Security: Update to Go 1.22.11 - Backport to v10.4.x (#99128)

* feat: update to Go 1.22.11 * chore: go work use * chore: make drone * chore: go work use * build: update mariadb connection The new Alpine base that the Golang images are built on no longer trust the CA of MySQL. This is a backport of: https://github.com/grafana/grafana/pull/98857 (cherry picked from commit e1bb8ccb79) (cherry picked from commit 5becd9ac03)
5 months ago · f1d4437205
parent 5e170ddd24
commit f1d4437205
7 changed files with 141 additions and 119 deletions
--- a/.drone.yml
+++ b/.drone.yml
@ -25,7 +25,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: compile-build-cmd
 - commands:
  - ./bin/build verify-drone
@ -75,7 +75,7 @@ steps:
  - go install github.com/bazelbuild/buildtools/buildifier@latest
  - buildifier --lint=warn -mode=check -r .
  depends_on: []
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: lint-starlark
 trigger:
  event:
@ -370,7 +370,7 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-cue
  depends_on: []
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: verify-gen-cue
 - commands:
  - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@ -379,14 +379,14 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-jsonnet
  depends_on: []
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: verify-gen-jsonnet
 - commands:
  - apk add --update make
  - make gen-go
  depends_on:
  - verify-gen-cue
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: wire-install
 - commands:
  - apk add --update build-base shared-mime-info shared-mime-info-lang
@ -394,7 +394,7 @@ steps:
    -timeout=5m
  depends_on:
  - wire-install
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: test-backend
 - commands:
  - apk add --update build-base
@ -403,7 +403,7 @@ steps:
    | grep -o '\(.*\)/' | sort -u)
  depends_on:
  - wire-install
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: test-backend-integration
 trigger:
  event:
@ -456,7 +456,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: compile-build-cmd
 - commands:
  - echo $(/usr/bin/github-app-external-token) > /github-app/token
@ -500,7 +500,7 @@ steps:
  - apk add --update make
  - make gen-go
  depends_on: []
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: wire-install
 - commands:
  - apk add --update make build-base
@ -509,16 +509,16 @@ steps:
  - wire-install
  environment:
    CGO_ENABLED: "1"
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: lint-backend
 - commands:
  - go run scripts/modowners/modowners.go check go.mod
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: validate-modfile
 - commands:
  - apk add --update make
  - make swagger-validate
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: validate-openapi-spec
 trigger:
  event:
@ -591,7 +591,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: compile-build-cmd
 - commands:
  - '# It is required that code generated from Thema/CUE be committed and in sync
@ -601,7 +601,7 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-cue
  depends_on: []
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: verify-gen-cue
 - commands:
  - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@ -610,14 +610,14 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-jsonnet
  depends_on: []
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: verify-gen-jsonnet
 - commands:
  - apk add --update make
  - make gen-go
  depends_on:
  - verify-gen-cue
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: wire-install
 - commands:
  - apk add --update g++ make python3 && ln -sf /usr/bin/python3 /usr/bin/python
@ -651,7 +651,7 @@ steps:
      from_secret: drone_token
 - commands:
  - /src/grafana-build artifacts -a targz:grafana:linux/amd64 -a targz:grafana:linux/arm64
-    -a targz:grafana:linux/arm/v7 --go-version=1.22.7 --yarn-cache=$$YARN_CACHE_FOLDER
+    -a targz:grafana:linux/arm/v7 --go-version=1.22.11 --yarn-cache=$$YARN_CACHE_FOLDER
    --build-id=$$DRONE_BUILD_NUMBER --grafana-dir=$$PWD > packages.txt
  depends_on:
  - yarn-install
@ -807,7 +807,7 @@ steps:
  - /src/grafana-build artifacts -a docker:grafana:linux/amd64 -a docker:grafana:linux/amd64:ubuntu
    -a docker:grafana:linux/arm64 -a docker:grafana:linux/arm64:ubuntu -a docker:grafana:linux/arm/v7
    -a docker:grafana:linux/arm/v7:ubuntu --yarn-cache=$$YARN_CACHE_FOLDER --build-id=$$DRONE_BUILD_NUMBER
-    --go-version=1.22.7 --ubuntu-base=ubuntu:22.04 --alpine-base=alpine:3.20.3 --tag-format='{{
+    --go-version=1.22.11 --ubuntu-base=ubuntu:22.04 --alpine-base=alpine:3.20.3 --tag-format='{{
    .version_base }}-{{ .buildID }}-{{ .arch }}' --grafana-dir=$$PWD --ubuntu-tag-format='{{
    .version_base }}-{{ .buildID }}-ubuntu-{{ .arch }}' > docker.txt
  - find ./dist -name '*docker*.tar.gz' -type f | xargs -n1 docker load -i
@ -970,7 +970,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: compile-build-cmd
 - commands:
  - echo $DRONE_RUNNER_NAME
@ -984,7 +984,7 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-cue
  depends_on: []
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: verify-gen-cue
 - commands:
  - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@ -993,14 +993,14 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-jsonnet
  depends_on: []
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: verify-gen-jsonnet
 - commands:
  - apk add --update make
  - make gen-go
  depends_on:
  - verify-gen-cue
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: wire-install
 - commands:
  - dockerize -wait tcp://postgres:5432 -timeout 120s
@ -1021,7 +1021,7 @@ steps:
    GRAFANA_TEST_DB: postgres
    PGPASSWORD: grafanatest
    POSTGRES_HOST: postgres
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: postgres-integration-tests
 - commands:
  - dockerize -wait tcp://mysql57:3306 -timeout 120s
@ -1029,9 +1029,9 @@ steps:
  name: wait-for-mysql-5.7
 - commands:
  - apk add --update build-base
-  - apk add --update mysql-client
-  - cat devenv/docker/blocks/mysql_tests/setup.sql | mysql -h mysql57 -P 3306 -u root
-    -prootpass
+  - apk add --update mariadb-client
+  - cat devenv/docker/blocks/mysql_tests/setup.sql | mariadb -h mysql57 -P 3306 -u
+    root -prootpass --disable-ssl-verify-server-cert
  - go clean -testcache
  - go test -p=1 -count=1 -covermode=atomic -timeout=5m -run '^TestIntegration' $(find
    ./pkg -type f -name '*_test.go' -exec grep -l '^func TestIntegration' '{}' '+'
@ -1042,7 +1042,7 @@ steps:
  environment:
    GRAFANA_TEST_DB: mysql
    MYSQL_HOST: mysql57
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: mysql-5.7-integration-tests
 - commands:
  - dockerize -wait tcp://mysql80:3306 -timeout 120s
@ -1050,9 +1050,9 @@ steps:
  name: wait-for-mysql-8.0
 - commands:
  - apk add --update build-base
-  - apk add --update mysql-client
-  - cat devenv/docker/blocks/mysql_tests/setup.sql | mysql -h mysql80 -P 3306 -u root
-    -prootpass
+  - apk add --update mariadb-client
+  - cat devenv/docker/blocks/mysql_tests/setup.sql | mariadb -h mysql80 -P 3306 -u
+    root -prootpass --disable-ssl-verify-server-cert
  - go clean -testcache
  - go test -p=1 -count=1 -covermode=atomic -timeout=5m -run '^TestIntegration' $(find
    ./pkg -type f -name '*_test.go' -exec grep -l '^func TestIntegration' '{}' '+'
@ -1063,7 +1063,7 @@ steps:
  environment:
    GRAFANA_TEST_DB: mysql
    MYSQL_HOST: mysql80
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: mysql-8.0-integration-tests
 - commands:
  - dockerize -wait tcp://redis:6379 -timeout 120s
@ -1079,7 +1079,7 @@ steps:
  - wait-for-redis
  environment:
    REDIS_URL: redis://redis:6379/0
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: redis-integration-tests
 - commands:
  - dockerize -wait tcp://memcached:11211 -timeout 120s
@ -1095,7 +1095,7 @@ steps:
  - wait-for-memcached
  environment:
    MEMCACHED_HOSTS: memcached:11211
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: memcached-integration-tests
 - commands:
  - dockerize -wait tcp://mimir_backend:8080 -timeout 120s
@ -1111,7 +1111,7 @@ steps:
  environment:
    AM_TENANT_ID: test
    AM_URL: http://mimir_backend:8080
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: remote-alertmanager-integration-tests
 trigger:
  event:
@ -1202,7 +1202,7 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-cue
  depends_on: []
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: verify-gen-cue
 trigger:
  event:
@ -1322,7 +1322,7 @@ steps:
    fi
  depends_on:
  - clone-enterprise
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: swagger-gen
 trigger:
  event:
@ -1443,7 +1443,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: compile-build-cmd
 - commands:
  - '# It is required that code generated from Thema/CUE be committed and in sync
@ -1454,7 +1454,7 @@ steps:
  - CODEGEN_VERIFY=1 make gen-cue
  depends_on:
  - clone-enterprise
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: verify-gen-cue
 - commands:
  - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@ -1464,14 +1464,14 @@ steps:
  - CODEGEN_VERIFY=1 make gen-jsonnet
  depends_on:
  - clone-enterprise
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: verify-gen-jsonnet
 - commands:
  - apk add --update make
  - make gen-go
  depends_on:
  - verify-gen-cue
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: wire-install
 - commands:
  - apk add --update build-base
@ -1479,7 +1479,7 @@ steps:
  - go test -v -run=^$ -benchmem -timeout=1h -count=8 -bench=. ${GO_PACKAGES}
  depends_on:
  - wire-install
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: sqlite-benchmark-integration-tests
 - commands:
  - apk add --update build-base
@ -1491,7 +1491,7 @@ steps:
    GRAFANA_TEST_DB: postgres
    PGPASSWORD: grafanatest
    POSTGRES_HOST: postgres
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: postgres-benchmark-integration-tests
 - commands:
  - apk add --update build-base
@ -1502,7 +1502,7 @@ steps:
  environment:
    GRAFANA_TEST_DB: mysql
    MYSQL_HOST: mysql57
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: mysql-5.7-benchmark-integration-tests
 - commands:
  - apk add --update build-base
@ -1513,7 +1513,7 @@ steps:
  environment:
    GRAFANA_TEST_DB: mysql
    MYSQL_HOST: mysql80
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: mysql-8.0-benchmark-integration-tests
 trigger:
  event:
@ -1594,7 +1594,7 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-cue
  depends_on: []
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: verify-gen-cue
 trigger:
  branch: main
@ -1771,7 +1771,7 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-cue
  depends_on: []
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: verify-gen-cue
 - commands:
  - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@ -1780,14 +1780,14 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-jsonnet
  depends_on: []
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: verify-gen-jsonnet
 - commands:
  - apk add --update make
  - make gen-go
  depends_on:
  - verify-gen-cue
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: wire-install
 - commands:
  - apk add --update build-base shared-mime-info shared-mime-info-lang
@ -1795,7 +1795,7 @@ steps:
    -timeout=5m
  depends_on:
  - wire-install
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: test-backend
 - commands:
  - apk add --update build-base
@ -1804,7 +1804,7 @@ steps:
    | grep -o '\(.*\)/' | sort -u)
  depends_on:
  - wire-install
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: test-backend-integration
 trigger:
  branch: main
@ -1849,13 +1849,13 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: compile-build-cmd
 - commands:
  - apk add --update make
  - make gen-go
  depends_on: []
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: wire-install
 - commands:
  - apk add --update make build-base
@ -1864,16 +1864,16 @@ steps:
  - wire-install
  environment:
    CGO_ENABLED: "1"
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: lint-backend
 - commands:
  - go run scripts/modowners/modowners.go check go.mod
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: validate-modfile
 - commands:
  - apk add --update make
  - make swagger-validate
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: validate-openapi-spec
 - commands:
  - ./bin/build verify-drone
@ -1944,7 +1944,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: compile-build-cmd
 - commands:
  - '# It is required that code generated from Thema/CUE be committed and in sync
@ -1954,7 +1954,7 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-cue
  depends_on: []
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: verify-gen-cue
 - commands:
  - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@ -1963,14 +1963,14 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-jsonnet
  depends_on: []
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: verify-gen-jsonnet
 - commands:
  - apk add --update make
  - make gen-go
  depends_on:
  - verify-gen-cue
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: wire-install
 - commands:
  - apk add --update g++ make python3 && ln -sf /usr/bin/python3 /usr/bin/python
@ -2003,7 +2003,7 @@ steps:
  name: build-frontend-packages
 - commands:
  - /src/grafana-build artifacts -a targz:grafana:linux/amd64 -a targz:grafana:linux/arm64
-    -a targz:grafana:linux/arm/v7 --go-version=1.22.7 --yarn-cache=$$YARN_CACHE_FOLDER
+    -a targz:grafana:linux/arm/v7 --go-version=1.22.11 --yarn-cache=$$YARN_CACHE_FOLDER
    --build-id=$$DRONE_BUILD_NUMBER --grafana-dir=$$PWD > packages.txt
  depends_on:
  - update-package-json-version
@ -2195,7 +2195,7 @@ steps:
  - /src/grafana-build artifacts -a docker:grafana:linux/amd64 -a docker:grafana:linux/amd64:ubuntu
    -a docker:grafana:linux/arm64 -a docker:grafana:linux/arm64:ubuntu -a docker:grafana:linux/arm/v7
    -a docker:grafana:linux/arm/v7:ubuntu --yarn-cache=$$YARN_CACHE_FOLDER --build-id=$$DRONE_BUILD_NUMBER
-    --go-version=1.22.7 --ubuntu-base=ubuntu:22.04 --alpine-base=alpine:3.20.3 --tag-format='{{
+    --go-version=1.22.11 --ubuntu-base=ubuntu:22.04 --alpine-base=alpine:3.20.3 --tag-format='{{
    .version_base }}-{{ .buildID }}-{{ .arch }}' --grafana-dir=$$PWD --ubuntu-tag-format='{{
    .version_base }}-{{ .buildID }}-ubuntu-{{ .arch }}' > docker.txt
  - find ./dist -name '*docker*.tar.gz' -type f | xargs -n1 docker load -i
@ -2403,7 +2403,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: compile-build-cmd
 - commands:
  - echo $DRONE_RUNNER_NAME
@ -2417,7 +2417,7 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-cue
  depends_on: []
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: verify-gen-cue
