks/mysql_tests/setup.sql | mariadb -h mysql80 -P 3306 -u
+    root -prootpass --disable-ssl-verify-server-cert
  - go clean -testcache
  - go test -p=1 -count=1 -covermode=atomic -timeout=5m -run '^TestIntegration' $(find
    ./pkg -type f -name '*_test.go' -exec grep -l '^func TestIntegration' '{}' '+'
@ -1194,7 +1194,7 @@ steps:
  environment:
    GRAFANA_TEST_DB: mysql
    MYSQL_HOST: mysql80
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: mysql-8.0-integration-tests
 - commands:
  - dockerize -wait tcp://redis:6379 -timeout 120s
@ -1210,7 +1210,7 @@ steps:
  - wait-for-redis
  environment:
    REDIS_URL: redis://redis:6379/0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: redis-integration-tests
 - commands:
  - dockerize -wait tcp://memcached:11211 -timeout 120s
@ -1226,7 +1226,7 @@ steps:
  - wait-for-memcached
  environment:
    MEMCACHED_HOSTS: memcached:11211
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: memcached-integration-tests
 - commands:
  - dockerize -wait tcp://mimir_backend:8080 -timeout 120s
@ -1243,7 +1243,7 @@ steps:
    AM_TENANT_ID: test
    AM_URL: http://mimir_backend:8080
  failure: ignore
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: remote-alertmanager-integration-tests
 trigger:
  event:
@ -1333,7 +1333,7 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-cue
  depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: verify-gen-cue
 trigger:
  event:
@ -1453,7 +1453,7 @@ steps:
    && return 1; fi
  depends_on:
  - clone-enterprise
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: swagger-gen
 trigger:
  event:
@ -1568,7 +1568,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: compile-build-cmd
 - commands:
  - '# It is required that code generated from Thema/CUE be committed and in sync
@ -1579,7 +1579,7 @@ steps:
  - CODEGEN_VERIFY=1 make gen-cue
  depends_on:
  - clone-enterprise
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: verify-gen-cue
 - commands:
  - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@ -1589,14 +1589,14 @@ steps:
  - CODEGEN_VERIFY=1 make gen-jsonnet
  depends_on:
  - clone-enterprise
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: verify-gen-jsonnet
 - commands:
  - apk add --update make
  - make gen-go
  depends_on:
  - verify-gen-cue
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: wire-install
 - commands:
  - apk add --update build-base
@ -1604,7 +1604,7 @@ steps:
  - go test -v -run=^$ -benchmem -timeout=1h -count=8 -bench=. ${GO_PACKAGES}
  depends_on:
  - wire-install
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: sqlite-benchmark-integration-tests
 - commands:
  - apk add --update build-base
@ -1616,7 +1616,7 @@ steps:
    GRAFANA_TEST_DB: postgres
    PGPASSWORD: grafanatest
    POSTGRES_HOST: postgres
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: postgres-benchmark-integration-tests
 - commands:
  - apk add --update build-base
@ -1627,7 +1627,7 @@ steps:
  environment:
    GRAFANA_TEST_DB: mysql
    MYSQL_HOST: mysql57
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: mysql-5.7-benchmark-integration-tests
 - commands:
  - apk add --update build-base
@ -1638,7 +1638,7 @@ steps:
  environment:
    GRAFANA_TEST_DB: mysql
    MYSQL_HOST: mysql80
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: mysql-8.0-benchmark-integration-tests
 trigger:
  event:
@ -1718,7 +1718,7 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-cue
  depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: verify-gen-cue
 trigger:
  branch: main
@ -1891,7 +1891,7 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-cue
  depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: verify-gen-cue
 - commands:
  - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@ -1900,21 +1900,21 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-jsonnet
  depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: verify-gen-jsonnet
 - commands:
  - apk add --update make
