{"id":"openSUSE-SU-2026:22197-1","summary":"Security update for gosec","details":"This update for gosec fixes the following issues:\n\nChanges in gosec:\n\n- Update to version 2.30.0 (bsc#1287590, CVE-2026-97032):\n  * fix(g602): recognize equality comparison in minimumLenForBranch (#1796)\n  * fix(G112): honor read timeouts assigned through a struct field (#1798)\n  * fix(G112): report read timeouts explicitly set to zero (#1797)\n  * feat(G706): extend log/slog method coverage (#1795)\n  * fix(autofix): read the first text block of a Claude response (#1794)\n  * fix(autofix): give every AI request its own timeout (#1793)\n  * fix(resolve): treat constants from other packages as resolved (#1792)\n  * fix(autofix): return an error when a Gemini candidate has no content (#1791)\n  * Update to go version 1.27.3 and 1.26.10 (#1790)\n  * fix(autofix): default Gemini model to gemini-3.1-pro-preview (#1788)\n  * fix(G102): resolve concatenated and constant listen addresses (#1787)\n  * fix: default -concurrency to GOMAXPROCS so container CPU limits apply (#1786)\n  * fix(g602): track statically known lengths for append results in slice bounds check (#1773)\n  * feat(rules): add G125 to detect unescaped url.JoinPath elements (#1777)\n  * fix: load absolute file paths so nested modules are analysed from the parent directory (#1779)\n  * fix(G118): treat a cancel sent on a channel as handed off (#1782)\n  * fix(G112): honor read timeouts assigned after the http.Server literal (#1781)\n  * fix(G303): resolve constant temp file paths (#1784)\n  * fix(deps): update all dependencies (#1783)\n  * fix(G203): treat constant template arguments as safe (#1770)\n  * fix(G402): check TLS settings assigned through a *tls.Config (#1769)\n  * fix(deps): update all dependencies (#1775)\n  * Update to go version 1.27.2 and 1.26.9 (#1772)\n  * Keep SARIF driver rules sorted and resolve rule indexes at the end (#1767)\n  * fix(G602): track append() results for slice bounds checking (#1754)\n  * fix(deps): update all dependencies (#1768)\n  * fix(G602): trust len(nilSlice) == N guards, matching make()-backed slices (#1752)\n  * fix(G407): treat an array IV/nonce as a zeroed buffer (#1763)\n  * fix(fileperms): resolve constant file and directory permissions (#1766)\n  * fix(G102): detect binding to the IPv6 unspecified address (#1760)\n  * fix(G407): stop the nonce source walk on cycles (#1761)\n  * fix(G407): do not count AEAD.Seal as the read that fills its own nonce (#1762)\n  * fix(deps): update all dependencies (#1764)\n  * fix(G602): validate inequality len guards (#1757)\n  * fix(G121): track request captured by closures (#1759)\n  * fix(deps): update all dependencies (#1756)\n  * fix: make nosec suppression independent of comment order (#1741)\n  * fix(G403): resolve constant RSA key sizes (#1751)\n  * fix(G602): validate subslice bounds under equality guards (#1749)\n  * fix(G124): resolve negated constant cookie flags (#1748)\n  * fix(G602): report constant index equal to the length asserted by an equality guard (#1746)\n  * Skip taint call graphs when no sinks match (#1745)\n  * Fix brittle test for html writer (#1744)\n  * fix(G404): ignore non-cryptographic Shuffle calls (#1742)\n  * fix(deps): update all dependencies (#1743)\n  * fix(taint): remove Result.Source field that is never populated (#1739)\n  * Update all dependencies (#1737)\n  * Update go version 1.27.1 and 1.26.8 and phased out 1.25 (#1738)\n  * fix(report): correct Babel SRI hash (#1736)\n  * fix(taint): make wide caller traversal deterministic (#1733)\n  * fix(G702): skip the context argument of exec.CommandContext (#1730)\n  * feat(taint): name the sink in taint finding messages (#1731)\n  * Update all dependencies (#1734)\n  * Update action to gosec version 2.29.0 (#1728)\n\n- Update to version 2.29.0:\n  * analyzers/G703: stop treating Clean/Abs/PathEscape as path-traversal sanitizers (#1723)\n  * fix(junit): properly escape XML in failure text (#1718)\n  * fix(csv): capture and report write errors on flush (#1716)\n  * fix(report): root path matching in formatters (#1719)\n  * fix(config): handle nosec tags with leading hash (#1717)\n  * Update all dependencies (#1720)\n  * Add support for go version 1.27.0 and update to version 1.25.14 and 1… (#1726)\n  * Update all dependencies (#1713)\n  * Update all dependencies (#1710)\n  * fix(G202): don't flag strings.Builder built from constants (#1707)\n  * ci: allow fork PR checkout in barry-ai-security-review job (#1708)\n  * Update all dependencies (#1709)\n  * Downgrade min Go version (#1706)\n  * Udpate action to use gosec v2.28.0 (#1705)\n","modified":"2026-10-31T18:00:09.295099004Z","published":"2026-10-28T16:40:06Z","related":["CVE-2026-97032"],"upstream":["CVE-2026-97032"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1287590"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-97032"}],"affected":[{"package":{"name":"gosec","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/gosec&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.30.0-bp160.1.1"}]}],"ecosystem_specific":{"binaries":[{"gosec":"2.30.0-bp160.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22197-1.json"}}],"schema_version":"1.9.2"}