v0.6.0

What's Changed

• Make the gates binding: stop cancelling the tier that dates regressions by @dakimura in #16
• Bail to go list when export data is asked for, instead of returning none by @dakimura in #18
• Lint the files git has not been told about yet by @dakimura in #19
• Report the integer conversions nothing has bounded (gosec G115) by @dakimura in #20
• Spare the parameters a config told revive to spare (allowRegex) by @dakimura in #21
• Peel the pointer off an elided composite literal (modernize atomictypes) by @dakimura in #22
• Leave the switch that cannot become an if-then alone (unnecessary-stmt) by @dakimura in #23
• Match gosec's call rules by syntax, the way gosec does (G404) by @dakimura in #24
• Keep the excluded files a test variant still has (modernize atomictypes) by @dakimura in #25
• Give testifylint a ground-truth gate, and fix the four things it found by @dakimura in #26
• Let errors.As take a target of any (govet errorsas) by @dakimura in #27
• Read protogetter's rules off protogetter, aliases and all by @dakimura in #28
• Read uses the error off the call arguments, as nilerr does by @dakimura in #29
• Print the type parameters a generic receiver has (unused) by @dakimura in #30
• Follow the rename through the join, not just into the branches (SA5011) by @dakimura in #31
• Stay out of a kubebuilder package (modernize omitzero) by @dakimura in #32
• A test file is a filename, not a package name (revive IsTest) by @dakimura in #33
• A nil is only a swallowed error where an error is returned (nilerr) by @dakimura in #34
• Format like the gofumpt golangci-lint pins, and stop inventing a severity by @dakimura in #35
• Name the path in a dupl message, and stop dereferencing an interface (gocritic underef) by @dakimura in #36
• Honour revive's own disable directives by @dakimura in #37
• Compare signatures, not arena ids (SA5010) by @dakimura in #39
• Two places upstream is deliberately blind, and guff was not (composites, nilnil) by @dakimura in #38
• Four gates gitea found missing (gocritic badCall/mapKey, revive identical-*/if-return) by @dakimura in #40
• Three more of gitea's 33 (bodyclose, testifylint bool-compare, govet structtag) by @dakimura in #41
• Compare the printed source, not an approximation of it (SA4000) by @dakimura in #42
• Only a map read counts as a map read (SA6001) by @dakimura in #44
• Two gates jaeger found missing (gocritic stringXbytes, revive max-control-nesting) by @dakimura in #43
• httpresponse: the membership test is the signature, not the package by @dakimura in #45
• contextcheck: a capturing closure had nowhere to report, and a bare one had no business reporting by @dakimura in #46
• An import stub is not a package: fact producers were scheduled on metadata by @dakimura in #47
• A labelled break jumped to the top of the loop it was leaving by @dakimura in #48
• Two gocritic false positives argo-cd found (walker scope, regexpSimplify escapes) by @dakimura in #49
• Two argo-cd false positives (thelper synctest, formatters crossing a module boundary) by @dakimura in #50
• G122: the path stays the path after filepath.Clean by @dakimura in #51
• usetesting: the function that owns the closure owns the finding by @dakimura in #52
• Session log: the 2026-08-20 hunt pass, and what the next one should start with by @dakimura in #53
• contextcheck: a callee built for an imported package has no SSA package to ask by @dakimura in #54
• protogetter: a getter that returns a value cannot fill a pointer field by @dakimura in #55
• spancheck: report on the assignment and on the return, and only when there is one by @dakimura in #56
• unused: a generic interface draws no edge to the methods that implement it by @dakimura in #57
• bodyclose: a response is one that came out of a call by @dakimura in #58
• prealloc: the capacity is printed the way go/printer prints it by @dakimura in #59
• gocritic: a block comment is its own group by @dakimura in #60
• recvcheck: 2.12.2 excludes the encoding half, not the decoding half by @dakimura in #61
• Session log, second half: eight more, and the version the comparison is against by @dakimura in #62
• Record the bodyclose hypothesis that fit three shapes and broke on a repo by @dakimura in #63
• gosec G202: SQL string concatenation by @dakimura in #64
• One shared body for ST1023 and QF1011, and the right-hand side seen alone by @dakimura in #65
• An index binds to the position that absorbs it (govet printf) by @dakimura in #66
• A deferred call can assign to a named result, so don't lift it by @dakimura in #67
• The receiver decides whether a call aborts (SA5011) by @dakimura in #68
• return f() returns f's results, not f's tuple by @dakimura in #69
• //lint:ignore U1000 marks an object used by @dakimura in #70
• Three loops: where rangeint points, what it refuses, and what range costs by @dakimura in #71
• Three dapr false positives: an else, a getter, and a stack index by @dakimura in #72
• The package initializer is not a source function (gosec) by @dakimura in #73
• G101's gate is a dictionary, not a character count (port zxcvbn) by @dakimura in #74
• Three ways a response goes unclosed, and two that are not calls at all (bodyclose) by @dakimura in #75
• unparam's other three families, and the results a range-over-func return was dropping by @dakimura in #76
• A response stored into a captured variable, and the closure that closes it by @dakimura in #77
• os-setenv is on by golangci's defaults, and a conversion is pure by @dakimura in #78
• cargo test that never starts is a file count, not a slow test by @dakimura in #79
• unused colours a graph from its roots, and go1.26's new takes a value by @dakimura in #80
• Release 0.6.0: 64 commits of upstream parity, re-measured by @dakimura in #81

Full Changelog: v0.5.0...v0.6.0