[dependabot]

Bumps the github-actions group with 1 update: securego/gosec.

Updates securego/gosec from 2.29.0 to 2.30.0

Release notes

Sourced from securego/gosec's releases.

v2.30.0

Changelog

• 5eb1d104ef85ff2c905c877eb600e8c1dee33a22 fix(g602): recognize equality comparison in minimumLenForBranch (#1796)
• cc750ddcf0d2219e121034f86db3c6c2f3c76d50 fix(G112): honor read timeouts assigned through a struct field (#1798)
• 1cbfd7e6488c2464f18603623354de1be9565b39 fix(G112): report read timeouts explicitly set to zero (#1797)
• 05b9c4c0a7f49e421d7a459922a11bc0c0dd7197 feat(G706): extend log/slog method coverage (#1795)
• 17ad2dd7533fd4c773d916e2bc81446917d593b5 fix(autofix): read the first text block of a Claude response (#1794)
• b23171c64c662de0bc757c17feced6f4c10a877e fix(autofix): give every AI request its own timeout (#1793)
• 20b9e5b1bcc56518b240bf1afc333d6589163cae fix(resolve): treat constants from other packages as resolved (#1792)
• 86d3c26c060940ea7b6832c3b0d41e8ebf07a146 fix(autofix): return an error when a Gemini candidate has no content (#1791)
• 14ef84f6feccf40be7f5092fd2db119bf3f5f836 Update to go version 1.27.3 and 1.26.10 (#1790)
• 7cbd7a927365c48badf18bfb118e5503d606351f fix(autofix): default Gemini model to gemini-3.1-pro-preview (#1788)
• 1e26bcef55d71e330db7ca5e494be6165ffbc35f fix(G102): resolve concatenated and constant listen addresses (#1787)
• 836dbdb55d40238f021780afc91c237898db85e3 fix: default -concurrency to GOMAXPROCS so container CPU limits apply (#1786)
• bbd69e23f657862f7e6d615dd8ba077663d593a3 fix(g602): track statically known lengths for append results in slice bounds check (#1773)
• 30e2d38421dc927e1f4f7148dcb822c1308cf4cc feat(rules): add G125 to detect unescaped url.JoinPath elements (#1777)
• 57c45b800aa0cbd12994ea142537673fd15d54b8 fix: load absolute file paths so nested modules are analysed from the parent directory (#1779)
• 77fa84e3a47a5532d6893467f3df13d2af907541 fix(G118): treat a cancel sent on a channel as handed off (#1782)
• ca547ab2f2c6c7c378bbb91e76e5b97321b55934 fix(G112): honor read timeouts assigned after the http.Server literal (#1781)
• 024084bafcb4182ad1c0af86134aa71a819d6f52 fix(G303): resolve constant temp file paths (#1784)
• 782eeb188eebedaf2335f3adac7052d106670324 fix(deps): update all dependencies (#1783)
• 707f2271f66579a18e1da25794b1e8012247274b fix(G203): treat constant template arguments as safe (#1770)
• 8c5daa67d0e2bec9069da20146b0e928fb9fa53b fix(G402): check TLS settings assigned through a *tls.Config (#1769)
• 71577268350e1e0f2f1491de1ef53f1227b43c1f fix(deps): update all dependencies (#1775)
• 7b1b5cebe007d62fb58eacb90fc571112939ec30 Update to go version 1.27.2 and 1.26.9 (#1772)
• d2b649ec01825c20bd101ec584e559adb287e578 Keep SARIF driver rules sorted and resolve rule indexes at the end (#1767)
• 1f52e64f6dfe434ae4261574baa9495c2532a6de fix(G602): track append() results for slice bounds checking (#1754)
• ea75d9ff49b6bbea15f0eb5e0483408a553019a6 fix(deps): update all dependencies (#1768)
• 65c2c082857febe898116edeb1fcddea0193634a fix(G602): trust len(nilSlice) == N guards, matching make()-backed slices (#1752)
• 6ff893e9ef3f172b24f235acba2a31dab66fa379 fix(G407): treat an array IV/nonce as a zeroed buffer (#1763)
• aaca8946492fb2a6ff3598c185ff97776e12ea6f fix(fileperms): resolve constant file and directory permissions (#1766)
• 826f6f4fd18b7b0cf0a76b2df1994b3eb90da8f3 fix(G102): detect binding to the IPv6 unspecified address (#1760)
• 021cc2eae58ed8ea0160ca8beab93648daefc0e7 fix(G407): stop the nonce source walk on cycles (#1761)
• ccb369da13791bade6e735e70e833d0d095b7db0 fix(G407): do not count AEAD.Seal as the read that fills its own nonce (#1762)
• 9b318063d35cfc5cdf2456de3b92830270e80326 fix(deps): update all dependencies (#1764)
• 8c77519419e934a3e158dbf1a3fbbc0871b8c691 fix(G602): validate inequality len guards (#1757)
• 027baa29ac97f58e9200d664d4ba63c9ea47a5ae fix(G121): track request captured by closures (#1759)
• 9ede89eea46b783aa0a1d28804b817c6d57ff36d fix(deps): update all dependencies (#1756)
• 29a042eca11db9ff0b3985146c5dd3ac46bbd24e fix: make nosec suppression independent of comment order (#1741)
• 681347199262bc33b9b5119ae2b448dec5718240 fix(G403): resolve constant RSA key sizes (#1751)
• 201d4136b42ab474d230d73ada12f7f98e57d8b0 fix(G602): validate subslice bounds under equality guards (#1749)
• accb42475d41cfbf54df86bdf7e3e97b9f9bfbe5 fix(G124): resolve negated constant cookie flags (#1748)
• 61fa1dafbaa3e41a5cb42a02eba204af91f60a41 fix(G602): report constant index equal to the length asserted by an equality guard (#1746)
• 78fbcc7b89a935cdf88bb6a4ecd2a73d1c2e26c5 Skip taint call graphs when no sinks match (#1745)
• 79b4fcd5e4aeed2f53ce93c499b63e4cb51e516e Fix brittle test for html writer (#1744)
• d70cac375c74052389aed6f2209fd2fd942dc6ab fix(G404): ignore non-cryptographic Shuffle calls (#1742)
• 9e8e5d91f2f39f90a574a18f55351b4a4832dacb fix(deps): update all dependencies (#1743)
• 8075fd2e520d33330afe168f26fc7a91f57f2cbc fix(taint): remove Result.Source field that is never populated (#1739)
• 58362d8a331e123b887741c27056f459c8b0660f Update all dependencies (#1737)
• d98945a5b2856e4586445089f564085c3b453e8f Update go version 1.27.1 and 1.26.8 and phased out 1.25 (#1738)

... (truncated)

Commits

• 5eb1d10 fix(g602): recognize equality comparison in minimumLenForBranch (#1796)
• cc750dd fix(G112): honor read timeouts assigned through a struct field (#1798)
• 1cbfd7e fix(G112): report read timeouts explicitly set to zero (#1797)
• 05b9c4c feat(G706): extend log/slog method coverage (#1795)
• 17ad2dd fix(autofix): read the first text block of a Claude response (#1794)
• b23171c fix(autofix): give every AI request its own timeout (#1793)
• 20b9e5b fix(resolve): treat constants from other packages as resolved (#1792)
• 86d3c26 fix(autofix): return an error when a Gemini candidate has no content (#1791)
• 14ef84f Update to go version 1.27.3 and 1.26.10 (#1790)
• 7cbd7a9 fix(autofix): default Gemini model to gemini-3.1-pro-preview (#1788)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions