fix(deps): update module github.com/golangci/golangci-lint to v1.60.2

bridges/otelslog/handler.go

@@ -425,7 +425,12 @@
  case slog.KindTime:
  return log.Int64Value(v.Time().UnixNano())
  case slog.KindUint64:
- return log.Int64Value(int64(v.Uint64()))
+ const maxInt64 = ^uint64(0) >> 1
+ u := v.Uint64()
+ if u > maxInt64 {
+ return log.Float64Value(float64(u))
+ }
+ return log.Int64Value(int64(u)) // nolint:gosec // Overflow checked above.
  case slog.KindGroup:
  g := v.Group()
  buf := newKVBuffer(len(g))

bridges/otelzap/encoder.go

@@ -175,7 +175,7 @@ func (m *objectEncoder) AddUint16(k string, v uint16) {
 }
 
 func (m *objectEncoder) AddUint8(k string, v uint8) {
- m.AddInt64(k, int64(v))
+ m.AddInt64(k, int64(v)) // nolint: gosec // https:/securego/gosec/issues/1185
 }
 
 func (m *objectEncoder) AddUintptr(k string, v uintptr) {
@@ -187,7 +187,7 @@ func assignUintValue(v uint64) log.Value {
  if v > maxInt64 {
  return log.Float64Value(float64(v))
  }
- return log.Int64Value(int64(v))
+ return log.Int64Value(int64(v)) // nolint:gosec // Overflow checked above.
 }
 
 // arrayEncoder implements [zapcore.ArrayEncoder].
@@ -272,8 +272,10 @@ func (a *arrayEncoder) AppendTime(v time.Time) { a.AppendInt64(v.UnixNan
 func (a *arrayEncoder) AppendUint(v uint) { a.AppendUint64(uint64(v)) }
 func (a *arrayEncoder) AppendUint32(v uint32) { a.AppendInt64(int64(v)) }
 func (a *arrayEncoder) AppendUint16(v uint16) { a.AppendInt64(int64(v)) }
-func (a *arrayEncoder) AppendUint8(v uint8) { a.AppendInt64(int64(v)) }
 func (a *arrayEncoder) AppendUintptr(v uintptr) { a.AppendUint64(uint64(v)) }
+func (a *arrayEncoder) AppendUint8(v uint8) {
+ a.AppendInt64(int64(v)) // nolint: gosec // https:/securego/gosec/issues/1185
+}
 
 func convertValue(v interface{}) log.Value {
  switch v := v.(type) {

bridges/prometheus/producer.go

@@ -214,10 +214,10 @@ func convertExponentialBuckets(bucketSpans []*dto.BucketSpan, deltas []int64) me
  initialOffset := bucketSpans[0].GetOffset() - 1
  // We will have one bucket count for each delta, and zeros for the offsets
  // after the initial offset.
- lenCounts := int32(len(deltas))
+ lenCounts := len(deltas)
  for i, bs := range bucketSpans {
  if i != 0 {
- lenCounts += bs.GetOffset()
+ lenCounts += int(bs.GetOffset())
  }
  }
  counts := make([]uint64, lenCounts)

config/metric.go

@@ -8,6 +8,7 @@
  "encoding/json"
  "errors"
  "fmt"
+ "math"
  "net"
  "net/http"
  "net/url"
@@ -358,8 +359,8 @@
 
  if aggr.Base2ExponentialBucketHistogram != nil {
  return sdkmetric.AggregationBase2ExponentialHistogram{
- MaxSize: int32(intOrZero(aggr.Base2ExponentialBucketHistogram.MaxSize)),
- MaxScale: int32(intOrZero(aggr.Base2ExponentialBucketHistogram.MaxScale)),
+ MaxSize: int32OrZero(aggr.Base2ExponentialBucketHistogram.MaxSize),
+ MaxScale: int32OrZero(aggr.Base2ExponentialBucketHistogram.MaxScale),
  // Need to negate because config has the positive action RecordMinMax.
  NoMinMax: !boolOrFalse(aggr.Base2ExponentialBucketHistogram.RecordMinMax),
  }
@@ -426,11 +427,18 @@
  return *pBool
 }
 
