Merge pull request #32 from codacy/bump-gosec-2.22.7

TCE-1226 Bump Gosec 2.22.7

Author: DMarinhoCodacy

.circleci/config.yml

@@ -1,7 +1,7 @@
 version: 2.1
 
 orbs:
-  codacy: codacy/base@10.2.2
+  codacy: codacy/base@12.2.0
 
 workflows:
   version: 2
@@ -12,12 +12,16 @@ workflows:
       - codacy/sbt:
           name: populate_cache
           persist_to_workspace: true
-          cmd: sbt "set scalafmtUseIvy in ThisBuild := false;update"
+          cmd: |
+            sbt "clean;
+                 scalafmtCheckAll;
+                 Test / scalafmtCheck;
+                 scalafmtCheck;"
           requires:
             - codacy/checkout_and_version
       - codacy/sbt:
           name: check_fmt
-          cmd: sbt "scalafmt::test;test:scalafmt::test;sbt:scalafmt::test"
+          cmd: sbt test:scalafmt scalafmt scalafmtSbt
           requires:
             - populate_cache
       - codacy/sbt:

.gitignore

@@ -9,3 +9,9 @@ target/
 .DS_Store
 *.iml
 .codacy-coverage
+
+
+#Ignore vscode AI rules
+.github/copilot-instructions.md
+
+.vscode

Dockerfile

@@ -1,12 +1,12 @@
-FROM golang:1.18.10-alpine3.17 as builder
+FROM golang:1.23-alpine3.22 as builder
 
 COPY doc-generation /doc-generation
 
 WORKDIR /doc-generation
 RUN mkdir -p /docs/description
 RUN go run main.go -docFolder=../docs
 
-FROM alpine:3.17.3
+FROM alpine:3.22
 
 COPY --from=builder /docs /docs
 COPY docs/tool-description.md /docs/

build.sbt

@@ -1,6 +1,6 @@
-val scalaVersionNumber = "2.13.1"
+val scalaVersionNumber = "2.13.16"
 val circeVersion = "0.12.3"
-val graalVersion = "21.2.0"
+val graalVersion = "22.3.3"
 
 lazy val root = (project in file("."))
   .enablePlugins(JavaAppPackaging)
@@ -12,11 +12,11 @@ lazy val root = (project in file("."))
     scalaVersion := scalaVersionNumber,
     test in assembly := {},
     libraryDependencies ++= Seq(
-      "com.codacy" %% "codacy-analysis-cli-model" % "2.2.0",
+      "com.codacy" %% "codacy-analysis-cli-model" % "5.2.1",
       "io.circe" %% "circe-core" % circeVersion,
       "io.circe" %% "circe-parser" % circeVersion,
-      "com.github.scopt" %% "scopt" % "3.7.1",
-      "org.scalatest" %% "scalatest" % "3.1.0" % Test
+      "com.github.scopt" %% "scopt" % "4.1.0",
+      "org.scalatest" %% "scalatest" % "3.2.19" % Test
     ),
     graalVMNativeImageGraalVersion := Some(graalVersion),
     graalVMNativeImageOptions ++= Seq(

doc-generation/go.mod

@@ -1,16 +1,22 @@
 module github.com/codacy/gosec-doc-generator
 
-go 1.18
+go 1.23.0
+
+toolchain go1.24.5
 
 require (
-	github.com/codacy/codacy-engine-golang-seed v1.0.1-0.20230412094526-1a71ba69afe3
-	github.com/securego/gosec/v2 v2.15.0
-	golang.org/x/mod v0.10.0
+	github.com/codacy/codacy-engine-golang-seed/v6 v6.4.0
+	github.com/securego/gosec/v2 v2.22.7
+	golang.org/x/mod v0.26.0
 )
 
 require (
-	github.com/nbutton23/zxcvbn-go v0.0.0-20210217022336-fa2cb2858354 // indirect
-	github.com/sirupsen/logrus v1.9.0 // indirect
-	golang.org/x/sys v0.4.0 // indirect
-	golang.org/x/tools v0.5.0 // indirect
+	github.com/CycloneDX/cyclonedx-go v0.9.2 // indirect
+	github.com/ccojocar/zxcvbn-go v1.0.4 // indirect
+	github.com/samber/lo v1.51.0 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
+	golang.org/x/sync v0.16.0 // indirect
+	golang.org/x/sys v0.34.0 // indirect
+	golang.org/x/text v0.27.0 // indirect
+	golang.org/x/tools v0.35.0 // indirect
 )

doc-generation/go.sum

@@ -11,7 +11,7 @@ import (
 	"sort"
 	"strings"
 
-	codacy "github.com/codacy/codacy-engine-golang-seed"
+	codacy "github.com/codacy/codacy-engine-golang-seed/v6"
 	"golang.org/x/mod/modfile"
 
 	"github.com/securego/gosec/v2/rules"
@@ -57,7 +57,7 @@ func gosecVersion() (string, error) {
 	goModFilename := "go.mod"
 	gosecDependency := "github.com/securego/gosec/v2"
 
-	goMod, err := ioutil.ReadFile(goModFilename)
+	goMod, err := os.ReadFile(goModFilename)
 	if err != nil {
 		return "", err
 	}
@@ -90,9 +90,10 @@ func toCodacyPatterns(rules []rules.RuleDefinition) []codacy.Pattern {
 
 	for _, value := range rules {
 		codacyPatterns = append(codacyPatterns, codacy.Pattern{
-			PatternID: value.ID,
-			Category:  "Security",
-			Level:     "Error",
+			ID:       value.ID,
+			Category: "Security",
+			Level:    "Error",
+			ScanType: "SAST",
 		})
 	}
 	return codacyPatterns
@@ -122,7 +123,7 @@ func createPatternsJSONFile(patterns []codacy.Pattern, toolVersion string) error
 	tool := codacy.ToolDefinition{
 		Name:     toolName,
 		Version:  toolVersion,
-		Patterns: patterns,
+		Patterns: &patterns,
 	}
 
 	toolAsJSON, err := json.MarshalIndent(tool, "", "  ")

doc-generation/main.go

@@ -1,2 +1,2 @@
 ## G307
-Unsafe defer call of a method returning an error
+Poor file permissions used when creating a file with os.Create

docs/description/G307.md

@@ -1,2 +1,2 @@
 ## G401
-Detect the usage of DES, RC4, MD5 or SHA1
+Detect the usage of MD5 or SHA1

docs/description/G401.md

@@ -0,0 +1,2 @@
+## G405
+Detect the usage of DES or RC4