chore(deps): update dependency golangci/golangci-lint to v2.10.1

hack/base.mk

@@ -1,5 +1,5 @@
 # renovate: datasource=github-tags depName=golangci/golangci-lint
-GOLANGCI_VERSION ?= v2.9.0
+GOLANGCI_VERSION ?= v2.10.1
 # renovate: datasource=github-tags depName=protocolbuffers/protobuf
 PROTOC_VERSION ?= v33.5
 TOOLS_BIN := $(shell mkdir -p build/tools && realpath build/tools)

internal/profiles/profiles.go

@@ -249,7 +249,7 @@ func Start(runner string, profile *types.Profile, cfg *types.Config, interactive
 		}
 	}
 
-	if len(imgs) > 1 && term.IsTerminal(int(os.Stdout.Fd())) {
+	if len(imgs) > 1 && term.IsTerminal(int(os.Stdout.Fd())) { //nolint:gosec // G115: fd values fit in int
 		if proceed("Not all workload images are present. Start loading them on the background?") {
 			go images.PreemptWorkloadImages(binary, cfg)
 		}
@@ -417,8 +417,8 @@ func createMagicCookie(profile *types.Profile) error {
 		xauthority = os.ExpandEnv("${HOME}/.XAUTHORITY")
 	}
 
-	slog.Debug("opening parent xauthority", "path", xauthority)
-	parent, err := os.Open(xauthority)
+	slog.Debug("opening parent xauthority", "path", xauthority) //nolint:gosec // G706: path is from trusted env var
+	parent, err := os.Open(xauthority)                          //nolint:gosec // G703: path is from trusted env var
 	if err != nil {
 		slog.Debug("failed to open parent xauthority", "error", err)
 		return err
@@ -670,7 +670,7 @@ func createNewDisplay(bin string, ca, cert, key []byte, profile *types.Profile,
 			grabberShortcut())
 	}
 
-	slog.Debug("exec: "+bin, "args", dockerArgs)
+	slog.Debug("exec", "binary", bin, "args", dockerArgs) //nolint:gosec // G706: binary path is from trusted config
 	cmd := execabs.Command(bin, dockerArgs...)
 	cmd.Env = append(cmd.Env, os.Environ()...)
 

internal/runners/docker/run.go

@@ -263,7 +263,7 @@ func Run(ew types.EffectiveWorkload) error {
 	args = append(args, wl.Command)
 	args = append(args, wl.Args...)
 
-	slog.Debug(fmt.Sprintf("exec: %s", runnerBinary), "args", args)
+	slog.Debug("exec", "binary", runnerBinary, "args", args) //nolint:gosec // G706: binary path is from trusted config
 	cmd := execabs.Command(runnerBinary, args...)
 
 	if ew.Workload.HostAccess.Mime {

internal/runners/podman/run.go

@@ -251,7 +251,7 @@ func Run(ew types.EffectiveWorkload) error {
 	args = append(args, wl.Command)
 	args = append(args, wl.Args...)
 
-	slog.Debug(fmt.Sprintf("exec: %s", runnerBinary), "args", args)
+	slog.Debug("exec", "binary", runnerBinary, "args", args) //nolint:gosec // G706: binary path is from trusted config
 	cmd := execabs.Command(runnerBinary, args...)
 
 	if ew.Workload.HostAccess.Mime {