Repository: hypnoglow/helm-s3

Issue:
Update dependencies to fix CVEs
There is a known issue with your current version of go that was fixed in version `1.24.4`:
* [CVE-2025-22874 (High)](https://scout.docker.com/v/CVE-2025-22874?s=golang&n=stdlib&t=golang&vr=%3E%3D1.24.0-0%2C%3C1.24.4&utm_source=desktop&utm_medium=ExternalLink)


There is a known issue with your current version of helm that was fixed in version `3.18.4`:
* [CVE-2025-53547 (High)](https://scout.docker.com/v/CVE-2025-53547?s=github&n=v3&ns=helm.sh%2Fhelm&t=golang&vr=%3E%3D3.18.0-rc.1%2C%3C3.18.4&utm_source=desktop&utm_medium=ExternalLink)

Discussion:

Solution patch:
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 35f8e7d..be5216c 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -44,9 +44,9 @@ jobs:
           flags: unit
 
       - name: Run linters
-        uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84 # v6.5.2
+        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
         with:
-          version: v1.64.8
+          version: v2.6.0
           args: --verbose
 
       - name: Run ShellCheck
diff --git a/.golangci.yml b/.golangci.yml
index da954f9..7c29fc8 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,34 +1,28 @@
-# Reference: https://golangci.github.io/legacy-v1-doc/usage/configuration/
+# Reference: https://golangci-lint.run/docs/configuration/file/
 
-run:
-  concurrency: 4
-  timeout: 5m
+version: "2"
 
 linters:
-  disable-all: true
+  default: none
   enable:
     - asciicheck
     - bodyclose
     - copyloopvar
     - dogsled
     - errcheck
+    - errchkjson
     - exhaustive
-    - gci
-    - gochecknoinits
+    - funcorder
 #    - gocognit
     - goconst
     - gocritic
     - gocyclo
     - godot
-    - gofmt
-    - goheader
-#    - gomnd
-    - gomodguard
     - goprintffuncname
     - gosec
-    - gosimple
     - govet
     - ineffassign
+    - mirror
     - misspell
     - nakedret
 #    - nestif
@@ -36,39 +30,60 @@ linters:
     - nolintlint
     - prealloc
     - revive
-    - rowserrcheck
-    - sqlclosecheck
     - staticcheck
-    - stylecheck
-    - typecheck
     - unconvert
     - unparam
     - unused
+    - usestdlibvars
     - whitespace
 
-linters-settings:
-  gci:
-    sections:
-      - standard
-      - default
-      - prefix(github.com/hypnoglow/helm-s3)
-  goimports:
-    local-prefixes: github.com/hypnoglow/helm-s3
+  settings:
+    gocritic:
+      disabled-checks:
+        - singleCaseSwitch
+    gomoddirectives:
+      toolchain-forbidden: true
+    nolintlint:
+      require-specific: true
+      require-explanation: true
+
+  exclusions:
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    rules:
+      # Relax requirements for tests.
+      - linters:
+          - goconst
+          - noctx
+        path: _test.go
+      - linters:
+          - golint
+          - stylecheck
+          - revive
+        text: "error strings should not be capitalized"
+      # TODO: fix this later.
+      - linters:
+          - revive
+        text: "^unused-parameter"
+
+formatters:
+  enable:
+    - gci
+    - gofmt
+
+  settings:
+    gci:
+      sections:
+        - standard
+        - default
+        - prefix(github.com/hypnoglow/helm-s3)
 
 issues:
-  exclude-rules:
-    - linters:
-        - golint
-        - stylecheck
-        - revive
-      text: "error strings should not be capitalized"
-    - linters:
-        - staticcheck
-      text: "strings.Title has been deprecated"
-    - linters:
-        - goconst
-      path: _test\.go
-    # TODO: fix this later.
-    - linters:
-        - revive
-      text: "^unused-parameter"
+  fix: true
+
+run:
+  timeout: 5m
+  build-tags: []
diff --git a/.tool-versions b/.tool-versions
index 2691183..1c80481 100644
--- a/.tool-versions
+++ b/.tool-versions
@@ -1,4 +1,4 @@
-golang 1.24.3
-golangci-lint 1.64.8
+golang 1.25.3
+golangci-lint 2.6.0
 goreleaser 2.0.1
 helm 3.19.0
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 29bf55d..4ffab0c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,8 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 - Supported (and tested against) Helm versions updated to `3.18.6` and `3.19.0`.
 
+- Go updated to `1.25.3`.
+
 ## [0.17.0] - 2025-06-02
 
 ### Added
diff --git a/Dockerfile b/Dockerfile
index 79236bb..8eb6437 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-ARG GO_VERSION=1.24.3
+ARG GO_VERSION=1.25.3
 ARG HELM_VERSION=3.19.0
 
 FROM golang:${GO_VERSION}-alpine AS build
diff --git a/cmd/helm-s3/util_errors.go b/cmd/helm-s3/util_errors.go
index 31daffb..08d3158 100644
--- a/cmd/helm-s3/util_errors.go
+++ b/cmd/helm-s3/util_errors.go
@@ -27,14 +27,14 @@ type customError struct {
 	err     error
 }
 
-func (c customError) errorType() errorType {
-	return c.errType
-}
-
 func (c customError) Error() string {
 	return c.err.Error()
 }
 
+func (c customError) errorType() errorType {
+	return c.errType
+}
+
 func newBadUsageError(err error) error {
 	return customError{
 		errType: errorTypeBadUsage,
diff --git a/go.mod b/go.mod
index fc990bf..627cdcd 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/hypnoglow/helm-s3
 
