diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 7c26dd22a8e..e06c9207321 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -27,21 +27,21 @@ jobs:
     # see https://github.community/t/github-sha-isnt-the-value-expected/17903/2
     # so we checkout the repo with `fetch-depth: 2` and let `codecov/codecov-action` to retrieve the real commit hash.
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
       with:
         path: go/src/github.com/${{ github.repository }}
         fetch-depth: 2
     - name: Set up Go
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@v5
       with:
         go-version-file: go/src/github.com/${{ github.repository }}/go.mod
-        go-version: 1.21.3
+        cache-dependency-path: "**/*.sum"
     - name: Set vars
       run: |
         echo "GOCACHE=$(go env GOCACHE)" >> $GITHUB_ENV
         echo "GOMODCACHE=$(go env GOMODCACHE)" >> $GITHUB_ENV
     - name: Try to use build cache
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       with:
         path: |
           ${{ env.GOCACHE }}
diff --git a/.golangci.yml b/.golangci.yml
index bab9f47ebb3..27047665ed1 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -22,6 +22,11 @@ linters-settings:
       - G201 # Rule: SQL query construction using format string
       - G114 # Rule: Use of net/http serve function that has no support for setting timeouts
       - G112 # Rule: Potential slowloris attack
+      - G115 # Rule: integer overflow conversion
+  
+  govet:
+    disable:
+      - printf # non-constant format string in call
 
 issues:
   exclude-rules:
diff --git a/cmd/backup-manager/app/util/util.go b/cmd/backup-manager/app/util/util.go
index 5ee9068807a..b00b1eaa0c2 100644
--- a/cmd/backup-manager/app/util/util.go
+++ b/cmd/backup-manager/app/util/util.go
@@ -175,7 +175,7 @@ func ConstructBRGlobalOptionsForBackup(backup *v1alpha1.Backup) ([]string, error
 	}
 	args = append(args, storageArgs...)
 
-	if spec.TableFilter != nil && len(spec.TableFilter) > 0 {
+	if len(spec.TableFilter) > 0 {
 		for _, tableFilter := range spec.TableFilter {
 			args = append(args, "--filter", tableFilter)
 		}
@@ -204,7 +204,7 @@ func ConstructDumplingOptionsForBackup(backup *v1alpha1.Backup) []string {
 	var args []string
 	config := backup.Spec
 
-	if config.TableFilter != nil && len(config.TableFilter) > 0 {
+	if len(config.TableFilter) > 0 {
 		for _, tableFilter := range config.TableFilter {
 			args = append(args, "--filter", tableFilter)
 		}
@@ -244,7 +244,7 @@ func ConstructBRGlobalOptionsForRestore(restore *v1alpha1.Restore) ([]string, er
 	}
 	args = append(args, storageArgs...)
 
-	if config.TableFilter != nil && len(config.TableFilter) > 0 {
+	if len(config.TableFilter) > 0 {
 		for _, tableFilter := range config.TableFilter {
 			args = append(args, "--filter", tableFilter)
 		}
diff --git a/cmd/http-service/go.mod b/cmd/http-service/go.mod
index 8092ca4902f..4e0ca6055bf 100644
--- a/cmd/http-service/go.mod
+++ b/cmd/http-service/go.mod
@@ -1,6 +1,6 @@
 module github.com/pingcap/tidb-operator/http-service
 
-go 1.21
+go 1.23.1
 
 require (
 	github.com/gin-gonic/gin v1.10.0
diff --git a/docs/CONTRIBUTING.md b/docs/CONTRIBUTING.md
index 04d0398d32c..00c59124719 100644
--- a/docs/CONTRIBUTING.md
+++ b/docs/CONTRIBUTING.md
@@ -2,7 +2,7 @@
 
