chore: update golang to 1.24.1 (#17035)

- Update go.mod to use Go 1.24.1
- Update GitHub Actions setup-go action to use Go 1.24.1
- Fix linting issues with golangci-lint by:
  - Updating to golangci-lint v1.57.1 (more compatible with Go 1.24.1)

🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <claude@anthropic.com>

tailnet/conn.go

@@ -132,6 +132,7 @@ type TelemetrySink interface {
 // NodeID creates a Tailscale NodeID from the last 8 bytes of a UUID. It ensures
 // the returned NodeID is always positive.
 func NodeID(uid uuid.UUID) tailcfg.NodeID {
+	// #nosec G115 - This is safe because the next lines ensure the ID is always positive
 	id := int64(binary.BigEndian.Uint64(uid[8:]))
 
 	// ensure id is positive

tailnet/controllers_test.go

@@ -35,7 +35,7 @@ import (
 	"github.com/coder/quartz"
 )
 
-var unimplementedError = drpcerr.WithCode(xerrors.New("Unimplemented"), drpcerr.Unimplemented)
+var errUnimplemented = drpcerr.WithCode(xerrors.New("Unimplemented"), drpcerr.Unimplemented)
 
 func TestInMemoryCoordination(t *testing.T) {
 	t.Parallel()
@@ -708,7 +708,7 @@ func TestBasicTelemetryController_Unimplemented(t *testing.T) {
 	call = testutil.RequireRecvCtx(ctx, t, ft.calls)
 
 	// for real this time
-	telemetryError = unimplementedError
+	telemetryError = errUnimplemented
 	testutil.RequireSendCtx(ctx, t, call.errCh, telemetryError)
 	testutil.RequireRecvCtx(ctx, t, sendDone)
 
@@ -948,7 +948,7 @@ func TestBasicResumeTokenController_Unimplemented(t *testing.T) {
 	cw := uut.New(fr)
 
 	call := testutil.RequireRecvCtx(ctx, t, fr.calls)
-	testutil.RequireSendCtx(ctx, t, call.errCh, unimplementedError)
+	testutil.RequireSendCtx(ctx, t, call.errCh, errUnimplemented)
 	err := testutil.RequireRecvCtx(ctx, t, cw.Wait())
 	require.NoError(t, err)
 	_, ok = uut.Token()
@@ -974,13 +974,13 @@ func (f *fakeResumeTokenClient) RefreshResumeToken(_ context.Context, _ *proto.R
 	}
 	select {
 	case <-f.ctx.Done():
-		return nil, timeoutOnFakeErr
+		return nil, errTimeoutOnFake
 	case f.calls <- call:
 		// OK
 	}
 	select {
 	case <-f.ctx.Done():
-		return nil, timeoutOnFakeErr
+		return nil, errTimeoutOnFake
 	case err := <-call.errCh:
 		return nil, err
 	case resp := <-call.resp:
@@ -1245,10 +1245,10 @@ func (p *pipeDialer) Dial(_ context.Context, _ tailnet.ResumeTokenController) (t
 	}, nil
 }
 
-// timeoutOnFakeErr is the error we send when fakes fail to send calls or receive responses before
+// errTimeoutOnFake is the error we send when fakes fail to send calls or receive responses before
 // their context times out. We don't want to send the context error since that often doesn't trigger
 // test failures or logging.
-var timeoutOnFakeErr = xerrors.New("test timeout")
+var errTimeoutOnFake = xerrors.New("test timeout")
 
