diff --git a/.github/workflows/linters.yml b/.github/workflows/linters.yml index 267c5015..30311c39 100644 --- a/.github/workflows/linters.yml +++ b/.github/workflows/linters.yml @@ -26,9 +26,7 @@ jobs: - name: Lint uses: golangci/golangci-lint-action@v9 with: - version: v2.1.6 - skip-pkg-cache: true - skip-build-cache: true + version: v2.12.2 args: --config=./.golangci.yml --verbose yammlint: diff --git a/.govulncheck.yaml b/.govulncheck.yaml index 2bc6f3ee..b2018681 100644 --- a/.govulncheck.yaml +++ b/.govulncheck.yaml @@ -18,8 +18,8 @@ ignored-vulnerabilities: silence-until: 2026-09-03 info: https://pkg.go.dev/vuln/GO-2026-4870 # Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net - # Found in: net/http@go1.24.13 - # Fixed in: net/http@go1.25.10 + # Found in: golang.org/x/net/http2@v0.47.0 + # Fixed in: golang.org/x/net/http2@v0.53.0 - id: GO-2026-4918 silence-until: 2026-09-03 info: https://pkg.go.dev/vuln/GO-2026-4918 @@ -35,6 +35,12 @@ ignored-vulnerabilities: - id: GO-2026-4947 silence-until: 2026-09-03 info: https://pkg.go.dev/vuln/GO-2026-4947 + # Root escape via symlink plus trailing slash in os + # Found in: os@go1.24.13 + # Fixed in: os@go1.25.12 + - id: GO-2026-4970 + silence-until: 2026-09-03 + info: https://pkg.go.dev/vuln/GO-2026-4970 # Panic in Dial and LookupPort when handling NUL byte on Windows in net # Found in: net@go1.24.13 # Fixed in: net@go1.25.10 diff --git a/go.mod b/go.mod index 84ee6f95..72647710 100644 --- a/go.mod +++ b/go.mod @@ -6,7 +6,7 @@ toolchain go1.24.13 require ( github.com/codeready-toolchain/api v0.0.0-20260731065234-734640c901d2 - github.com/codeready-toolchain/toolchain-common v0.0.0-20260731071123-c63091456f4a + github.com/codeready-toolchain/toolchain-common v0.0.0-20260804130313-0d4161d82454 github.com/ghodss/yaml v1.0.0 github.com/mitchellh/go-homedir v1.1.0 // using latest commit from 'github.com/openshift/api branch release-4.20' diff --git a/go.sum b/go.sum index 4a1deb0f..26ef37a9 100644 --- a/go.sum +++ b/go.sum @@ -44,8 +44,8 @@ github.com/charmbracelet/x/term v0.2.0 h1:cNB9Ot9q8I711MyZ7myUR5HFWL/lc3OpU8jZ4h github.com/charmbracelet/x/term v0.2.0/go.mod h1:GVxgxAbjUrmpvIINHIQnJJKpMlHiZ4cktEQCN6GWyF0= github.com/codeready-toolchain/api v0.0.0-20260731065234-734640c901d2 h1:i5izQYQWwi0Dbc2Mv/sDOJ5GIMH69O3n0jRwQaAWo9o= github.com/codeready-toolchain/api v0.0.0-20260731065234-734640c901d2/go.mod h1:PMg6kNHuCGNlu3MOdrCisqGkBpvzB0qS1+E6nrXxPAc= -github.com/codeready-toolchain/toolchain-common v0.0.0-20260731071123-c63091456f4a h1:3t4cvcI/6ZUxUSRZoGS/Q9jH9OFu6Sg26PMTtOPRok4= -github.com/codeready-toolchain/toolchain-common v0.0.0-20260731071123-c63091456f4a/go.mod h1:j4xJuhNtqEuZW7VR6BB5V6h/oDJ0dIwSh5iijUSwwdM= +github.com/codeready-toolchain/toolchain-common v0.0.0-20260804130313-0d4161d82454 h1:D3+dc9mEmLrq0XiG6xXDVJoZ+YChF7eX1OTKZ62ydfU= +github.com/codeready-toolchain/toolchain-common v0.0.0-20260804130313-0d4161d82454/go.mod h1:j4xJuhNtqEuZW7VR6BB5V6h/oDJ0dIwSh5iijUSwwdM= github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY= github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4= diff --git a/pkg/cmd/add_space_users.go b/pkg/cmd/add_space_users.go index a3e5801f..fa8b37d5 100644 --- a/pkg/cmd/add_space_users.go +++ b/pkg/cmd/add_space_users.go @@ -72,7 +72,7 @@ func AddSpaceUsers(ctx *clicontext.CommandContext, spaceName, role string, users validRolesMsg.WriteString("the following are valid roles:\n") for actual := range nsTemplTier.Spec.SpaceRoles { - validRolesMsg.WriteString(fmt.Sprintf("%s\n", actual)) + fmt.Fprintf(&validRolesMsg, "%s\n", actual) if role == actual { isRoleValid = true } diff --git a/pkg/cmd/adm/install_operator.go b/pkg/cmd/adm/install_operator.go index 01ccf201..25f3f691 100644 --- a/pkg/cmd/adm/install_operator.go +++ b/pkg/cmd/adm/install_operator.go @@ -44,7 +44,7 @@ func NewInstallOperatorCmd() *cobra.Command { return err } - cl := commonclient.NewSSAApplyClient(kubeClient, utils.KsctlFieldManager) + cl := commonclient.NewServerSideApplyClient(kubeClient, utils.KsctlFieldManager) ctx := clicontext.NewTerminalContext(term) return installOperator(ctx, commandArgs, args[0], cl) }, @@ -57,7 +57,7 @@ func NewInstallOperatorCmd() *cobra.Command { return cmd } -func installOperator(ctx *clicontext.TerminalContext, args installArgs, operator string, applyClient *commonclient.SSAApplyClient) error { +func installOperator(ctx *clicontext.TerminalContext, args installArgs, operator string, applyClient *commonclient.ServerSideApplyClient) error { // validate cluster type if operator != string(configuration.Host) && operator != string(configuration.Member) { return fmt.Errorf("invalid operator type provided: %s. Valid ones are %s|%s", operator, configuration.Host, configuration.Member) @@ -136,7 +136,7 @@ func getOperatorName(operator string) string { return fmt.Sprintf("toolchain-%s-operator", operator) } -func createNamespaceIfNotFound(ctx *clicontext.TerminalContext, applyClient *commonclient.SSAApplyClient, namespace string) error { +func createNamespaceIfNotFound(ctx *clicontext.TerminalContext, applyClient *commonclient.ServerSideApplyClient, namespace string) error { ns := &v1.Namespace{ ObjectMeta: metav1.ObjectMeta{ Name: namespace, diff --git a/pkg/cmd/adm/install_operator_test.go b/pkg/cmd/adm/install_operator_test.go index 697a772e..eb328fb5 100644 --- a/pkg/cmd/adm/install_operator_test.go +++ b/pkg/cmd/adm/install_operator_test.go @@ -65,7 +65,7 @@ func TestInstallOperator(t *testing.T) { ctx := clicontext.NewTerminalContext(term) // when - err := installOperator(ctx, args, operator, commonclient.NewSSAApplyClient(fakeClient, utils.KsctlFieldManager)) + err := installOperator(ctx, args, operator, commonclient.NewServerSideApplyClient(fakeClient, utils.KsctlFieldManager)) // then require.NoError(t, err) @@ -100,7 +100,7 @@ func TestInstallOperator(t *testing.T) { ctx := clicontext.NewTerminalContext(term) // when - err := installOperator(ctx, args, operator, commonclient.NewSSAApplyClient(fakeClient, utils.KsctlFieldManager)) + err := installOperator(ctx, args, operator, commonclient.NewServerSideApplyClient(fakeClient, utils.KsctlFieldManager)) // then require.ErrorContains(t, err, "failed waiting for catalog source to be ready.") @@ -120,7 +120,7 @@ func TestInstallOperator(t *testing.T) { ctx := clicontext.NewTerminalContext(term) // when - err := installOperator(ctx, args, operator, commonclient.NewSSAApplyClient(fakeClient, utils.KsctlFieldManager)) + err := installOperator(ctx, args, operator, commonclient.NewServerSideApplyClient(fakeClient, utils.KsctlFieldManager)) // then require.ErrorContains(t, err, "failed waiting for install plan to be complete.") @@ -140,7 +140,7 @@ func TestInstallOperator(t *testing.T) { // when err := installOperator(ctx, installArgs{namespace: namespace, waitForReadyTimeout: 1 * time.Second}, operator, - commonclient.NewSSAApplyClient(fakeClient, utils.KsctlFieldManager), + commonclient.NewServerSideApplyClient(fakeClient, utils.KsctlFieldManager), ) // then @@ -158,7 +158,7 @@ func TestInstallOperator(t *testing.T) { ctx := clicontext.NewTerminalContext(term) // when - err := installOperator(ctx, args, operator, commonclient.NewSSAApplyClient(fakeClient, utils.KsctlFieldManager)) + err := installOperator(ctx, args, operator, commonclient.NewServerSideApplyClient(fakeClient, utils.KsctlFieldManager)) // then require.NoError(t, err) @@ -177,7 +177,7 @@ func TestInstallOperator(t *testing.T) { // when err := installOperator(ctx, installArgs{namespace: "", kubeConfig: kubeconfig, waitForReadyTimeout: timeout}, // we provide no namespace operator, - commonclient.NewSSAApplyClient(fakeClient, utils.KsctlFieldManager), + commonclient.NewServerSideApplyClient(fakeClient, utils.KsctlFieldManager), ) // then require.NoError(t, err) @@ -195,7 +195,7 @@ func TestInstallOperator(t *testing.T) { // when err := installOperator(ctx, installArgs{}, "INVALIDOPERATOR", - commonclient.NewSSAApplyClient(fakeClient, utils.KsctlFieldManager), + commonclient.NewServerSideApplyClient(fakeClient, utils.KsctlFieldManager), ) // then @@ -212,7 +212,7 @@ func TestInstallOperator(t *testing.T) { operator := "host" err := installOperator(ctx, installArgs{namespace: "toolchain-host-operator", waitForReadyTimeout: time.Second * 1}, operator, - commonclient.NewSSAApplyClient(fakeClient, utils.KsctlFieldManager), + commonclient.NewServerSideApplyClient(fakeClient, utils.KsctlFieldManager), ) // then diff --git a/pkg/cmd/generate/assertion_test.go b/pkg/cmd/generate/assertion_test.go index 5ef49e41..a71f31c6 100644 --- a/pkg/cmd/generate/assertion_test.go +++ b/pkg/cmd/generate/assertion_test.go @@ -139,7 +139,7 @@ func (a *kStructureAssertion) listObjects(dirName, kind string, object runtimecl } if dirEntry != nil && !dirEntry.IsDir() && (filepath.Base(filepath.Dir(path)) == dirName || dirName == "") && dirEntry.Name() != "kustomization.yaml" { obj := object.DeepCopyObject() - objFile, err := os.ReadFile(path) + objFile, err := os.ReadFile(path) //nolint:gosec require.NoError(a.t, err) assert.True(a.t, strings.HasPrefix(string(objFile), header), "every file generated by cli should container a header") assert.NotContains(a.t, string(objFile), "creationTimestamp") diff --git a/pkg/cmd/generate/nstemplatetiers.go b/pkg/cmd/generate/nstemplatetiers.go index c7ca9336..b37ad08a 100644 --- a/pkg/cmd/generate/nstemplatetiers.go +++ b/pkg/cmd/generate/nstemplatetiers.go @@ -53,7 +53,7 @@ func NSTemplateTiers(term ioutils.Terminal, source, outDir, hostNs string) error if info.IsDir() { return nil } - file, err := os.ReadFile(path) + file, err := os.ReadFile(path) //nolint:gosec if err != nil { return err } diff --git a/pkg/cmd/generate/nstemplatetiers_test.go b/pkg/cmd/generate/nstemplatetiers_test.go index d659a724..2db59a64 100644 --- a/pkg/cmd/generate/nstemplatetiers_test.go +++ b/pkg/cmd/generate/nstemplatetiers_test.go @@ -221,7 +221,7 @@ func copyTemplates(t *testing.T, destination, tierToUpdate string) { if dirEntry.IsDir() { return os.MkdirAll(newPath, 0744) } - file, err := os.ReadFile(path) + file, err := os.ReadFile(path) //nolint:gosec if err != nil { return err } @@ -230,7 +230,7 @@ func copyTemplates(t *testing.T, destination, tierToUpdate string) { annotations: modified-by: "test"`, 1)) } - return os.WriteFile(newPath, file, 0600) + return os.WriteFile(newPath, file, 0600) //nolint:gosec }) require.NoError(t, err) }