 - commands:
  - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@ -2426,14 +2426,14 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-jsonnet
  depends_on: []
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: verify-gen-jsonnet
 - commands:
  - apk add --update make
  - make gen-go
  depends_on:
  - verify-gen-cue
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: wire-install
 - commands:
  - dockerize -wait tcp://postgres:5432 -timeout 120s
@ -2454,7 +2454,7 @@ steps:
    GRAFANA_TEST_DB: postgres
    PGPASSWORD: grafanatest
    POSTGRES_HOST: postgres
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: postgres-integration-tests
 - commands:
  - dockerize -wait tcp://mysql57:3306 -timeout 120s
@ -2462,9 +2462,9 @@ steps:
  name: wait-for-mysql-5.7
 - commands:
  - apk add --update build-base
-  - apk add --update mysql-client
-  - cat devenv/docker/blocks/mysql_tests/setup.sql | mysql -h mysql57 -P 3306 -u root
-    -prootpass
+  - apk add --update mariadb-client
+  - cat devenv/docker/blocks/mysql_tests/setup.sql | mariadb -h mysql57 -P 3306 -u
+    root -prootpass --disable-ssl-verify-server-cert
  - go clean -testcache
  - go test -p=1 -count=1 -covermode=atomic -timeout=5m -run '^TestIntegration' $(find
    ./pkg -type f -name '*_test.go' -exec grep -l '^func TestIntegration' '{}' '+'
@ -2475,7 +2475,7 @@ steps:
  environment:
    GRAFANA_TEST_DB: mysql
    MYSQL_HOST: mysql57
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: mysql-5.7-integration-tests
 - commands:
  - dockerize -wait tcp://mysql80:3306 -timeout 120s
@ -2483,9 +2483,9 @@ steps:
  name: wait-for-mysql-8.0
 - commands:
  - apk add --update build-base
-  - apk add --update mysql-client
-  - cat devenv/docker/blocks/mysql_tests/setup.sql | mysql -h mysql80 -P 3306 -u root
-    -prootpass
+  - apk add --update mariadb-client
+  - cat devenv/docker/blocks/mysql_tests/setup.sql | mariadb -h mysql80 -P 3306 -u
+    root -prootpass --disable-ssl-verify-server-cert
  - go clean -testcache
  - go test -p=1 -count=1 -covermode=atomic -timeout=5m -run '^TestIntegration' $(find
    ./pkg -type f -name '*_test.go' -exec grep -l '^func TestIntegration' '{}' '+'
@ -2496,7 +2496,7 @@ steps:
  environment:
    GRAFANA_TEST_DB: mysql
    MYSQL_HOST: mysql80
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: mysql-8.0-integration-tests
 - commands:
  - dockerize -wait tcp://redis:6379 -timeout 120s
@ -2512,7 +2512,7 @@ steps:
  - wait-for-redis
  environment:
    REDIS_URL: redis://redis:6379/0
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: redis-integration-tests
 - commands:
  - dockerize -wait tcp://memcached:11211 -timeout 120s
@ -2528,7 +2528,7 @@ steps:
  - wait-for-memcached
  environment:
    MEMCACHED_HOSTS: memcached:11211
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: memcached-integration-tests
 - commands:
  - dockerize -wait tcp://mimir_backend:8080 -timeout 120s
@ -2544,7 +2544,7 @@ steps:
  environment:
    AM_TENANT_ID: test
    AM_URL: http://mimir_backend:8080
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: remote-alertmanager-integration-tests
 trigger:
  branch: main
@ -2689,7 +2689,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: compile-build-cmd
 - commands:
  - ./bin/build artifacts docker fetch --edition oss
@ -2821,7 +2821,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: compile-build-cmd
 - commands:
  - ./bin/build artifacts docker fetch --edition oss
@ -2962,7 +2962,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: compile-build-cmd
 - commands:
  - ./bin/build artifacts packages --artifacts-editions=oss --tag $${DRONE_TAG} --src-bucket
@ -3053,7 +3053,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: compile-build-cmd
 - commands:
  - apk add --update g++ make python3 && ln -sf /usr/bin/python3 /usr/bin/python
@ -3154,7 +3154,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: compile-build-cmd
 - depends_on:
  - compile-build-cmd
@ -3270,7 +3270,7 @@ steps:
      from_secret: grafana_api_key
    GCP_KEY_BASE64:
      from_secret: gcp_key_base64
-    GO_VERSION: 1.22.7
+    GO_VERSION: 1.22.11
    GPG_PASSPHRASE:
      from_secret: packages_gpg_passphrase
    GPG_PRIVATE_KEY:
@ -3345,7 +3345,7 @@ steps:
      from_secret: grafana_api_key
    GCP_KEY_BASE64:
      from_secret: gcp_key_base64
-    GO_VERSION: 1.22.7
+    GO_VERSION: 1.22.11
    GPG_PASSPHRASE:
      from_secret: packages_gpg_passphrase
    GPG_PRIVATE_KEY:
@ -3402,13 +3402,13 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: compile-build-cmd
 - commands:
  - ./bin/build whatsnew-checker
  depends_on:
  - compile-build-cmd
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: whats-new-checker
 trigger:
  event:
@ -3507,7 +3507,7 @@ steps:
      from_secret: grafana_api_key
    GCP_KEY_BASE64:
      from_secret: gcp_key_base64
-    GO_VERSION: 1.22.7
+    GO_VERSION: 1.22.11