 ## Prerequisites
 
-Please install [Go 1.21.x](https://go.dev/doc/install). If you want to run TiDB Operator locally, please also install the latest version of [Docker](https://www.docker.com/get-started/), [kind](https://kind.sigs.k8s.io/docs/user/quick-start/), [kubectl](https://kubernetes.io/docs/tasks/tools/#kubectl) and [Helm](https://helm.sh/docs/intro/quickstart/).
+Please install [Go 1.23.x](https://go.dev/doc/install). If you want to run TiDB Operator locally, please also install the latest version of [Docker](https://www.docker.com/get-started/), [kind](https://kind.sigs.k8s.io/docs/user/quick-start/), [kubectl](https://kubernetes.io/docs/tasks/tools/#kubectl) and [Helm](https://helm.sh/docs/intro/quickstart/).
 
 ## Workflow
 
diff --git a/go.mod b/go.mod
index 43a37ede807..876e51522c2 100644
--- a/go.mod
+++ b/go.mod
@@ -4,7 +4,7 @@
 
 module github.com/pingcap/tidb-operator
 
-go 1.21
+go 1.23.1
 
 require (
 	cloud.google.com/go/storage v1.30.1
diff --git a/hack/lib.sh b/hack/lib.sh
index 297bd5cdba8..b552b582733 100644
--- a/hack/lib.sh
+++ b/hack/lib.sh
@@ -279,7 +279,7 @@ function hack::ensure_misspell() {
 
 function hack::ensure_golangci_lint() {
   echo "Installing golangci_lint..."
-  GOBIN=$OUTPUT_BIN go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.54.2
+  GOBIN=$OUTPUT_BIN go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.61.0
 }
 
 function hack::ensure_controller_gen() {
diff --git a/pkg/apis/go.mod b/pkg/apis/go.mod
index 1e4a97f6afc..9fb23529fc8 100644
--- a/pkg/apis/go.mod
+++ b/pkg/apis/go.mod
@@ -1,6 +1,6 @@
 module github.com/pingcap/tidb-operator/pkg/apis
 
-go 1.21
+go 1.23.1
 
 require (
 	github.com/BurntSushi/toml v0.3.1
diff --git a/pkg/client/go.mod b/pkg/client/go.mod
index 7b327b671c2..8eeb02cef36 100644
--- a/pkg/client/go.mod
+++ b/pkg/client/go.mod
@@ -1,6 +1,6 @@
 module github.com/pingcap/tidb-operator/pkg/client
 
-go 1.21
+go 1.23.1
 
 require (
 	github.com/pingcap/tidb-operator/pkg/apis v1.6.0
diff --git a/pkg/controller/tidb_control.go b/pkg/controller/tidb_control.go
index b143516e2a2..6e84119d93d 100644
--- a/pkg/controller/tidb_control.go
+++ b/pkg/controller/tidb_control.go
@@ -93,7 +93,7 @@ func (c *defaultTiDBControl) GetInfo(tc *v1alpha1.TidbCluster, ordinal int32) (*
 		return nil, err
 	}
 	if res.StatusCode != http.StatusOK {
-		errMsg := fmt.Errorf(fmt.Sprintf("Error response %s:%v URL: %s", string(body), res.StatusCode, url))
+		errMsg := fmt.Errorf("Error response %s:%v URL: %s", string(body), res.StatusCode, url)
 		return nil, errMsg
 	}
 	info := DBInfo{}
@@ -132,7 +132,7 @@ func getBodyOK(httpClient *http.Client, apiURL string) ([]byte, error) {
 		return nil, err
 	}
 	if res.StatusCode >= 400 {
-		errMsg := fmt.Errorf(fmt.Sprintf("Error response %s:%v URL %s", string(body), res.StatusCode, apiURL))
+		errMsg := fmt.Errorf("Error response %s:%v URL %s", string(body), res.StatusCode, apiURL)
 		return nil, errMsg
 	}
 
