umputun / feed-master / 35482446996

75%

push

github

chore: update golangci-lint to v2.12 (#177)

moves the CI golangci-lint pin from v2.9 to v2.12, per the measurements in #174.

v2.9 came in with #173 as the conservative step: v2.6.2 is built with go1.25 and refuses a module targeting 1.26 outright, and v2.9.0 is both the first release built with go1.26 and what `umputun/baseimage` installs. On this tree v2.12 reports five gosec findings and one `modernize` finding.

the `modernize` one is a real improvement and is taken: `CleanText` in `app/proc/twitter.go` uses `slices.Backward`.

all five gosec sites are safe as written, so each gets an inline `nolint:gosec` with the reason that applies to it:

- `app/api/server.go:255` writes `encoding/xml` output under `application/xml`
- `app/api/web.go:80` and `:161` write `html/template` output where the `template.HTML` description fields render inside quoted `title` attributes in `feed.tmpl` and `source.tmpl`, so quotes are escaped and tags dropped
- `app/api/web.go:308` writes `html/template` output too, but `sources.tmpl` only renders ordinary `string` source names and URLs, with no `template.HTML` involved
- `app/youtube/service.go:601` runs a shell command that comes from the operator's own YAML config, matching the existing directive at `app/youtube/feed/downloader.go:58`

the count is five rather than the four reported in the issue: `.golangci.yml` sets no `max-same-issues`, so the default of 3 hid a fourth G705 at `app/api/web.go:308`.

Related to #174

6 of 6 new or added lines in 4 files covered. (100.0%)

1468 of 1967 relevant lines covered (74.63%)

10.66 hits per line