chore: Update tools

.github/workflows/main.yml

@@ -18,7 +18,7 @@ env:
   FIND_TYPOS_VERSION: 0.0.3 # https://github.com/twpayne/find-typos/tags
   GO_VERSION: 1.23.1 # https://go.dev/doc/devel/release
   GOFUMPT_VERSION: 0.7.0 # https://github.com/mvdan/gofumpt/releases
-  GOLANGCI_LINT_VERSION: 1.60.3 # https://github.com/golangci/golangci-lint/releases
+  GOLANGCI_LINT_VERSION: 1.61.0 # https://github.com/golangci/golangci-lint/releases
   GOLINES_VERSION: 0.12.2 # https://github.com/segmentio/golines/releases
   GORELEASER_VERSION: 2.2.0 # https://github.com/goreleaser/goreleaser/releases
   GOVERSIONINFO_VERSION: 1.4.1 # https://github.com/josephspurrier/goversioninfo/releases

.golangci.yml

@@ -31,7 +31,6 @@ linters:
   - goimports
   - gomodguard
   - goprintffuncname
-  - gosec
   - gosimple
   - gosmopolitan
   - govet
@@ -95,6 +94,7 @@ linters:
   - goheader
   - gomnd
   - gomoddirectives
+  - gosec
   - ireturn
   - lll
   - maintidx
@@ -154,13 +154,10 @@ issues:
     text: unused-parameter
   - linters:
     - forbidigo
-    - gosec
     path: ^internal/cmds/
   - linters:
     - forcetypeassert
-    - gosec
     path: _test\.go$
   - linters:
     - forbidigo
-    - gosec
     path: assets/scripts/generate-commit.go

internal/chezmoi/ageencryption.go

@@ -37,7 +37,7 @@ func (e *AgeEncryption) Decrypt(ciphertext []byte) ([]byte, error) {
 		return e.builtinDecrypt(ciphertext)
 	}
 
-	cmd := exec.Command(e.Command, append(e.decryptArgs(), e.Args...)...) //nolint:gosec
+	cmd := exec.Command(e.Command, append(e.decryptArgs(), e.Args...)...)
 	cmd.Stdin = bytes.NewReader(ciphertext)
 	cmd.Stderr = os.Stderr
 	return chezmoilog.LogCmdOutput(slog.Default(), cmd)
@@ -50,11 +50,11 @@ func (e *AgeEncryption) DecryptToFile(plaintextAbsPath AbsPath, ciphertext []byt
 		if err != nil {
 			return err
 		}
-		return os.WriteFile(plaintextAbsPath.String(), plaintext, 0o644) //nolint:gosec
+		return os.WriteFile(plaintextAbsPath.String(), plaintext, 0o644)
 	}
 
 	args := append(append(e.decryptArgs(), "--output", plaintextAbsPath.String()), e.Args...)
-	cmd := exec.Command(e.Command, args...) //nolint:gosec
+	cmd := exec.Command(e.Command, args...)
 	cmd.Stdin = bytes.NewReader(ciphertext)
 	cmd.Stderr = os.Stderr
 	return chezmoilog.LogCmdRun(slog.Default(), cmd)
@@ -66,7 +66,7 @@ func (e *AgeEncryption) Encrypt(plaintext []byte) ([]byte, error) {
 		return e.builtinEncrypt(plaintext)
 	}
 
-	cmd := exec.Command(e.Command, append(e.encryptArgs(), e.Args...)...) //nolint:gosec
+	cmd := exec.Command(e.Command, append(e.encryptArgs(), e.Args...)...)
 	cmd.Stdin = bytes.NewReader(plaintext)
 	cmd.Stderr = os.Stderr
 	return chezmoilog.LogCmdOutput(slog.Default(), cmd)
@@ -83,7 +83,7 @@ func (e *AgeEncryption) EncryptFile(plaintextAbsPath AbsPath) ([]byte, error) {
 	}
 
 	args := append(append(e.encryptArgs(), e.Args...), plaintextAbsPath.String())
-	cmd := exec.Command(e.Command, args...) //nolint:gosec
+	cmd := exec.Command(e.Command, args...)
 	cmd.Stderr = os.Stderr
 	return chezmoilog.LogCmdOutput(slog.Default(), cmd)
 }

internal/chezmoi/chezmoi.go

@@ -4,8 +4,8 @@ package chezmoi
 import (
 	"bufio"
 	"bytes"
-	"crypto/md5"  //nolint:gosec
-	"crypto/sha1" //nolint:gosec
+	"crypto/md5"
+	"crypto/sha1"
 	"crypto/sha256"
 	"crypto/sha512"
 	"fmt"
@@ -20,7 +20,7 @@ import (
 
