Bump dependencies reported by govulncheck

.golangci.yml

@@ -1,26 +1,32 @@
-run:
-  timeout: 10m
-  skip-files:
-    - ".*\\.pb\\.go$"
-
-  modules-download-mode: vendor
+version: "2"
 
+run:
   build-tags:
     - dfrunsecurity
+  modules-download-mode: vendor
 
-linters:
+formatters:
   enable:
-    - depguard
     - gofmt
     - goimports
-    - gosimple
+  exclusions:
+    generated: lax
+    paths:
+      - .*\.pb\.go$
+      - third_party$
+      - builtin$
+      - examples$
+
+linters:
+  default: none
+  enable:
+    - depguard
     - revive
     - govet
     - importas
     - ineffassign
     - misspell
     - staticcheck
-    - typecheck
     - unused
     - bodyclose
     - errname
@@ -29,57 +35,80 @@ linters:
     - nolintlint
     - gosec
     - forbidigo
-  disable-all: true
 
-linters-settings:
-  depguard:
+  settings:
+    depguard:
+      rules:
+        main:
+          list-mode: lax
+          deny:
+            # https://go.dev/doc/go1.16#ioutil
+            - pkg: "io/ioutil"
+              desc: "The io/ioutil package has been deprecated."
+    forbidigo:
+      forbid:
+        - pattern: '^fmt\.Errorf(# use errors\.Errorf instead)?$'
+        - pattern: 'logrus\.(Trace|Debug|Info|Warn|Warning|Error|Fatal)(f|ln)?\((# use bklog\.G\(ctx\) instead of logrus directly)?'
+    importas:
+      alias:
+        - pkg: "github.com/opencontainers/image-spec/specs-go/v1"
+          alias: "ocispecs"
+        - pkg: "github.com/opencontainers/go-digest"
+          alias: "digest"
+      no-unaliased: true
+    gosec:
+      excludes:
+        - G101  # Potential hardcoded credentials (false positives)
+        - G402  # TLS MinVersion too low
+        - G601  # Implicit memory aliasing in for loop (false positives)
+        - G504  # Import blocklist: net/http/cgi
+        - G115  # Many false positives, maybe reconsider after looking closer
+        - G306  # Too restrictive; also flags "0o644" permissions
+      config:
+        G306: "0644"
+    staticcheck:
+      checks:
+        # Defaults
+        - all
+        - "-ST1000"
+        - "-ST1003"
+        - "-ST1016"
+        - "-ST1020"
+        - "-ST1021"
+        - "-ST1022"
+        # Custom
+        - "-QF1008"  # Omit embedded fields from selector expression. (Very noisy)
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
     rules:
-      main:
-        list-mode: lax
-        include-go-root: true
-        deny:
-          # https://go.dev/doc/go1.16#ioutil
-          pkg: "io/ioutil"
-          desc: "The io/ioutil package has been deprecated."
-  forbidigo:
-    forbid:
-      - '^fmt\.Errorf(# use errors\.Errorf instead)?$'
-      - 'logrus\.(Trace|Debug|Info|Warn|Warning|Error|Fatal)(f|ln)?\((# use bklog\.G\(ctx\) instead of logrus directly)?'
-  importas:
-    alias:
-      - pkg: "github.com/opencontainers/image-spec/specs-go/v1"
-        alias: "ocispecs"
-      - pkg: "github.com/opencontainers/go-digest"
-        alias: "digest"
-    no-unaliased: true
-  gosec:
-    excludes:
-      - G101  # Potential hardcoded credentials (false positives)
-      - G402  # TLS MinVersion too low
-      - G601  # Implicit memory aliasing in for loop (false positives)
-      - G504  # Import blocklist: net/http/cgi
-      - G115  # Many false positives, maybe reconsider after looking closer
-      - G306  # Too restrictive; also flags "0o644" permissions
-    config:
-      G306: "0644"
-
-issues:
-  exclude-rules:
-    - linters:
-        - revive
-      text: "stutters"
-    - linters:
-        - revive
-      text: "empty-block"
-    - linters:
-        - revive
-      text: "superfluous-else"
-    - linters:
-        - revive
-      text: "unused-parameter"
-    - linters:
-        - revive
-      text: "redefines-builtin-id"
-    - linters:
-        - revive
-      text: "if-return"
+      - linters:
+          - revive
+        text: "stutters"
+      - linters:
+          - revive
+        text: "empty-block"
+      - linters:
+          - revive
+        text: "superfluous-else"
+      - linters:
+          - revive
+        text: "unused-parameter"
+      - linters:
+          - revive
+        text: "redefines-builtin-id"
+      - linters:
+          - revive
+        text: "if-return"
+      - linters:
+          - staticcheck
+        text: "SA1019: intoto\\.\\w+ is deprecated"
+    paths:
+      - ".*\\.pb\\.go$"
+      - third_party$
+      - builtin$
+      - examples$

