gomod: update min go version

[crazy-max]

Don't think we require 1.21.3 as min go version, 1.21.0 should be enough. Also tried to set 1.21 but it seems tidy complains and expects a patch release 1.21.0: https://github.com/docker/buildkit-syft-scanner/actions/runs/7232529430/job/19706797619#step:4:447

Not sure why in other projects like https://github.com/docker/buildx/blob/8484fcdd5715c0683e8605e05cdffc0bfa8fde94/go.mod#L3 it doesn't complain though 🤔

Maybe something is cached on golang proxy?

Also add commit to align go version in vendor dockerfile.

[crazy-max]

Maybe something is cached on golang proxy?

Ok found why: https://go.dev/doc/toolchain

"The go get and go mod tidy commands maintain the go line to be greater than or equal to the go line of any required dependency module."

So in this case https://github.com/anchore/syft/blob/f4dd36ca9d8ac8f31bf3a9223f24b4647098c437/go.mod#L3 😢

[jedevc]

@crazy-max looks like this comes from anchore/syft#2108?

[crazy-max]

@crazy-max looks like this comes from anchore/syft#2108?

Yes indeed. I tried to set back 1.21 in syft but it also enforces 1.21.0 because one of underlying modules is 1.21.0