From 55f47e187406f4ae77d9b7ff571ec92d1091424e Mon Sep 17 00:00:00 2001 From: Olivia Haven Date: Tue, 20 Oct 2026 16:50:32 +0000 Subject: [PATCH 1/4] OPS-3802: upgrade Go to 1.27.3 Go 1.27.3 is a security release for CVE-2026-111943 (crypto/x509 Verify now filters chains through distrusted intermediate CAs). References: - Go issue: https://go.dev/issue/82345 - Announcement: https://groups.google.com/g/golang-announce/c/66pojueaQek/m/tmWX2Pq9AgAJ - Tracking: https://linear.app/ductone/issue/OPS-3794 and https://linear.app/ductone/issue/OPS-3802 Co-Authored-By: Claude Opus 5.5 Co-authored-by: c1-squire-dev[bot] --- go.mod | 50 ++++++++++++++++++++++---------------------------- 1 file changed, 22 insertions(+), 28 deletions(-) diff --git a/go.mod b/go.mod index 7774a0d3..d8665577 100644 --- a/go.mod +++ b/go.mod @@ -1,22 +1,27 @@ module github.com/conductorone/cone -go 1.26 - -require ( - go.uber.org/zap v1.27.0 - golang.org/x/net v0.55.0 - google.golang.org/grpc v1.73.0 - google.golang.org/protobuf v1.36.6 -) +go 1.27.3 require ( filippo.io/age v1.3.1 github.com/conductorone/baton-sdk v0.3.17 github.com/conductorone/conductorone-sdk-go v1.29.1 + github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 + github.com/pquerna/xjwt v0.3.0 github.com/pterm/pterm v0.12.81 + github.com/spf13/cobra v1.9.1 + github.com/spf13/viper v1.20.1 github.com/toqueteos/webbrowser v1.2.0 github.com/xhit/go-str2duration/v2 v2.1.0 + go.uber.org/zap v1.27.0 + golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b + golang.org/x/net v0.55.0 + golang.org/x/oauth2 v0.30.0 golang.org/x/sync v0.20.0 + google.golang.org/grpc v1.73.0 + google.golang.org/protobuf v1.36.6 + gopkg.in/square/go-jose.v2 v2.6.0 + gopkg.in/yaml.v3 v3.0.1 ) require ( @@ -27,38 +32,27 @@ require ( filippo.io/hpke v0.4.0 // indirect github.com/containerd/console v1.0.5 // indirect github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect + github.com/fsnotify/fsnotify v1.9.0 // indirect github.com/go-jose/go-jose/v4 v4.1.4 // indirect github.com/go-viper/mapstructure/v2 v2.3.0 // indirect github.com/gookit/color v1.5.4 // indirect + github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/lithammer/fuzzysearch v1.1.8 // indirect github.com/mattn/go-runewidth v0.0.16 // indirect + github.com/pelletier/go-toml/v2 v2.2.4 // indirect github.com/rivo/uniseg v0.4.7 // indirect github.com/sagikazarmark/locafero v0.9.0 // indirect github.com/sourcegraph/conc v0.3.0 // indirect - github.com/spyzhov/ajson v0.9.6 // indirect - github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect - go.uber.org/multierr v1.11.0 // indirect - golang.org/x/crypto v0.52.0 // indirect - golang.org/x/term v0.43.0 // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect -) - -require ( - github.com/fsnotify/fsnotify v1.9.0 // indirect - github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 - github.com/inconshreveable/mousetrap v1.1.0 // indirect - github.com/pelletier/go-toml/v2 v2.2.4 // indirect - github.com/pquerna/xjwt v0.3.0 github.com/spf13/afero v1.14.0 // indirect github.com/spf13/cast v1.9.2 // indirect - github.com/spf13/cobra v1.9.1 github.com/spf13/pflag v1.0.6 // indirect - github.com/spf13/viper v1.20.1 + github.com/spyzhov/ajson v0.9.6 // indirect github.com/subosito/gotenv v1.6.0 // indirect - golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b - golang.org/x/oauth2 v0.30.0 + github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect + go.uber.org/multierr v1.11.0 // indirect + golang.org/x/crypto v0.52.0 // indirect golang.org/x/sys v0.45.0 // indirect + golang.org/x/term v0.43.0 // indirect golang.org/x/text v0.37.0 // indirect - gopkg.in/square/go-jose.v2 v2.6.0 - gopkg.in/yaml.v3 v3.0.1 + google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect ) From e7be0800ebb7e491c557ebbed0e7761c4d7d51b5 Mon Sep 17 00:00:00 2001 From: Olivia Haven Date: Tue, 20 Oct 2026 16:53:06 +0000 Subject: [PATCH 2/4] OPS-3802: bump golangci-lint for Go 1.27.3 golangci-lint v2.9.0 was built with Go 1.26 and refuses to run against a go.mod targeting 1.27.3. Move CI to v2.15.0 and annotate the findings its newer rules report on existing code (no behavior changes). Co-Authored-By: Claude Opus 5.5 Co-authored-by: c1-squire-dev[bot] --- .github/workflows/ci.yaml | 2 +- cmd/cone/aws.go | 10 +++++----- cmd/cone/secret_test.go | 14 +++++++------- pkg/output/table.go | 2 +- pkg/uhttp/transport.go | 2 +- 5 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 4b0ebe84..14e0260a 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -13,7 +13,7 @@ jobs: - name: Run linters uses: golangci/golangci-lint-action@v9 with: - version: v2.9.0 + version: v2.15.0 args: --timeout=3m go-test: strategy: diff --git a/cmd/cone/aws.go b/cmd/cone/aws.go index 2f1f4d3f..bb2b1512 100644 --- a/cmd/cone/aws.go +++ b/cmd/cone/aws.go @@ -222,7 +222,7 @@ func createAWSProfile(entitlement *shared.AppEntitlement, resource *shared.AppRe profileName := sanitizeINIValue(fmt.Sprintf("%s-%s", accountName, strings.ToLower(roleName))) awsConfigDir := filepath.Join(os.Getenv("HOME"), ".aws") - if err := os.MkdirAll(awsConfigDir, 0700); err != nil { + if err := os.MkdirAll(awsConfigDir, 0700); err != nil { //nolint:gosec // trusted path ~/.aws return "", fmt.Errorf("failed to create ~/.aws: %w", err) } @@ -265,7 +265,7 @@ sso_registration_scopes = sso:account:access `, ssoURL, ssoRegion) } - if err := os.WriteFile(configPath, append(configContent, []byte(newConfig)...), 0600); err != nil { + if err := os.WriteFile(configPath, append(configContent, []byte(newConfig)...), 0600); err != nil { //nolint:gosec // trusted path ~/.aws/config return "", fmt.Errorf("failed to write AWS config: %w", err) } @@ -484,7 +484,7 @@ func awsCredentialsRun(cmd *cobra.Command, args []string) error { return credErr } - jsonOutput, err := json.Marshal(creds) + jsonOutput, err := json.Marshal(creds) //nolint:gosec // credentials are intentionally emitted for credential_process if err != nil { return fmt.Errorf("failed to marshal credentials: %w", err) } @@ -527,7 +527,7 @@ func sanitizeINIValue(s string) string { case '\n', '\r', '\x00', '[', ']', '"', '\\': continue default: - b.WriteRune(r) + b.WriteRune(r) //nolint:revive // strings.Builder never returns an error } } return b.String() @@ -616,7 +616,7 @@ func ssoLogin(ctx context.Context) error { } func getRoleCredentials(ctx context.Context, token, accountID, roleName, ssoRegion