v0.7.0

What's Changed

• A cancel that never gets called, and a TLS config that skips its own check by @dakimura in #82
• SA5008 was misreading struct tags before it ever looked at the JSON by @dakimura in #83
• wsl_v5 was reading three of upstream's exemptions as violations by @dakimura in #84
• G122 followed the walk callback into closures upstream never enters by @dakimura in #85
• //lint:file-ignore U1000 stopped at the file; upstream's does not by @dakimura in #86
• authelia's last three: wsl_v5's err check and a taint that never died by @dakimura in #87
• Two modernizers shipped their messages bare, and the case that would have caught it by @dakimura in #88
• minmax had one of upstream's two patterns, and the wrong idea of "equal" by @dakimura in #89
• forcetypeassert pointed at the :=, and its whole fixture was six lines by @dakimura in #90
• guff type-checked syncthing's lib/model as ill-typed, and no gate could say so by @dakimura in #91
• SA4016 had one of upstream's two branches, and ^ rendered as ? by @dakimura in #92
• gosec's taint is four rules on one engine, and its call graph is not every function by @dakimura in #93
• T[A, B](v) is a conversion, and *p is addressable whatever p was by @dakimura in #94
• Inference's "untyped" argument was tested for being a constant by @dakimura in #95
• An untyped constant does not convert to an interface by being representable as one by @dakimura in #96
• docs: the embedded-generic-instance failure narrows to one line of context by @dakimura in #97
• A generic instance one struct down still needs its methods expanded by @dakimura in #98
• package p_test imports the test variant of p, not the production one by @dakimura in #99
• A typed constant is rounded after every operation, not where it is used by @dakimura in #100
• errchkjson never matched (*encoding/json.Encoder).Encode by @dakimura in #101
• gosec G705: the sink is a method on an interface, and the writer decides by @dakimura in #102
• byte and rune are their own Basic values, not spellings of uint8 and int32 by @dakimura in #103
• Recovering a doc comment's position by line number threw away the column by @dakimura in #104
• godot: three defects — a missing collector, a wrong line, and a dropped blank line by @dakimura in #105
• Three linters reporting the right finding the wrong way by @dakimura in #106
• thanos no longer has an ill-typed package, so stop allowing it one by @dakimura in #107
• The seed compiled one copy of a package and ordered it by another's imports by @dakimura in #108
• 84 of 116 linters had never had a column or a severity checked by @dakimura in #109
• Widening 18 thin fixtures found 7 defects, two of them in the type checker by @dakimura in #110
• Widening 20 more fixtures: 4 defects, and one a unit test was demanding by @dakimura in #111
• 33 more fixtures widened: 2 defects, both invisible at one finding by @dakimura in #112
• Counting the Info.Defs holes instead of waiting to trip over them by @dakimura in #113
• Seven private expr_string, three upstream renderers, seven defects by @dakimura in #114
• The last three expr_string, and a fourth upstream renderer by @dakimura in #115
• --isolate --linter X was overwriting the committed 116-target snapshot by @dakimura in #116
• --fix was broken in three places, and fixing one moved nothing by @dakimura in #117
• A tier that compares what --fix writes, and the one case guff wrote too much by @dakimura in #118
• AddImport is one function ten checkers call, and File.imports was a different list by @dakimura in #119
• Three --fix defects in modernize, and the two the syntax error was hiding by @dakimura in #120
• importas renamed the alias and not the code that used it by @dakimura in #121
• QF1012 checked *T and passed T, and one hunk it leaves is upstream's bug by @dakimura in #122
• DeleteStmt and DeleteUnusedVars, and no guff-side broken tree left by @dakimura in #123
• revive's ReplacementLine, and a slot for "upstream is wrong" by @dakimura in #124
• govet's assign and unreachable, and a unit test that pinned the wrong answer by @dakimura in #125
• govet's timeformat and sigchanyzer by @dakimura in #126
• govet's stringintconv and composites by @dakimura in #127
• govet's hostport by @dakimura in #128
• godot's missing period, and an approximation not taken by @dakimura in #129
• whitespace's blank lines, and gocritic's first three fixes by @dakimura in #130
• staticcheck's S1002, S1004 and S1012, and the renderer that answers a different question by @dakimura in #131
• staticcheck's S1003 and S1021, and the case that closes is not the one worked on by @dakimura in #132
• staticcheck's S1016, S1028 and S1030, and two names for one type by @dakimura in #133
• Five more S checks, and a fixer that wrote nothing when it should have written a formatted file by @dakimura in #134