diff --git a/pkg/controller/tidb_control_test.go b/pkg/controller/tidb_control_test.go
index 2ff635efae4..347ae244915 100644
--- a/pkg/controller/tidb_control_test.go
+++ b/pkg/controller/tidb_control_test.go
@@ -79,6 +79,7 @@ o8O7UTMyQ7MUrPusaqsG/QuvppbdahOLzkVc0E5jUOL/dgSxsdOqc7EIxd94Cg65
 cQQSTMrQTbQLo5c=
 -----END CERTIFICATE-----
 `
+	// nolint:gosec
 	keyData string = `
 -----BEGIN EC PRIVATE KEY-----
 MHcCAQEEIFbUNEYv0ujI3dTLbnb5lTBfRxwst3lMROmRV2tN7NTroAoGCCqGSM49
diff --git a/pkg/manager/member/scaler.go b/pkg/manager/member/scaler.go
index 000e2583f79..c347cb50dda 100644
--- a/pkg/manager/member/scaler.go
+++ b/pkg/manager/member/scaler.go
@@ -14,6 +14,7 @@
 package member
 
 import (
+	"errors"
 	"fmt"
 	"time"
 
@@ -68,7 +69,7 @@ func (s *generalScaler) deleteDeferDeletingPVC(controller runtime.Object, member
 	if err != nil {
 		msg := fmt.Sprintf("%s %s/%s list pvc failed, selector: %s, err: %v", kind, ns, meta.GetName(), selector, err)
 		klog.Error(msg)
-		return skipReason, fmt.Errorf(msg)
+		return skipReason, errors.New(msg)
 	}
 	if len(pvcs) == 0 {
 		klog.Infof("%s %s/%s list pvc not found, selector: %s", kind, ns, meta.GetName(), selector)
@@ -116,12 +117,12 @@ func (s *generalScaler) updateDeferDeletingPVC(tc *v1alpha1.TidbCluster,
 	if err != nil {
 		msg := fmt.Sprintf("Cluster %s/%s list pvc failed, selector: %s, err: %v", ns, tc.Name, selector, err)
 		klog.Error(msg)
-		return fmt.Errorf(msg)
+		return errors.New(msg)
 	}
 	if len(pvcs) == 0 {
 		msg := fmt.Sprintf("Cluster %s/%s list pvc not found, selector: %s", ns, tc.Name, selector)
 		klog.Error(msg)
-		return fmt.Errorf(msg)
+		return errors.New(msg)
 	}
 
 	for _, pvc := range pvcs {
diff --git a/pkg/util/http/httputil.go b/pkg/util/http/httputil.go
index 710b1c0a269..483c1d0d441 100644
--- a/pkg/util/http/httputil.go
+++ b/pkg/util/http/httputil.go
@@ -14,6 +14,7 @@
 package httputil
 
 import (
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -36,7 +37,7 @@ func ReadErrorBody(body io.Reader) (err error) {
 	if err != nil {
 		return err
 	}
-	return fmt.Errorf(string(bodyBytes))
+	return errors.New(string(bodyBytes))
 }
 
