chore(dep): update go to v1.27, golangci-lint to v2.13, and fix all the lint

.github/workflows/lint.yaml

@@ -55,7 +55,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '>=1.26.2'
+          go-version: '>=1.27.0'
           cache: true
       - name: Set up terraform
         uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1

AGENTS.md

@@ -125,7 +125,7 @@ Always format and lint your code before proposing changes. The repository provid
 - Linter: `golangci-lint`
 - **Running Go Linters**: Run `golangci-lint` using `go run` directly within the module directory (`go/`, `vulnfeeds/`, or `bindings/go/`), or run `tools/lint_and_format.sh` which automatically maps changed files to the enclosing module:
   ```bash
-  cd go && go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.4.0 run ./...
+  cd go && go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.0 run ./...
   ```
   *(Note: Run outside the sandbox so `go run` can fetch the linter toolchain if not cached).*
 - **Formatting Command**:

bindings/go/.golangci.yaml

@@ -3,6 +3,8 @@ version: "2"
 linters:
   default: all
   # prettier-ignore
+  enable:
+    - gomodguard_v2 # gomodguard is deprecated but it's still in the default
   disable:
     - forbidigo
     - paralleltest
@@ -11,6 +13,7 @@ linters:
     - depguard         # Too annoying
     - err113           # will re-add later (another-rex)
     - exhaustruct      # overkill (g-rath)
+    - exhaustruct_v5
     - forcetypeassert  # too hard (g-rath)
     - funlen           #
     - funcorder        #

bindings/go/go.mod

@@ -1,6 +1,6 @@
 module osv.dev/bindings/go
 
-go 1.26.5
+go 1.27.0
 
 require (
 	github.com/google/go-cmp v0.7.0

bindings/go/osvdevexperimental/paging.go

@@ -71,9 +71,9 @@ func BatchQueryPaging(ctx context.Context, c OSVClientInterface, queries []*api.
 	}
 	// --- Paging logic ---
 	var errToReturn error
-	//nolint:prealloc
+
 	var nextPageQueries []*api.Query
-	//nolint:prealloc
+
 	var nextPageIndexMap []int
 	for i, res := range batchResp.GetResults() {
 		if res.GetNextPageToken() == "" {

docker/ci/install_go.sh

@@ -19,4 +19,4 @@ set -eux
 
 # Download and install Go
 # https://go.dev/doc/install
-curl https://go.dev/dl/go1.26.2.linux-amd64.tar.gz -LO && rm -rf /usr/local/go && tar -C /usr/local -xzf go1.26.2.linux-amd64.tar.gz
+curl https://go.dev/dl/go1.27.0.linux-amd64.tar.gz -LO && rm -rf /usr/local/go && tar -C /usr/local -xzf go1.27.0.linux-amd64.tar.gz

docker/terraform/Dockerfile

@@ -1,6 +1,6 @@
 # Taken and modified from https://github.com/GoogleCloudPlatform/cloud-builders-community/tree/master/terraform
 
-FROM golang:1.26.5-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS GO_BUILD
+FROM golang:1.27.0-alpine AS GO_BUILD
 
 ARG TERRAFORM_VERSION
 WORKDIR /build/

docs/go.mod

@@ -1,6 +1,6 @@
 module osv.dev/tools
 
-go 1.26.5
+go 1.27.0
 
 require (
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0

external/.golangci.yaml

@@ -3,6 +3,8 @@ version: "2"
 linters:
   default: all
   # prettier-ignore
+  enable:
+    - gomodguard_v2 # gomodguard is deprecated but it's still in the default
   disable:
     - forbidigo
     - paralleltest
@@ -11,6 +13,7 @@ linters:
     - depguard         # Too annoying
     - err113           # will re-add later (another-rex)
     - exhaustruct      # overkill (g-rath)
+    - exhaustruct_v5
     - forcetypeassert  # too hard (g-rath)
     - funlen           #
     - funcorder        #

