Update golang.org/x/mod to support tool directives

[mattdowdell]

While attempting to install trivy via bingo I ran into the following error:

$ bingo get github.com/aquasecurity/trivy/cmd/trivy
Error: get: trivy.mod: getting github.com/aquasecurity/trivy/cmd/trivy: parse target mod file /home/dev/go/pkg/mod/github.com/aquasecurity/trivy@v0.64.1/go.mod: parse: /home/dev/go/pkg/mod/github.com/aquasecurity/trivy@v0.64.1/go.mod:442: unknown block type: tool

It's a fairly straightforward problem: the version of golang.org/x/mod used by bingo does not recognise the tool directive introduced in Go 1.24.

To fix, we simply update that dependency and all is well again, i.e.

# success!
$ go run . get github.com/aquasecurity/trivy/cmd/trivy

For better or worse, this required updating the Go version for bingo, and a toolchain directive got added to the go.mod in the process. The Go version is inherited from golang.org/x/mod, but the toolchain might be negotiable if 1.24.0 is too modern. Other changes to go.sum came from running go mod tidy.

Note

It seems very likely that the CI workflow, when approved, will fail as it uses Go 1.18, 1.19, 1.20 and 1.21. With this change, it seems like we could only reasonably support 1.23 and 1.24, and the incoming 1.25 when released.

I'm happy to make that change too, just let me know if that's the direction you want to take.

[bwplotka]

Sorry for extreme lag!

Let's update bingo Go version.

There are two separate Go versions to care here:

• Version that bingo is build with
• Version that user use when installing things through bingo
• Versions of Go that are required for tools

Our current tests are very naive -- they just use same Go version for both bingo build and usage. However, it's likely what users would do anything (install bingo with same version using go install), but it's not something always the same.

Nevertheless, I think we need to stay to the latest and say we only support 2-3 latest Go versions with every bingo release. Help wanted to add clear readme about it and limit the Go version matrix on CI (and update all deps). Thanks!

NOTE: we have another reason for failed test on main #162

[dronenb]

this was fixed by #163

[bwplotka]

Can you rebase @mattdowdell ?

[bwplotka]

Ah actually, we did this already in upgrade ;p let's close Thanks anyway!

[mattdowdell]

@bwplotka No problem, thanks for fixing the issue :)