Bump deps

[natalieparellano]

Summary

• Updates go
• Supersedes:
  • build(deps): bump the go-dependencies group across 1 directory with 11 updates #2262
  • build(deps): bump github.com/docker/cli from 26.1.4+incompatible to 27.1.0+incompatible #2233
  • build(deps): bump anchore/scan-action from 4 to 5 #2271
  • build(deps): bump softprops/action-gh-release from 1 to 2 #2094

Output

Before

After

Documentation

• Should this change be documented?
  • Yes, see #___
  • No

Related

Resolves #___

[natalieparellano]

The TOML bump is biting us, taking a look: https://github.com/buildpacks/pack/actions/runs/11561373034/job/32180217662?pr=2273#step:11:8473

[natalieparellano]

This should be blocked on the next lifecycle minor (ETA: first week of November)

[codecov]

Codecov Report

Attention: Patch coverage is 58.82353% with 7 lines in your changes missing coverage. Please review.

Project coverage is 70.03%. Comparing base (466439d) to head (68447dd).
Report is 12 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2273   +/-   ##
=======================================
  Coverage   70.03%   70.03%           
=======================================
  Files         254      254           
  Lines       18703    18703           
=======================================
  Hits        13096    13096           
  Misses       4734     4734           
  Partials      873      873           

Flag	Coverage Δ
os_linux	69.16% <52.95%> (-<0.01%)	⬇️
os_macos-arm64	65.37% <11.77%> (+0.02%)	⬆️
os_windows	69.55% <58.83%> (+0.66%)	⬆️
unit	70.03% <58.83%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

[jjbustamante]

@natalieparellano Do we want to update to lifecycle 0.20.3?

• here
• here

[jjbustamante]

If we always pull the latest go version, I think we could have a similar error than the one we had with the github actions, where our Dockerfile could stay behind right?

[natalieparellano]

This one should be okay. We're using go-version-file: 'go.mod' (line below) so it knows that the go version should be 1.23.x. The check-latest: true just grabs the latest patch

[natalieparellano]

Do we want to update to lifecycle 0.20.3?

Ehh, sure - strictly speaking, it's kinda orthogonal to this PR which is just library changes. But I don't see why pack shouldn't default to the latest binary so let's add it.

[jjbustamante]

Awesome @natalieparellano