-func intOrZero(pInt *int) int {
+func int32OrZero(pInt *int) int32 {
  if pInt == nil {
  return 0
  }
- return *pInt
+ i := *pInt
+ if i > math.MaxInt32 {
+ return math.MaxInt32
+ }
+ if i < math.MinInt32 {
+ return math.MinInt32
+ }
+ return int32(i) // nolint: gosec // Overflow and underflow checked above.
 }
 
 func strOrEmpty(pStr *string) string {

config/resource.go

@@ -23,7 +23,7 @@ func keyVal(k string, v any) attribute.KeyValue {
  case int8:
  return attribute.Int64(k, int64(val))
  case uint8:
- return attribute.Int64(k, int64(val))
+ return attribute.Int64(k, int64(val)) // nolint: gosec // https:/securego/gosec/issues/1185
  case int16:
  return attribute.Int64(k, int64(val))
  case uint16:

instrumentation/github.com/emicklei/go-restful/otelrestful/internal/semconvutil/netconv.go

@@ -195,7 +195,7 @@ func splitHostPort(hostport string) (host string, port int) {
  if err != nil {
  return
  }
- return host, int(p)
+ return host, int(p) // nolint: gosec // Bitsize checked to be 16 above.
 }
 
 func netProtocol(proto string) (name string, version string) {

instrumentation/github.com/gin-gonic/gin/otelgin/internal/semconvutil/netconv.go

@@ -195,7 +195,7 @@ func splitHostPort(hostport string) (host string, port int) {
  if err != nil {
  return
  }
- return host, int(p)
+ return host, int(p) // nolint: gosec // Bitsize checked to be 16 above.
 }
 
 func netProtocol(proto string) (name string, version string) {

instrumentation/github.com/gorilla/mux/otelmux/internal/semconvutil/netconv.go

@@ -195,7 +195,7 @@ func splitHostPort(hostport string) (host string, port int) {
  if err != nil {
  return
  }
- return host, int(p)
+ return host, int(p) // nolint: gosec // Bitsize checked to be 16 above.
 }
 
 func netProtocol(proto string) (name string, version string) {

instrumentation/github.com/labstack/echo/otelecho/internal/semconvutil/netconv.go

@@ -195,7 +195,7 @@ func splitHostPort(hostport string) (host string, port int) {
  if err != nil {
  return
  }
- return host, int(p)
+ return host, int(p) // nolint: gosec // Bitsize checked to be 16 above.
 }
 
 func netProtocol(proto string) (name string, version string) {

instrumentation/google.golang.org/grpc/otelgrpc/internal/test/test_utils.go

@@ -44,12 +44,12 @@ import (
 )
 
 var (
- reqSizes = []int{27182, 8, 1828, 45904}
- respSizes = []int{31415, 9, 2653, 58979}
- largeReqSize = 271828
- largeRespSize = 314159
- initialMetadataKey = "x-grpc-test-echo-initial"
- trailingMetadataKey = "x-grpc-test-echo-trailing-bin"
+ reqSizes  = []int32{27182, 8, 1828, 45904}
+ respSizes  = []int32{31415, 9, 2653, 58979}
+ largeReqSize  = 271828
+ largeRespSize int32 = 314159
+ initialMetadataKey  = "x-grpc-test-echo-initial"
+ trailingMetadataKey  = "x-grpc-test-echo-trailing-bin"
 
