Skip to content

fix(security): remediate CVE vulnerabilities #25

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ulucinar merged 3 commits into from
Mar 25, 2026
Merged

fix(security): remediate CVE vulnerabilities #25

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5822d45
fix(security): remediate CVE vulnerabilities
ulucinar Mar 24, 2026
b833c85
fix(ci): update golangci-lint to v2.11.4 for Go 1.25.8 compatibility
ulucinar Mar 24, 2026
8a28bc6
fix(ci): upgrade golangci-lint-action to v7
ulucinar Mar 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,8 @@ on:

env:
# Common versions
GO_VERSION: '1.24.13'
GOLANGCI_VERSION: 'v1.64.2'
GO_VERSION: '1.25.8'
GOLANGCI_VERSION: 'v2.11.4'
DOCKER_BUILDX_VERSION: 'v0.24.0'

# These environment variables are important to the Crossplane CLI install.sh
Expand Down Expand Up @@ -52,7 +52,7 @@ jobs:
run: go mod tidy && git diff --exit-code go.mod go.sum

- name: Lint
uses: golangci/golangci-lint-action@v6
uses: golangci/golangci-lint-action@v7
with:
version: ${{ env.GOLANGCI_VERSION }}

Expand Down
316 changes: 132 additions & 184 deletions .golangci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,207 +1,155 @@
# SPDX-FileCopyrightText: 2024 The Crossplane Authors <https://crossplane.io>
#
# SPDX-License-Identifier: CC0-1.0

version: "2"

run:
timeout: 10m
timeout: 90m
concurrency: 1
Copy link
Copy Markdown

@ulucinar ulucinar Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We would like to use a common configuration across the official package repositories...


output:
# colored-line-number|line-number|json|tab|checkstyle|code-climate, default is "colored-line-number"
formats:
- format: colored-line-number

linters-settings:
errcheck:
# report about not checking of errors in type assetions: `a := b.(MyStruct)`;
# default is false: such cases aren't reported by default.
check-type-assertions: false

# report about assignment of errors to blank identifier: `num, _ := strconv.Atoi(numStr)`;
# default is false: such cases aren't reported by default.
check-blank: false

# List of functions to exclude from checking, where each entry is a single function to exclude.
# See https://github.com/kisielk/errcheck#excluding-functions for details.
exclude-functions:
- io/ioutil.ReadFile

govet:
# report about shadowed variables
disable:
- shadow

gofmt:
# simplify code: gofmt with `-s` option, true by default
simplify: true

gci:
custom-order: true
sections:
- standard
- default
- prefix(github.com/crossplane)
- prefix(github.com/crossplane-contrib)
- prefix(github.com/upbound)
- blank
- dot

gocyclo:
# minimal code complexity to report, 30 by default (but we recommend 10-20)
min-complexity: 10

dupl:
# tokens count to trigger issue, 150 by default
threshold: 100

goconst:
# minimal length of string constant, 3 by default
min-len: 3
# minimal occurrences count to trigger, 3 by default
min-occurrences: 5

lll:
# tab width in spaces. Default to 1.
tab-width: 1

unparam:
# Inspect exported functions, default is false. Set to true if no external program/library imports your code.
# XXX: if you enable this setting, unparam will report a lot of false-positives in text editors:
# if it's called for subdir of a project it can't find external interfaces. All text editor integrations
# with golangci-lint call it on a directory with the changed file.
check-exported: false

nakedret:
# make an issue if func has more lines of code than this setting and it has naked returns; default is 30
max-func-lines: 30

prealloc:
# XXX: we don't recommend using this linter before doing performance profiling.
# For most programs usage of prealloc will be a premature optimization.

# Report preallocation suggestions only on simple loops that have no returns/breaks/continues/gotos in them.
# True by default.
simple: true
range-loops: true # Report preallocation suggestions on range loops, true by default
for-loops: false # Report preallocation suggestions on for loops, false by default

gocritic:
# Enable multiple checks by tags, run `GL_DEBUG=gocritic golangci-lint` run to see all tags and checks.
# Empty list by default. See https://github.com/go-critic/go-critic#usage -> section "Tags".
enabled-tags:
- performance

settings: # settings passed to gocritic
captLocal: # must be valid enabled check name
paramsOnly: true
rangeValCopy:
sizeThreshold: 32

nolintlint:
require-explanation: true
require-specific: true
text:
colors: true
print-linter-name: true
show-stats: true