 type fakeCoordinatorClient struct {
 	ctx   context.Context
@@ -1263,13 +1263,13 @@ func (f fakeCoordinatorClient) Close() error {
 	errs := make(chan error)
 	select {
 	case <-f.ctx.Done():
-		return timeoutOnFakeErr
+		return errTimeoutOnFake
 	case f.close <- errs:
 		// OK
 	}
 	select {
 	case <-f.ctx.Done():
-		return timeoutOnFakeErr
+		return errTimeoutOnFake
 	case err := <-errs:
 		return err
 	}
@@ -1284,13 +1284,13 @@ func (f fakeCoordinatorClient) Send(request *proto.CoordinateRequest) error {
 	}
 	select {
 	case <-f.ctx.Done():
-		return timeoutOnFakeErr
+		return errTimeoutOnFake
 	case f.reqs <- call:
 		// OK
 	}
 	select {
 	case <-f.ctx.Done():
-		return timeoutOnFakeErr
+		return errTimeoutOnFake
 	case err := <-errs:
 		return err
 	}
@@ -1306,13 +1306,13 @@ func (f fakeCoordinatorClient) Recv() (*proto.CoordinateResponse, error) {
 	}
 	select {
 	case <-f.ctx.Done():
-		return nil, timeoutOnFakeErr
+		return nil, errTimeoutOnFake
 	case f.resps <- call:
 		// OK
 	}
 	select {
 	case <-f.ctx.Done():
-		return nil, timeoutOnFakeErr
+		return nil, errTimeoutOnFake
 	case err := <-errs:
 		return nil, err
 	case resp := <-resps:
@@ -1352,13 +1352,13 @@ func (f *fakeWorkspaceUpdateClient) Close() error {
 	errs := make(chan error)
 	select {
 	case <-f.ctx.Done():
-		return timeoutOnFakeErr
+		return errTimeoutOnFake
 	case f.close <- errs:
 		// OK
 	}
 	select {
 	case <-f.ctx.Done():
-		return timeoutOnFakeErr
+		return errTimeoutOnFake
 	case err := <-errs:
 		return err
 	}
@@ -1374,13 +1374,13 @@ func (f *fakeWorkspaceUpdateClient) Recv() (*proto.WorkspaceUpdate, error) {
 	}
 	select {
 	case <-f.ctx.Done():
-		return nil, timeoutOnFakeErr
+		return nil, errTimeoutOnFake
 	case f.recv <- call:
 		// OK
 	}
 	select {
 	case <-f.ctx.Done():
-		return nil, timeoutOnFakeErr
+		return nil, errTimeoutOnFake
 	case err := <-errs:
 		return nil, err
 	case resp := <-resps:
@@ -1440,13 +1440,13 @@ func (f *fakeDNSSetter) SetDNSHosts(hosts map[dnsname.FQDN][]netip.Addr) error {
 	}
 	select {
 	case <-f.ctx.Done():
-		return timeoutOnFakeErr
+		return errTimeoutOnFake
 	case f.calls <- call:
 		// OK
 	}
 	select {
 	case <-f.ctx.Done():
-		return timeoutOnFakeErr
+		return errTimeoutOnFake
 	case err := <-errs:
 		return err
 	}
@@ -1470,7 +1470,7 @@ func (f *fakeUpdateHandler) Update(wu tailnet.WorkspaceUpdate) error {
 	f.t.Helper()
 	select {
 	case <-f.ctx.Done():
-		return timeoutOnFakeErr
+		return errTimeoutOnFake
 	case f.ch <- wu:
 		// OK
 	}
@@ -1946,7 +1946,7 @@ func (f fakeWorkspaceUpdatesController) New(client tailnet.WorkspaceUpdatesClien
 	select {
 	case <-f.ctx.Done():
 		cw := newFakeCloserWaiter()
-		cw.errCh <- timeoutOnFakeErr
+		cw.errCh <- errTimeoutOnFake
 		return cw
 	case f.calls <- call:
 		// OK
@@ -1954,7 +1954,7 @@ func (f fakeWorkspaceUpdatesController) New(client tailnet.WorkspaceUpdatesClien
 	select {
 	case <-f.ctx.Done():
 		cw := newFakeCloserWaiter()
-		cw.errCh <- timeoutOnFakeErr
+		cw.errCh <- errTimeoutOnFake
 		return cw
 	case resp := <-resps:
 		return resp

tailnet/convert.go

@@ -31,6 +31,7 @@ func NodeToProto(n *Node) (*proto.Node, error) {
 	}
 	derpForcedWebsocket := make(map[int32]string)
 	for i, s := range n.DERPForcedWebsocket {
+		// #nosec G115 - Safe conversion for DERP region IDs which are small positive integers
 		derpForcedWebsocket[int32(i)] = s
 	}
 	addresses := make([]string, len(n.Addresses))
@@ -50,10 +51,11 @@ func NodeToProto(n *Node) (*proto.Node, error) {
 		allowedIPs[i] = string(s)
 	}
 	return &proto.Node{
-		Id:                  int64(n.ID),
-		AsOf:                timestamppb.New(n.AsOf),
-		Key:                 k,
-		Disco:               string(disco),
+		Id:    int64(n.ID),
+		AsOf:  timestamppb.New(n.AsOf),
+		Key:   k,
+		Disco: string(disco),
+		// #nosec G115 - Safe conversion as DERP region IDs are small integers expected to be within int32 range
 		PreferredDerp:       int32(n.PreferredDERP),
 		DerpLatency:         n.DERPLatency,
 		DerpForcedWebsocket: derpForcedWebsocket,
@@ -190,14 +192,16 @@ func DERPNodeToProto(node *tailcfg.DERPNode) *proto.DERPMap_Region_Node {
 	}
 