  - make gen-go
  depends_on:
  - verify-gen-cue
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: wire-install
 - commands:
  - apk add --update build-base shared-mime-info shared-mime-info-lang
  - go list -f '{{.Dir}}/...' -m  | xargs go test -short -covermode=atomic -timeout=5m
  depends_on:
  - wire-install
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: test-backend
 - commands:
  - apk add --update build-base
@ -1923,7 +1923,7 @@ steps:
    | grep -o '\(.*\)/' | sort -u)
  depends_on:
  - wire-install
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: test-backend-integration
 trigger:
  branch: main
@ -1968,22 +1968,22 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: compile-build-cmd
 - commands:
  - apk add --update make
  - make gen-go
  depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: wire-install
 - commands:
  - go run scripts/modowners/modowners.go check go.mod
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: validate-modfile
 - commands:
  - apk add --update make
  - make swagger-validate
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: validate-openapi-spec
 - commands:
  - ./bin/build verify-drone
@ -2114,7 +2114,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: compile-build-cmd
 - commands:
  - '# It is required that code generated from Thema/CUE be committed and in sync
@ -2124,7 +2124,7 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-cue
  depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: verify-gen-cue
 - commands:
  - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@ -2133,7 +2133,7 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-jsonnet
  depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: verify-gen-jsonnet
 - commands:
  - yarn install --immutable || yarn install --immutable
@ -2168,7 +2168,7 @@ steps:
  - /src/grafana-build artifacts -a targz:grafana:linux/amd64 -a targz:grafana:linux/arm64
    -a targz:grafana:linux/arm/v7 -a docker:grafana:linux/amd64 -a docker:grafana:linux/amd64:ubuntu
    -a docker:grafana:linux/arm64 -a docker:grafana:linux/arm64:ubuntu -a docker:grafana:linux/arm/v7
-    -a docker:grafana:linux/arm/v7:ubuntu --go-version=1.23.1 --yarn-cache=$$YARN_CACHE_FOLDER
+    -a docker:grafana:linux/arm/v7:ubuntu --go-version=1.23.5 --yarn-cache=$$YARN_CACHE_FOLDER
    --build-id=$$DRONE_BUILD_NUMBER --ubuntu-base=ubuntu:22.04 --alpine-base=alpine:3.20.3
    --tag-format='{{ .version_base }}-{{ .buildID }}-{{ .arch }}' --ubuntu-tag-format='{{
    .version_base }}-{{ .buildID }}-ubuntu-{{ .arch }}' --verify='false' --grafana-dir=$$PWD
@ -2654,7 +2654,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: compile-build-cmd
 - commands:
  - echo $DRONE_RUNNER_NAME
@ -2668,7 +2668,7 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-cue
  depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: verify-gen-cue
 - commands:
  - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@ -2677,14 +2677,14 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-jsonnet
  depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: verify-gen-jsonnet
 - commands:
  - apk add --update make
  - make gen-go
  depends_on:
  - verify-gen-cue
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: wire-install
 - commands:
  - dockerize -wait tcp://postgres:5432 -timeout 120s
@ -2705,7 +2705,7 @@ steps:
    GRAFANA_TEST_DB: postgres
    PGPASSWORD: grafanatest
    POSTGRES_HOST: postgres
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: postgres-integration-tests
 - commands:
  - dockerize -wait tcp://mysql57:3306 -timeout 120s
@ -2713,9 +2713,9 @@ steps:
  name: wait-for-mysql-5.7
 - commands:
  - apk add --update build-base
-  - apk add --update mysql-client
-  - cat devenv/docker/blocks/mysql_tests/setup.sql | mysql -h mysql57 -P 3306 -u root
-    -prootpass
+  - apk add --update mariadb-client
+  - cat devenv/docker/blocks/mysql_tests/setup.sql | mariadb -h mysql57 -P 3306 -u
+    root -prootpass --disable-ssl-verify-server-cert
  - go clean -testcache
  - go test -p=1 -count=1 -covermode=atomic -timeout=5m -run '^TestIntegration' $(find
    ./pkg -type f -name '*_test.go' -exec grep -l '^func TestIntegration' '{}' '+'
@ -2726,7 +2726,7 @@ steps:
  environment:
    GRAFANA_TEST_DB: mysql
    MYSQL_HOST: mysql57
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: mysql-5.7-integration-tests
 - commands:
  - dockerize -wait tcp://mysql80:3306 -timeout 120s
@ -2734,9 +2734,9 @@ steps:
  name: wait-for-mysql-8.0
 - commands:
  - apk add --update build-base
-  - apk add --update mysql-client
-  - cat devenv/docker/blocks/mysql_tests/setup.sql | mysql -h mysql80 -P 3306 -u root
-    -prootpass
+  - apk add --update mariadb-client
+  - cat devenv/docker/blocks/mysql_tests/setup.sql | mariadb -h mysql80 -P 3306 -u
+    root -prootpass --disable-ssl-verify-server-cert
  - go clean -testcache
  - go test -p=1 -count=1 -covermode=atomic -timeout=5m -run '^TestIntegration' $(find
    ./pkg -type f -name '*_test.go' -exec grep -l '^func TestIntegration' '{}' '+'
@ -2747,7 +2747,7 @@ steps:
  environment:
    GRAFANA_TEST_DB: mysql
    MYSQL_HOST: mysql80
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: mysql-8.0-integration-tests
 - commands:
  - dockerize -wait tcp://redis:6379 -timeout 120s
@ -2763,7 +2763,7 @@ steps:
  - wait-for-redis
  environment:
    REDIS_URL: redis://redis:6379/0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: redis-integration-tests
 - commands:
  - dockerize -wait tcp://memcached:11211 -timeout 120s
@ -2779,7 +2779,7 @@ steps:
  - wait-for-memcached
  environment:
    MEMCACHED_HOSTS: memcached:11211
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: memcached-integration-tests
 - commands:
  - dockerize -wait tcp://mimir_backend:8080 -timeout 120s
@ -2796,7 +2796,7 @@ steps:
    AM_TENANT_ID: test
    AM_URL: http://mimir_backend:8080
  failure: ignore
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: remote-alertmanager-integration-tests
 trigger:
  branch: main
@ -3058,7 +3058,7 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-cue
  depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: verify-gen-cue
 - commands:
  - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@ -3067,21 +3067,21 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-jsonnet
  depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: verify-gen-jsonnet
 - commands:
  - apk add --update make
  - make gen-go
  depends_on:
  - verify-gen-cue
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: wire-install
 - commands:
  - apk add --update build-base shared-mime-info shared-mime-info-lang
  - go list -f '{{.Dir}}/...' -m  | xargs go test -short -covermode=atomic -timeout=5m
  depends_on:
  - wire-install
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: test-backend
 - commands:
  - apk add --update build-base
@ -3090,7 +3090,7 @@ steps:
    | grep -o '\(.*\)/' | sort -u)
  depends_on:
  - wire-install
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: test-backend-integration
 trigger:
  branch:
@ -3133,22 +3133,22 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: compile-build-cmd
 - commands:
  - apk add --update make
  - make gen-go
  depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: wire-install
 - commands:
  - go run scripts/modowners/modowners.go check go.mod
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: validate-modfile
 - commands:
  - apk add --update make
  - make swagger-validate
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: validate-openapi-spec
 trigger:
  branch:
@ -3238,7 +3238,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: compile-build-cmd
 - commands:
  - echo $DRONE_RUNNER_NAME
@ -3252,7 +3252,7 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-cue
  depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: verify-gen-cue
 - commands:
  - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@ -3261,14 +3261,14 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-jsonnet
  depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: verify-gen-jsonnet
 - commands:
  - apk add --update make
  - make gen-go
  depends_on:
  - verify-gen-cue
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: wire-install
 - commands:
  - dockerize -wait tcp://postgres:5432 -timeout 120s
@ -3289,7 +3289,7 @@ steps:
    GRAFANA_TEST_DB: postgres
    PGPASSWORD: grafanatest
    POSTGRES_HOST: postgres
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: postgres-integration-tests
 - commands:
  - dockerize -wait tcp://mysql57:3306 -timeout 120s
@ -3297,9 +3297,9 @@ steps:
  name: wait-for-mysql-5.7
 - commands:
  - apk add --update build-base
-  - apk add --update mysql-client
-  - cat devenv/docker/blocks/mysql_tests/setup.sql | mysql -h mysql57 -P 3306 -u root
-    -prootpass
+  - apk add --update mariadb-client
+  - cat devenv/docker/blocks/mysql_tests/setup.sql | mariadb -h mysql57 -P 3306 -u
+    root -prootpass --disable-ssl-verify-server-cert
  - go clean -testcache
  - go test -p=1 -count=1 -covermode=atomic -timeout=5m -run '^TestIntegration' $(find
    ./pkg -type f -name '*_test.go' -exec grep -l '^func TestIntegration' '{}' '+'
@ -3310,7 +3310,7 @@ steps:
  environment:
    GRAFANA_TEST_DB: mysql
    MYSQL_HOST: mysql57
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: mysql-5.7-integration-tests
 - commands:
  - dockerize -wait tcp://mysql80:3306 -timeout 120s
@ -3318,9 +3318,9 @@ steps:
  name: wait-for-mysql-8.0
 - commands:
  - apk add --update build-base
-  - apk add --update mysql-client
-  - cat devenv/docker/blocks/mysql_tests/setup.sql | mysql -h mysql80 -P 3306 -u root
-    -prootpass
+  - apk add --update mariadb-client
+  - cat devenv/docker/blocks/mysql_tests/setup.sql | mariadb -h mysql80 -P 3306 -u
+    root -prootpass --disable-ssl-verify-server-cert
  - go clean -testcache
  - go test -p=1 -count=1 -covermode=atomic -timeout=5m -run '^TestIntegration' $(find
    ./pkg -type f -name '*_test.go' -exec grep -l '^func TestIntegration' '{}' '+'
@ -3331,7 +3331,7 @@ steps:
  environment:
    GRAFANA_TEST_DB: mysql
    MYSQL_HOST: mysql80
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: mysql-8.0-integration-tests
 - commands:
  - dockerize -wait tcp://redis:6379 -timeout 120s
@ -3347,7 +3347,7 @@ steps:
  - wait-for-redis
  environment:
    REDIS_URL: redis://redis:6379/0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: redis-integration-tests
 - commands:
  - dockerize -wait tcp://memcached:11211 -timeout 120s
@ -3363,7 +3363,7 @@ steps:
  - wait-for-memcached
  environment:
    MEMCACHED_HOSTS: memcached:11211
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: memcached-integration-tests
 - commands:
  - dockerize -wait tcp://mimir_backend:8080 -timeout 120s
@ -3380,7 +3380,7 @@ steps:
    AM_TENANT_ID: test
    AM_URL: http://mimir_backend:8080
  failure: ignore
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: remote-alertmanager-integration-tests
 trigger:
  branch:
@ -3483,7 +3483,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: compile-build-cmd
 - commands:
  - ./bin/build artifacts docker fetch --edition oss
@ -3615,7 +3615,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: compile-build-cmd
 - commands:
  - ./bin/build artifacts docker fetch --edition oss
@ -3756,7 +3756,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: compile-build-cmd
 - commands:
  - ./bin/build artifacts packages --artifacts-editions=oss --tag $${DRONE_TAG} --src-bucket
@ -3847,7 +3847,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: compile-build-cmd
 - commands:
  - yarn install --immutable || yarn install --immutable
@ -3947,7 +3947,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: compile-build-cmd
 - depends_on:
  - compile-build-cmd
@ -4044,7 +4044,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: compile-build-cmd
 - commands:
  - ./bin/build publish grafana-com --edition oss ${DRONE_TAG}
@ -4106,7 +4106,7 @@ steps:
      from_secret: grafana_api_key
    GCP_KEY_BASE64:
      from_secret: gcp_key_base64
-    GO_VERSION: 1.23.1
+    GO_VERSION: 1.23.5
    GPG_PASSPHRASE:
      from_secret: packages_gpg_passphrase
    GPG_PRIVATE_KEY:
@ -4181,7 +4181,7 @@ steps:
      from_secret: grafana_api_key
    GCP_KEY_BASE64:
      from_secret: gcp_key_base64
-    GO_VERSION: 1.23.1
+    GO_VERSION: 1.23.5
    GPG_PASSPHRASE:
      from_secret: packages_gpg_passphrase
    GPG_PRIVATE_KEY:
@ -4238,13 +4238,13 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: compile-build-cmd
 - commands:
  - ./bin/build whatsnew-checker
  depends_on:
  - compile-build-cmd
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: whats-new-checker
 trigger:
  event:
@ -4343,7 +4343,7 @@ steps:
      from_secret: grafana_api_key
    GCP_KEY_BASE64:
      from_secret: gcp_key_base64
-    GO_VERSION: 1.23.1
+    GO_VERSION: 1.23.5
    GPG_PASSPHRASE:
      from_secret: packages_gpg_passphrase
    GPG_PRIVATE_KEY:
@ -4494,7 +4494,7 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-cue
  depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: verify-gen-cue
 - commands:
  - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@ -4503,21 +4503,21 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-jsonnet
  depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: verify-gen-jsonnet
 - commands:
  - apk add --update make
  - make gen-go
  depends_on:
  - verify-gen-cue
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: wire-install
 - commands:
  - apk add --update build-base shared-mime-info shared-mime-info-lang
  - go list -f '{{.Dir}}/...' -m  | xargs go test -short -covermode=atomic -timeout=5m
  depends_on:
  - wire-install
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: test-backend
 - commands:
  - apk add --update build-base
@ -4526,7 +4526,7 @@ steps:
    | grep -o '\(.*\)/' | sort -u)
  depends_on:
  - wire-install
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: test-backend-integration
 trigger:
  cron:
@ -4580,7 +4580,7 @@ steps:
      from_secret: grafana_api_key
    GCP_KEY_BASE64:
      from_secret: gcp_key_base64
-    GO_VERSION: 1.23.1
+    GO_VERSION: 1.23.5
    GPG_PASSPHRASE:
      from_secret: packages_gpg_passphrase
    GPG_PRIVATE_KEY:
@ -4724,7 +4724,7 @@ steps:
      from_secret: grafana_api_key
    GCP_KEY_BASE64:
      from_secret: gcp_key_base64
-    GO_VERSION: 1.23.1
+    GO_VERSION: 1.23.5
    GPG_PASSPHRASE:
      from_secret: packages_gpg_passphrase
    GPG_PRIVATE_KEY:
@ -4830,7 +4830,7 @@ steps:
  - export GITHUB_TOKEN=$(cat /github-app/token)
  - 'dagger run --silent /src/grafana-build artifacts -a $${ARTIFACTS} --grafana-ref=$${GRAFANA_REF}
    --enterprise-ref=$${ENTERPRISE_REF} --grafana-repo=$${GRAFANA_REPO} --version=$${VERSION} '
-  - --go-version=1.23.1
+  - --go-version=1.23.5
  depends_on:
  - github-app-generate-token
  environment:
@ -4851,7 +4851,7 @@ steps:
      from_secret: grafana_api_key
    GCP_KEY_BASE64:
      from_secret: gcp_key_base64
-    GO_VERSION: 1.23.1
+    GO_VERSION: 1.23.5
    GPG_PASSPHRASE:
      from_secret: packages_gpg_passphrase
    GPG_PRIVATE_KEY:
@ -4996,7 +4996,7 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-cue
  depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: verify-gen-cue
 - commands:
  - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@ -5005,14 +5005,14 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-jsonnet
  depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: verify-gen-jsonnet
 - commands:
  - apk add --update make
  - make gen-go
  depends_on:
  - verify-gen-cue
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: wire-install
 - commands:
  - dockerize -wait tcp://postgres:5432 -timeout 120s
@ -5033,7 +5033,7 @@ steps:
    GRAFANA_TEST_DB: postgres
