Files
milvus/client/.golangci.yml
b0ec4a2dd8 fix: upgrade Go to 1.25.8 for CVE-2025-68121, CVE-2026-27142, CVE-2026-25679 (#48286)
issue: #48574

## Summary
- Upgrade Go from 1.24.12 to 1.25.8 across all go.mod files and
Dockerfiles
- Fixes CVE-2025-68121 (CRITICAL), CVE-2026-27142 (HIGH), CVE-2026-25679
(HIGH) in Go stdlib
- All three CVEs affect the Go standard library and are resolved by
upgrading to Go 1.25.8

## Changes
- Updated `go` directive in go.mod files (root, pkg/, client/,
tests/go_client/, examples/)
- Updated Go download URLs in Dockerfiles (build/docker/builder/)
- Updated `toolchain` directives where present

issue: https://github.com/milvus-io/milvus/issues/TBD

## Test plan
- [x] `make milvus` builds successfully with Go 1.25.8
- [ ] CI passes

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Signed-off-by: Li Liu <li.liu@zilliz.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-27 14:23:30 +08:00

284 lines
7.2 KiB
YAML

version: "2"
run:
go: "1.25"
linters:
default: none
enable:
- decorder
- depguard
- durationcheck
- forbidigo
- gocritic
- gosec
- govet
- ineffassign
- misspell
- revive
- staticcheck
- unconvert
- whitespace
settings:
depguard:
rules:
main:
deny:
- pkg: errors
desc: not allowed, use github.com/cockroachdb/errors
- pkg: github.com/pkg/errors
desc: not allowed, use github.com/cockroachdb/errors
- pkg: github.com/pingcap/errors
desc: not allowed, use github.com/cockroachdb/errors
- pkg: golang.org/x/xerrors
desc: not allowed, use github.com/cockroachdb/errors
- pkg: github.com/go-errors/errors
desc: not allowed, use github.com/cockroachdb/errors
- pkg: io/ioutil
desc: ioutil is deprecated after 1.16, 1.17, use os and io package instead
- pkg: github.com/tikv/client-go/rawkv
desc: not allowed, use github.com/tikv/client-go/v2/txnkv
- pkg: github.com/tikv/client-go/v2/rawkv
desc: not allowed, use github.com/tikv/client-go/v2/txnkv
forbidigo:
forbid:
- pattern: ^time\.Tick$
- pattern: return merr\.Err[a-zA-Z]+
- pattern: merr\.Wrap\w+\(\)\.Error\(\)
- pattern: '\.(ErrorCode|Reason) = '
- pattern: Reason:\s+\w+\.Error\(\)
- pattern: errors.New\((.+)\.GetReason\(\)\)
- pattern: commonpb\.Status\{[\s\n]*ErrorCode:[\s\n]*.+[\s\S\n]*?\}
- pattern: os\.Open\(.+\)
- pattern: os\.ReadFile\(.+\)
- pattern: os\.WriteFile\(.+\)
- pattern: runtime.NumCPU
- pattern: runtime.GOMAXPROCS(0)
gocritic:
enabled-tags: []
enabled-checks:
- ruleguard
settings:
ruleguard:
rules: ruleguard/rules.go
govet:
disable:
- printf
misspell:
locale: US
revive:
rules:
- name: unused-parameter
disabled: true
- name: var-naming
arguments:
- - ID
severity: warning
disabled: false
- name: context-as-argument
arguments:
- allowTypesBefore: '*testing.T'
severity: warning
disabled: false
- name: datarace
severity: warning
disabled: false
- name: duplicated-imports
severity: warning
disabled: false
- name: waitgroup-by-value
severity: warning
disabled: false
- name: indent-error-flow
arguments:
- preserveScope
severity: warning
disabled: false
- name: range-val-in-closure
severity: warning
disabled: false
- name: range-val-address
severity: warning
disabled: false
- name: string-of-int
severity: warning
disabled: false
