diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index d69f35f95..8c3aab229 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -22,7 +22,7 @@ jobs:
       - name: Run golangci-lint
         uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # v6.1.1
         with:
-          version:  v1.63.4
+          version: v1.64.6
           args: --verbose
       - uses: codecov/codecov-action@a2f73fb6db51fcd2e0aa085dfb36dea90c5e3689 # v5.0.2
         with:
diff --git a/.github/workflows/vulncheck.yml b/.github/workflows/vulncheck.yml
new file mode 100644
index 000000000..7d9166184
--- /dev/null
+++ b/.github/workflows/vulncheck.yml
@@ -0,0 +1,36 @@
+name: vulncheck
+
+on:
+  push:
+    branches:
+      - 'master'
+      - 'release-*'
+  pull_request:
+    branches:
+      - 'master'
+      - 'release-*'
+
+env:
+  # Golang version to use across CI steps
+  # renovate: datasource=golang-version packageName=golang
+  GOLANG_VERSION: '1.24.1'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  vulncheck:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@8410ad0602e1e429cee44a835ae9f77f654a6694 # v4.0.0
+
+      - name: Run govulncheck
+        uses: golang/govulncheck-action@v1
+        with:
+          go-version-input: ${{ env.GOLANG_VERSION }}
+          repo-checkout: false
diff --git a/go.mod b/go.mod
index 1dae69966..cbbb7ea65 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/argoproj/gitops-engine
 
-go 1.23.5
+go 1.24.2
 
 require (
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
diff --git a/pkg/utils/json/json.go b/pkg/utils/json/json.go
index b1aa5817e..4cb2f8ed0 100644
--- a/pkg/utils/json/json.go
+++ b/pkg/utils/json/json.go
@@ -7,16 +7,14 @@ func removeFields(config, live any) any {
 		l, ok := live.(map[string]any)
 		if ok {
 			return RemoveMapFields(c, l)
-		} else {
-			return live
 		}
+		return live
 	case []any:
 		l, ok := live.([]any)
 		if ok {
 			return RemoveListFields(c, l)
-		} else {
-			return live
 		}
+		return live
 	default:
 		return live
 	}
diff --git a/pkg/utils/json/json_test.go b/pkg/utils/json/json_test.go
new file mode 100644
index 000000000..d1016e693
--- /dev/null
+++ b/pkg/utils/json/json_test.go
@@ -0,0 +1,105 @@
+package json
+
+import (
+	"reflect"
+	"testing"
+)
+
+func Test_removeFields(t *testing.T) {
+	tests := []struct {
+		name   string
+		config any
+		live   any
+		want   any
+	}{
+		{
+			name: "map",
+			config: map[string]any{
+				"foo": "bar",
+			},
+			live: map[string]any{
+				"foo": "baz",
+				"bar": "baz",
+			},
+			want: map[string]any{
+				"foo": "baz",
+			},
+		},
+		{
+			name: "nested map",
+			config: map[string]any{
+				"foo": map[string]any{
+					"bar": "baz",
+				},
+				"bar": "baz",
+			},
+			live: map[string]any{
+				"foo": map[string]any{
+					"bar": "qux",
+					"baz": "qux",
+				},
+				"bar": "baz",
+			},
+			want: map[string]any{
+				"foo": map[string]any{
+					"bar": "qux",
+				},
+				"bar": "baz",
+			},
+		},
+		{
+			name: "list",
+			config: []any{
+				map[string]any{
+					"foo": "bar",
+				},
+			},
+			live: []any{
+				map[string]any{
+					"foo": "baz",
+					"bar": "baz",
+				},
+			},
+			want: []any{
+				map[string]any{
+					"foo": "baz",
+				},
+			},
+		},
+		{
+			name: "nested list",
+			config: []any{
+				map[string]any{
+					"foo": map[string]any{
+						"bar": "baz",
+					},
+					"bar": "baz",
+				},
+			},
+			live: []any{
+				map[string]any{
+					"foo": map[string]any{
+						"bar": "qux",
+						"baz": "qux",
+					},
+					"bar": "baz",
+				},
+			},
+			want: []any{
+				map[string]any{
+					"foo": map[string]any{
+						"bar": "qux",
+					},
+					"bar": "baz",
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := removeFields(tt.config, tt.live); !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("removeFields() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}