openSUSE-SU-2026:22197-1

Dashboard / Vulnerabilities / openSUSE-SU-2026:22197-1

openSUSE-SU-2026:22197-1

Summary: Security update for gosec

Details: This update for gosec fixes the following issues: Changes in gosec: - Update to version 2.30.0 (bsc#1287590, CVE-2026-97032): * fix(g602): recognize equality comparison in minimumLenForBranch (#1796) * fix(G112): honor read timeouts assigned through a struct field (#1798) * fix(G112): report read timeouts explicitly set to zero (#1797) * feat(G706): extend log/slog method coverage (#1795) * fix(autofix): read the first text block of a Claude response (#1794) * fix(autofix): give every AI request its own timeout (#1793) * fix(resolve): treat constants from other packages as resolved (#1792) * fix(autofix): return an error when a Gemini candidate has no content (#1791) * Update to go version 1.27.3 and 1.26.10 (#1790) * fix(autofix): default Gemini model to gemini-3.1-pro-preview (#1788) * fix(G102): resolve concatenated and constant listen addresses (#1787) * fix: default -concurrency to GOMAXPROCS so container CPU limits apply (#1786) * fix(g602): track statically known lengths for append results in slice bounds check (#1773) * feat(rules): add G125 to detect unescaped url.JoinPath elements (#1777) * fix: load absolute file paths so nested modules are analysed from the parent directory (#1779) * fix(G118): treat a cancel sent on a channel as handed off (#1782) * fix(G112): honor read timeouts assigned after the http.Server literal (#1781) * fix(G303): resolve constant temp file paths (#1784) * fix(deps): update all dependencies (#1783) * fix(G203): treat constant template arguments as safe (#1770) * fix(G402): check TLS settings assigned through a *tls.Config (#1769) * fix(deps): update all dependencies (#1775) * Update to go version 1.27.2 and 1.26.9 (#1772) * Keep SARIF driver rules sorted and resolve rule indexes at the end (#1767) * fix(G602): track append() results for slice bounds checking (#1754) * fix(deps): update all dependencies (#1768) * fix(G602): trust len(nilSlice) == N guards, matching make()-backed slices (#1752) * fix(G407): treat an array IV/nonce as a zeroed buffer (#1763) * fix(fileperms): resolve constant file and directory permissions (#1766) * fix(G102): detect binding to the IPv6 unspecified address (#1760) * fix(G407): stop the nonce source walk on cycles (#1761) * fix(G407): do not count AEAD.Seal as the read that fills its own nonce (#1762) * fix(deps): update all dependencies (#1764) * fix(G602): validate inequality len guards (#1757) * fix(G121): track request captured by closures (#1759) * fix(deps): update all dependencies (#1756) * fix: make nosec suppression independent of comment order (#1741) * fix(G403): resolve constant RSA key sizes (#1751) * fix(G602): validate subslice bounds under equality guards (#1749) * fix(G124): resolve negated constant cookie flags (#1748) * fix(G602): report constant index equal to the length asserted by an equality guard (#1746) * Skip taint call graphs when no sinks match (#1745) * Fix brittle test for html writer (#1744) * fix(G404): ignore non-cryptographic Shuffle calls (#1742) * fix(deps): update all dependencies (#1743) * fix(taint): remove Result.Source field that is never populated (#1739) * Update all dependencies (#1737) * Update go version 1.27.1 and 1.26.8 and phased out 1.25 (#1738) * fix(report): correct Babel SRI hash (#1736) * fix(taint): make wide caller traversal deterministic (#1733) * fix(G702): skip the context argument of exec.CommandContext (#1730) * feat(taint): name the sink in taint finding messages (#1731) * Update all dependencies (#1734) * Update action to gosec version 2.29.0 (#1728) - Update to version 2.29.0: * analyzers/G703: stop treating Clean/Abs/PathEscape as path-traversal sanitizers (#1723) * fix(junit): properly escape XML in failure text (#1718) * fix(csv): capture and report write errors on flush (#1716) * fix(report): root path matching in formatters (#1719) * fix(config): handle nosec tags with leading hash (#1717) * Update all dependencies (#1720) * Add support for go version 1.27.0 and update to version 1.25.14 and 1… (#1726) * Update all dependencies (#1713) * Update all dependencies (#1710) * fix(G202): don't flag strings.Builder built from constants (#1707) * ci: allow fork PR checkout in barry-ai-security-review job (#1708) * Update all dependencies (#1709) * Downgrade min Go version (#1706) * Udpate action to use gosec v2.28.0 (#1705)

References: , https://bugzilla.suse.com/1287590, https://www.suse.com/security/cve/CVE-2026-97032