openSUSE-SU-2026:20579-1

openSUSE-SU-2026:20579-1 · Security update for gosec

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

Cette page présente une partie des faits des sources. Consultez les avis liés pour la description complète et les versions concernées.

This update for gosec fixes the following issues: Changes in gosec: - Update to version 2.25.0: * chore(deps): bump google.golang.org/grpc from 1.75.0 to 1.79.3 (#1617) * fix: allow barry action to access secrets on fork PRs (#1616) * fix: reduce G117 false positives for custom marshalers and transformed values (#1614) (#1615) * Add barry security scanner as a step in the CI (#1612) * chore(deps): update all dependencies (#1611) * fix: prevent taint analysis hang on packages with many CHA call graph edges (#1608) (#1610) * Add some skills for claude code to automate some tasks (#1609) * Add G701-G706 rule-to-CWE mappings and CWE-117, CWE-918 entries (#1606) * fix: skip SSA analysis on ill-typed packages to prevent panic (#1607) * Port G120 from SSA-based to taint analysis (fixes #1600, #1603) (#1605) * fix(G118): eliminate false positive for package-level cancel variables (#1602) * feat: add G124 rule for insecure HTTP cookie configuration (#1599) * feat: add G709 rule for unsafe deserialization of untrusted data (#1598) * feat: add G708 rule for server-side template injection via text/template (#1597) * fix(G118): eliminate false positive when cancel is called via struct field in a closure (#1596) * Fix infinite recursion in interprocedural taint analysis (#1594) * Fix G118 false positive when cancel is stored in returned struct field (#1593) * Fix G118 false positive on cancel called inside goroutine closure (#1592) * fix(analyzer): per-package rule instantiation eliminates concurrent map crash (#1589) * chore(deps): update all dependencies (#1588) * fix(G118): treat returned cancel func as called (fixes #1584) (#1585) * chore(go): update supported Go versions to 1.25.8 and 1.26.1 (#1583) * Update the README with the correct version of the Github action for gosec (#1582) * chore(deps): update all dependencies (#1579) * Fix G115 false positives for guarded int64-to-byte conversions (#1578) * Update the container image migration notice (#1576) * chore(action): bump gosec to 2.24.7 (#1575) - Update to version 2.24.7: * Ignore nosec comments in action integration workflow to generate some warnings (#1573) * Add a workflow for action integration test (#1571) * fix(sarif): avoid invalid null relationships in SARIF output (#1569) * chore: migrate gosec container image references to GHCR (#1567) * Update gorelease to use the latest cosign bundle argument (#1565) * Migrate goreleaser to use the proper cosign arguments (#1564) * Update the cosing to version v3.0.5 (#1563) * fix(release): use existing cosign-installer action version (#1562) * chore(prompts): add skill and prompt to update supported Go versions (#1561) * chore(prompts): add action version update skill and prompt (#1560) * fix(analyzers): avoid SSA dependency cycle blowups in issue #1555 paths (#1559) * Add a SKILL and PROMPT for fixing a GitHub issue (#1558) * Add a SKILL and PROMPT for generating rules with AI (#1557) * fix(G120): prevent hang-like analysis blowup in wrapper protection checks (#1556) * fix(G705): eliminate false positive when guard type cannot be resolved (#1554) * Remove gcmurphy from funding list * Extend the release workflow to push the container images also to GHCR * Update to gosec to v2.24.0 in the action and fix the docker image signing (#1552) - Update to version 2.24.0: * fix: G704 false positive on const URL (#1551) * fix(G705): eliminate false positive for non-HTTP io.Writer (#1550) * G120: avoid false positive when MaxBytesReader is applied in middleware (#1547) * Fix G602 regression coverage for issue #1545 and stabilize G117 TOML test dependency (#1546) * taint: skip `context.Context` arguments during taint propagation to fix false positives (#1543) * test: add missing rules to formatter report tests (#1540) * chore(deps): update all dependencies (#1541) * Regenrate