Update go version and actions

.github/workflows/deploy-docker.yaml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
@@ -45,5 +45,7 @@ jobs:
           file: ./docker/Dockerfile
           platforms: linux/amd64,linux/arm64
           push: ${{ github.event_name != 'pull_request' }}
+          provenance: mode=max
+          sbom: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}

.github/workflows/pr-build.yml

@@ -12,14 +12,14 @@ jobs:
     name: Build
     runs-on: ubuntu-latest
     steps:
-      - name: Set up Go 1.23.6
-        uses: actions/setup-go@v5
+      - name: Set up Go 1.x
+        uses: actions/setup-go@v6
         with:
-          go-version: 1.23.6
+          go-version: 1.26.2
         id: go
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Get dependencies
         run: |

.github/workflows/pr-tests.yml

@@ -11,14 +11,14 @@ jobs:
     name: Unit
     runs-on: ubuntu-latest
     steps:
-      - name: Set up Go 1.23.6
-        uses: actions/setup-go@v5
+      - name: Set up Go 1.x
+        uses: actions/setup-go@v6
         with:
-          go-version: 1.23.6
+          go-version: 1.26.2
         id: go
 
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Get dependencies
         run: |

api/groups/baseProofGroup_test.go

@@ -41,7 +41,7 @@ func TestGetProof_FailWhenFacadeGetProofFails(t *testing.T) {
 		GetProofCalled: func(rh string, addr string) (*data.GenericAPIResponse, error) {
 			assert.Equal(t, rootHash, rh)
 			assert.Equal(t, address, addr)
-			return nil, fmt.Errorf(returnedError)
+			return nil, fmt.Errorf("%s", returnedError)
 		},
 	}
 
@@ -116,7 +116,7 @@ func TestVerifyProof_FailWhenFacadeVerifyProofFails(t *testing.T) {
 			assert.Equal(t, rootHash, rh)
 			assert.Equal(t, address, addr)
 			assert.Equal(t, []string{proof}, p)
-			return nil, fmt.Errorf(returnedError)
+			return nil, fmt.Errorf("%s", returnedError)
 		},
 	}
 	proofGroup, err := groups.NewProofGroup(facade)
@@ -194,7 +194,7 @@ func TestGetProofDataTrie_FailWhenFacadeGetProofFails(t *testing.T) {
 			assert.Equal(t, rootHash, rh)
 			assert.Equal(t, address, addr)
 			assert.Equal(t, key, k)
-			return nil, fmt.Errorf(returnedError)
+			return nil, fmt.Errorf("%s", returnedError)
 		},
 	}
 

docker/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.23.6 AS builder
+FROM golang:1.26.2 AS builder
 LABEL maintainer="multiversx"
 
 WORKDIR /mx-chain-proxy-go
@@ -12,8 +12,13 @@ RUN go build -ldflags="-X main.appVersion=$(git describe --tags --long --dirty)
 FROM ubuntu:22.04
 RUN apt-get update -y && apt-get upgrade -y
 
+RUN useradd --create-home --uid 10001 --shell /usr/sbin/nologin appuser
+
 COPY --from=builder /mx-chain-proxy-go/cmd/proxy /mx-chain-proxy-go/cmd/proxy
 
+RUN chown -R appuser:appuser /mx-chain-proxy-go/cmd/proxy/
+
 WORKDIR /mx-chain-proxy-go/cmd/proxy/
+USER appuser
 EXPOSE 8080
 ENTRYPOINT ["./proxy"]

