Open
Conversation
3061ab1 to
ad5b351
Compare
Contributor
Author
|
55a7196 to
ca1e8bd
Compare
4ddfa54 to
6a6166b
Compare
8eb3e76 to
f1aa247
Compare
7c8ec28 to
2b721f7
Compare
2b721f7 to
2be196d
Compare
2be196d to
458ca5f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.0.0→v2.0.1v1.63.4→v2.11.4v5.3.1→v6.0.2v2.6.3→v4.1.4Release Notes
MakeNowJust/heredoc (github.com/MakeNowJust/heredoc)
v2.0.1Compare Source
Version 2.0.1
Fixes
importpath for Go modulesv2.0.0Compare Source
Version 2.0.0
Breaking Changes
golangci/golangci-lint (github.com/golangci/golangci-lint)
v2.11.4Compare Source
Released on 2026-03-22
govet-modernize: from 0.42.0 to 0.43.0noctx: from 0.5.0 to 0.5.1sqlclosecheck: from 0.5.1 to 0.6.0v2.11.3Compare Source
Released on 2026-03-10
gosec: from v2.24.7 to619ce21v2.11.2Compare Source
Released on 2026-03-07
fmt: fix error when using thefmtcommand with explicit paths.v2.11.1Compare Source
Released on 2026-03-06
Due to an error related to AUR, some artifacts of the v2.11.0 release have not been published.
This release contains the same things as v2.11.0.
v2.11.0Compare Source
Released on 2026-03-06
errcheck: from 1.9.0 to 1.10.0 (excludecrypto/rand.Readby default)gosec: from 2.23.0 to 2.24.6 (new rules:G113,G118,G119,G120,G121,G122,G123,G408,G707)noctx: from 0.4.0 to 0.5.0 (new detection:httptest.NewRequestWithContext)prealloc: from 1.0.2 to 1.1.0revive: from 1.14.0 to 1.15.0 (var-namingto a new rulepackage-naming)gocognit: from 1.2.0 to 1.2.1gosec: from 2.24.6 to 2.24.7unqueryvet: from 1.5.3 to 1.5.4v2.10.1Compare Source
Released on 2026-02-17
v2.10.0Compare Source
Released on 2026-02-17
ginkgolinter: from 0.22.0 to 0.23.0gosec: from 2.22.11 to 2.23.0 (new rules:G117,G602,G701,G702,G703,G704,G705,G706)staticcheck: from 0.6.1 to 0.7.0godoclint: from 0.11.1 to 0.11.2v2.9.0Compare Source
Released on 2026-02-10
arangolint: from 0.3.1 to 0.4.0 (new rule: detect potential query injections)ginkgolinter: from 0.21.2 to 0.22.0 (support for wrappers)golines: from 0.14.0 to 0.15.0misspell: from 0.7.0 to 0.8.0unqueryvet: from 1.4.0 to 1.5.3 (new options:check-n1,check-sql-injection,check-tx-leaks,allow,custom-rules)wsl: from 5.3.0 to 5.6.0 (new rule:after-block)modernize: from 0.41.0 to 0.42.0prealloc: from 1.0.1 to 1.0.2protogetter: from 0.3.18 to 0.3.20v2.8.0Compare Source
Released on 2026-01-07
godoc-lint: from 0.10.2 to 0.11.1 (new rule:require-stdlib-doclink)golines: from442fd00to 0.14.0gomoddirectives: from 0.7.1 to 0.8.0gosec: fromdaccba6to 2.22.11 (new rule:G116)modernize: from 0.39.0 to 0.40.0 (new analyzers:stringscut,unsafefuncs)prealloc: from 1.0.0 to 1.0.1 (message changes)unqueryvet: from 1.3.0 to 1.4.0 (new options:check-aliased-wildcard,check-string-concat,check-format-strings,check-string-builder,check-subqueries,ignored-functions,sql-builders)go-critic: from 0.14.2 to 0.14.3go-errorlint: from 1.8.0 to 1.9.0govet: from 0.39.0 to 0.40.0protogetter: from 0.3.17 to 0.3.18revive: add missing enable-default-rules settingv2.7.2Compare Source