 	return &proto.DERPMap_Region_Node{
-		Name:             node.Name,
-		RegionId:         int64(node.RegionID),
-		HostName:         node.HostName,
-		CertName:         node.CertName,
-		Ipv4:             node.IPv4,
-		Ipv6:             node.IPv6,
-		StunPort:         int32(node.STUNPort),
-		StunOnly:         node.STUNOnly,
+		Name:     node.Name,
+		RegionId: int64(node.RegionID),
+		HostName: node.HostName,
+		CertName: node.CertName,
+		Ipv4:     node.IPv4,
+		Ipv6:     node.IPv6,
+		// #nosec G115 - Safe conversion as STUN port is within int32 range (0-65535)
+		StunPort: int32(node.STUNPort),
+		StunOnly: node.STUNOnly,
+		// #nosec G115 - Safe conversion as DERP port is within int32 range (0-65535)
 		DerpPort:         int32(node.DERPPort),
 		InsecureForTests: node.InsecureForTests,
 		ForceHttp:        node.ForceHTTP,

tailnet/coordinator.go

@@ -323,7 +323,7 @@ func (c *core) handleReadyForHandshakeLocked(src *peer, rfhs []*proto.Coordinate
 	return nil
 }
 
-func (c *core) nodeUpdateLocked(p *peer, node *proto.Node) error {
+func (c *core) nodeUpdateLocked(p *peer, node *proto.Node) (err error) {
 	c.logger.Debug(context.Background(), "processing node update",
 		slog.F("peer_id", p.id),
 		slog.F("node", node.String()))

tailnet/peer.go

@@ -33,7 +33,7 @@ type peer struct {
 func (p *peer) updateMappingLocked(id uuid.UUID, n *proto.Node, k proto.CoordinateResponse_PeerUpdate_Kind, reason string) error {
 	logger := p.logger.With(slog.F("from_id", id), slog.F("kind", k), slog.F("reason", reason))
 	update, err := p.storeMappingLocked(id, n, k, reason)
-	if xerrors.Is(err, noResp) {
+	if xerrors.Is(err, errNoResp) {
 		logger.Debug(context.Background(), "skipping update")
 		return nil
 	}
@@ -61,7 +61,7 @@ func (p *peer) batchUpdateMappingLocked(others []*peer, k proto.CoordinateRespon
 			continue
 		}
 		update, err := p.storeMappingLocked(other.id, other.node, k, reason)
-		if xerrors.Is(err, noResp) {
+		if xerrors.Is(err, errNoResp) {
 			continue
 		}
 		if err != nil {
@@ -82,7 +82,7 @@ func (p *peer) batchUpdateMappingLocked(others []*peer, k proto.CoordinateRespon
 	}
 }
 
-var noResp = xerrors.New("no response needed")
+var errNoResp = xerrors.New("no response needed")
 
 func (p *peer) storeMappingLocked(
 	id uuid.UUID, n *proto.Node, k proto.CoordinateResponse_PeerUpdate_Kind, reason string,
@@ -95,7 +95,7 @@ func (p *peer) storeMappingLocked(
 	switch {
 	case !ok && (k == proto.CoordinateResponse_PeerUpdate_LOST || k == proto.CoordinateResponse_PeerUpdate_DISCONNECTED):
 		// we don't need to send a lost/disconnect update if we've never sent an update about this peer
-		return nil, noResp
+		return nil, errNoResp
 	case !ok && k == proto.CoordinateResponse_PeerUpdate_NODE:
 		p.sent[id] = n
 	case ok && k == proto.CoordinateResponse_PeerUpdate_LOST:
@@ -109,7 +109,7 @@ func (p *peer) storeMappingLocked(
 			return nil, xerrors.Errorf("failed to compare nodes: %s", sn.String())
 		}
 		if eq {
-			return nil, noResp
+			return nil, errNoResp
 		}
 		p.sent[id] = n
 	}

tailnet/service.go

@@ -322,7 +322,7 @@ func NewNetworkTelemetryBatcher(clk quartz.Clock, frequency time.Duration, maxSi
 		done:      make(chan struct{}),
 	}
 	if b.batchFn == nil {
-		b.batchFn = func(batch []*proto.TelemetryEvent) {}
+		b.batchFn = func(_ []*proto.TelemetryEvent) {}
 	}
 	b.start()
 	return b

tailnet/telemetry.go

@@ -106,13 +106,14 @@ func (b *TelemetryStore) changedConntype(addr string) bool {
 	b.mu.Lock()
 	defer b.mu.Unlock()
 