    GPG_PASSPHRASE:
      from_secret: packages_gpg_passphrase
    GPG_PRIVATE_KEY:
@ -3659,7 +3659,7 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-cue
  depends_on: []
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: verify-gen-cue
 - commands:
  - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@ -3668,14 +3668,14 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-jsonnet
  depends_on: []
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: verify-gen-jsonnet
 - commands:
  - apk add --update make
  - make gen-go
  depends_on:
  - verify-gen-cue
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: wire-install
 - commands:
  - apk add --update build-base shared-mime-info shared-mime-info-lang
@ -3683,7 +3683,7 @@ steps:
    -timeout=5m
  depends_on:
  - wire-install
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: test-backend
 - commands:
  - apk add --update build-base
@ -3692,7 +3692,7 @@ steps:
    | grep -o '\(.*\)/' | sort -u)
  depends_on:
  - wire-install
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: test-backend-integration
 trigger:
  cron:
@ -3746,7 +3746,7 @@ steps:
      from_secret: grafana_api_key
    GCP_KEY_BASE64:
      from_secret: gcp_key_base64
-    GO_VERSION: 1.22.7
+    GO_VERSION: 1.22.11
    GPG_PASSPHRASE:
      from_secret: packages_gpg_passphrase
    GPG_PRIVATE_KEY:
@ -3890,7 +3890,7 @@ steps:
      from_secret: grafana_api_key
    GCP_KEY_BASE64:
      from_secret: gcp_key_base64
-    GO_VERSION: 1.22.7
+    GO_VERSION: 1.22.11
    GPG_PASSPHRASE:
      from_secret: packages_gpg_passphrase
    GPG_PRIVATE_KEY:
@ -4016,7 +4016,7 @@ steps:
      from_secret: grafana_api_key
    GCP_KEY_BASE64:
      from_secret: gcp_key_base64
-    GO_VERSION: 1.22.7
+    GO_VERSION: 1.22.11
    GPG_PASSPHRASE:
      from_secret: packages_gpg_passphrase
    GPG_PRIVATE_KEY:
@ -4161,7 +4161,7 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-cue
  depends_on: []
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: verify-gen-cue
 - commands:
  - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@ -4170,14 +4170,14 @@ steps:
  - apk add --update make
  - CODEGEN_VERIFY=1 make gen-jsonnet
  depends_on: []
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: verify-gen-jsonnet
 - commands:
  - apk add --update make
  - make gen-go
  depends_on:
  - verify-gen-cue
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: wire-install
 - commands:
  - dockerize -wait tcp://postgres:5432 -timeout 120s
@ -4198,7 +4198,7 @@ steps:
    GRAFANA_TEST_DB: postgres
    PGPASSWORD: grafanatest
    POSTGRES_HOST: postgres
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: postgres-integration-tests
 - commands:
  - dockerize -wait tcp://mysql57:3306 -timeout 120s
@ -4206,9 +4206,9 @@ steps:
  name: wait-for-mysql-5.7
 - commands:
  - apk add --update build-base
-  - apk add --update mysql-client
-  - cat devenv/docker/blocks/mysql_tests/setup.sql | mysql -h mysql57 -P 3306 -u root
-    -prootpass
+  - apk add --update mariadb-client
+  - cat devenv/docker/blocks/mysql_tests/setup.sql | mariadb -h mysql57 -P 3306 -u
+    root -prootpass --disable-ssl-verify-server-cert
  - go clean -testcache
  - go test -p=1 -count=1 -covermode=atomic -timeout=5m -run '^TestIntegration' $(find
    ./pkg -type f -name '*_test.go' -exec grep -l '^func TestIntegration' '{}' '+'
@ -4219,7 +4219,7 @@ steps:
  environment:
    GRAFANA_TEST_DB: mysql
    MYSQL_HOST: mysql57
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: mysql-5.7-integration-tests
 - commands:
  - dockerize -wait tcp://mysql80:3306 -timeout 120s
@ -4227,9 +4227,9 @@ steps:
  name: wait-for-mysql-8.0
 - commands:
  - apk add --update build-base
-  - apk add --update mysql-client
-  - cat devenv/docker/blocks/mysql_tests/setup.sql | mysql -h mysql80 -P 3306 -u root
-    -prootpass
+  - apk add --update mariadb-client
+  - cat devenv/docker/blocks/mysql_tests/setup.sql | mariadb -h mysql80 -P 3306 -u
+    root -prootpass --disable-ssl-verify-server-cert
  - go clean -testcache
  - go test -p=1 -count=1 -covermode=atomic -timeout=5m -run '^TestIntegration' $(find
    ./pkg -type f -name '*_test.go' -exec grep -l '^func TestIntegration' '{}' '+'
@ -4240,7 +4240,7 @@ steps:
  environment:
    GRAFANA_TEST_DB: mysql
    MYSQL_HOST: mysql80
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: mysql-8.0-integration-tests
 - commands:
  - dockerize -wait tcp://redis:6379 -timeout 120s
@ -4256,7 +4256,7 @@ steps:
  - wait-for-redis
  environment:
    REDIS_URL: redis://redis:6379/0
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: redis-integration-tests
 - commands:
  - dockerize -wait tcp://memcached:11211 -timeout 120s
@ -4272,7 +4272,7 @@ steps:
  - wait-for-memcached
  environment:
    MEMCACHED_HOSTS: memcached:11211
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: memcached-integration-tests