Released on 2025-12-07
gosec: from 2.22.10 todaccba6v2.7.1Compare Source
Released on 2025-12-04
modernize: disablestringscutanalyzerv2.7.0Compare Source
customcommandno-sprintf-host-port: from 0.2.0 to 0.3.1 (ignore string literals without a colon)unqueryvet: from 1.2.1 to 1.3.0 (handlesconstandvardeclarations)revive: from 1.12.0 to 1.13.0 (new option:enable-default-rules, new rules:forbidden-call-in-wg-go,unnecessary-if,inefficient-map-lookup)modernize: from 0.38.0 to 0.39.0 (new analyzers:plusbuild,stringscut)perfsprint: from 0.10.0 to 0.10.1wrapcheck: from 2.11.0 to 2.12.0godoc-lint: from 0.10.1 to 0.10.2customcommandv2.6.2Compare Source
Released on 2025-11-14
fmtcommand with symlinkstestableexamples: from 1.0.0 to 1.0.1testpackage: from 1.1.1 to 1.1.2v2.6.1Compare Source
v2.6.0Compare Source
modernizeanalyzer suitearangolint: from 0.2.0 to 0.3.1dupword: from 0.1.6 to 0.1.7 (new optioncomments-only)go-critic: from 0.13.0 to 0.14.0 (new rules/checkers:zeroByteRepeat,dupOption)gofumpt: from 0.9.1 to 0.9.2 ("clothe" naked returns is now controlled by theextra-rulesoption)perfsprint: from 0.9.1 to 0.10.0 (new options:concat-loop,loop-other-ops)wsl: from 5.2.0 to 5.3.0dupword: from 0.1.6 to 0.1.7durationcheck: from 0.0.10 to 0.0.11exptostd: from 0.4.4 to 0.4.5fatcontext: from 0.8.1 to 0.9.0forbidigo: from 2.1.0 to 2.3.0ginkgolinter: from 0.21.0 to 0.21.2godoc-lint: from 0.10.0 to 0.10.1gomoddirectives: from 0.7.0 to 0.7.1gosec: from 2.22.8 to 2.22.10makezero: from 2.0.1 to 2.1.0nilerr: from 0.1.1 to 0.1.2paralleltest: from 1.0.14 to 1.0.15protogetter: from 0.3.16 to 0.3.17unparam: from0df0534to5beb8c8v2.5.0Compare Source
godoclintlinter https://github.com/godoc-lint/godoc-lintunqueryvetlinter https://github.com/MirrexOne/unqueryvetiotamixinglinter https://github.com/AdminBenni/iota-mixingembeddedstructfieldcheck: from 0.3.0 to 0.4.0 (new option:empty-line)err113: fromaea10b5to 0.1.1 (skip internals ofIsmethods forerrortype)ginkgolinter: from 0.20.0 to 0.21.0 (new option:force-tonot)gofumpt: from 0.8.0 to 0.9.1 (new rule is to "clothe" naked returns for the sake of clarity)ineffassign: from 0.1.0 to 0.2.0 (new option:check-escaping-errors)musttag: from 0.13.1 to 0.14.0 (support interface methods)revive: from 1.11.0 to 1.12.0 (new options:identical-ifelseif-branches,identical-ifelseif-conditions,identical-switch-branches,identical-switch-conditions,package-directory-mismatch,unsecure-url-scheme,use-waitgroup-go,useless-fallthrough)thelper: from 0.6.3 to 0.7.1 (skipt.Helperin functions passed tosynctest.Test)wsl: from 5.1.1 to 5.2.0 (improvements related to subexpressions)asciicheck: from 0.4.1 to 0.5.0errname: from 1.1.0 to 1.1.1fatcontext: from 0.8.0 to 0.8.1go-printf-func-name: from 0.1.0 to 0.1.1godot: from 1.5.1 to 1.5.4gosec: from 2.22.7 to 2.22.8nilerr: from 0.1.1 to a temporary forknilnil: from 1.1.0 to 1.1.1protogetter: from 0.3.15 to 0.3.16tagliatelle: from 0.7.1 to 0.7.2testifylint: from 1.6.1 to 1.6.4v2.4.0Compare Source
