Update go to 1.26

[adamwg]

Description of your changes

Upcoming developer experience changes require golang 1.26. Do the update separately and resolve new lint issues so that we don't mix the changes into the bigger DevEx PR.

We have to get Go 1.26 and the relevant golangci-lint version from nixpkgs-unstable. To simplify this, export the entire nixpkgs-unstable rather than just its go package so that our nix setup can use arbitrary packages from unstable as needed. This matches the change in crossplane/crossplane commit 744190edf.

I have:

• Read and followed Crossplane's contribution process.
• Run ./nix.sh flake check to ensure this PR is ready for review.
  - [ ] Added or updated unit tests.
  - [ ] Linked a PR or a docs tracking issue to document this change.
  - [ ] Added backport release-x.y labels to auto-backport this PR.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR systematically migrates pointer construction from the k8s.io/utils/ptr helper to Go's built-in new() expression, simplifies control flow in command handling, removes unnecessary linter directives, adds gosec suppressions for safe operations, and updates the Nix development environment to use unstable package versions.

Changes

Pointer Helper Migration

Layer / File(s)	Summary
Core Load Operations cmd/crossplane/render/op/load.go	InjectWatchedResource replaces ptr.To(...) calls with new(...) for Name and Namespace pointers; removes k8s.io/utils/ptr import.
Operation Test Updates cmd/crossplane/render/op/load_test.go, cmd/crossplane/common/resource/xpkg/client_test.go	Test expectations and helpers updated to use new(...) instead of ptr.To(...); import removed.
Validation Test Fixtures cmd/crossplane/validate/validate_test.go	Expected CRD outputs for OwnerReference.Controller, BlockOwnerDeletion, and schema XListType fields switched from ptr.To[bool](true) / ptr.to(...) to new(true) / new(...).

Code Cleanup & Tooling

Layer / File(s)	Summary
Linter Configuration .golangci.yml	gomodguard added to disabled linters list with inline note of deprecation.
Package & Implementation Cleanup cmd/crossplane/common/package.go, cmd/crossplane/xpkg/build.go, cmd/crossplane/validate/unknown_fields.go, cmd/crossplane/trace/internal/printer/default.go, cmd/crossplane/render/xr/cmd.go	Package-level //nolint:revive removed; buildCmd.Run simplified to assign buildOpts directly from GetRuntimeBaseImageOpts(); error list preallocated by count; string formatting refactored to use fmt.Fprintf; extra-resources control flow simplified to append directly into slice.
Gosec Suppressions & Minor Edits cmd/crossplane/validate/image.go, cmd/crossplane/xpkg/init.go, cmd/crossplane/xpkg/template_funcs.go, internal/docker/docker.go	//nolint:gosec added to document safe filepath.Walk, init script execution, template key assertions, and auth marshaling operations; Help() output refactored to use fmt.Fprintf.
Development Environment flake.nix	Nixpkgs overlay extended with pkgs.unstable import; development shell switched from pkgs.go-unstable / pkgs.golangci-lint to pkgs.unstable.go_1_26 / pkgs.unstable.golangci-lint.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

🚥 Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: updating Go to version 1.26. It is concise at 17 characters, well under the 72-character limit, and directly relates to the primary objective of the PR.
Description check	✅ Passed	The description comprehensively explains the rationale for the Go 1.26 update, references related changes, and lists completed checklist items. It is clearly related to the changeset across multiple files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Breaking Changes	✅ Passed	No public fields/flags in cmd/** were removed, renamed, or made required. Changes are internal refactoring, linter directives, and build system updates only.
Feature Gate Requirement	✅ Passed	This PR updates Go to 1.26 with refactoring and linter fixes. No experimental features, no apis/** changes, no significant behavioral changes—only code style updates and linting improvements.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (3)

cmd/crossplane/render/xr/cmd.go (1)

273-281: ⚡ Quick win

Consider adding a deprecation warning when --extra-resources is used

Thanks for simplifying this merge path — the direct append is clearer. Could we also print a one-time warning when c.ExtraResources != "" to guide users to --required-resources? That keeps behavior backward-compatible while improving migration UX.

Suggested tweak

 if c.ExtraResources != "" {
+	log.Info("Flag --extra-resources is deprecated; use --required-resources instead.")
 	ers, err := render.LoadRequiredResources(c.fs, c.ExtraResources)
 	if err != nil {
 		return errors.Wrapf(err, "cannot load extra resources from %q", c.ExtraResources)
 	}

 	// Merge extra resources into required resources.
 	rrs = append(rrs, ers...)
 }

As per coding guidelines: "**/cmd/**: Review CLI commands for proper flag handling, help text, and error messages. Ensure commands follow Crossplane CLI conventions. Ask about backward compatibility and user experience."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cmd/crossplane/render/xr/cmd.go` around lines 273 - 281, When
c.ExtraResources != "" is used we should emit a one-time deprecation/migration
warning to guide users toward --required-resources; update the block around the
call to render.LoadRequiredResources in cmd.go (the code that currently appends
ers to rrs) to log a clear warn message (e.g., "the --extra-resources flag is
deprecated; please use --required-resources instead") before loading/merging,
using the CLI logger or stderr so it appears to users; keep the existing load
and append behavior to preserve backward compatibility and ensure the message is
only printed once for this invocation.

