openSUSE-SU-2026:22197-1

This update for gosec fixes the following issues:

Changes in gosec:

• Update to version 2.30.0 (bsc#1287590, CVE-2026-97032):

  • fix(g602): recognize equality comparison in minimumLenForBranch (#1796)
  • fix(G112): honor read timeouts assigned through a struct field (#1798)
  • fix(G112): report read timeouts explicitly set to zero (#1797)
  • feat(G706): extend log/slog method coverage (#1795)
  • fix(autofix): read the first text block of a Claude response (#1794)
  • fix(autofix): give every AI request its own timeout (#1793)
  • fix(resolve): treat constants from other packages as resolved (#1792)
  • fix(autofix): return an error when a Gemini candidate has no content (#1791)
  • Update to go version 1.27.3 and 1.26.10 (#1790)
  • fix(autofix): default Gemini model to gemini-3.1-pro-preview (#1788)
  • fix(G102): resolve concatenated and constant listen addresses (#1787)
  • fix: default -concurrency to GOMAXPROCS so container CPU limits apply (#1786)
  • fix(g602): track statically known lengths for append results in slice bounds check (#1773)
  • feat(rules): add G125 to detect unescaped url.JoinPath elements (#1777)
  • fix: load absolute file paths so nested modules are analysed from the parent directory (#1779)
  • fix(G118): treat a cancel sent on a channel as handed off (#1782)
  • fix(G112): honor read timeouts assigned after the http.Server literal (#1781)
  • fix(G303): resolve constant temp file paths (#1784)
  • fix(deps): update all dependencies (#1783)
  • fix(G203): treat constant template arguments as safe (#1770)
  • fix(G402): check TLS settings assigned through a *tls.Config (#1769)
  • fix(deps): update all dependencies (#1775)
  • Update to go version 1.27.2 and 1.26.9 (#1772)
  • Keep SARIF driver rules sorted and resolve rule indexes at the end (#1767)
  • fix(G602): track append() results for slice bounds checking (#1754)
  • fix(deps): update all dependencies (#1768)
  • fix(G602): trust len(nilSlice) == N guards, matching make()-backed slices (#1752)
  • fix(G407): treat an array IV/nonce as a zeroed buffer (#1763)
  • fix(fileperms): resolve constant file and directory permissions (#1766)
  • fix(G102): detect binding to the IPv6 unspecified address (#1760)
  • fix(G407): stop the nonce source walk on cycles (#1761)
  • fix(G407): do not count AEAD.Seal as the read that fills its own nonce (#1762)
  • fix(deps): update all dependencies (#1764)
  • fix(G602): validate inequality len guards (#1757)
  • fix(G121): track request captured by closures (#1759)
  • fix(deps): update all dependencies (#1756)
  • fix: make nosec suppression independent of comment order (#1741)
  • fix(G403): resolve constant RSA key sizes (#1751)
  • fix(G602): validate subslice bounds under equality guards (#1749)
  • fix(G124): resolve negated constant cookie flags (#1748)
  • fix(G602): report constant index equal to the length asserted by an equality guard (#1746)
  • Skip taint call graphs when no sinks match (#1745)
  • Fix brittle test for html writer (#1744)
  • fix(G404): ignore non-cryptographic Shuffle calls (#1742)
  • fix(deps): update all dependencies (#1743)
  • fix(taint): remove Result.Source field that is never populated (#1739)
  • Update all dependencies (#1737)
  • Update go version 1.27.1 and 1.26.8 and phased out 1.25 (#1738)
  • fix(report): correct Babel SRI hash (#1736)
  • fix(taint): make wide caller traversal deterministic (#1733)
  • fix(G702): skip the context argument of exec.CommandContext (#1730)
  • feat(taint): name the sink in taint finding messages (#1731)
  • Update all dependencies (#1734)
  • Update action to gosec version 2.29.0 (#1728)

• Update to version 2.29.0:

  • analyzers/G703: stop treating Clean/Abs/PathEscape as path-traversal sanitizers (#1723)
  • fix(junit): properly escape XML in failure text (#1718)
  • fix(csv): capture and report write errors on flush (#1716)
  • fix(report): root path matching in formatters (#1719)
  • fix(config): handle nosec tags with leading hash (#1717)
  • Update all dependencies (#1720)
  • Add support for go version 1.27.0 and update to version 1.25.14 and 1… (#1726)
  • Update all dependencies (#1713)
  • Update all dependencies (#1710)
  • fix(G202): don't flag strings.Builder built from constants (#1707)
  • ci: allow fork PR checkout in barry-ai-security-review job (#1708)
  • Update all dependencies (#1709)
  • Downgrade min Go version (#1706)
  • Udpate action to use gosec v2.28.0 (#1705)