exhaustruct: from v3.3.1 to 4.0.0 (new options:allow-empty,allow-empty-rx,allow-empty-returns,allow-empty-declarations)godox: trim filepath from report messagesstaticcheck: allow empty optionstagalign: from 1.4.2 to 1.4.3v2.3.1Compare Source
gci: from 0.13.6 to 0.13.7gosec: from 2.22.6 to 2.22.7noctx: from 0.3.5 to 0.4.0wsl: from 5.1.0 to 5.1.1v2.3.0Compare Source
ginkgolinter: from 0.19.1 to 0.20.0 (new option:force-assertion-description)iface: from 1.4.0 to 1.4.1 (report message improvements)noctx: from 0.3.4 to 0.3.5 (new detections:log/slog,exec,crypto/tls)revive: from 1.10.0 to 1.11.0 (new rule:enforce-switch-style)wsl: from 5.0.0 to 5.1.0gosec: from 2.22.5 to 2.22.6noinlineerr: from 1.0.4 to 1.0.5sloglint: from 0.11.0 to 0.11.1v2.2.2Compare Source
noinlineerr: from 1.0.3 to 1.0.4v2.2.1Compare Source
varnamelen: fix configurationv2.2.0Compare Source
arangolintlinter https://github.com/Crocmagnon/arangolintembeddedstructfieldchecklinter https://github.com/manuelarte/embeddedstructfieldchecknoinlineerrlinter https://github.com/AlwxSin/noinlineerrswaggoformatter https://github.com/golangci/swaggoswagerrcheck: addverboseoptionfuncorder: from 0.2.1 to 0.5.0 (new optionalphabetical)gomoddirectives: from 0.6.1 to 0.7.0 (new optionignore-forbidden)iface: from 1.3.1 to 1.4.0 (new optionunexported)noctx: from 0.1.0 to 0.3.3 (new report messages, and new rules related todatabase/sql)noctx: from 0.3.3 to 0.3.4 (new SQL functions detection)revive: from 1.9.0 to 1.10.0 (new rules:time-date,unnecessary-format,use-fmt-print)usestdlibvars: from 1.28.0 to 1.29.0 (new optiontime-date-month)wsl: deprecationwsl_v5: from 4.7.0 to 5.0.0 (major version with new configuration)dupword: from 0.1.3 to 0.1.6exptostd: from 0.4.3 to 0.4.4forbidigo: from 1.6.0 to 2.1.0gci: consistently format the codego-spancheck: from 0.6.4 to 0.6.5goconst: from 1.8.1 to 1.8.2gosec: from 2.22.3 to 2.22.4gosec: from 2.22.4 to 2.22.5makezero: from 1.2.0 to 2.0.1misspell: from 0.6.0 to 0.7.0usetesting: from 0.4.3 to 0.5.0path-expectstdoutwhen usingstdinand there are no changestypecheck: deduplicate errorstypecheck: stops the analysis after the first errorprint-resources-usageflaglinters.defaultsetsv2.1.6Compare Source
godot: from 1.5.0 to 1.5.1musttag: from 0.13.0 to 0.13.1v2.1.5Compare Source
Due to an error related to Snapcraft, some artifacts of the v2.1.4 release have not been published.
This release contains the same things as v2.1.3.
v2.1.4Compare Source
Due to an error related to Snapcraft, some artifacts of the v2.1.3 release have not been published.
This release contains the same things as v2.1.3.
v2.1.3Compare Source
fatcontext: from 0.7.2 to 0.8.0nakedret.max-func-lines: 0staticchecksettingsgo.modhash to the cache saltv2.1.2Compare Source
exptostd: from 0.4.2 to 0.4.3gofumpt: from 0.7.0 to 0.8.0protogetter: from 0.3.13 to 0.3.15usetesting: from 0.4.2 to 0.4.3v2.1.1Compare Source
The release process of v2.1.0 failed due to a regression inside goreleaser.
