[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/securego/gosec/v2	v2.29.0 → v2.30.0

---

Release Notes

securego/gosec (github.com/securego/gosec/v2)

v2.30.0

Compare Source

Changelog

• 5eb1d10 fix(g602): recognize equality comparison in minimumLenForBranch (#​1796)
• cc750dd fix(G112): honor read timeouts assigned through a struct field (#​1798)
• 1cbfd7e fix(G112): report read timeouts explicitly set to zero (#​1797)
• 05b9c4c feat(G706): extend log/slog method coverage (#​1795)
• 17ad2dd fix(autofix): read the first text block of a Claude response (#​1794)
• b23171c fix(autofix): give every AI request its own timeout (#​1793)
• 20b9e5b fix(resolve): treat constants from other packages as resolved (#​1792)
• 86d3c26 fix(autofix): return an error when a Gemini candidate has no content (#​1791)
• 14ef84f Update to go version 1.27.3 and 1.26.10 (#​1790)
• 7cbd7a9 fix(autofix): default Gemini model to gemini-3.1-pro-preview (#​1788)
• 1e26bce fix(G102): resolve concatenated and constant listen addresses (#​1787)
• 836dbdb fix: default -concurrency to GOMAXPROCS so container CPU limits apply (#​1786)
• bbd69e2 fix(g602): track statically known lengths for append results in slice bounds check (#​1773)
• 30e2d38 feat(rules): add G125 to detect unescaped url.JoinPath elements (#​1777)
• 57c45b8 fix: load absolute file paths so nested modules are analysed from the parent directory (#​1779)
• 77fa84e fix(G118): treat a cancel sent on a channel as handed off (#​1782)
• ca547ab fix(G112): honor read timeouts assigned after the http.Server literal (#​1781)
• 024084b fix(G303): resolve constant temp file paths (#​1784)
• 782eeb1 fix(deps): update all dependencies (#​1783)
• 707f227 fix(G203): treat constant template arguments as safe (#​1770)
• 8c5daa6 fix(G402): check TLS settings assigned through a *tls.Config (#​1769)
• 7157726 fix(deps): update all dependencies (#​1775)
• 7b1b5ce Update to go version 1.27.2 and 1.26.9 (#​1772)
• d2b649e Keep SARIF driver rules sorted and resolve rule indexes at the end (#​1767)
• 1f52e64 fix(G602): track append() results for slice bounds checking (#​1754)
• ea75d9f fix(deps): update all dependencies (#​1768)
• 65c2c08 fix(G602): trust len(nilSlice) == N guards, matching make()-backed slices (#​1752)
• 6ff893e fix(G407): treat an array IV/nonce as a zeroed buffer (#​1763)
• aaca894 fix(fileperms): resolve constant file and directory permissions (#​1766)
• 826f6f4 fix(G102): detect binding to the IPv6 unspecified address (#​1760)
• 021cc2e fix(G407): stop the nonce source walk on cycles (#​1761)
• ccb369d fix(G407): do not count AEAD.Seal as the read that fills its own nonce (#​1762)
• 9b31806 fix(deps): update all dependencies (#​1764)
• 8c77519 fix(G602): validate inequality len guards (#​1757)
• 027baa2 fix(G121): track request captured by closures (#​1759)
• 9ede89e fix(deps): update all dependencies (#​1756)
• 29a042e fix: make nosec suppression independent of comment order (#​1741)
• 6813471 fix(G403): resolve constant RSA key sizes (#​1751)
• 201d413 fix(G602): validate subslice bounds under equality guards (#​1749)
• accb424 fix(G124): resolve negated constant cookie flags (#​1748)
• 61fa1da fix(G602): report constant index equal to the length asserted by an equality guard (#​1746)
• 78fbcc7 Skip taint call graphs when no sinks match (#​1745)
• 79b4fcd Fix brittle test for html writer (#​1744)
• d70cac3 fix(G404): ignore non-cryptographic Shuffle calls (#​1742)
• 9e8e5d9 fix(deps): update all dependencies (#​1743)
• 8075fd2 fix(taint): remove Result.Source field that is never populated (#​1739)
• 58362d8 Update all dependencies (#​1737)
• d98945a Update go version 1.27.1 and 1.26.8 and phased out 1.25 (#​1738)
• 720c679 fix(report): correct Babel SRI hash (#​1736)
• 598d614 fix(taint): make wide caller traversal deterministic (#​1733)
• 4d447d9 fix(G702): skip the context argument of exec.CommandContext (#​1730)
• be1e315 feat(taint): name the sink in taint finding messages (#​1731)
• a102130 Update all dependencies (#​1734)
• 57f1613 Update action to gosec version 2.29.0 (#​1728)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.5%. Comparing base (4224a8c) to head (692c703).

Additional details and impacted files

@@           Coverage Diff           @@
##            main   #9272     +/-   ##
=======================================
- Coverage   89.5%   89.5%   -0.1%     
=======================================
  Files        351     351             
  Lines      23192   23192             
=======================================
- Hits       20775   20766      -9     
- Misses      2417    2426      +9     

see 4 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[opentelemetry-pr-dashboard]

Pull request dashboard status

Waiting on reviewers · refreshed 2026-10-23 21:13 UTC

Review the latest changes.

Status above doesn't look right?

• Just replied or pushed? Anything around or after the refresh time above may not be picked up yet — give it a few minutes.
• Anything look wrong? Report it with what you expected; it helps us improve the dashboard.

[Copilot]

🔵 Needs a closer look

Compatibility with the pinned lint tooling and Go toolchain remains unverified and needs CI confirmation before human approval.

No open issues 🎉

What changed in this PR

Updates gosec from v2.29.0 to v2.30.0 in the internal tooling module, bringing upstream security-analysis improvements without changing application code.

Changes:

• Bumps the indirect gosec dependency.
• Refreshes checksums for gosec, pprof, Ginkgo, and Gomega.

No concrete issues were identified in the supplied changes.

File	Description
internal/​tools/​go.sum	Refreshes gosec and related dependency checksums.
internal/​tools/​go.mod	Updates gosec to v2.30.0.

_{Review effort: Balanced}