 	"github.com/spf13/cobra"
 	vfs "github.com/twpayne/go-vfs/v5"
-	"golang.org/x/crypto/ripemd160" //nolint:gosec,staticcheck
+	"golang.org/x/crypto/ripemd160" //nolint:staticcheck
 
 	"github.com/twpayne/chezmoi/v2/internal/chezmoiset"
 )
@@ -336,7 +336,7 @@ func isReadOnly(fileInfo fs.FileInfo) bool {
 
 // md5Sum returns the MD5 sum of data.
 func md5Sum(data []byte) []byte {
-	md5SumArr := md5.Sum(data) //nolint:gosec
+	md5SumArr := md5.Sum(data)
 	return md5SumArr[:]
 }
 
@@ -361,12 +361,12 @@ func modeTypeName(mode fs.FileMode) string {
 
 // ripemd160Sum returns the RIPEMD-160 sum of data.
 func ripemd160Sum(data []byte) []byte {
-	return ripemd160.New().Sum(data) //nolint:gosec
+	return ripemd160.New().Sum(data)
 }
 
 // sha1Sum returns the SHA1 sum of data.
 func sha1Sum(data []byte) []byte {
-	sha1SumArr := sha1.Sum(data) //nolint:gosec
+	sha1SumArr := sha1.Sum(data)
 	return sha1SumArr[:]
 }
 

internal/chezmoi/chezmoi_unix.go

@@ -12,7 +12,7 @@ import (
 const nativeLineEnding = "\n"
 
 func init() {
-	Umask = fs.FileMode(unix.Umask(0)) //nolint:gosec
+	Umask = fs.FileMode(unix.Umask(0))
 	unix.Umask(int(Umask))
 }
 

internal/chezmoi/externaldiffsystem.go

@@ -199,7 +199,7 @@ func (s *ExternalDiffSystem) RunScript(scriptName RelPath, dir AbsPath, data []b
 		if !s.scriptContents {
 			toData = nil
 		}
-		if err := os.WriteFile(targetAbsPath.String(), toData, 0o700); err != nil { //nolint:gosec
+		if err := os.WriteFile(targetAbsPath.String(), toData, 0o700); err != nil {
 			return err
 		}
 		if err := s.runDiffCommand(devNullAbsPath, targetAbsPath); err != nil {
@@ -325,7 +325,7 @@ func (s *ExternalDiffSystem) runDiffCommand(destAbsPath, targetAbsPath AbsPath)
 		args = append(args, templateData.Destination, templateData.Target)
 	}
 
-	cmd := exec.Command(s.command, args...) //nolint:gosec
+	cmd := exec.Command(s.command, args...)
 	cmd.Stdin = os.Stdin
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr

internal/chezmoi/gpgencryption.go

@@ -139,7 +139,7 @@ func (e *GPGEncryption) encryptArgs(plaintextAbsPath, ciphertextAbsPath AbsPath)
 
 // run runs the command with args.
 func (e *GPGEncryption) run(args []string) error {
-	cmd := exec.Command(e.Command, args...) //nolint:gosec
+	cmd := exec.Command(e.Command, args...)
 	cmd.Stdin = os.Stdin
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr

internal/chezmoi/interpreter.go

@@ -16,7 +16,7 @@ func (i *Interpreter) ExecCommand(name string) *exec.Cmd {
 	if i.None() {
 		return exec.Command(name)
 	}
-	return exec.Command(i.Command, append(i.Args, name)...) //nolint:gosec
+	return exec.Command(i.Command, append(i.Args, name)...)
 }
 
 // None returns if i represents no interpreter.

