Repository navigation
Release v1.26.3 - #4
Merged
Merged
Conversation
Backport of golangci-lint upstream fix #6515 (commit 1b86933). Without filtering, GIT_* env vars from the calling environment (e.g. GIT_DIR, GIT_INDEX_FILE) leak into the `git clone` invocation issued by `gopherlint custom`, which can cause the clone to target the wrong working tree or fail outright. The fix retains only the GIT_* vars that should propagate (SSH config, SSL settings, GIT_CONFIG_KEY_*/VALUE_* overrides, etc.) and drops the rest.
Picks up two upstream bug fixes: - v1.5.5 a7be78a: correct auto-fix replacement offset for inline comments - v1.5.6 88cf245: bounds-check before slicing pf.lines to prevent panic on files with //line directives No new rules, no new config options, no behavior changes to existing rules. Other commits in the range are //nolint cleanups and release process tweaks.
…secheck fork Verbatim port of golangci/sqlclosecheck@1b5fadbb, applied to the local vendored copy of ryanrolds/sqlclosecheck. Pre-fix, getAction returns actionPassed for an interface-method Close() call on a target type (e.g. pgx.Rows), because StaticCallee() is nil for interface dispatch and isTarget never gets set. The new branch handles the Method != nil case explicitly and returns actionClosed/actionNoOp based on the receiver type — same logic the *ssa.Defer case has used for a while. Not switching wholesale to the golangci/sqlclosecheck fork: its nil-Referrers fix is a strict subset of gopherlint's local cherry-pick (commit 9f0a0ed), so a switch would regress two load-bearing nil checks.
Verbatim cherry-picks from upstream securego/gosec: - #1578 (6641fcf) Fix G115 false positives for guarded int64-to-byte conversions. Tracks SSA Phi edge values and walks one block up the predecessor chain so range-checked conversions in branches are recognized as safe. - #1589 (cbf46b8) fix(analyzer): per-package rule instantiation eliminates concurrent map crash. Stores RuleBuilder funcs after LoadRules and rebuilds the rule set per package walk so concurrent workers no longer share G304 readfile's mutable cleanedVar/joinedVar maps. The four G118 bugfixes from this upstream range (#1585, #1592, #1593, #1596) are not applied — G118 is a charter-excluded rule that gopherlint does not vendor (added upstream in #1516, post-v2.23.0).
Verbatim cherry-pick of upstream 8aec3f4. Adds a pkg.IllTyped guard in buildSSA so gosec returns a clean error for packages with type errors instead of letting the SSA builder panic at golang.org/x/tools/go/ssa .emitConv when given partial type info. AST-based rules continue to run normally on the affected package. Other PRs in the v2.25.0 → v2.26.1 range are not applied: - #1602 fixes G118, a charter-excluded rule gopherlint does not vendor. - #1608 (taint hang on dense CHA edges) and #1614 (G117 false positives for custom marshalers) target upstream code that has diverged significantly from gopherlint's vendored copy — taint.go has more than doubled in size upstream and rules/secret_serialization.go has been largely rewritten. Applying these would require authoring new fixes against shapes that don't exist here, not copy-pasting.
Bug-fix backports from golangci-lint v2.10.1 → v2.12.1, godot v1.5.5 + v1.5.6, golangci/sqlclosecheck pgx interface dispatch, and gosec PRs #1578, #1589, #1607.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Backports six upstream bug fixes for the v1.26.3 release. Targets golangci-lint v2.10.1 → v2.12.1, plus selected fixes from godot, sqlclosecheck (pgx fork), and gosec.
gopherlint custom: filter env vars when cloning the repository (golangci-lint#6515)//linedirective panic guard (v1.5.6)Close()on pgx target types (cherry-pick fromgolangci/sqlclosecheck@1b5fadbb, without switching wholesale — the fork's nil-Referrers fix is a strict subset of our local one)IllTypedSSA panic guard (#1607)Charter-excluded fixes from the same upstream range (G118 series #1585/#1592/#1593/#1596/#1602; gomodguard_v2 panic; install.sh) and divergence-blocked fixes (gosec #1608 taint hang, #1614 G117 marshalers) are intentionally not applied; rationale lives in the individual commit messages.
CHANGELOG.md updated; merging to
maintriggers the auto-tag workflow which createsv1.26.3and kicks off the release build.