feat: adopt govulncheck

.github/workflows/ci.yml

@@ -12,23 +12,17 @@ on:
       - 'pkg/dash/**'
 
 jobs:
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: '1.25'
-      - name: Run linters
-        uses: golangci/golangci-lint-action@v8
-        with:
-          args: --verbose
+  golangci-lint:
+    uses: GeoNet/Actions/.github/workflows/reusable-golangci-lint.yml@main
+
+  govulncheck:
+    uses: GeoNet/Actions/.github/workflows/reusable-govulncheck.yml@main
 
   test:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        go: ['1.23.x', '1.24.x', '1.25.x']
+        go: ['1.25.9']
         platform: [ubuntu-latest, windows-latest, macos-latest, macos-14]
     services:
       mysql56:
@@ -197,7 +191,7 @@ jobs:
       - name: Test
         run: gotestsum -f testname -- ./... -race -count=1 -coverprofile=coverage.txt -covermode=atomic
       - name: Upload coverage reports to Codecov
-        if: ${{ matrix.platform == 'ubuntu-latest' && matrix.go == '1.25.x' }}
+        if: ${{ matrix.platform == 'ubuntu-latest' && matrix.go == '1.25.9' }}
         uses: codecov/codecov-action@v5.0.7
         with:
           token: ${{ secrets.CODECOV_TOKEN }}

go.mod

@@ -1,8 +1,8 @@
 module github.com/fastschema/fastschema
 
-go 1.24
+go 1.25
 
-toolchain go1.24.7
+toolchain go1.25.9
 
 require (
 	ariga.io/atlas v0.36.1
@@ -13,14 +13,13 @@ require (
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
 	github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6
 	github.com/emersion/go-smtp v0.23.0
-	github.com/expr-lang/expr v1.17.5
+	github.com/expr-lang/expr v1.17.7
 	github.com/fasthttp/websocket v1.5.12
-	github.com/fastschema/fastschema v0.9.6
 	github.com/fastschema/qjs v0.0.6
 	github.com/fatih/color v1.18.0
 	github.com/go-sql-driver/mysql v1.9.3
 	github.com/gofiber/contrib/websocket v1.3.4
-	github.com/gofiber/fiber/v2 v2.52.9
+	github.com/gofiber/fiber/v2 v2.52.12
 	github.com/golang-jwt/jwt/v4 v4.5.2
 	github.com/google/uuid v1.6.0
 	github.com/hjson/hjson-go/v4 v4.5.0

go.sum

@@ -158,8 +158,8 @@ github.com/emersion/go-smtp v0.23.0 h1:ZiriTOTK7sKep7jbWqgB5kPsiBp5wnE5auEMnwRMn
 github.com/emersion/go-smtp v0.23.0/go.mod h1:ZtRRkbTyp2XTHCA+BmyTFTrj8xY4I+b4McvHxCU2gsQ=
 github.com/emersion/go-vcard v0.0.0-20241024213814-c9703dde27ff h1:4N8wnS3f1hNHSmFD5zgFkWCyA4L1kCDkImPAtK7D6tg=
 github.com/emersion/go-vcard v0.0.0-20241024213814-c9703dde27ff/go.mod h1:HMJKR5wlh/ziNp+sHEDV2ltblO4JD2+IdDOWtGcQBTM=
-github.com/expr-lang/expr v1.17.5 h1:i1WrMvcdLF249nSNlpQZN1S6NXuW9WaOfF5tPi3aw3k=
-github.com/expr-lang/expr v1.17.5/go.mod h1:8/vRC7+7HBzESEqt5kKpYXxrxkr31SaO8r40VO/1IT4=
+github.com/expr-lang/expr v1.17.7 h1:Q0xY/e/2aCIp8g9s/LGvMDCC5PxYlvHgDZRQ4y16JX8=
+github.com/expr-lang/expr v1.17.7/go.mod h1:8/vRC7+7HBzESEqt5kKpYXxrxkr31SaO8r40VO/1IT4=
 github.com/fasthttp/websocket v1.5.12 h1:e4RGPpWW2HTbL3zV0Y/t7g0ub294LkiuXXUuTOUInlE=
 github.com/fasthttp/websocket v1.5.12/go.mod h1:I+liyL7/4moHojiOgUOIKEWm9EIxHqxZChS+aMFltyg=
 github.com/fastschema/qjs v0.0.6 h1:C45KMmQMd21UwsUAmQHxUxiWOfzwTg1GJW0DA0AbFEE=
@@ -219,8 +219,8 @@ github.com/go-test/deep v1.0.3/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3a
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gofiber/contrib/websocket v1.3.4 h1:tWeBdbJ8q0WFQXariLN4dBIbGH9KBU75s0s7YXplOSg=
 github.com/gofiber/contrib/websocket v1.3.4/go.mod h1:kTFBPC6YENCnKfKx0BoOFjgXxdz7E85/STdkmZPEmPs=
-github.com/gofiber/fiber/v2 v2.52.9 h1:YjKl5DOiyP3j0mO61u3NTmK7or8GzzWzCFzkboyP5cw=
-github.com/gofiber/fiber/v2 v2.52.9/go.mod h1:YEcBbO/FB+5M1IZNBP9FO3J9281zgPAreiI1oqg8nDw=
+github.com/gofiber/fiber/v2 v2.52.12 h1:0LdToKclcPOj8PktUdIKo9BUohjjwfnQl42Dhw8/WUw=
+github.com/gofiber/fiber/v2 v2.52.12/go.mod h1:YEcBbO/FB+5M1IZNBP9FO3J9281zgPAreiI1oqg8nDw=
 github.com/gofrs/flock v0.12.1 h1:MTLVXXHf8ekldpJk3AKicLij9MdwOWkZ+a/jHHZby9E=
 github.com/gofrs/flock v0.12.1/go.mod h1:9zxTsyu5xtJ9DK+1tFZyibEV7y3uwDxPPfbxeeHCoD0=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=

pkg/entdbadapter/common_test.go

@@ -138,7 +138,7 @@ func TestCreateDBDSN(t *testing.T) {
 	assert.Equal(t, expectedMySQLDSN, CreateDBDSN(config))
 
 	config.Driver = "pgx"
-	expectedPGXDSN := "host=localhost port=3306 user=user dbname=database password=pass sslmode=disable"
+	expectedPGXDSN := "host=localhost port=3306 user=user dbname=database password=pass sslmode=prefer"
 	assert.Equal(t, expectedPGXDSN, CreateDBDSN(config))
 
 	config.Driver = "sqlite"

pkg/utils/utils.go

@@ -7,6 +7,7 @@ import (
 	"math"
 	"net/http"
 	"os"
+	"path/filepath"
 	"reflect"
 	"regexp"
 	"slices"
@@ -325,12 +326,12 @@ func IsFileExists(filePath string) bool {
 }
 
 func CopyFile(src string, dst string) error {
-	data, err := os.ReadFile(src)
+	data, err := os.ReadFile(filepath.Clean(src))
 	if err != nil {
 		return err
 	}
 
-	return os.WriteFile(dst, data, 0600)
+	return os.WriteFile(filepath.Clean(dst), data, 0600) //nolint:gosec // paths are internal, not user-controlled
 }
 
 func MkDirs(dirs ...string) error {