build(deps): bump securego/gosec from 2.19.0 to 2.21.3

[dependabot]

Bumps securego/gosec from 2.19.0 to 2.21.3.

Release notes

Sourced from securego/gosec's releases.

v2.21.3

Changelog

• be8bd6e40be105333f2bc783ba8d688154441559 Populate the fixes only when autofix is not empty (#1226)
• 30049320058a3d116f9f0d3a98c7fdf3fedc20af chore(deps): update all dependencies (#1223)
• 1f3bdd93493b70e06e508b51ea7ad757e8f2f21e G115 Struct Attribute Checks (#1221)
• 5f3194b581979e508b0ba1ee22f1f1f85a314e16 Update the github action to v2.21.2 (#1218)

v2.21.2

Changelog

• abfe8cfd6d5687c96abf31f8e7f57982df2a6e4f Update the SARIF schema URL (#1217)
• 0396179112d5e2071365e5ecb2a75d77e90852f8 Update go version to 1.23.1 and 1.22.7 (#1216)
• 5e53c8b9f7f77380e95960e6095392f49977e63d chore(deps): update all dependencies (#1215)
• 014751c91c04fe3fe05e381dea9faadbd4ce8e78 Update gosec version to v2.21.1 in github action (#1213)

v2.21.1

Changelog

• 0ce4453ddd8cca1291d2056cf903b545baad95a0 Rollback the SARIF version to 2.1 since github doesn't support 2.2 (#1210)
• ea26e8431f53a5d229b1c07ffe3529008a01c25e Update gosec in github action to v2.21.0 (#1208)

v2.21.0

Changelog

• b278b40c5266eb2b52f41c57d9e6509d9360a2a6 Update cosign version to v2.4.0 in release github workflow (#1207)
• eaedce9a8b64ce207e25553232bcc7541e0044e7 Improvement the int conversion overflow logic to handle bound checks (#1194)
• ea5b2766bb1abd38e13375c0e2d789f8ab2b789c fix: G602 support for nested conditionals with bounds check (#1201)
• 11d69032b0856c96afd4c493967ab7a30e20ff5e Update go.mod to sue go 1.22.0 toolchain
• 655527dfb4df16091cbdc0a10bd89c2d5d9312a5 chore(deps): update all dependencies
• 08985601695d7b6eb13330521c80859adc9d72aa Make variable name more clear
• ac67231ec5a73f1525942d5ef482d1152e61ac3f Make variable names more explicity and reduce duplications
• e0414c46402de6813677e1868b6c0f82270fdb80 Fix formatting
• c7003fc7e5e7f05783097793d4410d50896e06d4 Refactor to reduce some fuctions and variable names
• 2401936458ea4c80b8c83a3500d9354ca3914605 Pass the value argument directly since is an interface
• f5d312825f753d7c598fcd5e80e2c9c6f9cb1776 Added suggested changes
• a14ca4ac59d9b519d1b195afe6098ff13d574d32 Added another test case in order to increase code coverage
• a6dd589bae11a5eb18408a4a75e63e46833a01a3 Removed function parameter which is always the same
• b4c746962f33c83ec64ce337e546bd0cc6529cd1 Formatting problems(CI was not passing)
• 7f8f654235b42704bab6c65c3459a2824bccadd3 Updated analyzer to use new way of initialization
• a26215cf23be85d473f6d5a1e059a02406ea5d55 Migrated the rule to the analyzers folder
• 3f6e1e7326fe7849aaaaf35698907a1a7c504997 Refractored code a little bit
• 0eb8143c23b649a345370fd169baff6525c34bd9 Added new rule G407(hardcoded IV/nonce)
• 4ae73c8ba3a6b38e3c1bafad75f59cb4910e389f Fix conversion overflow false positive when using ParseUint
• c52dc0ea4e0fed5898f6b1d1f1028bd20ac0fa86 Add a build step to measure the scan perfomance
• bcec04e784830d45797201cb889246bf266cd941 Fix conversion overflow false positives when they are checked or pre-determined
• 71e397b9944c50b3f8f9e0e3e1904047c7b3967e Update go.mod
• aec45b0b7dd15c03d89d67e16b93f41df8ece85b chore(deps): update all dependencies
• ab3f6c1c83a0c80fcb8c95838de10cc3cf0d8ba2 Fix false positive in conversion overflow check from uint8/int8 type
• a39ec5a16bca81f2442050ce3d2d442911ace4cc Disable staticcheck SA1019 rule
• a1b2ab80af682c279271a7d3e3cf939e0e5c2847 Update the golangci linters
• 8467f012e0d6238433e299fd0499ee29342000c3 Add more test to cover more use cases for G115 rule
• 81cda2f91fbe1bf4735feb55febcae03e697a92b Allow excluding analyzers globally (#1180)
• 18135b439cbafc52ac712528099193a0d6b18a33 Update to Go 1.23.0 (#1183)

... (truncated)

Commits

• be8bd6e Populate the fixes only when autofix is not empty (#1226)
• 3004932 chore(deps): update all dependencies (#1223)
• 1f3bdd9 G115 Struct Attribute Checks (#1221)
• 5f3194b Update the github action to v2.21.2 (#1218)
• abfe8cf Update the SARIF schema URL (#1217)
• 0396179 Update go version to 1.23.1 and 1.22.7 (#1216)
• 5e53c8b chore(deps): update all dependencies (#1215)
• 014751c Update gosec version to v2.21.1 in github action (#1213)
• 0ce4453 Rollback the SARIF version to 2.1 since github doesn't support 2.2 (#1210)
• ea26e84 Update gosec in github action to v2.21.0 (#1208)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[lzap]

Let’s rebase on top of my Go upgrade.

[lzap]

Ok I mixed two problems together accidentally. What I am trying to solve is this problem:

github.com/oapi-codegen/oapi-codegen/[email protected] requires go >= 1.21.13 (running go 1.21.9; ../../../go.mod sets toolchain go1.21.9)

This is unrelated to that, I am closing this for now, gosec is a separate issue that will be solved once Go toolchain is updated later on.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.