 - commands:
  - dockerize -wait tcp://mimir_backend:8080 -timeout 120s
@ -4288,7 +4288,7 @@ steps:
  environment:
    AM_TENANT_ID: test
    AM_URL: http://mimir_backend:8080
-  image: golang:1.22.7-alpine
+  image: golang:1.22.11-alpine
  name: remote-alertmanager-integration-tests
 trigger:
  event:
@ -4594,7 +4594,7 @@ steps:
 - commands:
  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM docker:27-cli
  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM alpine/git:2.40.1
-  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM golang:1.22.7-alpine
+  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM golang:1.22.11-alpine
  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM node:20.9.0-alpine
  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM google/cloud-sdk:431.0.0
  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM grafana/grafana-ci-deploy:1.3.3
@ -4632,7 +4632,7 @@ steps:
 - commands:
  - trivy --exit-code 1 --severity HIGH,CRITICAL docker:27-cli
  - trivy --exit-code 1 --severity HIGH,CRITICAL alpine/git:2.40.1
-  - trivy --exit-code 1 --severity HIGH,CRITICAL golang:1.22.7-alpine
+  - trivy --exit-code 1 --severity HIGH,CRITICAL golang:1.22.11-alpine
  - trivy --exit-code 1 --severity HIGH,CRITICAL node:20.9.0-alpine
  - trivy --exit-code 1 --severity HIGH,CRITICAL google/cloud-sdk:431.0.0
  - trivy --exit-code 1 --severity HIGH,CRITICAL grafana/grafana-ci-deploy:1.3.3
@ -4901,6 +4901,6 @@ kind: secret
 name: gcr_credentials
 ---
 kind: signature
-hmac: 4b6a6c50d8a0a023875bba4c8b06c4398a9e37b1fc6d2e0f9426745ad1412139
+hmac: 2f35a675be53074c2af9c80d02d69871c7c0c2856b73ac7f6a4ac270a3ad4aa7

 ...
--- a/2
+++ b/2
@ -3,7 +3,7 @@
 ARG BASE_IMAGE=alpine:3.19.1
 ARG JS_IMAGE=node:20-alpine
 ARG JS_PLATFORM=linux/amd64
-ARG GO_IMAGE=golang:1.22.7-alpine
+ARG GO_IMAGE=golang:1.22.11-alpine

 ARG GO_SRC=go-builder
 ARG JS_SRC=js-builder
--- a/go.mod
+++ b/go.mod
@ -1,6 +1,6 @@
 module github.com/grafana/grafana

-go 1.22.7
+go 1.22.11

 // Override docker/docker to avoid:
 // go: github.com/drone-runners/drone-runner-docker@v1.8.2 requires
--- a/go.work
+++ b/go.work
@ -1,4 +1,4 @@
-go 1.22.7
+go 1.22.11

 use (
 	.
--- a/go.work.sum
+++ b/go.work.sum
@ -124,6 +124,7 @@ cloud.google.com/go/compute v1.25.1/go.mod h1:oopOIR53ly6viBYxaDhBfJwzUAxf1zE//u
 cloud.google.com/go/compute v1.27.2 h1:5cE5hdrwJV/92ravlwIFRGnyH9CpLGhh4N0ZDVTU+BA=
 cloud.google.com/go/compute v1.27.2/go.mod h1:YQuHkNEwP3bIz4LBYQqf4DIMfFtTDtnEgnwG0mJQQ9I=
 cloud.google.com/go/compute v1.27.4 h1:XM8ulx6crjdl09XBfji7viFgZOEQuIxBwKmjRH9Rtmc=
+cloud.google.com/go/compute v1.27.4/go.mod h1:7JZS+h21ERAGHOy5qb7+EPyXlQwzshzrx1x6L9JhTqU=
 cloud.google.com/go/compute/metadata v0.3.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
 cloud.google.com/go/contactcenterinsights v1.12.1 h1:EiGBeejtDDtr3JXt9W7xlhXyZ+REB5k2tBgVPVtmNb0=
 cloud.google.com/go/contactcenterinsights v1.12.1/go.mod h1:HHX5wrz5LHVAwfI2smIotQG9x8Qd6gYilaHcLLLmNis=
@ -546,6 +547,8 @@ github.com/AndreasBriese/bbloom v0.0.0-20190306092124-e2d15f34fcf9 h1:HD8gA2tkBy
 github.com/Azure/azure-amqp-common-go/v3 v3.2.2 h1:CJpxNAGxP7UBhDusRUoaOn0uOorQyAYhQYLnNgkRhlY=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal v1.1.2 h1:mLY+pNLjCUeKhgnAJWAKhEUQM+RJQo2H1fuGSw1Ky1E=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.0.0 h1:ECsQtyERDVz3NP3kvDOTLvbQhqWp/x9EsGKtb4ogUr8=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.0.1/go.mod h1:GpPjLhVR9dnUoJMyHWSPy71xY9/lcmpzIPZXmF0FCVY=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.0.0/go.mod h1:bTSOgj05NGRuHHhQwAdPnYr9TOdNmKlZTgGLL6nyAdI=
 github.com/Azure/azure-service-bus-go v0.11.5 h1:EVMicXGNrSX+rHRCBgm/TRQ4VUZ1m3yAYM/AB2R/SOs=
 github.com/Azure/go-amqp v0.16.4 h1:/1oIXrq5zwXLHaoYDliJyiFjJSpJZMWGgtMX9e0/Z30=
 github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
@ -565,6 +568,7 @@ github.com/IBM/sarama v1.43.1/go.mod h1:GG5q1RURtDNPz8xxJs3mgX6Ytak8Z9eLhAkJPObe
 github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c h1:RGWPOewvKIROun94nF7v2cua9qP+thov/7M50KEoeSU=
 github.com/Joker/hpp v1.0.0 h1:65+iuJYdRXv/XyN62C1uEmmOx3432rNG/rKlX6V7Kkc=
 github.com/Knetic/govaluate v3.0.1-0.20171022003610-9aa49832a739+incompatible h1:1G1pk05UrOh0NlF1oeaaix1x8XzrfjIDK47TY0Zehcw=
+github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 h1:TngWCqHvy9oXAN6lEVMRuU21PR1EtLVZJmdB18Gu3Rw=
 github.com/OneOfOne/xxhash v1.2.6 h1:U68crOE3y3MPttCMQGywZOLrTeF5HHJ3/vDBCJn9/bA=
@ -1026,6 +1030,7 @@ github.com/markbates/hmax v1.0.0 h1:yo2N0gBoCnUMKhV/VRLHomT6Y9wUm+oQQENuWJqCdlM=
 github.com/markbates/inflect v1.0.4 h1:5fh1gzTFhfae06u3hzHYO9xe3l3v3nW5Pwt3naLTP5g=
 github.com/markbates/oncer v1.0.0 h1:E83IaVAHygyndzPimgUYJjbshhDTALZyXxvk9FOlQRY=
 github.com/markbates/pkger v0.17.1 h1:/MKEtWqtc0mZvu9OinB9UzVN9iYCwLWuyUv4Bw+PCno=
+github.com/markbates/pkger v0.17.1/go.mod h1:0JoVlrol20BSywW79rN3kdFFsE5xYM+rSCQDXbLhiuI=