The binaries of v2.1.0 have been published, but not the other artifacts (AUR, Docker, etc.).
v2.1.0Compare Source
--path-mode=abs)${config-path})warn-unusedoption forfmtcommandfmtcommand (golangci-lint fmt --diff-colored)funcorderlinter https://github.com/manuelarte/funcordergo-errorlint: from 1.7.1 to 1.8.0 (automatic error comparison and type assertion fixes)goconst:ignore-stringsis deprecated and replaced byignore-string-valuesgoconst: from 1.7.1 to 1.8.1 (new options:find-duplicates,eval-const-expressions)govet: addhttpmuxanalyzernilnesserr: from 0.1.2 to 0.2.0 (detect more cases)paralleltest: from 1.0.10 to 1.0.14 (checks only_test.gofiles)revive: from 1.7.0 to 1.9.0 (support kebab case for setting names)sloglint: from 0.9.0 to 0.11.0 (autofix, new optionmsg-style, suggestslog.DiscardHandler)wrapcheck: from 2.10.0 to 2.11.0 (new optionreport-internal-errors)wsl: from 4.6.0 to 4.7.0 (cgo files are always excluded)fatcontext: from 0.7.1 to 0.7.2gocritic: fiximportshadowcheckergosec: from 2.22.2 to 2.22.3ireturn: from 0.3.1 to 0.4.0loggercheck: from 0.10.1 to 0.11.0nakedret: from 2.0.5 to 2.0.6nonamedreturns: from 1.0.5 to 1.0.6protogetter: from 0.3.12 to 0.3.13testifylint: from 1.6.0 to 1.6.1unconvert: update to HEADgolangci-lint-fmtpre-commit hookv2.0.2Compare Source
sourceoptionv2.0.1Compare Source
golines: fix settings during linter loadversionfield before the configurationforbidigo: fix migrationv2.0.0Compare Source
golangci-lint fmtcommand with dedicated formatter configurationgolangci-lint migratecommand to help migration from v1 to v2 (cf. Migration guide)run.relative-path-mode(cf. Migration guide)--fast-onlyflag (cf. Migration guide)linters.exclusions.warn-unusedto log a warning if an exclusion rule is unused.golinesformatter https://github.com/segmentio/golinesstaticcheck,stylecheck,gosimpleinto one linter (staticcheck) (cf. Migration guide)go-critic: from 0.12.0 to 0.13.0gomodguard: from 1.3.5 to 1.4.1 (block explicit indirect dependencies)nilnil: from 1.0.1 to 1.1.0 (new option:only-two)perfsprint: from 0.8.2 to 0.9.1 (checker name in the diagnostic message)staticcheck: newquickfixset of rulestestifylint: from 1.5.2 to 1.6.0 (new options:equal-values,suite-method-signature,require-string-msg)wsl: from 4.5.0 to 4.6.0 (new option:allow-cuddle-used-in-block)bidichk: from 0.3.2 to 0.3.3errchkjson: from 0.4.0 to 0.4.1errname: from 1.0.0 to 1.1.0funlen: fixignore-commentsoptiongci: from 0.13.5 to 0.13.6gosmopolitan: from 1.2.2 to 1.3.0inamedparam: from 0.1.3 to 0.2.0intrange: from 0.3.0 to 0.3.1protogetter: from 0.3.9 to 0.3.12unparam: from8a5130cto0df0534golangci-lint config path --jsongolangci-lint help linters --jsongolangci-lint help formatters --jsongolangci-lint linters --jsongolangci-lint formatters --jsongolangci-lint version --jsonv1.64.8Compare Source
v1.64.7Compare Source
depguard: from 2.2.0 to 2.2.1dupl: from3e9179atof665c8dgosec: from 2.22.1 to 2.22.2staticcheck: from 0.6.0 to 0.6.1v1.64.6Compare Source
asciicheck: from 0.4.0 to 0.4.1contextcheck: from 1.1.5 to 1.1.6errcheck: from 1.8.0 to 1.9.0exptostd: from 0.4.1 to 0.4.2ginkgolinter: from 0.19.0 to 0.19.1go-exhaustruct: from 3.3.0 to 3.3.1gocheckcompilerdirectives: from 1.2.1 to 1.3.0godot: from 1.4.20 to 1.5.0perfsprint: from 0.8.1 to 0.8.2revive: from 1.6.1 to 1.7.0tagalign: from 1.4.1 to 1.4.2v1.64.5Compare Source
new-from-merge-base-flagasciicheck: from 0.3.0 to 0.4.0forcetypeassert: from 0.1.0 to 0.2.0gosec: from 2.22.0 to 2.22.1v1.64.4Compare Source
gci: fix standard packages list for go1.24v1.64.3Compare Source
ginkgolinter: from 0.18.4 to 0.19.0go-critic: from 0.11.5 to 0.12.0revive: from 1.6.0 to 1.6.1gci: fix standard packages list for go1.24v1.64.2Compare Source
This is the last minor release of golangci-lint v1.