the TLS config rule (#1539) * Improve documentation (#1538) * Expand analyzer-core test coverage for orchestration, go/analysis adapter logic, and taint integration (#1537) * Add unit tests for CLI orchestration, TLS config generation, and SSA cache behavior (#1536) * Add G707 taint analyzer for SMTP command/header injection (#1535) * Add G123 analyzer for tls.VerifyPeerCertificate resumption bypass risk (#1534) * Add G122 SSA analyzer for filepath.Walk/WalkDir symlink TOCTOU race risks (#1532) * fix(G602): avoid false positives for range-over-array indexing (#1531) * Improve taint analyzer performance with shared SSA cache, parallel analyzer execution, and CI regression guard (#1530) * fix: taint analysis false positives with G703,G705 (#1522) * Extend the G117 rule to cover other types of serialization such as yaml/xml/toml (#1529) * Fix the G117 rule to take the JSON serialization into account (#1528) * (docs) fix justification format (#1524) * Add G121 analyzer for unsafe CORS bypass patterns in CrossOriginProtection (#1521) * Add G120 SSA analyzer for unbounded form parsing in HTTP handlers (#1520) * Add G119 analyzer for unsafe redirect header propagation in CheckRedirect callbacks (#1519) * Fix G115 false positives and negatives (Issue #1501) (#1518) * chore(deps): update all dependencies (#1517) * Add G118 SSA analyzer for context propagation failures that can cause goroutine/resource leaks (#1516) * Add G113: Detect HTTP Request Smuggling via conflicting headers (CVE-2025-22891, CWE-444) (#1515) * Add G408: SSH PublicKeyCallback Authentication Bypass Analyzer (#1513) * Add more unit tests to improve coverage (#1512) * Improve test coverage in various areas (#1511) * Imprve the test coverage (#1510) * Fix incorrect detection of fixed iv in G407 (#1509) * Add support for go 1.26.x and removed support for go 1.24.x (#1508) * Fix the sonar report to follow the latest schema (#1507) * fix: broken taint analysis causing false positives (#1506) * fix: panic on float constants in overflow analyzer (#1505) * fix: panic when scanning multi-module repos from root (#1504) * fix: G602 false positive for array element access (#1499) * Update gosec to version v2.23.0 in the Github action (#1496) - Update to version 2.23.0: * feat: Support for adding taint analysis engine (#1486) * chore(deps): update all dependencies (#1494) * chore(deps): update all dependencies (#1494) * chore(deps): update all dependencies (#1488) * Fix G602 analyzer panic that kills gosec process (#1491) * update go version to 1.25.7 (#1492) * Fix URL regexp and remove redundant Google regex patterns (#1485) * feat: implement global cache usage in rules (#1480) * chore(deps): update module google.golang.org/genai to v1.43.0 (#1484) * refactor: optimize nosec parsing and reduce allocations (#1478) * Fix SARIF artifactChanges null validation error (#1483) * feat: optimize GetCallInfo with per-package sync.Pool caching (#1481) * feat: implement entropy pre-filtering to optimize secret detection (#1479) * feat: ensure GoVersion is cached using sync.Once (#1477) * Fix #1240: nosec comments now work with trailing open brackets (#1475) * Debug Build Profiling Support: Code improvement suggestions for PR#1471 (#1476) * Update the go version to 1.25.6 and 1.24.12 (#1474) * G115: Enhance RangeAnalyzer with constant propagation and chained arithmetic support (#1470) * chore(deps): update all dependencies (#1473) * feat: support path-based rule exclusions via exclude-rules (#1465) * Optimize analyzer with parallel package processing (#1466) * feat: add goanalysis package for nogo (#1449) * Refactor Analyzers: Unify Range Logic & Optimize Allocations (#1464) * Optimize G115, G602, G407 analyzers to reduce allocations and memory (#1463) * refactor(g115): improve coverage (#1462) * Refine G407 to improve detection and coverage of hardcoded nonces (#1460) * chore(deps): update all dependencies (#1461) * Refactor rules to us

Correctif disponible

Publication

2026-04-14T16:34:51Z

Mise à jour

2026-04-22T18:26:34.738030Z

Pile logicielle: system

Vérifiez votre serveur →