 github.com/markbates/refresh v1.4.10 h1:6EZ/vvVpWiam8OTIhrhfV9cVJR/NvScvcCiqosbTkbA=
 github.com/markbates/safe v1.0.1 h1:yjZkbvRM6IzKj9tlu/zMJLS0n/V351OZWRnF3QfaUxI=
 github.com/markbates/sigtx v1.0.0 h1:y/xtkBvNPRjD4KeEplf4w9rJVSc23/xl+jXYGowTwy0=
@ -1124,6 +1129,8 @@ github.com/ory/jsonschema/v3 v3.0.1 h1:xzV7w2rt/Qn+jvh71joIXNKKOCqqNyTlaIxdxU0IQ
 github.com/ory/jsonschema/v3 v3.0.8/go.mod h1:ZPzqjDkwd3QTnb2Z6PAS+OTvBE2x5i6m25wCGx54W/0=
 github.com/pact-foundation/pact-go v1.0.4 h1:OYkFijGHoZAYbOIb1LWXrwKQbMMRUv1oQ89blD2Mh2Q=
 github.com/parnurzeal/gorequest v0.2.15 h1:oPjDCsF5IkD4gUk6vIgsxYNaSgvAnIh1EJeROn3HdJU=
+github.com/parnurzeal/gorequest v0.2.15/go.mod h1:3Kh2QUMJoqw3icWAecsyzkpY7UzRfDhbRdTjtNwNiUE=
+github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
 github.com/pelletier/go-toml/v2 v2.0.5 h1:ipoSadvV8oGUjnUbMub59IDPPwfxF694nG/jwbMiyQg=
 github.com/performancecopilot/speed v3.0.0+incompatible h1:2WnRzIquHa5QxaJKShDkLM+sc0JPuwhXzK8OYOyt3Vg=
 github.com/performancecopilot/speed/v4 v4.0.0 h1:VxEDCmdkfbQYDlcr/GC9YoN9PQ6p8ulk9xVsepYy9ZY=
@ -1257,6 +1264,7 @@ github.com/xhit/go-str2duration v1.2.0 h1:BcV5u025cITWxEQKGWr1URRzrcXtu7uk8+luz3
 github.com/xhit/go-str2duration/v2 v2.1.0 h1:lxklc02Drh6ynqX+DdPyp5pCKLUQpRT8bp8Ydu2Bstc=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77 h1:ESFSdwYZvkeru3RtdrYueztKhOBCSAAzS4Gf+k0tEow=
 github.com/xtgo/uuid v0.0.0-20140804021211-a0b114877d4c h1:3lbZUMbMiGUW/LMkfsEABsc5zNT9+b1CvsJx47JzJ8g=
+github.com/xtgo/uuid v0.0.0-20140804021211-a0b114877d4c/go.mod h1:UrdRz5enIKZ63MEE3IF9l2/ebyx59GyGgPi+tICQdmM=
 github.com/yalp/jsonpath v0.0.0-20180802001716-5cc68e5049a0 h1:6fRhSjgLCkTD3JnJxvaJ4Sj+TYblw757bqYgZaOq5ZY=
 github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d h1:splanxYIlg+5LfHAM6xpdFEAYOk8iySO56hMFq6uLyA=
 github.com/yuin/goldmark v1.4.13 h1:fVcFKWvrslecOb/tg+Cc05dkeYx540o0FuFt3nUVDoE=
@ -1300,6 +1308,7 @@ go.opentelemetry.io/contrib/propagators/b3 v1.15.0 h1:bMaonPyFcAvZ4EVzkUNkfnUHP5
 go.opentelemetry.io/contrib/propagators/b3 v1.15.0/go.mod h1:VjU0g2v6HSQ+NwfifambSLAeBgevjIcqmceaKWEzl0c=
 go.opentelemetry.io/otel v1.22.0/go.mod h1:eoV4iAi3Ea8LkAEI9+GFT44O6T/D0GWAVFyZVCC6pMI=
 go.opentelemetry.io/otel v1.23.0/go.mod h1:YCycw9ZeKhcJFrb34iVSkyT0iczq/zYDtZYFufObyB0=
+go.opentelemetry.io/otel v1.24.0/go.mod h1:W7b9Ozg4nkF5tWI5zsXkaKKDjdVjpD4oAt9Qi/MArHo=
 go.opentelemetry.io/otel/bridge/opencensus v0.37.0 h1:ieH3gw7b1eg90ARsFAlAsX5LKVZgnCYfaDwRrK6xLHU=
 go.opentelemetry.io/otel/bridge/opencensus v0.37.0/go.mod h1:ddiK+1PE68l/Xk04BGTh9Y6WIcxcLrmcVxVlS0w5WZ0=
 go.opentelemetry.io/otel/bridge/opentracing v1.10.0 h1:WzAVGovpC1s7KD5g4taU6BWYZP3QGSDVTlbRu9fIHw8=
@ -1310,13 +1319,16 @@ go.opentelemetry.io/otel/exporters/prometheus v0.37.0 h1:NQc0epfL0xItsmGgSXgfbH2
 go.opentelemetry.io/otel/exporters/prometheus v0.37.0/go.mod h1:hB8qWjsStK36t50/R0V2ULFb4u95X/Q6zupXLgvjTh8=
 go.opentelemetry.io/otel/metric v1.22.0/go.mod h1:evJGjVpZv0mQ5QBRJoBF64yMuOf4xCWdXjK8pzFvliY=
 go.opentelemetry.io/otel/metric v1.23.0/go.mod h1:MqUW2X2a6Q8RN96E2/nqNoT+z9BSms20Jb7Bbp+HiTo=
+go.opentelemetry.io/otel/metric v1.24.0/go.mod h1:VYhLe1rFfxuTXLgj4CBiyz+9WYBA8pNGJgDcSFRKBco=
 go.opentelemetry.io/otel/oteltest v0.18.0 h1:FbKDFm/LnQDOHuGjED+fy3s5YMVg0z019GJ9Er66hYo=
 go.opentelemetry.io/otel/sdk v1.22.0/go.mod h1:iu7luyVGYovrRpe2fmj3CVKouQNdTOkxtLzPvPz1DOc=
+go.opentelemetry.io/otel/sdk v1.24.0/go.mod h1:KVrIYw6tEubO9E96HQpcmpTKDVn9gdv35HoYiQWGDFg=
 go.opentelemetry.io/otel/sdk/metric v0.39.0 h1:Kun8i1eYf48kHH83RucG93ffz0zGV1sh46FAScOTuDI=
 go.opentelemetry.io/otel/sdk/metric v0.39.0/go.mod h1:piDIRgjcK7u0HCL5pCA4e74qpK/jk3NiUoAHATVAmiI=
 go.opentelemetry.io/otel/sdk/metric v1.24.0/go.mod h1:I6Y5FjH6rvEnTTAYQz3Mmv2kl6Ek5IIrmwTLqMrrOE0=
 go.opentelemetry.io/otel/trace v1.22.0/go.mod h1:RbbHXVqKES9QhzZq/fE5UnOSILqRt40a21sPw2He1xo=
 go.opentelemetry.io/otel/trace v1.23.0/go.mod h1:GSGTbIClEsuZrGIzoEHqsVfxgn5UkggkflQwDScNUsk=
+go.opentelemetry.io/otel/trace v1.24.0/go.mod h1:HPc3Xr/cOApsBI154IU0OI0HJexz+aw5uPdbs3UCjNU=
 go.opentelemetry.io/proto/otlp v1.2.0/go.mod h1:gGpR8txAl5M03pDhMC79G6SdqNV26naRm/KDsgaHD8A=
 go.uber.org/automaxprocs v1.5.3 h1:kWazyxZUrS3Gs4qUpbwo5kEIMGe/DAvi5Z4tl2NW4j8=
 go.uber.org/mock v0.2.0 h1:TaP3xedm7JaAgScZO7tlvlKrqT0p7I6OsdGB5YNSMDU=
@ -1324,6 +1336,7 @@ go.uber.org/mock v0.2.0/go.mod h1:J0y0rp9L3xiff1+ZBfKxlC1fz2+aO16tw0tsDOixfuM=
 go.uber.org/tools v0.0.0-20190618225709-2cfd321de3ee h1:0mgffUl7nfd+FpvXMVz4IDEaUSmT1ysygQC7qYo7sG4=
 golang.org/x/crypto v0.24.0/go.mod h1:Z1PMYSOR5nyMcyAVAIQSKCDwalqy85Aqn1x3Ws4L5DM=
 golang.org/x/crypto v0.25.0/go.mod h1:T+wALwcMOSE0kXgUAnPAHqTLW+XHgcELELW8VaDgm/M=
+golang.org/x/crypto v0.26.0/go.mod h1:GY7jblb9wI+FOo5y8/S2oY4zWP07AkOJ4+jxCqdqn54=
 golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo=
 golang.org/x/image v0.0.0-20220302094943-723b81ca9867 h1:TcHcE0vrmgzNH1v3ppjcMGbhG5+9fMuvOmUYwNEF4q4=