The next release will be golangci-lint v2.
issues.new-from-merge-baseoptionrun.relative-path-modeoptioncopyloopvar: from 1.1.0 to 1.2.1 (support suggested fixes)exptostd: from 0.3.1 to 0.4.1 (handlesgolang.org/x/exp/constraints.Ordered)fatcontext: from 0.5.3 to 0.7.1 (new option:check-struct-pointers)perfsprint: from 0.7.1 to 0.8.1 (new options:integer-format,error-format,string-format,bool-format, andhex-format)revive: from 1.5.1 to 1.6.0 (new rules:redundant-build-tag,use-errors-new. New optionearly-return.early-return)go-errorlint: from 1.7.0 to 1.7.1gochecknoglobals: from 0.2.1 to 0.2.2godox: from006bad1to 1.1.0gosec: from 2.21.4 to 2.22.0iface: from 1.3.0 to 1.3.1nilnesserr: from 0.1.1 to 0.1.2protogetter: from 0.3.8 to 0.3.9sloglint: from 0.7.2 to 0.9.0spancheck: fix defaultStartSpanMatchersSlicevaluesstaticcheck: from 0.5.1 to 0.6.0tenvis deprecated and replaced byusetesting.os-setenv: true.exportlooprefdeprecation step 2depguardconfigurationv1.64.1Compare Source
Cancelled due to CI failure.
v1.64.0Compare Source
Cancelled due to CI failure.
santhosh-tekuri/jsonschema (github.com/santhosh-tekuri/jsonschema/v5)
v6.0.2Compare Source
v6.0.1Compare Source
Bug Fixes:
check https://redirect.github.com/santhosh-tekuri/jsonschema/discussions/172 to see notes for migrating from v5 to v6
v6.0.0Compare Source
Improvements
$vocabularysupportsermverformatValidationErrorjv--insecureand--cacertflag--quietflagcheck https://redirect.github.com/santhosh-tekuri/jsonschema/discussions/172 to see notes for migrating from v5 to v6
go-jose/go-jose (gopkg.in/go-jose/go-jose.v2)
v4.1.4Compare Source
What's Changed
Fixes Panic in JWE decryption. See GHSA-78h2-9frx-2jm8
Full Changelog: go-jose/go-jose@v4.1.3...v4.1.4
v4.1.3Compare Source
This release drops Go 1.23 support as that Go release is no longer supported. With that, we can drop
x/cryptoand no longer have any external dependencies in go-jose outside of the standard library!This release fixes a bug where a critical b64 header was ignored if in an unprotected header. It is now rejected instead of ignored.
What's Changed
Full Changelog: go-jose/go-jose@v4.1.2...v4.1.3
v4.1.2Compare Source
What's Changed
go-jose v4.1.2 improves some documentation, errors, and removes the only 3rd-party dependency.