• Seven more S checks, and the three shapes a one-shape fixture was hiding by @dakimura in #135
• S1001, and the three defects a seven-shape fixture found in one run by @dakimura in #136
• goheader: the largest pending gap was two missing pieces by @dakimura in #137
• testifylint: seven checkers that rewrite the name and the arguments together by @dakimura in #138
• testifylint: the other nine checkers, and the case closes by @dakimura in #139
• dupword's comments, an upstream bug reproduced, and one half left undone by @dakimura in #140
• nlreturn and protogetter: "source not obtainable" was one command from false by @dakimura in #141
• Write down why nolint's fixes are a design decision, not a port by @dakimura in #142
• ginkgolinter: the message already carried the fix by @dakimura in #143
• A path boundary in the fixer: an edit must land in its own issue's file by @dakimura in #144
• SA1004: emitting more so that less is written by @dakimura in #145
• SA4013: two rules meeting in one hunk by @dakimura in #146
• SA4026 and SA1013: writing the rewrite that does not compile by @dakimura in #147
• SA1006 and SA6005, and three cases closing at once by @dakimura in #148
• staticcheck-sa closes: SA4029, SA1008, SA9004 by @dakimura in #149
• gocritic's extras.go: 48 lines of diff, none of them written by a linter by @dakimura in #150
• parens over-wrote by one hunk, and the ledger's refusal was one level too shallow by @dakimura in #151
• QF1005: seven defects behind four differing lines, one of them deleting a call by @dakimura in #152
• Add a Hindi README and put it in every language bar by @dakimura in #153
• dupword closes: a linter did less because of where a file sat in the crate graph by @dakimura in #154
• nolintlint gets its fixes: three cases close, and #142's dilemma was a false one by @dakimura in #155
• gocritic: 13 ruleguard suggestions, and the last 9 lines belong to another subsystem by @dakimura in #156
• wsl and wsl-v5 close, and the thin fixtures were hiding a reporting bug by @dakimura in #157
• The Fixer belongs inside the pipeline, before dedup and the caps by @dakimura in #158
• nakedret and embeddedstructfieldcheck: the inputs were already there by @dakimura in #159
• usetesting: upstream's comment and its code disagree, and the code is the spec by @dakimura in #160
• sloglint: guff-gostd gets its second caller by @dakimura in #161
• tagalign: the hardest-looking one was already computed by @dakimura in #162
• exptostd: the deferral's reason contradicted upstream's own TODO by @dakimura in #163
• govet inline: my own "needs new data" call was half wrong by @dakimura in #164
• docs: measure the go/doc/comment gap — 88% of unformatted input, not 9 lines by @dakimura in #165
• noinlineerr: the deferral's fact held, its reason had rotted by @dakimura in #166
• go/doc/comment: the last 9 lines were gofmt's, and the gap was 60% of GOROOT by @dakimura in #167
• compat/fmt: the fmt surface had no tier, and its first run found four defects by @dakimura in #168
• goimports: two group-blank defects, and a corpus that cannot see either by @dakimura in #169
• gofmt -s: port the simplifier, so the default config needs no Go toolchain by @dakimura in #170
• godoclint: the deferral's blocker had been removed four PRs earlier by @dakimura in #171
• godoclint: default: all was silently dropping five rules; give one back by @dakimura in #172
• godoclint: require-pkg-doc, the second of five rules default: all dropped by @dakimura in #173
• godoclint: options.* was missing entirely, and two rules degraded outside opt-in by @dakimura in #174
• godoclint: port the inspector's symbol list, and the three things deprecated missed by @dakimura in #175
• godoclint: require-doc — the rule body is 30 lines, the model was the work by @dakimura in #176
• godoclint: max-len measures the reprinted line, not the source line by @dakimura in #177
• godoclint: require-stdlib-doclink closes the set — the index is vendored, not regenerated by @dakimura in #178
• Four linters saw code buildssa cannot reach: package-level var initializers by @dakimura in #179
• go/ssa gives every result a local; guff gave FuncLits one only when named by @dakimura in #180
• unparam called function literals "", a string golangci-lint cannot emit by @dakimura in #181
• nilerr rendered its line list with Rust's commas, not Go's spaces by @dakimura in #182
• The corpus's first seven new targets, and the crash and the refusal they found by @dakimura in #183
• gitea: an upstream sigma-node duplicate, and a const go/ssa never gives a cell by @dakimura in #184
• The loop ran as an account that was never signed in, and called it "no pull request" by @dakimura in #185
