Changelog
- 5eb1d10 fix(g602): recognize equality comparison in minimumLenForBranch (#1796)
- cc750dd fix(G112): honor read timeouts assigned through a struct field (#1798)
- 1cbfd7e fix(G112): report read timeouts explicitly set to zero (#1797)
- 05b9c4c feat(G706): extend log/slog method coverage (#1795)
- 17ad2dd fix(autofix): read the first text block of a Claude response (#1794)
- b23171c fix(autofix): give every AI request its own timeout (#1793)
- 20b9e5b fix(resolve): treat constants from other packages as resolved (#1792)
- 86d3c26 fix(autofix): return an error when a Gemini candidate has no content (#1791)
- 14ef84f Update to go version 1.27.3 and 1.26.10 (#1790)
- 7cbd7a9 fix(autofix): default Gemini model to gemini-3.1-pro-preview (#1788)
- 1e26bce fix(G102): resolve concatenated and constant listen addresses (#1787)
- 836dbdb fix: default -concurrency to GOMAXPROCS so container CPU limits apply (#1786)
- bbd69e2 fix(g602): track statically known lengths for append results in slice bounds check (#1773)
- 30e2d38 feat(rules): add G125 to detect unescaped url.JoinPath elements (#1777)
- 57c45b8 fix: load absolute file paths so nested modules are analysed from the parent directory (#1779)
- 77fa84e fix(G118): treat a cancel sent on a channel as handed off (#1782)
- ca547ab fix(G112): honor read timeouts assigned after the http.Server literal (#1781)
- 024084b fix(G303): resolve constant temp file paths (#1784)
- 782eeb1 fix(deps): update all dependencies (#1783)
- 707f227 fix(G203): treat constant template arguments as safe (#1770)
- 8c5daa6 fix(G402): check TLS settings assigned through a *tls.Config (#1769)
- 7157726 fix(deps): update all dependencies (#1775)
- 7b1b5ce Update to go version 1.27.2 and 1.26.9 (#1772)
- d2b649e Keep SARIF driver rules sorted and resolve rule indexes at the end (#1767)
- 1f52e64 fix(G602): track append() results for slice bounds checking (#1754)
- ea75d9f fix(deps): update all dependencies (#1768)
- 65c2c08 fix(G602): trust len(nilSlice) == N guards, matching make()-backed slices (#1752)
- 6ff893e fix(G407): treat an array IV/nonce as a zeroed buffer (#1763)
- aaca894 fix(fileperms): resolve constant file and directory permissions (#1766)
- 826f6f4 fix(G102): detect binding to the IPv6 unspecified address (#1760)
- 021cc2e fix(G407): stop the nonce source walk on cycles (#1761)
- ccb369d fix(G407): do not count AEAD.Seal as the read that fills its own nonce (#1762)
- 9b31806 fix(deps): update all dependencies (#1764)
- 8c77519 fix(G602): validate inequality len guards (#1757)
- 027baa2 fix(G121): track request captured by closures (#1759)
- 9ede89e fix(deps): update all dependencies (#1756)
- 29a042e fix: make nosec suppression independent of comment order (#1741)
- 6813471 fix(G403): resolve constant RSA key sizes (#1751)
- 201d413 fix(G602): validate subslice bounds under equality guards (#1749)
- accb424 fix(G124): resolve negated constant cookie flags (#1748)
- 61fa1da fix(G602): report constant index equal to the length asserted by an equality guard (#1746)
- 78fbcc7 Skip taint call graphs when no sinks match (#1745)
- 79b4fcd Fix brittle test for html writer (#1744)
- d70cac3 fix(G404): ignore non-cryptographic Shuffle calls (#1742)
- 9e8e5d9 fix(deps): update all dependencies (#1743)
- 8075fd2 fix(taint): remove Result.Source field that is never populated (#1739)
- 58362d8 Update all dependencies (#1737)
- d98945a Update go version 1.27.1 and 1.26.8 and phased out 1.25 (#1738)
- 720c679 fix(report): correct Babel SRI hash (#1736)
- 598d614 fix(taint): make wide caller traversal deterministic (#1733)
- 4d447d9 fix(G702): skip the context argument of exec.CommandContext (#1730)
- be1e315 feat(taint): name the sink in taint finding messages (#1731)
- a102130 Update all dependencies (#1734)
- 57f1613 Update action to gosec version 2.29.0 (#1728)