New Contributors
Full Changelog: go-jose/go-jose@v4.1.1...v4.1.2
v4.1.1Compare Source
What's Changed
New Contributors
Full Changelog: go-jose/go-jose@v4.1.0...v4.1.1
v4.1.0Compare Source
What's Changed
signatureAlgorithmsargument by @tgeoghegan in #163New Contributors
Full Changelog: go-jose/go-jose@v4.0.5...v4.1.0
v4.0.5Compare Source
What's Changed
Fixes GHSA-c6gw-w398-hv78
Various other dependency updates, small fixes, and documentation updates in the full changelog
New Contributors
Full Changelog: go-jose/go-jose@v4.0.4...v4.0.5
v4.0.4: Version 4.0.4Compare Source
Fixed
v4.0.3: Version 4.0.3Compare Source
Changed
v4.0.2: Version 4.0.2Compare Source
What's Changed
New Contributors
Full Changelog: go-jose/go-jose@v4.0.1...v4.0.2
v4.0.1: Version 4.0.1Compare Source
Fixed
amounts of memory and CPU when decompressed by
DecryptorDecryptMulti.Those functions now return an error if the decompressed data would exceed
250kB or 10x the compressed size (whichever is larger). Thanks to
Enze Wang@Alioth and Jianjun Chen@Zhongguancun Lab (@zer0yu and @chenjj)
for reporting.
v4.0.0: Version 4.0.0Compare Source
This release makes some breaking changes in order to more thoroughly address the vulnerabilities discussed in Three New Attacks Against JSON Web Tokens, "Sign/encrypt confusion", "Billion hash attack", and "Polyglot token".
Changed
ParseSigned, ParseDetached, jwt.ParseEncrypted, jwt.ParseSigned,
jwt.ParseSignedAndEncrypted (#69, #74)
Added
v3.0.5Compare Source
What's Changed
Fixes GHSA-78h2-9frx-2jm8
We recommend migrating from v3 to v4, and we will stop support v3 in the near future.
Full Changelog: go-jose/go-jose@v3.0.4...v3.0.5
v3.0.4Compare Source
What's Changed
Backport fix for GHSA-c6gw-w398-hv78 CVE-2025-27144
#174
Full Changelog: go-jose/go-jose@v3.0.3...v3.0.4
v3.0.3: Version 3.0.3Compare Source
Fixed
v3.0.2: Version 3.0.2Compare Source
Fixed
Changed
Added
v3.0.1: Version 3.0.1Compare Source
Fixed
Security issue: an attacker specifying a large "p2c" value can cause JSONWebEncryption.Decrypt and JSONWebEncryption.DecryptMulti to consume large amounts of CPU, causing a DoS. Thanks to Matt Schwager (@mschwager) for the disclosure and to Tom Tervoort for originally publishing the category of attack. https://i.blackhat.com/BH-US-23/Presentations/US-23-Tervoort-Three-New-Attacks-Against-JSON-Web-Tokens.pdf
The release is tagged off the release-v3.0.1 branch to avoid mixing in some as-yet unreleased changes on the v3 branch.
v3.0.0: Version 3.0.0Compare Source
First release after moving from square/go-jose to the new go-jose/go-jose repository.
Fixes & Improvements
a10ff54- Fix for EC thumbprint template so we compute EC thumbprints correctly30f4a6a- Treat zero Expected.Time as now in Claims.Validate when verifying JWTs4ac8eda- Fix handling of the x5u header (X.509 certificate URL) in JWKsd7b900b- Strip padding off base64 strings, to match spec per RFC7515 Appendix C7f81482- Extract key from JWKs to ensure you can use it when verifying a detached signaturee225b2d- Support non-pointer JWKs to match behavior for other key types94cbec2- Useed25519from the stdlib instead of the golang.org/x/crypto versioneae0da4- Export jose-util helpers as they might be useful for others4bac79d- Fix issue square#182 that caused panic on claims with invalid JWT payload60a6e9d- Use string.Builder to remove whitespace, instead of a regexp to improve performance2009556- Better error handling to avoid panic that can be caused by invalid headersThis release also cleans up a number of module references for the new repo migration, fixed some typos in comments, and more.
Configuration
📅 Schedule: (UTC)
* 0-3 * * *)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.