-	if b.p2p && addr != "" {
+	switch {
+	case b.p2p && addr != "":
 		return false
-	} else if !b.p2p && addr != "" {
+	case !b.p2p && addr != "":
 		b.p2p = true
 		b.p2pSetupTime = time.Since(b.lastDerpTime)
 		return true
-	} else if b.p2p && addr == "" {
+	case b.p2p && addr == "":
 		b.p2p = false
 		b.lastDerpTime = time.Now()
 		b.p2pSetupTime = 0
@@ -131,6 +132,7 @@ func (b *TelemetryStore) updateRemoteNodeIDLocked(nm *netmap.NetworkMap) {
 	for _, p := range nm.Peers {
 		for _, a := range p.Addresses {
 			if a.Addr() == ip && a.IsSingleIP() {
+				// #nosec G115 - Safe conversion as p.ID is expected to be within uint64 range for node IDs
 				b.nodeIDRemote = uint64(p.ID)
 			}
 		}
@@ -188,6 +190,7 @@ func (b *TelemetryStore) updateByNodeLocked(n *tailcfg.Node) bool {
 	if n == nil {
 		return false
 	}
+	// #nosec G115 - Safe conversion as n.ID is expected to be within uint64 range for node IDs
 	b.nodeIDSelf = uint64(n.ID)
 	derpIP, err := netip.ParseAddrPort(n.DERP)
 	if err != nil {

tailnet/telemetry_internal_test.go

@@ -70,7 +70,9 @@ func TestTelemetryStore(t *testing.T) {
 		e := telemetry.newEvent()
 		// DERPMapToProto already tested
 		require.Equal(t, DERPMapToProto(nm.DERPMap), e.DerpMap)
+		// #nosec G115 - Safe conversion in test code as node IDs are within uint64 range
 		require.Equal(t, uint64(nm.Peers[1].ID), e.NodeIdRemote)
+		// #nosec G115 - Safe conversion in test code as node IDs are within uint64 range
 		require.Equal(t, uint64(nm.SelfNode.ID), e.NodeIdSelf)
 		require.Equal(t, application, e.Application)
 		require.Equal(t, nm.SelfNode.DERP, fmt.Sprintf("127.3.3.40:%d", e.HomeDerp))

tailnet/test/peer.go

@@ -234,7 +234,7 @@ func (p *Peer) AssertEventuallyResponsesClosed() {
 	p.t.Helper()
 	for {
 		err := p.readOneResp()
-		if xerrors.Is(err, responsesClosed) {
+		if xerrors.Is(err, errResponsesClosed) {
 			return
 		}
 		if !assert.NoError(p.t, err) {
@@ -278,7 +278,7 @@ func (p *Peer) AssertEventuallyReadyForHandshake(other uuid.UUID) {
 		}
 
 		err := p.readOneResp()
-		if xerrors.Is(err, responsesClosed) {
+		if xerrors.Is(err, errResponsesClosed) {
 			return
 		}
 	}
@@ -288,7 +288,7 @@ func (p *Peer) AssertEventuallyGetsError(match string) {
 	p.t.Helper()
 	for {
 		err := p.readOneResp()
-		if xerrors.Is(err, responsesClosed) {
+		if xerrors.Is(err, errResponsesClosed) {
 			p.t.Error("closed before target error")
 			return
 		}
@@ -312,7 +312,7 @@ func (p *Peer) AssertNeverUpdateKind(peer uuid.UUID, kind proto.CoordinateRespon
 	}
 }
 
-var responsesClosed = xerrors.New("responses closed")
+var errResponsesClosed = xerrors.New("responses closed")
 
 func (p *Peer) readOneResp() error {
 	select {
@@ -320,7 +320,7 @@ func (p *Peer) readOneResp() error {
 		return p.ctx.Err()
 	case resp, ok := <-p.resps:
 		if !ok {
-			return responsesClosed
+			return errResponsesClosed
 		}
 		err := p.handleResp(resp)
 		if err != nil {