api/services/control/generate.go

@@ -1,3 +1,3 @@
-package moby_buildkit_v1 //nolint:revive
+package moby_buildkit_v1
 
 //go:generate protoc -I=. -I=../../../vendor/ -I=../../../../../../ --gogo_out=plugins=grpc:. control.proto

api/types/generate.go

@@ -1,3 +1,3 @@
-package moby_buildkit_v1_types //nolint:revive
+package moby_buildkit_v1_types
 
 //go:generate protoc -I=. -I=../../vendor/ -I=../../../../../ --gogo_out=plugins=grpc:. worker.proto

cache/contenthash/checksum.go

@@ -807,9 +807,10 @@ func splitWildcards(p string) (d1, d2 string) {
 func containsWildcards(name string) bool {
 	for i := 0; i < len(name); i++ {
 		ch := name[i]
-		if ch == '\\' {
+		switch ch {
+		case '\\':
 			i++
-		} else if ch == '*' || ch == '?' || ch == '[' {
+		case '*', '?', '[':
 			return true
 		}
 	}
@@ -912,10 +913,7 @@ func (cc *cacheContext) checksum(ctx context.Context, root *iradix.Node, txn *ir
 		iter.SeekLowerBound(append(append([]byte{}, next...), 0))
 		subk := next
 		ok := true
-		for {
-			if !ok || !bytes.HasPrefix(subk, next) {
-				break
-			}
+		for ok && bytes.HasPrefix(subk, next) {
 			h.Write(bytes.TrimPrefix(subk, k))
 
 			subcr, _, err := cc.checksum(ctx, root, txn, m, subk, true)
@@ -1177,20 +1175,17 @@ func poolsCopy(dst io.Writer, src io.Reader) (written int64, err error) {
 }
 
 func convertPathToKey(p []byte) []byte {
-	return bytes.Replace([]byte(p), []byte("/"), []byte{0}, -1)
+	return bytes.ReplaceAll([]byte(p), []byte("/"), []byte{0})
 }
 
 func convertKeyToPath(p []byte) []byte {
-	return bytes.Replace([]byte(p), []byte{0}, []byte("/"), -1)
+	return bytes.ReplaceAll([]byte(p), []byte{0}, []byte("/"))
 }
 
 func splitKey(k []byte) ([]byte, []byte) {
 	foundBytes := false
 	i := len(k) - 1
-	for {
-		if i <= 0 || foundBytes && k[i] == 0 {
-			break
-		}
+	for i > 0 && (!foundBytes || k[i] != 0) {
 		if k[i] != 0 {
 			foundBytes = true
 		}

cache/manager.go

@@ -223,7 +223,7 @@ func (cm *cacheManager) GetByBlob(ctx context.Context, desc ocispecs.Descriptor,
 	snapshotID := chainID.String()
 	if link != nil {
 		snapshotID = link.getSnapshotID()
-		go link.Release(context.TODO())
+		go link.Release(context.TODO()) //nolint:gosec
 	}
 
 	l, err := cm.LeaseManager.Create(ctx, func(l *leases.Lease) error {
@@ -1369,10 +1369,7 @@ func (cm *cacheManager) DiskUsage(ctx context.Context, opt client.DiskUsageInfo)
 	}
 	cm.mu.Unlock()
 