 // GetBodyOK returns the body or an error if the response is not okay
diff --git a/tests/e2e/br/br.go b/tests/e2e/br/br.go
index 58e5c1c81fb..b296d828fe0 100644
--- a/tests/e2e/br/br.go
+++ b/tests/e2e/br/br.go
@@ -936,7 +936,8 @@ func createTidbCluster(f *e2eframework.Framework, name string, version string, e
 func createLogBackupEnableTidbCluster(f *e2eframework.Framework, name string, version string, enableTLS bool, skipCA bool) error {
 	ns := f.Namespace.Name
 	// TODO: change to use tidbclusterutil like brutil
-	tc := fixture.GetTidbCluster(ns, name, version)
+	// NOTE(pdms): some cases will port forward pd service to get current ts, so we disable TSO microservice here
+	tc := fixture.GetTidbClusterWithoutPDMS(ns, name, version)
 	tc.Spec.PD.Replicas = 1
 	tc.Spec.TiKV.Replicas = 1
 	tc.Spec.TiDB.Replicas = 1
diff --git a/tests/e2e/br/framework/br/wait.go b/tests/e2e/br/framework/br/wait.go
index 1d061fe121c..72e510c62b6 100644
--- a/tests/e2e/br/framework/br/wait.go
+++ b/tests/e2e/br/framework/br/wait.go
@@ -192,8 +192,12 @@ func WaitForLogBackupReachTS(name, pdhost, expect string, timeout time.Duration)
 		if err != nil {
 			return false, err
 		}
-		if len(kvs) != 1 {
-			return false, fmt.Errorf("get log backup checkpoint ts from pd %s failed", pdhost)
+		if len(kvs) == 0 {
+			// wait for log backup start
+			return false, nil
+		}
+		if len(kvs) > 1 {
+			return false, fmt.Errorf("get log backup checkpoint ts from pd %s failed, expect 1, got %d", pdhost, len(kvs))
 		}
 		checkpointTS := binary.BigEndian.Uint64(kvs[0].Value)
 		expectTS, err := config.ParseTSString(expect)
diff --git a/tests/examples/002-selfsigned-tls.sh b/tests/examples/002-selfsigned-tls.sh
index c6cb608199f..625bebd1a47 100755
--- a/tests/examples/002-selfsigned-tls.sh
+++ b/tests/examples/002-selfsigned-tls.sh
@@ -20,7 +20,7 @@ source "${ROOT}/hack/lib.sh"
 source "${ROOT}/tests/examples/t.sh"
 
 NS=$(basename ${0%.*})
-CERT_MANAGER_VERSION=1.12.2
+CERT_MANAGER_VERSION=1.15.1
 
 PORT_FORWARD_PID=
 
diff --git a/tests/images/e2e/Dockerfile b/tests/images/e2e/Dockerfile
index 6f1d1d6a423..6efb4fe90dc 100644
--- a/tests/images/e2e/Dockerfile
+++ b/tests/images/e2e/Dockerfile
@@ -25,7 +25,7 @@ RUN curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2
     unzip awscliv2.zip && \
     ./aws/install && \
     rm -r aws awscliv2.zip
-RUN curl -L "https://github.com/jetstack/cert-manager/releases/download/v1.12.2/cert-manager.yaml" -o "/cert-manager.yaml"
+RUN curl -L "https://github.com/jetstack/cert-manager/releases/download/v1.15.1/cert-manager.yaml" -o "/cert-manager.yaml"
 ADD minio /minio
 
 ADD tidb-operator /charts/e2e/tidb-operator
diff --git a/tests/images/kubekins-e2e/Dockerfile b/tests/images/kubekins-e2e/Dockerfile
index 3931ecb36c1..7a5c5460404 100644
--- a/tests/images/kubekins-e2e/Dockerfile
+++ b/tests/images/kubekins-e2e/Dockerfile
@@ -1,6 +1,6 @@
 FROM debian:buster-slim
 
-ARG GO_VERSION=1.21.3
+ARG GO_VERSION=1.23.1
 
 # common util tools
 RUN apt-get update && \
diff --git a/tests/third_party/k8s/resource_usage_gatherer.go b/tests/third_party/k8s/resource_usage_gatherer.go
index f71fc0b386f..d56cbffd6e8 100644
--- a/tests/third_party/k8s/resource_usage_gatherer.go
+++ b/tests/third_party/k8s/resource_usage_gatherer.go
@@ -23,6 +23,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"math"
 	"regexp"
@@ -592,7 +593,7 @@ func (g *ContainerResourceGatherer) StopAndSummarize(percentiles []int, constrai
 		}
 	}
 	if len(violatedConstraints) > 0 {
-		return &summary, fmt.Errorf(strings.Join(violatedConstraints, "\n"))
+		return &summary, errors.New(strings.Join(violatedConstraints, "\n"))
 	}
 	return &summary, nil
 }