.golangci.yml (2)

99-100: 💤 Low value

Consider naming the replacement linter in the comment.

According to the golangci-lint docs, gomodguard has a "New major version" and the recommendation is to "Use gomodguard_v2 instead." Naming gomodguard_v2 explicitly in the comment makes it clearer to future contributors what linter is providing the coverage:

✏️ Suggested comment update

-    # Deprecated and replaced by a new version, but still on by default.
-    - gomodguard
+    # Deprecated and replaced by gomodguard_v2, which is active via `default: all`.
+    - gomodguard

That said, is gomodguard_v2 actually being relied on here, or is module-dependency enforcement handled entirely by depguard (which already has rules configured in the settings block)? If gomodguard_v2 isn't needed at all, it might be worth disabling it too rather than silently inheriting it.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.golangci.yml around lines 99 - 100, Update the comment that mentions the
deprecated linter `gomodguard` to explicitly reference the replacement
`gomodguard_v2`, and then decide whether to keep or disable it: inspect the
repository's lint configuration for `depguard` rules (the `settings` block) and
if `depguard` fully covers module-dependency enforcement, remove or disable
`gomodguard`/`gomodguard_v2` so it isn't silently inherited; otherwise, leave
`gomodguard_v2` enabled and update the comment to read something like
"Deprecated and replaced by `gomodguard_v2`" to make the replacement explicit.

---

99-100: ⚡ Quick win

Update the comment to name the replacement linter explicitly.

The rationale comment is helpful, but naming the replacement linter would make it clearer for future contributors. gomodguard is deprecated and replaced by gomodguard_v2 (deprecated since v2.12.0). Consider updating the comment to:

-    # Deprecated and replaced by a new version, but still on by default.
+    # Deprecated; use gomodguard_v2 instead. Still enabled by default.
     - gomodguard

This gives contributors immediate context about which linter supersedes it and where to look if they need to adjust configuration.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.golangci.yml around lines 99 - 100, Update the explanatory comment above
the disabled linter entry for gomodguard to explicitly name its replacement
gomodguard_v2; locate the entry where "- gomodguard" is listed in .golangci.yml
and change the comment text to mention that gomodguard is deprecated and
replaced by gomodguard_v2 (deprecated since v2.12.0) so future contributors know
which linter supersedes it and where to look for configuration changes.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.golangci.yml:
- Around line 99-100: Update the comment that mentions the deprecated linter
`gomodguard` to explicitly reference the replacement `gomodguard_v2`, and then
decide whether to keep or disable it: inspect the repository's lint
configuration for `depguard` rules (the `settings` block) and if `depguard`
fully covers module-dependency enforcement, remove or disable
`gomodguard`/`gomodguard_v2` so it isn't silently inherited; otherwise, leave
`gomodguard_v2` enabled and update the comment to read something like
"Deprecated and replaced by `gomodguard_v2`" to make the replacement explicit.
- Around line 99-100: Update the explanatory comment above the disabled linter
entry for gomodguard to explicitly name its replacement gomodguard_v2; locate
the entry where "- gomodguard" is listed in .golangci.yml and change the comment
text to mention that gomodguard is deprecated and replaced by gomodguard_v2
(deprecated since v2.12.0) so future contributors know which linter supersedes
it and where to look for configuration changes.

In `@cmd/crossplane/render/xr/cmd.go`:
- Around line 273-281: When c.ExtraResources != "" is used we should emit a
one-time deprecation/migration warning to guide users toward
--required-resources; update the block around the call to
render.LoadRequiredResources in cmd.go (the code that currently appends ers to
rrs) to log a clear warn message (e.g., "the --extra-resources flag is
deprecated; please use --required-resources instead") before loading/merging,
using the CLI logger or stderr so it appears to users; keep the existing load
and append behavior to preserve backward compatibility and ensure the message is
only printed once for this invocation.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: a87864dc-1dbf-4d3e-a249-61fa45f93911

📥 Commits

Reviewing files that changed from the base of the PR and between a336c13 and 2e8ea06.

⛔ Files ignored due to path filters (5)

• go.mod is excluded by none and included by none
• go.sum is excluded by !**/*.sum and included by none
• nix/apps.nix is excluded by none and included by none
• nix/build.nix is excluded by none and included by none
• nix/checks.nix is excluded by none and included by none

📒 Files selected for processing (15)

• .golangci.yml
• cmd/crossplane/common/package.go
• cmd/crossplane/common/resource/xpkg/client_test.go
• cmd/crossplane/render/op/load.go
• cmd/crossplane/render/op/load_test.go
• cmd/crossplane/render/xr/cmd.go
• cmd/crossplane/trace/internal/printer/default.go
• cmd/crossplane/validate/image.go
• cmd/crossplane/validate/unknown_fields.go
• cmd/crossplane/validate/validate_test.go
• cmd/crossplane/xpkg/build.go
• cmd/crossplane/xpkg/init.go
• cmd/crossplane/xpkg/template_funcs.go
• flake.nix
• internal/docker/docker.go

[haarchri]

LGTM