formatters:
enable:
- goimports
- gofmt
settings:
gofmt:
simplify: true
goimports:
local-prefixes:
- github.com/upbound/function-openai

linters:
default: none
enable:
- megacheck
# explicitly enabled
- govet
- gocyclo
- gocritic
- goconst
- gci
- gofmt # We enable this as well as goimports for its simplify mode.
- prealloc
- revive
- staticcheck
- unconvert
- misspell
- nakedret
- nolintlint

disable:
# These linters are all deprecated as of golangci-lint v1.49.0. We disable
# them explicitly to avoid the linter logging deprecation warnings.
- deadcode
- varcheck
- scopelint
- structcheck
- interfacer

presets:
- bugs
# v1 "bugs" preset
- asasalint
- asciicheck
- bodyclose
- contextcheck
- durationcheck
- errcheck
- errchkjson
- errorlint
- exhaustive
- gosec
- gosmopolitan
- loggercheck
- makezero
- musttag
- nilerr
- nilnesserr
- noctx
- protogetter
- reassign
- recvcheck
- rowserrcheck
- spancheck
- testifylint
- zerologlint
# v1 "unused" preset
- ineffassign
- unparam
- unused
fast: false

settings:
errcheck:
check-type-assertions: false
check-blank: false
exclude-functions:
- io/ioutil.ReadFile
- io/ioutil.ReadDir
- io/ioutil.ReadAll

govet:
disable:
- shadow

revive:
confidence: 0.8

gocyclo:
min-complexity: 10

dupl:
threshold: 100

goconst:
min-len: 3
min-occurrences: 5

lll:
tab-width: 1

unparam:
check-exported: false

nakedret:
max-func-lines: 30

gocritic:
enabled-tags:
- performance
settings:
captLocal:
paramsOnly: true
rangeValCopy:
sizeThreshold: 32

exclusions:
generated: lax
rules:
- path: _test(ing)?\.go
linters:
- gocyclo
- errcheck
- dupl
- gosec
- unparam

- path: _test\.go
text: "(unnamedResult|exitAfterDefer)"
linters:
- gocritic

- text: "(hugeParam|rangeValCopy):"
linters:
- gocritic

- text: "SA3000:"
linters:
- staticcheck

- text: "QF1008:"
linters:
- staticcheck

- text: "G101:"
linters:
- gosec

- text: "G104:"
linters:
- gosec

issues:
# Excluding configuration per-path and per-linter
exclude-rules:
- path: "zz_generated\\..+\\.go$"
linters: ["all"]

# Exclude some linters from running on tests files.
- path: _test(ing)?\.go
linters:
- gocyclo
- errcheck
- dupl
- gosec
- scopelint
- unparam

# Ease some gocritic warnings on test files.
- path: _test\.go
text: "(unnamedResult|exitAfterDefer)"
linters:
- gocritic

# These are performance optimisations rather than style issues per se.
# They warn when function arguments or range values copy a lot of memory
# rather than using a pointer.
- text: "(hugeParam|rangeValCopy):"
linters:
- gocritic

# This "TestMain should call os.Exit to set exit code" warning is not clever
# enough to notice that we call a helper method that calls os.Exit.
- text: "SA3000:"
linters:
- staticcheck

- text: "k8s.io/api/core/v1"
linters:
- goimports

# This is a "potential hardcoded credentials" warning. It's triggered by
# any variable with 'secret' in the same, and thus hits a lot of false
# positives in Kubernetes land where a Secret is an object type.
- text: "G101:"
linters:
- gosec
- gas

# This is an 'errors unhandled' warning that duplicates errcheck.
- text: "G104:"
linters:
- gosec
- gas

# Some k8s dependencies do not have JSON tags on all fields in structs.
- path: k8s.io/
linters:
- musttag

# Independently from option `exclude` we use default exclude patterns,
# it can be disabled by this option. To list all
# excluded by default patterns execute `golangci-lint run --help`.
# Default value for this option is true.
exclude-use-default: false

# Show only new issues: if there are unstaged changes or untracked files,
# only those changes are analyzed, else only changes in HEAD~ are analyzed.
# It's a super-useful option for integration of golangci-lint into existing
# large codebase. It's not practical to fix all existing issues at the moment
# of integration: much better don't allow issues in new code.
# Default is false.
new: false

# Maximum issues count per one linter. Set to 0 to disable. Default is 50.
max-issues-per-linter: 0

# Maximum count of issues with the same text. Set to 0 to disable. Default is 3.
max-same-issues: 0
Loading
Loading