chore(deps): bump securego/gosec from 2.21.4 to 2.22.9

[dependabot]

Bumps securego/gosec from 2.21.4 to 2.22.9.

Release notes

Sourced from securego/gosec's releases.

v2.22.9

Changelog

• 15d5c61e866bc2e2e8389376a31f1e5e09bde7d8 Update cosign to v2.6.0 and go in the CI to latest version
• 7b8713e2c9114d7db686be71c260e4e9f7ffc2e9 fix(autofix): unnecessary conversion
• 64ebfc010618034268272af465bb47dbbb49d64f feat(autofix): update gemini sdk and add anthropic claude
• 506407e7dfe6979d514d362f0b2d2ea77f49f5c8 feat(G304): add os.Root remediation hint (Autofix) when Go >= 1.24
• 3ead143f0a3b5ace623f1865ea0f560bf730cd32 chore(deps): update all dependencies
• e81fba3c3afd54f0740d580297d9206d972d47b9 refactor(G304): remove unused trackJoin helper; no functional change
• ab078db7b0e0de577588ae298d22d1b490bf136c style: gofmt rules/readfile.go
• e6218c83ecf834512867fda709dbb096b9cc06aa test(g304): add samples for var perm and var flag with cleaned path\n\n- Ensure G304 does not fire when only non-path args (flag/perm) are variables\n- Both samples use filepath.Clean on the path arg\n- Rules suite remains green (42 passed)
• 79f835d9c776f61d7d61505970829d8b3610b763 rules(G304): analyze only path arg; ignore flag/perm vars; track Clean and safe Join; fix nil-context panic\n\n- Limit G304 checks to first arg (path) for os.Open/OpenFile/ReadFile, avoiding false positives when flag/perm are variables\n- Track filepath.Clean so cleaned identifiers are treated as safe\n- Consider safe joins: filepath.Join(const|resolvedBase, Clean(var)|cleanedIdent)\n- Record Join(...) assigned to identifiers and allow if later cleaned\n- Fix panic by passing non-nil context in trackJoinAssignStmt\n- All rules tests: 42 passed
• 40ac53017b81ea0e251e6d04eef0a3434773bf1c rules(G202): detect SQL concat in ValueSpec declarations; add test sample\n\n- Handle var query string = 'SELECT ...' + user style declarations\n- Reuse existing binary expr detection on ValueSpec.Values\n- Add postgres sample mirroring issue #1309 report\n- Rules tests: 42 passed
• 4be6b11bbcb9a225e44194a8867ee4645a4eb618 chore(deps): update all dependencies
• 5af1117217e476b56a63eaa9ea28eeeb91fbc5ff chore(deps): update all dependencies
• 287b46c018ebe8ca18d45aa8fc0ebea927f1e27d chore(deps): update all dependencies
• cee0aeae8a8b6c2d59571e500bc69010f2630db6 Update gosec version to v2.22.8 in the Github action

v2.22.8

Changelog

• c9453023c4e81ebdb6dde29e22d9cd5e2285fb16 Add support for go version 1.25.0
• ef7adab98ce3c9599c340cb6d6e988f666d9a866 Update go version in CI to 1.24.6 and 1.23.12
• e201bb86c2a1ab06d6773b6185a5c16413267abf chore(deps): update all dependencies
• ba592afef69e0e9f70adf25b95a15056cd61f015 chore(deps): update all dependencies
• 2ef6017991fdf27d40052196a32571a0ba71dc9a Update github action to release v2.22.7

v2.22.7

Changelog

• 32975f4bab0d7b683a88756aaf3fa5502188b476 Fix crash in hardcoded_nonce analyzer
• 6ea6b35e61f367312f4ec362440c98891830286d Update go action to use release v2.22.6

v2.22.6

Changelog

• bc3f2145b52adab91f2bee2686c9ad65e65005d6 Update go version to 1.24.5 and 1.23.11 in the CI
• 925741b7eff92a31663cb1d4e84d809345029883 chore(deps): update module google.golang.org/api to v0.242.0
• 59ae7e9e275d7dce03bb9c37432b7b3575dbe5fc chore(deps): update all dependencies
• e7abd9e3482c9ba37761c7e39dad696d2fd7bedb chore(deps): update all dependencies
• 35e7bc1a94c4df54c5f3f5debd3241b752c65a1a chore(deps): update all dependencies
• 2d1ed95a0be84f9468a177e96285ab901051819c chore(deps): update all dependencies
• 4a8cb4609fccc267e012189996cad9b08f2f2af8 Do not allow dashes in file names
• bcc8afbe30446f2660a7b6b6909541e12fa28239 Update gosec to version 2.22.5 in Github action

v2.22.5

Changelog

• d2d3ae66bd8d340b78b5142b6fe610691783c2fe Switch back go.mod to minimum 1.23.0
• 1e7ed06b152a8a835f64c0c2a0f4ef7b83434ae8 Update dependencies
• 1bef91a07f24a9853461be9d3f13df7ee0dfc44c Update go version 1.24.4 and 1.23.10 in CI
• 621702f13a80eed1b8e60d1fa35b128d622832cb chore(deps): update all dependencies
• 017d1d655c299165954ba3c6d99bdb86319ecb6a G201/G202: add checks for injection into sql.Conn methods
• 67f63d47819d2766119d7f5df1cc898e6d985516 chore(deps): update module google.golang.org/api to v0.235.0
• b4eabb1b18f22ef42f267d416701e57e82394e14 chore(deps): update module google.golang.org/api to v0.234.0

... (truncated)

Commits

• 15d5c61 Update cosign to v2.6.0 and go in the CI to latest version
• 7b8713e fix(autofix): unnecessary conversion
• 64ebfc0 feat(autofix): update gemini sdk and add anthropic claude
• 506407e feat(G304): add os.Root remediation hint (Autofix) when Go >= 1.24
• 3ead143 chore(deps): update all dependencies
• e81fba3 refactor(G304): remove unused trackJoin helper; no functional change
• ab078db style: gofmt rules/readfile.go
• e6218c8 test(g304): add samples for var perm and var flag with cleaned path\n\n- Ensu...
• 79f835d rules(G304): analyze only path arg; ignore flag/perm vars; track Clean and sa...
• 40ac530 rules(G202): detect SQL concat in ValueSpec declarations; add test sample\n\n...
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[sonarqubecloud]

Quality Gate failed

Failed conditions
7 Security Hotspots

See analysis details on SonarQube Cloud