• jaeger's two revive findings are guff's; upstream was silent because its binary's GOROOT is gone by @dakimura in #187
• Half an hour of silence is not a status, and cargo never cleans up after itself by @dakimura in #186
• nats-server: a func literal cleared the goto table, and SA5011 knew one of two mirrors by @dakimura in #188
• An iteration waited for a background job, and claude -p has no next turn by @dakimura in #189
• Drop the unattended loop; keep the ledger and hand the method to a session by @dakimura in #190
• thanos: the three findings were under t.Skip(…), where upstream's IR has nothing by @dakimura in #191
• Merge the compat PRs without asking, and count the shapes in a Rust test by @dakimura in #192
• scaleway-cli: two gates in series, and a linter that skips on an import by @dakimura in #193
• gocritic unnamedResult asks the type for its name, not the syntax by @dakimura in #194
• SA6002 asks IsPointerLike; guff was asking SA1014's Pointer by @dakimura in #195
• complex(2, 3) is an untyped constant, and three ports did not know it by @dakimura in #196
• tagliatelle keeps a digit inside the word it follows by @dakimura in #197
• Type.Implements asks the type as written, not the addressable one by @dakimura in #198
• A renderer that answers makes two different expressions equal by @dakimura in #199
• datarace matches objects, not names — and a longer fixture ate another gate by @dakimura in #200
• gosec's #nosec covers the node's line range, not the three lines above it by @dakimura in #201
• callcheck asked for the argument type through a peel upstream does not have by @dakimura in #202
• port fieldalignment, and fix the ownership map it exposed by @dakimura in #203
• contextcheck: a replaced context stops the analysis, and $bound is not the method by @dakimura in #204
• wrapcheck: the func-literal skip belongs to the call branch, not the return by @dakimura in #205
• unparam: emulate go/ssa's packed variadic slice, and check func literals by @dakimura in #206
• fatcontext: the span helper had no FuncDecl arm, so every plain body reported by @dakimura in #207
• unusedresult, perfsprint, ineffassign: three ways to look at the wrong thing by @dakimura in #208
• IntegerLiteral is a syntactic pattern, not a folded constant by @dakimura in #209
• printf: a format with no directives is its own branch, and a method's name is FullName() by @dakimura in #210
• bodyclose: isopen walks the referrers, and the approximation folded five branches into two by @dakimura in #211
• exclusions run before //nolint, so an excluded finding leaves its directive unused by @dakimura in #212
• sqlclosecheck: two assignments meeting in a phi are settled by one later Close by @dakimura in #213
• staticcheck: a const group's Deprecated: doc is the group's own, not its members' by @dakimura in #214
• wastedassign: a cell whose address is taken is not in Locals, so its stores are not wasted by @dakimura in #215
• promlinter: MetricTypeInName looks for every metric type name, not the metric's own by @dakimura in #216
• gosec: a call through a named func type resolves to every function with that signature by @dakimura in #217
• ssa: the reachability walk follows a closure's function operand by @dakimura in #218
• gosec: port G117, the secret-looking struct field that reaches a serializer by @dakimura in #219
• gosec: port G120, unbounded multipart form parsing by @dakimura in #220
• gosec: port G304, a file read whose path is not a constant by @dakimura in #221
• gosec: G122 resolves a callback passed by name, and dedupes by the sink by @dakimura in #222
• ssa: a zero constant carries its value, the way NewConst gives it by @dakimura in #223
• gosec: G102 resolves the address through its declaration, G402 reads the cipher list by @dakimura in #224
• modernize: a fix it cannot write drops the finding, and stringsseq has four functions by @dakimura in #225
• modernize: build every fix from source text, not from a hand-written printer by @dakimura in #226
• unparam: an interface method belongs to the type that implements the interface by @dakimura in #227
• nilnesserr: an error passed to %v has been widened to any by @dakimura in #228
• printf: which functions are printf-like is deduced, not guessed from the name by @dakimura in #229
• gosec: G602 learns a bound from a variadic call and from MakeSlice by @dakimura in #230
• gocritic: deprecatedComment sees every declaration doc, not just the outer two by @dakimura in #231
• perfsprint: hex-format is two cases, and collapsing them missed both ways by @dakimura in #232
• errorlint: the fmt.Errorf half, which golangci-lint has always had on by @dakimura in #233
• corpus: adopt alertmanager, and name the one finding that keeps it off zero by @dakimura in #234
• typecheck: port the pseudo linter, and locate the one thing that keeps it quiet by @dakimura in #235