external/cmd/ids/main_test.go

@@ -45,6 +45,7 @@ func TestAssignIDs(t *testing.T) {
 			if err != nil {
 				t.Fatalf("failed to read existing ID: %v", err)
 			}
+			//nolint:gosec // G703: Writing to test temp directory
 			err = os.WriteFile(filepath.Join(tmpDir, tt.existingName), existingData, 0600)
 			if err != nil {
 				t.Fatalf("failed to copy existing ID: %v", err)
@@ -57,6 +58,7 @@ func TestAssignIDs(t *testing.T) {
 				t.Fatalf("failed to read template %s: %v", templatePath, err)
 			}
 			destPath := filepath.Join(tmpDir, tt.templateName)
+			//nolint:gosec // G703: Writing to test temp directory
 			if err := os.WriteFile(destPath, templateData, 0600); err != nil {
 				t.Fatalf("failed to setup unassigned vuln: %v", err)
 			}

external/cmd/pypi/main.go

@@ -51,6 +51,7 @@ func loadExisting(vulnsDir string) (map[string]bool, error) {
 			return nil
 		}
 
+		//nolint:gosec // G122: Local directory walk in CLI script
 		f, err := os.Open(path)
 		if err != nil {
 			return fmt.Errorf("failed to open %s: %w", path, err)

external/cmd/pypi/main_test.go

@@ -98,10 +98,6 @@ affected:
 	}
 }
 
-func strPtr(s string) *string {
-	return &s
-}
-
 func TestGeneratePyPIAffected(t *testing.T) {
 	cve := models.NVDCVE{
 		ID:      "CVE-2022-29194",
@@ -115,13 +111,13 @@ func TestGeneratePyPIAffected(t *testing.T) {
 							{
 								Vulnerable:          true,
 								Criteria:            "cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*",
-								VersionEndExcluding: strPtr("2.6.4"),
+								VersionEndExcluding: new("2.6.4"),
 							},
 							{
 								Vulnerable:            true,
 								Criteria:              "cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*",
-								VersionStartIncluding: strPtr("2.7.0"),
-								VersionEndExcluding:   strPtr("2.7.2"),
+								VersionStartIncluding: new("2.7.0"),
+								VersionEndExcluding:   new("2.7.2"),
 							},
 						},
 					},

external/go.mod

@@ -1,6 +1,6 @@
 module github.com/google/osv.dev/external
 
-go 1.26.5
+go 1.27.0
 
 require (
 	github.com/aquasecurity/go-pep440-version v0.0.1

external/pypi/pypi.go

@@ -351,9 +351,9 @@ func (p *PyPI) packageExists(pkg string) bool {
 func (p *PyPI) finalPkgCheck(cve models.NVDCVE, pkg string, falsePositives *triage.FalsePositives) bool {
 	// To avoid false positives, check that the pkg name is mentioned in the description.
 	desc := strings.ToLower(models.EnglishDescription(cve.Descriptions))
-	pkgNameParts := strings.Split(pkg, "-")
+	pkgNameParts := strings.SplitSeq(pkg, "-")
 
-	for _, part := range pkgNameParts {
+	for part := range pkgNameParts {
 		// Python packages can commonly be py<name> or <name>-py.
 		// Remove this to be a bit more lenient when matching against the description.
 		part = strings.TrimPrefix(part, "py")

gcp/indexer/Dockerfile

@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.26.5-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS GO_BUILD
+FROM golang:1.27.0-alpine AS GO_BUILD
 WORKDIR /build
 