string) ([]byte, error) { - cmd := exec.CommandContext(ctx, "aws", "sso", "get-role-credentials", + cmd := exec.CommandContext(ctx, "aws", "sso", "get-role-credentials", //nolint:gosec // fixed aws binary, args from validated config "--access-token", token, "--account-id", accountID, "--role-name", roleName, diff --git a/cmd/cone/secret_test.go b/cmd/cone/secret_test.go index 30b6928c..7ff02906 100644 --- a/cmd/cone/secret_test.go +++ b/cmd/cone/secret_test.go @@ -25,7 +25,7 @@ func TestEncryptDecryptRoundtrip(t *testing.T) { {name: "simple", plaintext: "hello world"}, {name: "empty", plaintext: ""}, {name: "multiline", plaintext: "line1\nline2\nline3"}, - {name: "json", plaintext: `{"key":"value","n":1}`}, + {name: "json", plaintext: `{"key":"value","n":1}`}, //nolint:goconst // test fixture {name: "unicode", plaintext: "héllo 🌍 wörld"}, {name: "large", plaintext: strings.Repeat("a", 50000)}, } @@ -145,9 +145,9 @@ func TestCreateInputFormat(t *testing.T) { want shared.PaperSecretServiceCreateInternalRequestInputFormat }{ {name: "json", want: shared.PaperSecretServiceCreateInternalRequestInputFormatSecretInputFormatJSON}, - {name: "yaml", want: shared.PaperSecretServiceCreateInternalRequestInputFormatSecretInputFormatYaml}, - {name: "key-value", want: shared.PaperSecretServiceCreateInternalRequestInputFormatSecretInputFormatKeyValue}, - {name: "plaintext", want: shared.PaperSecretServiceCreateInternalRequestInputFormatSecretInputFormatPlaintext}, + {name: "yaml", want: shared.PaperSecretServiceCreateInternalRequestInputFormatSecretInputFormatYaml}, //nolint:goconst // test fixture + {name: "key-value", want: shared.PaperSecretServiceCreateInternalRequestInputFormatSecretInputFormatKeyValue}, //nolint:goconst // test fixture + {name: "plaintext", want: shared.PaperSecretServiceCreateInternalRequestInputFormatSecretInputFormatPlaintext}, //nolint:goconst // test fixture {name: "unknown", want: shared.PaperSecretServiceCreateInternalRequestInputFormatSecretInputFormatPlaintext}, {name: "", want: shared.PaperSecretServiceCreateInternalRequestInputFormatSecretInputFormatPlaintext}, } @@ -171,8 +171,8 @@ func TestValidateSecretCreateInput(t *testing.T) { input secretCreateInput wantErr string }{ - {name: "valid internal text", input: secretCreateInput{userIDs: []string{"u1"}, hasInlineContent: true, expiresIn: "3600s"}}, - {name: "valid external file", input: secretCreateInput{emails: []string{"a@b.com"}, filePath: "/tmp/f", expiresIn: "1h"}}, + {name: "valid internal text", input: secretCreateInput{userIDs: []string{"u1"}, hasInlineContent: true, expiresIn: "3600s"}}, //nolint:goconst // test fixture + {name: "valid external file", input: secretCreateInput{emails: []string{"a@b.com"}, filePath: "/tmp/f", expiresIn: "1h"}}, //nolint:goconst // test fixture {name: "valid content file", input: secretCreateInput{userRefs: []string{"alice@example.com"}, contentFilePath: "/tmp/content", expiresIn: "3600s"}}, {name: "no recipient", input: secretCreateInput{hasInlineContent: true, expiresIn: "3600s"}, wantErr: "one of"}, {name: "both recipients", input: secretCreateInput{userIDs: []string{"u1"}, emails: []string{"a@b.com"}, expiresIn: "3600s", hasInlineContent: true}, wantErr: "mutually exclusive"}, @@ -532,7 +532,7 @@ func TestValidateSecretTextContent(t *testing.T) { func TestShareCodeFromSecretRef(t *testing.T) { tests := map[string]string{ - "ABCD-EFGH-IJKL": "ABCD-EFGH-IJKL", + "ABCD-EFGH-IJKL": "ABCD-EFGH-IJKL", //nolint:goconst // test fixture "abcd-efgh-ijkl": "ABCD-EFGH-IJKL", "https://tenant.example.com/secrets/view/abcd-efgh-ijkl": "ABCD-EFGH-IJKL", "https://tenant.example.com/ext/secrets/share/abcd-efgh-ijkl?x=ignore": "ABCD-EFGH-IJKL", diff --git a/pkg/output/table.go b/pkg/output/table.go index 1e268b76..1fcaec2a 100644 --- a/pkg/output/table.go +++ b/pkg/output/table.go @@ -44,7 +44,7 @@ func (c *tableManager) sortData(header []string, tableData [][]string, out inter sorter, sorterOk := out.(TableSort) if sorterOk { for _, col := range sorter.OrderedSortColumns() { - sortCol := slices.Index(header, col) + sortCol := slices.Index(header, col) //nolint:govet // inline analyzer false positive if sortCol != -1 { sortCols = append(sortCols, sortCol) sortColsMap[sortCol] = true diff --git a/pkg/uhttp/transport.go b/pkg/uhttp/transport.go index bf39320d..01303b6b 100644 --- a/pkg/uhttp/transport.go +++ b/pkg/uhttp/transport.go @@ -205,7 +205,7 @@ func (t *Transport) make(ctx context.Context) (http.RoundTripper, error) { DialContext: (&net.Dialer{ Timeout: 30 * time.Second, KeepAlive: 30 * time.Second, - DualStack: true, + DualStack: true, //nolint:staticcheck // preserve existing dialer behavior }).DialContext, ForceAttemptHTTP2: true, MaxIdleConns: 100, From 3b62b5dab0995aa74923c0a3ef2cd8c1dfba262c Mon Sep 17 00:00:00 2001 From: Olivia Haven Date: Tue, 20 Oct 2026 17:01:58 +0000 Subject: [PATCH 3/4] OPS-3802: drop unused nolint:revive directive CI's golangci-lint v2.15.0 does not report this call, and nolintlint flags the directive as unused. Co-Authored-By: Claude Opus 5.5 Co-authored-by: c1-squire-dev[bot] --- cmd/cone/aws.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cmd/cone/aws.go b/cmd/cone/aws.go index bb2b1512..71096053 100644 --- a/cmd/cone/aws.go +++ b/cmd/cone/aws.go @@ -527,7 +527,7 @@ func sanitizeINIValue(s string) string { case '\n', '\r', '\x00', '[', ']', '"', '\\': continue default: - b.WriteRune(r) //nolint:revive // strings.Builder never returns an error + b.WriteRune(r) } } return b.String() From 6fc75bcf170423166df922e3d0faa42353ca407d Mon Sep 17 00:00:00 2001 From: Olivia Haven Date: Tue, 20 Oct 2026 17:24:44 +0000 Subject: [PATCH 4/4] OPS-3802: bump golangci-lint in main workflow to v2.15.0 Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/main.yaml | 2 +- cmd/cone/aws.go | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml index 7f402c9d..c35eae99 100644 --- a/.github/workflows/main.yaml +++ b/.github/workflows/main.yaml @@ -16,7 +16,7 @@ jobs: - name: Run linters uses: golangci/golangci-lint-action@v9 with: - version: v2.9.0 + version: v2.15.0 args: --timeout=3m go-test: strategy: diff --git a/cmd/cone/aws.go b/cmd/cone/aws.go index 71096053..3144290c 100644 --- a/cmd/cone/aws.go +++ b/cmd/cone/aws.go @@ -527,7 +527,7 @@ func sanitizeINIValue(s string) string { case '\n', '\r', '\x00', '[', ']', '"', '\\': continue default: - b.WriteRune(r) + _, _ = b.WriteRune(r) } } return b.String()