  logger = grpclog.Component("interop")
 )
@@ -87,7 +87,7 @@ func DoLargeUnaryCall(ctx context.Context, tc testpb.TestServiceClient, args ...
  pl := ClientNewPayload(testpb.PayloadType_COMPRESSABLE, largeReqSize)
  req := &testpb.SimpleRequest{
  ResponseType: testpb.PayloadType_COMPRESSABLE,
- ResponseSize: int32(largeRespSize),
+ ResponseSize: largeRespSize,
  Payload: pl,
  }
  reply, err := tc.UnaryCall(ctx, req, args...)
@@ -96,7 +96,7 @@ func DoLargeUnaryCall(ctx context.Context, tc testpb.TestServiceClient, args ...
  }
  t := reply.GetPayload().GetType()
  s := len(reply.GetPayload().GetBody())
- if t != testpb.PayloadType_COMPRESSABLE || s != largeRespSize {
+ if t != testpb.PayloadType_COMPRESSABLE || s != int(largeRespSize) {
  logger.Fatalf("Got the reply with type %d len %d; want %d, %d", t, s, testpb.PayloadType_COMPRESSABLE, largeRespSize)
  }
 }
@@ -107,9 +107,9 @@ func DoClientStreaming(ctx context.Context, tc testpb.TestServiceClient, args ..
  if err != nil {
  logger.Fatalf("%v.StreamingInputCall(_) = _, %v", tc, err)
  }
- var sum int
+ var sum int32
  for _, s := range reqSizes {
- pl := ClientNewPayload(testpb.PayloadType_COMPRESSABLE, s)
+ pl := ClientNewPayload(testpb.PayloadType_COMPRESSABLE, int(s))
  req := &testpb.StreamingInputCallRequest{
  Payload: pl,
  }
@@ -122,7 +122,7 @@ func DoClientStreaming(ctx context.Context, tc testpb.TestServiceClient, args ..
  if err != nil {
  logger.Fatalf("%v.CloseAndRecv() got error %v, want %v", stream, err, nil)
  }
- if reply.GetAggregatedPayloadSize() != int32(sum) {
+ if reply.GetAggregatedPayloadSize() != sum {
  logger.Fatalf("%v.CloseAndRecv().GetAggregatePayloadSize() = %v; want %v", stream, reply.GetAggregatedPayloadSize(), sum)
  }
 }
@@ -132,7 +132,7 @@ func DoServerStreaming(ctx context.Context, tc testpb.TestServiceClient, args ..
  respParam := make([]*testpb.ResponseParameters, len(respSizes))
  for i, s := range respSizes {
  respParam[i] = &testpb.ResponseParameters{
- Size: int32(s),
+ Size: s,
  }
  }
  req := &testpb.StreamingOutputCallRequest{
@@ -157,7 +157,7 @@ func DoServerStreaming(ctx context.Context, tc testpb.TestServiceClient, args ..
  logger.Fatalf("Got the reply of type %d, want %d", t, testpb.PayloadType_COMPRESSABLE)
  }
  size := len(reply.GetPayload().GetBody())
- if size != respSizes[index] {
+ if size != int(respSizes[index]) {
  logger.Fatalf("Got reply body of length %d, want %d", size, respSizes[index])
  }
  index++
@@ -181,10 +181,10 @@ func DoPingPong(ctx context.Context, tc testpb.TestServiceClient, args ...grpc.C
  for index < len(reqSizes) {
  respParam := []*testpb.ResponseParameters{
  {
- Size: int32(respSizes[index]),
+ Size: respSizes[index],
  },
  }
- pl := ClientNewPayload(testpb.PayloadType_COMPRESSABLE, reqSizes[index])
+ pl := ClientNewPayload(testpb.PayloadType_COMPRESSABLE, int(reqSizes[index]))
  req := &testpb.StreamingOutputCallRequest{
  ResponseType: testpb.PayloadType_COMPRESSABLE,
  ResponseParameters: respParam,
@@ -202,7 +202,7 @@ func DoPingPong(ctx context.Context, tc testpb.TestServiceClient, args ...grpc.C
  logger.Fatalf("Got the reply of type %d, want %d", t, testpb.PayloadType_COMPRESSABLE)
  }
  size := len(reply.GetPayload().GetBody())
- if size != respSizes[index] {
+ if size != int(respSizes[index]) {
  logger.Fatalf("Got reply body of length %d, want %d", size, respSizes[index])
  }
  index++
@@ -304,19 +304,21 @@ func (s *testServer) StreamingOutputCall(args *testpb.StreamingOutputCallRequest
 }
 
 func (s *testServer) StreamingInputCall(stream testpb.TestService_StreamingInputCallServer) error {
- var sum int
+ var sum int32
  for {
  in, err := stream.Recv()
  if errors.Is(err, io.EOF) {
  return stream.SendAndClose(&testpb.StreamingInputCallResponse{
- AggregatedPayloadSize: int32(sum),
+ AggregatedPayloadSize: sum,
  })
  }
  if err != nil {
  return err
  }
- p := in.GetPayload().GetBody()
- sum += len(p)
+ n := len(in.GetPayload().GetBody())
+ // This could overflow, but given this is a test and the negative value
+ // should be detectable this should be good enough.
+ sum += int32(n) // nolint: gosec
  }
 }
 

instrumentation/gopkg.in/macaron.v1/otelmacaron/internal/semconvutil/netconv.go

@@ -195,7 +195,7 @@ func splitHostPort(hostport string) (host string, port int) {
  if err != nil {
  return
  }
- return host, int(p)
+ return host, int(p) // nolint: gosec // Bitsize checked to be 16 above.
 }
 
 func netProtocol(proto string) (name string, version string) {

instrumentation/host/host.go

@@ -6,6 +6,7 @@
 import (
  "context"
  "fmt"
+ "math"
  "os"
  "sync"
 
@@ -118,7 +119,11 @@
  lock sync.Mutex
  )
 
- proc, err := process.NewProcess(int32(os.Getpid()))
+ pid := os.Getpid()
+ if pid > math.MaxInt32 || pid < math.MinInt32 {
+ return fmt.Errorf("invalid process ID: %d", pid)
+ }
+ proc, err := process.NewProcess(int32(pid)) // nolint: gosec // Overflow checked above.
  if err != nil {
  return fmt.Errorf("could not find this process: %w", err)
  }
@@ -246,9 +251,9 @@
 
  // Host memory usage
  opt = metric.WithAttributeSet(AttributeMemoryUsed)
- o.ObserveInt64(hostMemoryUsage, int64(vmStats.Used), opt)
+ o.ObserveInt64(hostMemoryUsage, clampInt64(vmStats.Used), opt)
  opt = metric.WithAttributeSet(AttributeMemoryAvailable)
- o.ObserveInt64(hostMemoryUsage, int64(vmStats.Available), opt)
+ o.ObserveInt64(hostMemoryUsage, clampInt64(vmStats.Available), opt)
 
  // Host memory utilization
  opt = metric.WithAttributeSet(AttributeMemoryUsed)
@@ -262,9 +267,9 @@
  // interface, with similar questions to those posed
  // about per-CPU measurements above.
  opt = metric.WithAttributeSet(AttributeNetworkTransmit)
- o.ObserveInt64(networkIOUsage, int64(ioStats[0].BytesSent), opt)
+ o.ObserveInt64(networkIOUsage, clampInt64(ioStats[0].BytesSent), opt)
  opt = metric.WithAttributeSet(AttributeNetworkReceive)
- o.ObserveInt64(networkIOUsage, int64(ioStats[0].BytesRecv), opt)
+ o.ObserveInt64(networkIOUsage, clampInt64(ioStats[0].BytesRecv), opt)
 
  return nil
  },
@@ -280,3 +285,10 @@
 
  return nil
 }
+
+func clampInt64(v uint64) int64 {
+ if v > math.MaxInt64 {
+ return math.MaxInt64
+ }
+ return int64(v) // nolint: gosec // Overflow checked.
+}

instrumentation/net/http/httptrace/otelhttptrace/internal/semconvutil/netconv.go

@@ -195,7 +195,7 @@ func splitHostPort(hostport string) (host string, port int) {
  if err != nil {
  return
  }
- return host, int(p)
+ return host, int(p) // nolint: gosec // Bitsize checked to be 16 above.
 }
 
 func netProtocol(proto string) (name string, version string) {

instrumentation/net/http/otelhttp/internal/semconv/util.go

@@ -50,7 +50,7 @@ func splitHostPort(hostport string) (host string, port int) {
  if err != nil {
  return
  }
- return host, int(p)
+ return host, int(p) // nolint: gosec // Byte size checked 16 above.
 }
 
 func requiredHTTPPort(https bool, port int) int { // nolint:revive

instrumentation/net/http/otelhttp/internal/semconvutil/netconv.go

@@ -195,7 +195,7 @@ func splitHostPort(hostport string) (host string, port int) {
  if err != nil {
  return
  }
- return host, int(p)
+ return host, int(p) // nolint: gosec // Bitsize checked to be 16 above.
 }
 
 func netProtocol(proto string) (name string, version string) {