exclusions:
generated: lax
rules:
- linters:
- forbidigo
path: .+_test\.go
- path: (.+)\.go$
text: should have a package comment
- path: (.+)\.go$
text: should have comment
- path: (.+)\.go$
text: should be of the form
- path: (.+)\.go$
text: should not use dot imports
- path: (.+)\.go$
text: which can be annoying to use
- path: (.+)\.go$
text: G102
- path: (.+)\.go$
text: G103
- path: (.+)\.go$
text: G104
- path: (.+)\.go$
text: G301
- path: (.+)\.go$
text: G302
- path: (.+)\.go$
text: G304
- path: (.+)\.go$
text: G307
- path: (.+)\.go$
text: G402
- path: (.+)\.go$
text: G404
- path: (.+)\.go$
text: SA1019
- path: (.+)\.go$
text: SA5001
- path: (.+)\.go$
text: sloppyLen
- path: (.+)\.go$
text: dupSubExpr
- path: (.+)\.go$
text: assignOp
- path: (.+)\.go$
text: ifElseChain
- path: (.+)\.go$
text: elseif
- path: (.+)\.go$
text: commentFormatting
- path: (.+)\.go$
text: exitAfterDefer
- path: (.+)\.go$
text: captLocal
- path: (.+)\.go$
text: singleCaseSwitch
- path: (.+)\.go$
text: typeSwitchVar
- path: (.+)\.go$
text: indent-error-flow
- path: (.+)\.go$
text: appendAssign
- path: (.+)\.go$
text: deprecatedComment
- path: (.+)\.go$
text: SA9009
- path: (.+)\.go$
text: SA1006
- path: (.+)\.go$
text: S1009
- path: (.+)\.go$
text: offBy1
- path: (.+)\.go$
text: unslice
- path: (.+)\.go$
text: G115
# TODO: cleanup following exclusions, added on golangci-lint v2 upgrade
# staticcheck quick-fix suggestions (QF)
- path: (.+)\.go$
text: QF1001
- path: (.+)\.go$
text: QF1003
- path: (.+)\.go$
text: QF1005
- path: (.+)\.go$
text: QF1006
- path: (.+)\.go$
text: QF1007
- path: (.+)\.go$
text: QF1008
- path: (.+)\.go$
text: QF1011
- path: (.+)\.go$
text: QF1012
# staticcheck style checks (ST)
- path: (.+)\.go$
text: ST1005
- path: (.+)\.go$
text: ST1008
- path: (.+)\.go$
text: ST1011
- path: (.+)\.go$
text: ST1023
# gosec rules not enforced in v1 (G602 slice bounds, G101 hardcoded credentials)
- path: (.+)\.go$
text: G602
- path: (.+)\.go$
text: G101
# staticcheck SA4006 (assigned value never used) — not enforced in v1
- path: (.+)\.go$
text: SA4006
# whitespace trailing newline — not enforced strictly in v1
- path: (.+)\.go$
linters:
- whitespace
text: unnecessary trailing newline
# gosec new rules (introduced in gosec v2.23+, not present in golangci-lint v1)
- path: (.+)\.go$
text: G117
- path: (.+)\.go$
text: G118
- path: (.+)\.go$
text: G120
- path: (.+)\.go$
text: G702
- path: (.+)\.go$
text: G703
- path: (.+)\.go$
text: G705
- path: (.+)\.go$
text: G704
- path: (.+)\.go$
text: G706
paths:
- (^|/)partial_search_test\.go$
- ^build/
- ^configs/
- ^deployments/
- ^docs/
- ^scripts/
- ^internal/core/
- ^cmake_build/
- ^third_party/
- ^builtin/
- ^examples/
issues:
max-issues-per-linter: 0
max-same-issues: 0
formatters:
enable:
- gci
- gofmt
- gofumpt
- goimports
settings:
gci:
sections:
- standard
- default
- prefix(github.com/milvus-io)
custom-order: true
gofumpt:
module-path: github.com/milvus-io
goimports:
local-prefixes:
- github.com/milvus-io
exclusions:
generated: lax
paths:
- (^|/)partial_search_test\.go$
- ^build/
- ^configs/
- ^deployments/
- ^docs/
- ^scripts/
- ^internal/core/
- ^cmake_build/
- ^third_party/
- ^builtin/
- ^examples/