search

mlflow / mlflow-go

Repository for the Go-based MLflow Tracking Server
Apache License 2.0
5 stars 4 forks source link

Monitor golangci-lint for gosec 2.21.4 Overflow Checks (G115) Update #73

Open fabiovincenzi opened 4 weeks ago

fabiovincenzi commented 4 weeks ago

We relies on golangci-lint version1.61.0 since https://github.com/mlflow/mlflow-go/pull/72, which currently includes gosec version 2.21.2. In gosec version 2.21.4, a significant improvement was introduced for detecting integer overflows in rule G115 through bound checks. This enhancement, documented in gosec Issue #1187, would help us catch potential overflow vulnerabilities more effectively once available in golangci-lint.

References: gosec Issue #1187 - Details the addition of bound checks for G115. gosec Release Notes - Overview of recent gosec updates.

nojaf commented 4 weeks ago

For those reading this, the todo item is to remove //nolint:gosec // disable G115 and update the code accordingly.