-go 1.24.3
+go 1.25.3
 
 require (
 	github.com/Masterminds/semver v1.5.0
diff --git a/internal/awss3/storage.go b/internal/awss3/storage.go
index e146c68..f4b0338 100644
--- a/internal/awss3/storage.go
+++ b/internal/awss3/storage.go
@@ -66,7 +66,7 @@ func (s *Storage) Traverse(ctx context.Context, repoURI string) (<-chan ChartInf
 // traverse traverses all charts in the repository.
 // It writes an info item about every chart to items, and errors to errs.
 // It always closes both channels when returns.
-func (s *Storage) traverse(ctx context.Context, repoURI string, items chan<- ChartInfo, errs chan<- error) {
+func (s *Storage) traverse(ctx context.Context, repoURI string, items chan<- ChartInfo, errs chan<- error) { //nolint:funcorder // TODO: needs fixing
 	defer close(items)
 	defer close(errs)
 
@@ -121,8 +121,8 @@ func (s *Storage) traverse(ctx context.Context, repoURI string, items chan<- Cha
 
 			reindexItem := ChartInfo{Filename: key}
 
-			serializedChartMeta, hasMeta := metaOut.Metadata[strings.Title(metaChartMetadata)]
-			chartDigest, hasDigest := metaOut.Metadata[strings.Title(metaChartDigest)]
+			serializedChartMeta, hasMeta := metaOut.Metadata[strings.Title(metaChartMetadata)] //nolint:staticcheck // Safe use of strings.Title
+			chartDigest, hasDigest := metaOut.Metadata[strings.Title(metaChartDigest)]         //nolint:staticcheck // Safe use of strings.Title
 			if !hasMeta || !hasDigest {
 				// Some charts in the repository can have no metadata.
 				//
diff --git a/internal/awsutil/session.go b/internal/awsutil/session.go
index bc19779..e83d8b6 100644
--- a/internal/awsutil/session.go
+++ b/internal/awsutil/session.go
@@ -76,8 +76,8 @@ func DynamicBucketRegion(s3URL string) SessionOption {
 			WithCredentials(credentials.NewStaticCredentials("dummy", "dummy", "")).
 			WithRegion("us-east-1").
 			WithEndpoint("s3.amazonaws.com")
-		session := session.Must(session.NewSession())
-		s3Client := s3.New(session, configuration)
+		sess := session.Must(session.NewSession())
+		s3Client := s3.New(sess, configuration)
 
 		bucketRegionHeader := "X-Amz-Bucket-Region"
 		input := &s3.HeadBucketInput{
@@ -96,10 +96,7 @@ func DynamicBucketRegion(s3URL string) SessionOption {
 
 // Session returns an AWS session as described http://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html
 func Session(opts ...SessionOption) (*session.Session, error) {
-	disableSSL := false
-	if os.Getenv(awsDisableSSL) == "true" {
-		disableSSL = true
-	}
+	disableSSL := os.Getenv(awsDisableSSL) == "true"
 
 	so := session.Options{
 		Config: aws.Config{
diff --git a/internal/helmutil/version.go b/internal/helmutil/version.go
index ab95823..e3614a6 100644
--- a/internal/helmutil/version.go
+++ b/internal/helmutil/version.go
@@ -1,9 +1,11 @@
 package helmutil
 
 import (
+	"context"
 	"os"
 	"os/exec"
 	"strings"
+	"time"
 )
 
 // IsHelm3 returns true if helm is version 3+.
@@ -29,7 +31,10 @@ func IsHelm3() bool {
 var helm3Detected func() bool
 
 func helmVersionCommand() bool {
-	cmd := exec.Command("helm", "version", "--short", "--client")
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, "helm", "version", "--short", "--client")
 	out, err := cmd.Output()
 	if err != nil {
 		// Should not happen in normal cases (when helm is properly installed).



Test patch:
diff --git a/tests/e2e/main_test.go b/tests/e2e/main_test.go
index 4d311ef..f111ba4 100644
--- a/tests/e2e/main_test.go
+++ b/tests/e2e/main_test.go
@@ -122,7 +122,7 @@ func teardownBucket(t *testing.T, name string) {
 	require.NoError(t, err, "remove bucket")
 }
 
-func setupRepo(t *testing.T, name, dir string) { //nolint:unparam
+func setupRepo(t *testing.T, name, dir string) { //nolint:unparam // For now dir is always "charts".
 	t.Helper()
 
 	setupBucket(t, name)
@@ -153,7 +153,7 @@ func command(c string) (cmd *exec.Cmd, stdout, stderr *bytes.Buffer) {
 	stderr = &bytes.Buffer{}
 	args := strings.Split(c, " ")
 
-	cmd = exec.Command(args[0], args[1:]...) //nolint:gosec
+	cmd = exec.Command(args[0], args[1:]...) //nolint:gosec // TODO: fix to always "helm" command.
 	cmd.Stdout = stdout
 	cmd.Stderr = stderr
 
@@ -168,7 +168,7 @@ func runCommand(c string) (stdout, stderr *bytes.Buffer, err error) {
 
 // For helm v2, the command is `helm search foo/bar`.
 // For helm v3, the command is `helm search repo foo/bar`.
-func makeSearchCommand(repoName, chartName string) string { //nolint:unparam
+func makeSearchCommand(repoName, chartName string) string { //nolint:unparam // For now chartName is always "foo".
 	c := "helm search"
 
 	helmutil.SetupHelm()