• typecheck: the missing word was embed, and one of the two places it was missing was a cache by @dakimura in #236
• corpus: don't adopt harness — no tag carries a v2 config, and ./... measures only typecheck by @dakimura in #237
• corpus: adopt ebpf — the one guff-only finding is generated-file detection, holding two bugs that cancel by @dakimura in #238
• generated files: the key run reads is the linters one, and its scan must skip a BOM by @dakimura in #239
• corpus: adopt buildkit — 37 of its 39 findings are one cause, gosec.config going unread by @dakimura in #240
• gosec: read config's file-permission thresholds — and the message text that comes from them by @dakimura in #241
• sa4023: measure buildkit's last two — the check is inverted, and fixing it needs a part guff lacks by @dakimura in #242
• sa1019: a field's owner is the struct that declares it, not the one you selected on by @dakimura in #243
• packages: connect the import graph dependency-first, so it is connected deeper than one level by @dakimura in #244
• sa4023: the IR path asked the comparison's type (bool) whether it was an interface by @dakimura in #245
• corpus: adopt skopeo — the plain checkout measures nothing, and its own Makefile says why by @dakimura in #246
• corpus: exclude opentelemetry-collector — ./... at the root is 1 package of 100 modules by @dakimura in #247
• sa5003: the body scan was a hand-written statement walk, so switch/select/labelled statements were a blind spot by @dakimura in #248
• corpus: adopt external-dns — three diffs, two independent causes, both measured to a minimal repro by @dakimura in #249
• misspell/exclude: the dictionaries were right and the matching was not, and exclusion paths are filepath.Rel by @dakimura in #250
• exclude: NormalizePathInRegex is the identity on unix, and guff ran the windows one everywhere by @dakimura in #251
• funlen: the re-parse was gated on "comments is empty", and the typecheck keeps the package doc by @dakimura in #252
• nilnil: whether to descend depends on rejecting, not on reporting by @dakimura in #253
• wastedassign: upstream keeps the self-edge on the first hop, because it walks a copy of the block by @dakimura in #254
• sa1008: an assignment that writes a header key leaves the whole subtree, not just its own index by @dakimura in #255
• modernize/fmtappendf: the conversion must be []byte itself, and a format that may render empty is left alone by @dakimura in #256
• modernize/slicescontains: read the predicate's signature — not variadic, and its parameter identical to the element by @dakimura in #257
• exhaustive: correct a note that says it does not need cross-package facts — it does, and a finding is missing by @dakimura in #258
• makezero: one in-order walk per file, so an append before the make is not a finding by @dakimura in #259
• asasalint: upstream never sees any, because its type assertions do not unalias by @dakimura in #260
• unparam: compare constant values, not their shortened printed form by @dakimura in #261
• gocritic: dupArg was missing its method form, eleven names, three argument positions, and the right Pure by @dakimura in #262
• unused: model struct fields — a named struct type owns them by @dakimura in #263
• canonicalheader: gate on the object upstream picks, which can be a method by @dakimura in #264
• revive: empty-block stops walking a range only when its body is empty by @dakimura in #265
• revive: cognitive-complexity ignored its argument and walked nodes upstream does not by @dakimura in #266
• revive: six numeric-limit rules never read their argument by @dakimura in #267
• contextcheck: key a closure by its parent, not by its bare run$1 name by @dakimura in #268
• corpus: adopt telegraf — 2748 of its 3493 findings are one cause, revive's per-rule exclude by @dakimura in #269
• revive: exported has seven configuration flags and guff read two by @dakimura in #270
• gocritic: read all five per-check settings, not three by @dakimura in #271
• revive: import-alias-naming takes two regexps, and guff had neither by @dakimura in #272
• revive: an unnamed receiver is not "no receiver" (unconditional-recursion) by @dakimura in #273
• corpus: telegraf's three time-equal rows are §6's environment gap, not a defect by @dakimura in #274
• gosec: G201 judges the declaration, not the query argument — guff never implemented it by @dakimura in #275
• gocritic: one \< silences both regexp checks, and the char-range check reads the wrong bound by @dakimura in #276
• perfsprint: concat-loop leaves the loop body for if and nothing else by @dakimura in #277
• bodyclose: two stores to one variable only kill each other when one dominates by @dakimura in #278
• sqlclosecheck: a Rows/Stmt stored in a struct field is closed by another flow by @dakimura in #279
• staticcheck: SA1026 never walks a type that marshals itself — and telegraf closes by @dakimura in #280
• corpus: adopt karmada — and find a type-check bug that deletes a whole package by @dakimura in #281
• types: copy's special case runs before any core-type question by @dakimura in #283
• types: a generic instance created inside a type cycle had no underlying by @dakimura in #284
• types: reverse type inference — a generic function value takes its type arguments from where it lands by @dakimura in #285
• exhaustive: an imported package's enum has members too — read them from its scope by @dakimura in #286
• gosec: add G704 — the taint engine was carrying five of its six rules by @dakimura in #287
• corpus: adopt tailscale — 55 of its 66 diffs are one cause, revive's per-rule arguments by @dakimura in #289
• revive: defer's arguments pick which sub-checks run — guff ran all six by @dakimura in #290
• types: a type parameter can be compared with nil — hasNil had only half its interface arm by @dakimura in #291
• types: infer a type parameter that appears only in another's constraint by @dakimura in #292
• types: make(T) on a type parameter asks for the common underlying type by @dakimura in #293
• types: verify a constraint against the instance's methods, not the origin's by @dakimura in #294
• corpus: allowlist tailscale's four revive time-equal findings — upstream cannot report that rule by @dakimura in #295
• govet: printf skips operands that might format themselves, and byte arrays print as strings by @dakimura in #296
• goimports: a body that needs gofmt is unformatted even when the imports are right by @dakimura in #297
• corpus: exclude ollama — its //go:embed target is in .gitignore, so no clone has it by @dakimura in #298
• corpus: adopt buildah as linux-only, and stop the ledger recording measurements this host cannot make by @dakimura in #299
• govet: port nilness — and the four source positions guff-ssa was dropping by @dakimura in #300
• ssa: give the builder the ctrlflow no-return predicate by @dakimura in #301
• govet/inline: implement the type-alias arm of //go:fix inline by @dakimura in #302
• corpus: adopt tetragon — 70 of its 219 packages do not load on darwin by @dakimura in #303
• types: a non-interface constraint is an implicit interface (adopt celestia-node) by @dakimura in #304
• fmt/gofumpt: one bare // line exempts the whole comment group by @dakimura in #305
• ssa: _ is not a location — give address go/ssa's blank arm by @dakimura in #306
• gocritic/exitAfterDefer: walk the body generically, as upstream does by @dakimura in #307
• staticcheck/SA1019: a package doc is not required to live in doc.go by @dakimura in #308
• corpus: adopt kratos — 33 vs 33, two gosec divergences by @dakimura in #309
• gosec: elided composite literals (G124) and the packed variadic tail (G710) by @dakimura in #310
• corpus: adopt dubbo-go — 0 vs 0, and the check that it is not measuring nothing by @dakimura in #311
• corpus: adopt cert-manager — 10 guff-only, and 7 of them are a shadow by @dakimura in #312
• staticcheck/promlinter/gosmopolitan: three defects behind cert-manager's ten by @dakimura in #313
• corpus: adopt argo-rollouts — 9 vs 9, an exact match by @dakimura in #314
• corpus: adopt flipt — multi-module, but 87 packages at the root by @dakimura in #315
• modernize/lostcancel/QF1003/SA4014/intrange: six defects behind flipt's four by @dakimura in #316
• staticcheck/SA1019: a prefix is not a parseable Go file by @dakimura in #317
• corpus: adopt boundary — guff names its own bug in the run by @dakimura in #318
• seed: decline the test edge that closes a cycle, and correct a false invariant by @dakimura in #320
• corpus: exclude signoz — the host's go1.26 cannot build a pinned dependency by @dakimura in #321
• seed: skip the declined test edge in the wave passes too by @dakimura in #322
• bodyclose: a func literal declaring the name is not a capture of it by @dakimura in #323
• bodyclose: skip a function by its result type, not by the name it is spelled by @dakimura in #324
• S1025: implement fmt.Stringer, don't compare against its name by @dakimura in #325
• S1011: the append destination is whatever expression appears on both sides by @dakimura in #326
• S1005: the pattern has an IndexExpr arm at the pinned version by @dakimura in #327
• S1017: remember the else branch, which is what skips an else if by @dakimura in #328
• S1040: compare types, and render the source expression by @dakimura in #329
• bodyclose: two things the AST calls a call and go/ssa does not by @dakimura in #330
• corpus: exclude inspektor-gadget — Linux only, with no subtree to scope to by @dakimura in #331
• Release 0.7.0: 247 commits, and a corpus that now says 50 of 100 exact by @dakimura in #333

Full Changelog: v0.6.0...v0.7.0