 golang.org/x/image v0.18.0/go.mod h1:4yyo5vMFQjVjUcVk4jEQcU9MGy/rulF5WvUILseCM2E=
@ -1333,11 +1346,14 @@ golang.org/x/mod v0.13.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.22.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
 golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
+golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
 golang.org/x/oauth2 v0.17.0/go.mod h1:OzPDGQiuQMguemayvdylqddI7qcD9lnSDb+1FiwQ5HA=
 golang.org/x/oauth2 v0.20.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.22.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.23.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
@ -1348,7 +1364,10 @@ golang.org/x/term v0.21.0/go.mod h1:ooXLefLobQVslOqselCNF4SxFAaoS6KujMbsGzSDmX0=
 golang.org/x/term v0.22.0 h1:BbsgPEJULsl2fV/AT3v15Mjva5yXKQDyKf+TbDz7QJk=
 golang.org/x/term v0.22.0/go.mod h1:F3qCibpT5AMpCRfhfT53vVJwhLtIVHhB9XDjfFvnMI4=
 golang.org/x/term v0.23.0 h1:F6D4vR+EHoL9/sWAWgAR1H2DcHr4PareCbAaCo1RpuU=
+golang.org/x/term v0.23.0/go.mod h1:DgV24QBUrK6jhZXl+20l6UWznPlwAHm1Q1mGHtydmSk=
+golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
+golang.org/x/text v0.17.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
 golang.org/x/tools v0.11.0/go.mod h1:anzJrxPjNtfgiYQYirP2CPGzGLxrH2u2QBhn6Bf3qY8=
 golang.org/x/tools v0.14.0/go.mod h1:uYBEerGOWcJyEORxN+Ek8+TT266gXkNlHdJBwexUsBg=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d h1:vU5i/LfpvrRCpgM/VPfJLg5KjxD3E+hfT1SH+d9zLwg=
@ -1364,6 +1383,7 @@ google.golang.org/api v0.183.0/go.mod h1:q43adC5/pHoSZTx5h2mSmdF7NcyfW9JuDyIOJAg
 google.golang.org/api v0.184.0/go.mod h1:CeDTtUEiYENAf8PPG5VZW2yNp2VM3VWbCeTioAZBTBA=
 google.golang.org/api v0.187.0/go.mod h1:KIHlTc4x7N7gKKuVsdmfBXN13yEEWXWFURWY6SBp2gk=
 google.golang.org/api v0.188.0/go.mod h1:VR0d+2SIiWOYG3r/jdm7adPW9hI2aRv9ETOSCQ9Beag=
+google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
 google.golang.org/genproto v0.0.0-20240116215550-a9fa1716bcac/go.mod h1:+Rvu7ElI+aLzyDQhpHMFMMltsD6m7nqpuWDd2CwJw3k=
 google.golang.org/genproto v0.0.0-20240125205218-1f4bbc51befe/go.mod h1:cc8bqMqtv9gMOr0zHg2Vzff5ULhhL2IXP4sbcn32Dro=
 google.golang.org/genproto v0.0.0-20240205150955-31a09d347014/go.mod h1:xEgQu1e4stdSSsxPDK8Azkrk/ECl5HvdPf6nbZrTS5M=
@ -1416,6 +1436,7 @@ google.golang.org/grpc v1.63.2/go.mod h1:WAX/8DgncnokcFUldAxq7GeB5DXHDbMF+lLvDom
 google.golang.org/grpc v1.64.0/go.mod h1:oxjF8E3FBnjp+/gVFYdWacaLDx9na1aqy9oovLpxQYg=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0 h1:M1YKkFIboKNieVO5DLUEVzQfGwJD30Nv2jfUgzb5UcE=
 google.golang.org/grpc/examples v0.0.0-20210304020650-930c79186c99 h1:qA8rMbz1wQ4DOFfM2ouD29DG9aHWBm6ZOy9BGxiUMmY=
+google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
 google.golang.org/protobuf v1.34.1/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
 gopkg.in/DataDog/dd-trace-go.v1 v1.27.0 h1:WGVt9dwn9vNeWZVdDYzjGQbEW8CghAkJlrC8w80jFVY=
 gopkg.in/airbrake/gobrake.v2 v2.0.9 h1:7z2uVWwn7oVeeugY1DtlPAy5H+KYgB1KeKTnqjNatLo=
@ -1433,6 +1454,7 @@ gopkg.in/gorp.v1 v1.7.2 h1:j3DWlAyGVv8whO7AcIWznQ2Yj7yJkn34B8s63GViAAw=
 gopkg.in/inconshreveable/log15.v2 v2.0.0-20180818164646-67afb5ed74ec h1:RlWgLqCMMIYYEVcAR5MDsuHlVkaIPDAF+5Dehzg8L5A=
 gopkg.in/mgo.v2 v2.0.0-20180705113604-9856a29383ce h1:xcEWjVhvbDy+nHP67nPDDpbYrY+ILlfndk4bRioVHaU=
 gopkg.in/resty.v1 v1.12.0 h1:CuXP0Pjfw9rOuY6EP+UvtNvt5DSqHpIxILZKT/quCZI=
+gopkg.in/square/go-jose.v2 v2.6.0/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
 gopkg.in/src-d/go-billy.v4 v4.3.2 h1:0SQA1pRztfTFx2miS8sA97XvooFeNOmvUenF4o0EcVg=
 gopkg.in/src-d/go-billy.v4 v4.3.2/go.mod h1:nDjArDMp+XMs1aFAESLRjfGSgfvoYN0hDfzEk0GjC98=
 gopkg.in/telebot.v3 v3.2.1 h1:3I4LohaAyJBiivGmkfB+CiVu7QFOWkuZ4+KHgO/G3rs=
--- a/scripts/drone/steps/lib.star
+++ b/scripts/drone/steps/lib.star
@ -1012,8 +1012,8 @@ def postgres_integration_tests_steps():

 def mysql_integration_tests_steps(hostname, version):
    cmds = [
-        "apk add --update mysql-client",
-        "cat devenv/docker/blocks/mysql_tests/setup.sql | mysql -h {} -P 3306 -u root -prootpass".format(hostname),
+        "apk add --update mariadb-client",  # alpine doesn't package mysql anymore; more info: https://wiki.alpinelinux.org/wiki/MySQL
+        "cat devenv/docker/blocks/mysql_tests/setup.sql | mariadb -h {} -P 3306 -u root -prootpass --disable-ssl-verify-server-cert".format(hostname),
        "go clean -testcache",
        "go test -p=1 -count=1 -covermode=atomic -timeout=5m -run '^TestIntegration' $(find ./pkg -type f -name '*_test.go' -exec grep -l '^func TestIntegration' '{}' '+' | grep -o '\\(.*\\)/' | sort -u)",
    ]
--- a/scripts/drone/variables.star
+++ b/scripts/drone/variables.star
@ -3,7 +3,7 @@ global variables
 """

 grabpl_version = "v3.1.1"
-golang_version = "1.22.7"
+golang_version = "1.22.11"

 # nodejs_version should match what's in ".nvmrc", but without the v prefix.
 nodejs_version = "20.9.0"