    PGPASSWORD: grafanatest
    POSTGRES_HOST: postgres
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: postgres-integration-tests
 - commands:
  - dockerize -wait tcp://mysql57:3306 -timeout 120s
@ -5041,9 +5041,9 @@ steps:
  name: wait-for-mysql-5.7
 - commands:
  - apk add --update build-base
-  - apk add --update mysql-client
-  - cat devenv/docker/blocks/mysql_tests/setup.sql | mysql -h mysql57 -P 3306 -u root
-    -prootpass
+  - apk add --update mariadb-client
+  - cat devenv/docker/blocks/mysql_tests/setup.sql | mariadb -h mysql57 -P 3306 -u
+    root -prootpass --disable-ssl-verify-server-cert
  - go clean -testcache
  - go test -p=1 -count=1 -covermode=atomic -timeout=5m -run '^TestIntegration' $(find
    ./pkg -type f -name '*_test.go' -exec grep -l '^func TestIntegration' '{}' '+'
@ -5054,7 +5054,7 @@ steps:
  environment:
    GRAFANA_TEST_DB: mysql
    MYSQL_HOST: mysql57
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: mysql-5.7-integration-tests
 - commands:
  - dockerize -wait tcp://mysql80:3306 -timeout 120s
@ -5062,9 +5062,9 @@ steps:
  name: wait-for-mysql-8.0
 - commands:
  - apk add --update build-base
-  - apk add --update mysql-client
-  - cat devenv/docker/blocks/mysql_tests/setup.sql | mysql -h mysql80 -P 3306 -u root
-    -prootpass
+  - apk add --update mariadb-client
+  - cat devenv/docker/blocks/mysql_tests/setup.sql | mariadb -h mysql80 -P 3306 -u
+    root -prootpass --disable-ssl-verify-server-cert
  - go clean -testcache
  - go test -p=1 -count=1 -covermode=atomic -timeout=5m -run '^TestIntegration' $(find
    ./pkg -type f -name '*_test.go' -exec grep -l '^func TestIntegration' '{}' '+'
@ -5075,7 +5075,7 @@ steps:
  environment:
    GRAFANA_TEST_DB: mysql
    MYSQL_HOST: mysql80
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: mysql-8.0-integration-tests
 - commands:
  - dockerize -wait tcp://redis:6379 -timeout 120s
@ -5091,7 +5091,7 @@ steps:
  - wait-for-redis
  environment:
    REDIS_URL: redis://redis:6379/0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: redis-integration-tests
 - commands:
  - dockerize -wait tcp://memcached:11211 -timeout 120s
@ -5107,7 +5107,7 @@ steps:
  - wait-for-memcached
  environment:
    MEMCACHED_HOSTS: memcached:11211
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: memcached-integration-tests
 - commands:
  - dockerize -wait tcp://mimir_backend:8080 -timeout 120s
@ -5124,7 +5124,7 @@ steps:
    AM_TENANT_ID: test
    AM_URL: http://mimir_backend:8080
  failure: ignore
-  image: golang:1.23.1-alpine
+  image: golang:1.23.5-alpine
  name: remote-alertmanager-integration-tests
 trigger:
  event:
@ -5430,7 +5430,7 @@ steps:
 - commands:
  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM docker:27-cli
  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM alpine/git:2.40.1
-  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM golang:1.23.1-alpine
+  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM golang:1.23.5-alpine
  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM node:20.9.0-alpine
  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM node:20-bookworm
  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM google/cloud-sdk:431.0.0
@ -5469,7 +5469,7 @@ steps:
 - commands:
  - trivy --exit-code 1 --severity HIGH,CRITICAL docker:27-cli
  - trivy --exit-code 1 --severity HIGH,CRITICAL alpine/git:2.40.1
-  - trivy --exit-code 1 --severity HIGH,CRITICAL golang:1.23.1-alpine
+  - trivy --exit-code 1 --severity HIGH,CRITICAL golang:1.23.5-alpine
  - trivy --exit-code 1 --severity HIGH,CRITICAL node:20.9.0-alpine
  - trivy --exit-code 1 --severity HIGH,CRITICAL node:20-bookworm
  - trivy --exit-code 1 --severity HIGH,CRITICAL google/cloud-sdk:431.0.0
@ -5739,6 +5739,6 @@ kind: secret
 name: gcr_credentials
 ---
 kind: signature
-hmac: 65ebf9abca7cfdb688c77bb47650aad3e4716a4a23350ef7a601de48f56ed02e
+hmac: be19150e8d9c93d3e71e570e9e8c6a13310bbde351260ccc73f7b2c515f8d511

 ...