-	for {
-		if len(rescan) == 0 {
-			break
-		}
+	for len(rescan) != 0 {
 		for id := range rescan {
 			v := m[id]
 			if v.refs == 0 {

cache/refs.go

@@ -1413,7 +1413,7 @@ func (cr *cacheRecord) finalize(ctx context.Context) error {
 	cr.mountCache = nil
 
 	mutable.dead = true
-	go func() {
+	go func() { //nolint:gosec
 		cr.cm.mu.Lock()
 		defer cr.cm.mu.Unlock()
 		if err := mutable.remove(context.TODO(), true); err != nil {

cache/remotecache/v1/chains.go

@@ -157,10 +157,7 @@ func (c *item) LinkFrom(rec solver.CacheExporterRecord, index int, selector stri
 		return
 	}
 
-	for {
-		if index < len(c.links) {
-			break
-		}
+	for index >= len(c.links) {
 		c.links = append(c.links, map[link]struct{}{})
 	}
 

client/build_test.go

@@ -1090,7 +1090,7 @@ func newTestPrompt(ctx context.Context, t *testing.T, input io.Writer, output *b
 func (p *testPrompt) String() string { return p.prompt }
 
 func (p *testPrompt) SendExit(status int) {
-	p.input.Write([]byte(fmt.Sprintf("exit %d\n", status)))
+	fmt.Fprintf(p.input, "exit %d\n", status)
 }
 
 func (p *testPrompt) Send(cmd string) {

client/client.go

@@ -57,7 +57,7 @@ func New(ctx context.Context, address string, opts ...ClientOpt) (*Client, error
 
 	for _, o := range opts {
 		if _, ok := o.(*withFailFast); ok {
-			gopts = append(gopts, grpc.FailOnNonTempDialError(true))
+			gopts = append(gopts, grpc.FailOnNonTempDialError(true)) //nolint:staticcheck
 		}
 		if credInfo, ok := o.(*withCredentials); ok {
 			if creds == nil {
@@ -146,7 +146,7 @@ func New(ctx context.Context, address string, opts ...ClientOpt) (*Client, error
 	gopts = append(gopts, grpc.WithStreamInterceptor(grpcerrors.StreamClientInterceptor))
 	gopts = append(gopts, customDialOptions...)
 
-	conn, err := grpc.DialContext(ctx, address, gopts...)
+	conn, err := grpc.DialContext(ctx, address, gopts...) //nolint:staticcheck
 	if err != nil {
 		return nil, errors.Wrapf(err, "failed to dial %q . make sure buildkitd is running", address)
 	}

client/llb/meta.go

@@ -197,7 +197,7 @@ func shlexf(str string, replace bool, v ...interface{}) StateOption {
 	}
 	return func(s State) State {
 		arg, err := shlex.Split(str)
-		if err != nil { //nolint
+		if err != nil { //nolint:staticcheck
 			// TODO: handle error
 		}
 		return args(arg...)(s)

cmd/buildkitd/main_oci_worker.go

@@ -356,7 +356,7 @@ func snapshotterFactory(commonRoot string, cfg config.OCIConfig, sm *session.Man
 				grpc.WithDefaultCallOptions(grpc.MaxCallRecvMsgSize(defaults.DefaultMaxRecvMsgSize)),
 				grpc.WithDefaultCallOptions(grpc.MaxCallSendMsgSize(defaults.DefaultMaxSendMsgSize)),
 			}
-			conn, err := grpc.Dial(dialer.DialAddress(address), gopts...)
+			conn, err := grpc.Dial(dialer.DialAddress(address), gopts...) //nolint:staticcheck
 			if err != nil {
 				return nil, errors.Wrapf(err, "failed to dial %q", address)
 			}

docs/generate.go

@@ -1,3 +1,4 @@
+//nolint:gosec
 package main
 
 import (

examples/build-using-dockerfile/main.go

@@ -125,9 +125,10 @@ func action(clicontext *cli.Context) error {
 
 func newSolveOpt(clicontext *cli.Context, w io.WriteCloser) (*client.SolveOpt, error) {
 	buildCtx := clicontext.Args().First()
-	if buildCtx == "" {
+	switch buildCtx {
+	case "":
 		return nil, errors.New("please specify build context (e.g. \".\" for the current directory)")
-	} else if buildCtx == "-" {
+	case "-":
 		return nil, errors.New("stdin not supported yet")
 	}
 

executor/oci/hosts.go

@@ -49,7 +49,7 @@ func makeHostsFile(stateDir string, extraHosts []executor.HostIP, idmap *idtools
 	}
 
 	for _, h := range extraHosts {
-		if _, err := b.Write([]byte(fmt.Sprintf("%s\t%s\n", h.IP.String(), h.Host))); err != nil {
+		if _, err := fmt.Fprintf(b, "%s\t%s\n", h.IP.String(), h.Host); err != nil {
 			return "", nil, err
 		}
 	}

executor/oci/resolvconf.go

@@ -95,7 +95,7 @@ func GetResolvConf(ctx context.Context, stateDir string, idmap *idtools.Identity
 			return struct{}{}, err
 		}
 
-		if err := os.WriteFile(tmpPath, f.Content, 0644); err != nil {
+		if err := os.WriteFile(tmpPath, f.Content, 0644); err != nil { //nolint:gosec
 			return struct{}{}, err
 		}
 

executor/resources/monitor.go

@@ -278,6 +278,7 @@ func prepareCgroupControllers() error {
 		if c == "" {
 			continue
 		}
+		//nolint:gosec // both strings are constants; no path traversal is possible (G703)
 		if err := os.WriteFile(filepath.Join(defaultMountpoint, cgroupSubtreeFile), []byte("+"+c), 0); err != nil {
 			// ignore error
 			logrus.Warnf("failed to enable cgroup controller %q: %+v", c, err)

executor/resources/types/systypes.go

@@ -57,8 +57,7 @@ type SysMemoryStat struct {
 }
 
 type SysSample struct {
-	//nolint
-	Timestamp_     time.Time      `json:"timestamp"`
+	Timestamp_     time.Time      `json:"timestamp"` //nolint:revive
 	CPUStat        *SysCPUStat    `json:"cpuStat,omitempty"`
 	ProcStat       *ProcStat      `json:"procStat,omitempty"`
 	MemoryStat     *SysMemoryStat `json:"memoryStat,omitempty"`

executor/resources/types/types.go

@@ -22,8 +22,7 @@ type Samples struct {
 
 // Sample represents a wrapper for sampled data of cgroupv2 controllers
 type Sample struct {
-	//nolint
-	Timestamp_ time.Time       `json:"timestamp"`
+	Timestamp_ time.Time       `json:"timestamp"` //nolint:revive
 	CPUStat    *CPUStat        `json:"cpuStat,omitempty"`
 	MemoryStat *MemoryStat     `json:"memoryStat,omitempty"`
 	IOStat     *IOStat         `json:"ioStat,omitempty"`

executor/runcexecutor/executor.go

@@ -608,7 +608,7 @@ func runcProcessHandle(ctx context.Context, killer procKiller) (*procHandle, con
 	// preserve the logger on the context used for the runc process handling
 	runcCtx = bklog.WithLogger(runcCtx, bklog.G(ctx))
 
-	go func() {
+	go func() { //nolint:gosec // G118 false positive
 		// Wait for pid
 		select {
 		case <-ctx.Done():