 # Cache dependencies in these steps

gcp/indexer/go.mod

@@ -1,6 +1,6 @@
 module github.com/google/osv.dev/gcp/indexer
 
-go 1.26.5
+go 1.27.0
 
 require (
 	cloud.google.com/go/datastore v1.26.0

go/.golangci.yaml

@@ -3,6 +3,8 @@ version: "2"
 linters:
   default: all
   # prettier-ignore
+  enable:
+    - gomodguard_v2 # gomodguard is deprecated but it's still in the default
   disable:
     - forbidigo
     - paralleltest
@@ -12,6 +14,7 @@ linters:
     - depguard         # Too annoying
     - err113           # will re-add later (another-rex)
     - exhaustruct      # overkill (g-rath)
+    - exhaustruct_v5
     - forcetypeassert  # too hard (g-rath)
     - funlen           #
     - funcorder        #

go/Dockerfile

@@ -31,7 +31,7 @@
 # ========================================================
 # Shared Builder Stage
 # ========================================================
-FROM golang:1.26.5-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS builder
+FROM golang:1.27.0-alpine AS builder
 
 WORKDIR /workspace
 

go/cmd/exporter/downloader.go

@@ -85,6 +85,7 @@ func downloadThenProcessor(ctx context.Context, cancel context.CancelFunc, clien
 
 		// Cache pre-compressed Deflate payload to local scratch disk.
 		localPath := filepath.Join(scratchDir, vuln.GetId()+".deflate")
+		//nolint:gosec // G703: Staging temporary file in scratch directory
 		if err := os.WriteFile(localPath, compressedBytes, 0600); err != nil {
 			logger.ErrorContext(ctx, "failed to write cached vulnerability to disk", slog.String("id", vuln.GetId()), slog.Any("err", err))
 			// Cancel the exporter context if writing to the scratch disk fails (e.g. disk full)

go/cmd/exporter/exporter.go

@@ -50,6 +50,7 @@ func main() {
 	flag.Parse()
 
 	scratchDir := *scratchDirFlag
+	//nolint:gosec // G703: Creating scratch directory
 	if err := os.MkdirAll(scratchDir, 0755); err != nil {
 		logger.FatalContext(ctx, "failed to create scratch directory", slog.String("dir", scratchDir), slog.Any("err", err))
 	}

go/cmd/exporter/worker.go

@@ -291,6 +291,7 @@ func writeVanir(ctx context.Context, vanirVulnIDs []string, outCh chan<- writeMs
 	vulns := make([]json.RawMessage, 0, len(vanirVulnIDs))
 	for _, id := range vanirVulnIDs {
 		localPath := filepath.Join(scratchDir, id+".deflate")
+		//nolint:gosec // G703: Reading temporary local file in scratch directory
 		f, err := os.Open(localPath)
 		if err != nil {
 			logger.ErrorContext(ctx, "failed to open local vuln file for vanir", slog.String("id", id), slog.Any("err", err))

go/cmd/extract_versions/main.go

@@ -38,9 +38,7 @@ func main() {
 
 	// Start workers
 	for range numWorkers {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
+		wg.Go(func() {
 			for file := range fileChan {
 				r, err := file.Open()
 				if err != nil {
@@ -80,7 +78,7 @@ func main() {
 					}
 				}
 			}
-		}()
+		})
 	}
 
 	// Collector
@@ -110,6 +108,7 @@ func main() {
 	vers := slices.Sorted(maps.Keys(allVersions))
 
 	// Write to output file
+	//nolint:gosec // G703: Writing to CLI output file
 	f, err := os.Create(outputFile)
 	if err != nil {
 		panic(err)

go/cmd/gitter/git.go

@@ -21,6 +21,8 @@ type FetchOptions struct {
 
 // prepareCmd prepares the command with context cancellation handled by sending SIGINT.
 func prepareCmd(ctx context.Context, dir string, env []string, name string, args ...string) *exec.Cmd {
+	//nolint: gosec // G702: The command arguments are mostly from within gitter
+	// The only user controlled input is the repoURL, which is still from internal services
 	cmd := exec.CommandContext(ctx, name, args...)
 	if dir != "" {
 		cmd.Dir = dir

go/cmd/gitter/gitter.go

@@ -390,6 +390,7 @@ func main() {
 	if repoMaxCostUint > math.MaxInt64 {
 		logger.Fatal("Repo cache max cost too large", slog.Uint64("maxCost", repoMaxCostUint))
 	}
+	//nolint:gosec // G115: The check is right above us
 	repoCacheMaxCostBytes = int64(repoMaxCostUint)
 
 	loadLastFetchMap()

go/cmd/gitter/repository.go

@@ -234,8 +234,8 @@ func (r *Repository) buildCommitGraph(ctx context.Context, cache *pb.RepositoryC
 					continue
 				}
 				// Only keep tags
-				if strings.HasPrefix(ref, "tag: ") {
-					tags = append(tags, strings.TrimPrefix(ref, "tag: "))
+				if after, ok := strings.CutPrefix(ref, "tag: "); ok {
+					tags = append(tags, after)
 				}
 			}
 

go/cmd/osv-linter-worker/Dockerfile

@@ -14,7 +14,7 @@
 
 
 # Stage 1: Build the Go linter binary
-FROM golang:1.26.5-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS go_builder
+FROM golang:1.27.0-alpine AS go_builder
 
 RUN apk add --no-cache git
 WORKDIR /src

go/cmd/osv-linter-worker/main.go

@@ -33,7 +33,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-	"sort"
+	"slices"
 	"strings"
 	"time"
 
@@ -296,8 +296,7 @@ func runLinter(binaryPath, dataDir string) ([]byte, error) {
 	logger.Info("Executing linter", slog.String("cmd", cmd.String()))
 	output, err := cmd.Output() // err usually just indicates that there were findings
 	if err != nil {
-		var exitErr *exec.ExitError
-		if !errors.As(err, &exitErr) {
+		if _, ok := errors.AsType[*exec.ExitError](err); !ok {
 			logger.Error("Linter execution failed unexpectedly", slog.Any("err", err))
 			return nil, err
 		}
@@ -373,9 +372,7 @@ func processLinterResult(ctx context.Context, store internalmodels.ImportFinding
 		for f := range uniqueFindings {
 			sortedFindings = append(sortedFindings, f)
 		}
-		sort.Slice(sortedFindings, func(i, j int) bool {
-			return sortedFindings[i] < sortedFindings[j]
-		})
+		slices.Sort(sortedFindings)
 
 		prefix := strings.Split(bugID, "-")[0] + "-"
 		source := prefixToSource[prefix]
@@ -396,10 +393,7 @@ func processLinterResult(ctx context.Context, store internalmodels.ImportFinding
 
 	// Fill channel
 	for i := 0; i < len(findingsToPut); i += batchSize {
-		end := i + batchSize
-		if end > len(findingsToPut) {
-			end = len(findingsToPut)
-		}
+		end := min(i+batchSize, len(findingsToPut))
 		batchChan <- findingsToPut[i:end]
 	}
 	close(batchChan)
@@ -441,10 +435,7 @@ func processLinterResult(ctx context.Context, store internalmodels.ImportFinding
 			deleteBatchChan := make(chan []string, len(idsToDelete)/batchSize+1)
 
 			for i := 0; i < len(idsToDelete); i += batchSize {
-				end := i + batchSize
-				if end > len(idsToDelete) {
-					end = len(idsToDelete)
-				}
+				end := min(i+batchSize, len(idsToDelete))
 				deleteBatchChan <- idsToDelete[i:end]
 			}
 			close(deleteBatchChan)

go/cmd/recordchecker/recordchecker.go

@@ -129,13 +129,11 @@ func run(ctx context.Context, env *appEnv) error {
 	// Start the worker pool
 	var workerWg sync.WaitGroup
 	for range env.numWorkers {
-		workerWg.Add(1)
-		go func() {
-			defer workerWg.Done()
+		workerWg.Go(func() {
 			for task := range tasksChan {
 				resultsChan <- checkRecord(ctx, env.ds, env.storage, task.id, task.vuln)
 			}
-		}()
+		})
 	}
 
 	// Queue all invalid records from the previous run.