--- a/2
+++ b/2
@ -3,7 +3,7 @@
 ARG BASE_IMAGE=alpine:3.19.1
 ARG JS_IMAGE=node:20-alpine
 ARG JS_PLATFORM=linux/amd64
-ARG GO_IMAGE=golang:1.23.1-alpine
+ARG GO_IMAGE=golang:1.23.5-alpine

 ARG GO_SRC=go-builder
 ARG JS_SRC=js-builder
--- a/2
+++ b/2
@ -8,7 +8,7 @@ WIRE_TAGS = "oss"
 include .bingo/Variables.mk

 GO = go
-GO_VERSION = 1.23.1
+GO_VERSION = 1.23.5
 GO_LINT_FILES ?= $(shell ./scripts/go-workspace/golangci-lint-includes.sh)
 GO_TEST_FILES ?= $(shell ./scripts/go-workspace/test-includes.sh)
 SH_FILES ?= $(shell find ./scripts -name *.sh)
--- a/go.mod
+++ b/go.mod
@ -1,6 +1,6 @@
 module github.com/grafana/grafana

-go 1.23.1
+go 1.23.5

 // contains openapi encoder fixes. remove ASAP
 replace cuelang.org/go => github.com/grafana/cue v0.0.0-20230926092038-971951014e3f // @grafana/grafana-as-code
--- a/go.sum
+++ b/go.sum
@ -3471,8 +3471,6 @@ golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1m
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
 golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
-golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A=
-golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=
 golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
 golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@ -3721,8 +3719,7 @@ golang.org/x/sync v0.4.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
-golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@ -3863,8 +3860,7 @@ golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.25.0 h1:r+8e+loiHxRqhXVl6ML1nO3l1+oFoWbnlu2Ehimmi34=
-golang.org/x/sys v0.25.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/telemetry v0.0.0-20240208230135-b75ee8823808/go.mod h1:KG1lNk5ZFNssSZLrpVb4sMXKMpGwGXOxSG3rnu2gZQQ=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
@ -3889,8 +3885,7 @@ golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58=
 golang.org/x/term v0.19.0/go.mod h1:2CuTdWZ7KHSQwUzKva0cbMg6q2DMI3Mmxp+gKJbskEk=
-golang.org/x/term v0.24.0 h1:Mh5cbb+Zk2hqqXNO7S1iTjEphVL+jb8ZWaqh/g+JWkM=
-golang.org/x/term v0.24.0/go.mod h1:lOBK/LVxemqiMij05LGJ0tzNr8xlmwBRJ81PX6wVLH8=
+golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@ -3913,8 +3908,7 @@ golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.18.0 h1:XvMDiNzPAl0jr17s6W9lcaIhGUfUORdGCNsuLmPG224=
-golang.org/x/text v0.18.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
+golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
--- a/go.work
+++ b/go.work
@ -1,4 +1,4 @@
-go 1.23.1
+go 1.23.5

 // The `skip:golangci-lint` comment tag is used to exclude the package from the `golangci-lint` GitHub Action.
 // The module at the root of the repo (`.`) is excluded because ./pkg/... is included manually in the `golangci-lint` configuration.
--- a/scripts/drone/steps/lib.star
+++ b/scripts/drone/steps/lib.star
@ -1075,8 +1075,8 @@ def postgres_integration_tests_steps():

 def mysql_integration_tests_steps(hostname, version):
    cmds = [
-        "apk add --update mysql-client",
-        "cat devenv/docker/blocks/mysql_tests/setup.sql | mysql -h {} -P 3306 -u root -prootpass".format(hostname),
+        "apk add --update mariadb-client",  # alpine doesn't package mysql anymore; more info: https://wiki.alpinelinux.org/wiki/MySQL
+        "cat devenv/docker/blocks/mysql_tests/setup.sql | mariadb -h {} -P 3306 -u root -prootpass --disable-ssl-verify-server-cert".format(hostname),
        "go clean -testcache",
        "go test -p=1 -count=1 -covermode=atomic -timeout=5m -run '^TestIntegration' $(find ./pkg -type f -name '*_test.go' -exec grep -l '^func TestIntegration' '{}' '+' | grep -o '\\(.*\\)/' | sort -u)",
    ]
--- a/scripts/drone/variables.star
+++ b/scripts/drone/variables.star
@ -3,7 +3,7 @@ global variables
 """

 grabpl_version = "v3.1.1"
-golang_version = "1.23.1"
+golang_version = "1.23.5"

 # nodejs_version should match what's in ".nvmrc", but without the v prefix.
 nodejs_version = "20.9.0"