Bump golang version to 1.19.6 for both release-3.5 and release-3.4 and bump golang.org/x/net to v0.7.0

[ahrtr]

What would you like to be added?

For both release-3.5 and release-3.4

1. Bump golang version to 1.19.6;
2. Bump golang.org/x/net to v0.7.0 to address CVE GO-2023-1571 . See also security: bump golang.org/x/net to v0.7.0 to address CVE GO-2023-1571 #15331

Why is this needed?

1. golang 1.17 is out of support; and all active K8s branches (1.23 ~ 1.26) have already bumped to 1.19
2. Refer to https://pkg.go.dev/vuln/GO-2023-1571

[ahrtr]

cc @mitake @ptabor @serathius @spzala

[fuweid]

@ahrtr it will be included in 3.4.24 release?

[ahrtr]

@ahrtr it will be included in 3.4.24 release?

3.4.24 is already released, so it will only be included in 3.4.25.

[fuweid]

Thanks! I missed the release notification.

[spzala]

cc @tjungblu

[jmhbnz]

@ahrtr I'm keen to give this a go if you don't mind? I Just want to double check before raising pull request as I've done a couple of the good-first-issue contributions recently and I don't mind leaving this if it would be better to let someone else.

[ahrtr]

Thanks @jmhbnz . Just assigned to you.

We are still pending on other maintainers' comment. It's OK to have more discussion under your PR.

[tjungblu]

Thanks, that helps a lot. Do you guys foresee any challenges with going directly to 1.19?

[serathius]

cc @liggitt

[liggitt]

Thanks, that helps a lot. Do you guys foresee any challenges with going directly to 1.19?

Not really... there were only three changes Kubernetes encountered going from go1.17 → go1.19, and they don't seem relevant to etcd:

• sha-1 support disabled by default (not an issue unless someone is using etcd with insecure certificates, and they can re-enable with a GODEBUG envvar)
• LookPath returns an error when resolving binaries in the current directory (I don't see etcd using this)
• GC tuning differences that improved latency but could increase peak memory use in kube-apiserver (we didn't see this in all components or clusters, only specific kubernetes configurations, and this was tunable to get the go1.17 balance back by setting a GOGC envvar)

[ahrtr]

Completed.