go.mod

@@ -1,59 +1,63 @@
 module github.com/multiversx/mx-chain-proxy-go
 
-go 1.23
+go 1.26
 
 require (
-	github.com/gin-contrib/cors v1.6.0
-	github.com/gin-contrib/pprof v1.4.0
-	github.com/gin-contrib/static v0.0.1
-	github.com/gin-gonic/gin v1.10.0
-	github.com/multiversx/mx-chain-core-go v1.4.2-0.20260112082618-e36a88370557
-	github.com/multiversx/mx-chain-crypto-go v1.3.0
-	github.com/multiversx/mx-chain-es-indexer-go v1.9.3-0.20260112102658-97d6a0ceb5f6
-	github.com/multiversx/mx-chain-logger-go v1.1.0
+	github.com/gin-contrib/cors v1.7.7
+	github.com/gin-contrib/pprof v1.5.4
+	github.com/gin-contrib/static v1.1.6
+	github.com/gin-gonic/gin v1.12.0
+	github.com/multiversx/mx-chain-core-go v1.5.1-0.20260507110346-d73f809da273
+	github.com/multiversx/mx-chain-crypto-go v1.3.2-0.20260507122929-499e3d2c694b
+	github.com/multiversx/mx-chain-es-indexer-go v1.10.3-0.20260507130205-07abf93225fe
+	github.com/multiversx/mx-chain-logger-go v1.1.1-0.20260507125359-65e7094302f7
 	github.com/multiversx/mx-chain-storage-go v1.1.0
 	github.com/pkg/errors v0.9.1
-	github.com/stretchr/testify v1.10.0
-	github.com/urfave/cli v1.22.16
+	github.com/stretchr/testify v1.11.1
+	github.com/urfave/cli v1.22.17
 	gopkg.in/go-playground/validator.v8 v8.18.2
 )
 
 require (
-	github.com/btcsuite/btcd/btcutil v1.1.3 // indirect
-	github.com/bytedance/sonic v1.11.6 // indirect
-	github.com/bytedance/sonic/loader v0.1.1 // indirect
-	github.com/cloudwego/base64x v0.1.4 // indirect
-	github.com/cloudwego/iasm v0.2.0 // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.5 // indirect
+	github.com/btcsuite/btcd/btcutil v1.1.6 // indirect
+	github.com/bytedance/gopkg v0.1.4 // indirect
+	github.com/bytedance/sonic v1.15.1 // indirect
+	github.com/bytedance/sonic/loader v0.5.1 // indirect
+	github.com/cloudwego/base64x v0.1.7 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/denisbrodbeck/machineid v1.0.1 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.3 // indirect
-	github.com/gin-contrib/sse v0.1.0 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.13 // indirect
+	github.com/gin-contrib/sse v1.1.1 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
-	github.com/go-playground/validator/v10 v10.20.0 // indirect
-	github.com/goccy/go-json v0.10.2 // indirect
+	github.com/go-playground/validator/v10 v10.30.2 // indirect
+	github.com/goccy/go-json v0.10.6 // indirect
+	github.com/goccy/go-yaml v1.19.2 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/klauspost/cpuid/v2 v2.2.9 // indirect
+	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.22 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
-	github.com/mr-tron/base58 v1.2.0 // indirect
-	github.com/pelletier/go-toml v1.9.3 // indirect
-	github.com/pelletier/go-toml/v2 v2.2.2 // indirect
+	github.com/mr-tron/base58 v1.3.0 // indirect
+	github.com/pelletier/go-toml v1.9.5 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/quic-go/qpack v0.6.0 // indirect
+	github.com/quic-go/quic-go v0.59.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
-	github.com/ugorji/go/codec v1.2.12 // indirect
-	golang.org/x/arch v0.8.0 // indirect
-	golang.org/x/crypto v0.32.0 // indirect
-	golang.org/x/net v0.34.0 // indirect
-	golang.org/x/sys v0.30.0 // indirect
-	golang.org/x/text v0.21.0 // indirect
-	google.golang.org/protobuf v1.36.4 // indirect
+	github.com/ugorji/go/codec v1.3.1 // indirect
+	go.mongodb.org/mongo-driver/v2 v2.5.1 // indirect
+	golang.org/x/arch v0.23.0 // indirect
+	golang.org/x/crypto v0.50.0 // indirect
+	golang.org/x/net v0.53.0 // indirect
+	golang.org/x/sys v0.43.0 // indirect
+	golang.org/x/text v0.36.0 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/go-playground/assert.v1 v1.2.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )