The.golangci.yml file does not take effect for the gosec Linter configuration

[LukLau]

Welcome

• Yes, I'm using a binary release within 2 latest major releases. Only such installations are supported.
• Yes, I've searched similar issues on GitHub and didn't find any.
• Yes, I've included all information below (version, config, etc).
• Yes, I've tried with the standalone linter if available. (https://golangci-lint.run/usage/linters/)

Description of the problem

I used.golangci.yaml to configure the Linter rule.
But in the actual actual process, I found that it was not available and never worked

Version of golangci-lint

 ./bin/golangci-lint  version
golangci-lint has version 1.26.0 built from 6bd10d0 on 2020-05-01T15:26:22Z

Configuration file

run:
  deadline: 3m
  skip-files:
    - ".*.gen.go$"
    - ".*.pb.go$"
  skip-dirs:
    - "/mock"

linters:
  enable-all: true
  disable:
    - gochecknoglobals
    - wsl
    - golint
    - goerr113
    - gochecknoinits
    - unparam
    - whitespace
    - maligned
    - dupl
    - godot

linters-settings:
  nestif:
    min-complexity: 8
  godox:
    keywords:
      - "BUG"
      - "FIXME"
  lll:
    line-length: 160
  funlen:
    lines: 110
    statements: 110
  gosec:
    excludes:
      - G101
      - G107

issues:
  exclude-rules:
    - linters:
        - staticcheck
      text: "SA1019"
    - linters:
        - stylecheck
      text: "ST1003"

Go environment

go version go1.16.5 darwin/amd64
GO111MODULE="on"
GOARCH="amd64"
GOBIN=""
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOINSECURE=""
GOMODCACHE="/Users/dora/go/pkg/mod"
GOOS="darwin"
GOPATH="/Users/dora/go"
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/Users/dora/go/go1.16.5"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/Users/dora/go/go1.16.5/pkg/tool/darwin_amd64"
GOVCS=""
GOVERSION="go1.16.5"
GCCGO="gccgo"
AR="ar"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD="/Users/dora/go/src/privacy/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -arch x86_64 -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/9c/pl2z29cs78d3j9rqg3l5507h0000gp/T/go-build739582616=/tmp/go-build -gno-record-gcc-switches -fno-common"

Verbose output of running

INFO [config_reader] Config search paths: [./ /Users/dora/go/src/privacy-downstream /Users/dora/go/src /Users/dora/go /Users/dora /Users /] 
INFO [config_reader] Used config file .golangci.yml 
INFO [lintersdb] Active 38 linters: [asciicheck bodyclose deadcode depguard dogsled errcheck funlen gocognit goconst gocritic gocyclo godox gofmt goimports gomnd gomodguard goprintffuncname gosec gosimple govet ineffassign interfacer lll misspell nakedret nestif nolintlint prealloc rowserrcheck scopelint staticcheck structcheck stylecheck testpackage typecheck unconvert unused varcheck] 
INFO [lintersdb] Active 38 linters: [asciicheck bodyclose deadcode depguard dogsled errcheck funlen gocognit goconst gocritic gocyclo godox gofmt goimports gomnd gomodguard goprintffuncname gosec gosimple govet ineffassign interfacer lll misspell nakedret nestif nolintlint prealloc rowserrcheck scopelint staticcheck structcheck stylecheck testpackage typecheck unconvert unused varcheck] 
INFO [loader] Go packages loading at mode 575 (deps|exports_file|name|types_sizes|compiled_files|files|imports) took 999.24373ms 
INFO [runner/enabledLinters] Active 38 linters: [asciicheck bodyclose deadcode depguard dogsled errcheck funlen gocognit goconst gocritic gocyclo godox gofmt goimports gomnd gomodguard goprintffuncname gosec gosimple govet ineffassign interfacer lll misspell nakedret nestif nolintlint prealloc rowserrcheck scopelint staticcheck structcheck stylecheck testpackage typecheck unconvert unused varcheck] 
INFO [runner/filename_unadjuster] Pre-built 0 adjustments in 250.515865ms 
INFO [runner/unused/goanalysis] analyzers took 5.449623628s with top 10 stages: buildssa: 4.576796078s, U1000: 872.82755ms 
INFO [runner/goanalysis_metalinter/goanalysis] analyzers took 5m35.905560597s with top 10 stages: buildssa: 1m32.328245533s, the_only_name: 19.020359012s, goimports: 15.853384828s, gosec: 11.053191995s, gofmt: 10.2918764s, ineffassign: 9.403352689s, vrp: 7.358545279s, gocritic: 6.281634938s, ctrlflow: 5.704692437s, scopelint: 5.339537416s 
INFO [runner] Issues before processing: 24374, after processing: 1 
INFO [runner] Processors filtering stat (out/in): max_from_linter: 1/1, source_code: 1/1, path_shortener: 1/1, identifier_marker: 123/123, exclude-rules: 10/63, max_per_file_from_linter: 1/1, max_same_issues: 1/1, filename_unadjuster: 24374/24374, skip_files: 123/24374, autogenerated_exclude: 123/123, nolint: 2/10, path_prettifier: 24374/24374, skip_dirs: 123/123, diff: 1/1, cgo: 24374/24374, exclude: 63/123, uniq_by_line: 1/2 
INFO [runner] processing took 101.324642ms with stages: skip_files: 64.115851ms, path_prettifier: 17.522646ms, autogenerated_exclude: 4.045216ms, exclude: 4.008199ms, cgo: 3.688576ms, filename_unadjuster: 3.079868ms, identifier_marker: 2.506734ms, nolint: 1.940942ms, skip_dirs: 244.157µs, exclude-rules: 126.418µs, source_code: 38.642µs, uniq_by_line: 2.437µs, max_same_issues: 2.026µs, path_shortener: 995ns, max_from_linter: 964ns, max_per_file_from_linter: 630ns, diff: 341ns 
INFO [runner] linters took 27.173404541s with stages: goanalysis_metalinter: 22.74720814s, unused: 4.324142209s 
internal/batchloader/multiload.go:58:15: G107: Potential HTTP request made with variable url (gosec)
        resp, err := http.Get(file)
                     ^
INFO File cache stats: 90 entries of total size 6.9MiB 
INFO Memory: 250 samples, avg is 2392.0MB, max is 3639.3MB 
INFO Execution took 28.487529821s                 

Code example or link to a public repository

func TestLinter(t *testing.T) {
	file := "test"
	readFile, err := multiLoadReadFile(file)
	if err != nil {
		t.Error(err)
		return
	}
	defer readFile.Close()
}

func multiLoadReadFile(file string) (io.ReadCloser, error) {
	f, err := os.Open(file)
	if err == nil {
		return f, nil
	}
	resp, err := http.Get(file)
	return resp.Body, err
}

[boring-cyborg[bot]]

Hey, thank you for opening your first Issue ! 🙂 If you would like to contribute we have a guide for contributors.

[ldez]

You are using an old version without the support of this configuration, the configuration works with the latest version.

The gosec configuration was added in April 2021 (v1.40.0), and you are using a golangci-lint created in April 2020 (v1.26.0).

The latest version is v1.46.2.

[LukLau]

You are using v1.26.0 (created there is 2 years)

You have to update golangci-lint to latest version (v1.46.2)

hi,

1. Is this a known problem for Lint Team?
2. Is the problem caused by a bug in the low version code?
3. Why does config file not take effect？

Because I do code checks in production env. I used V1.26 to be as compatible as possible and to avoid changes from new linter rules .

The only solution is to migrate the version or ban it?

[ldez]

1.2.3. -> you are using an old version without the support of this configuration, the configuration works with the latest version.

The solution is to update your tooling.
A linter has no impact on production.

[LukLau]

Excuse me.

I can see from this graph that it has been supported since golanci-lint V1.0.
Ask 1 question:

1. golanci-lint Config file is not supported in V1.2.6?.

[ldez]

You are using an old version without the support of this configuration, the configuration works with the latest version.

The gosec configuration was added in April 2021 (v1.40.0), and you are using a golangci-lint created in April 2020 (v1.26.0).

The latest version is v1.46.2.