internal/chezmoi/sourcestate.go

@@ -1714,7 +1714,7 @@ func (s *SourceState) getExternalData(
 	}
 
 	if external.Filter.Command != "" {
-		cmd := exec.Command(external.Filter.Command, external.Filter.Args...) //nolint:gosec
+		cmd := exec.Command(external.Filter.Command, external.Filter.Args...)
 		cmd.Stdin = bytes.NewReader(data)
 		cmd.Stderr = os.Stderr
 		data, err = chezmoilog.LogCmdOutput(s.logger, cmd)

internal/chezmoitest/chezmoitest.go

@@ -25,7 +25,7 @@ var ageRecipientRx = regexp.MustCompile(`(?m)^Public key: ([0-9a-z]+)\s*$`)
 // AgeGenerateKey generates an identity in identityFile and returns the
 // recipient.
 func AgeGenerateKey(command, identityFile string) (string, error) {
-	cmd := exec.Command(command+"-keygen", "--output", identityFile) //nolint:gosec
+	cmd := exec.Command(command+"-keygen", "--output", identityFile)
 	output, err := chezmoilog.LogCmdCombinedOutput(slog.Default(), cmd)
 	if err != nil {
 		return "", err
@@ -41,7 +41,7 @@ func AgeGenerateKey(command, identityFile string) (string, error) {
 // passphrase.
 func GPGGenerateKey(command, homeDir string) (key, passphrase string, err error) {
 	key = "chezmoi-test-gpg-key"
-	passphrase = "chezmoi-test-gpg-passphrase" //nolint:gosec
+	passphrase = "chezmoi-test-gpg-passphrase"
 	cmd := exec.Command(
 		command,
 		"--batch",
@@ -101,5 +101,5 @@ func mustParseFileMode(s string) fs.FileMode {
 	if err != nil {
 		panic(err)
 	}
-	return fs.FileMode(uint32(u)) //nolint:gosec
+	return fs.FileMode(uint32(u))
 }

internal/cmd/config.go

@@ -733,7 +733,7 @@ func (c *Config) colorAutoFunc() bool {
 		return false
 	}
 	if stdout, ok := c.stdout.(*os.File); ok {
-		return term.IsTerminal(int(stdout.Fd())) //nolint:gosec
+		return term.IsTerminal(int(stdout.Fd()))
 	}
 	return false
 }
@@ -2270,7 +2270,7 @@ func (c *Config) persistentStateFile() (chezmoi.AbsPath, error) {
 // progressAutoFunc detects whether progress bars should be displayed.
 func (c *Config) progressAutoFunc() bool {
 	if stdout, ok := c.stdout.(*os.File); ok {
-		return term.IsTerminal(int(stdout.Fd())) //nolint:gosec
+		return term.IsTerminal(int(stdout.Fd()))
 	}
 	return false
 }
@@ -2720,7 +2720,7 @@ func (c *Config) writeOutput(data []byte) error {
 		_, err := c.stdout.Write(data)
 		return err
 	}
-	return os.WriteFile(c.outputAbsPath.String(), data, 0o666) //nolint:gosec
+	return os.WriteFile(c.outputAbsPath.String(), data, 0o666)
 }
 
 type writePathsOptions struct {

internal/cmd/doctorcmd.go

@@ -492,7 +492,7 @@ func (c *binaryCheck) Run(system chezmoi.System, homeDirAbsPath chezmoi.AbsPath)
 		return checkResultOK, fmt.Sprintf("found %s", pathAbsPath)
 	}
 
-	cmd := exec.Command(pathAbsPath.String(), c.versionArgs...) //nolint:gosec
+	cmd := exec.Command(pathAbsPath.String(), c.versionArgs...)
 	output, err := chezmoilog.LogCmdCombinedOutput(slog.Default(), cmd)
 	if err != nil {
 		return checkResultFailed, err.Error()
@@ -583,13 +583,7 @@ func (c *dirCheck) Run(system chezmoi.System, homeDirAbsPath chezmoi.AbsPath) (c
 		if dirEntry.Name() != ".git" {
 			continue
 		}
-		cmd := exec.Command( //nolint:gosec
-			"git",
-			"-C",
-			c.dirname.String(),
-			"status",
-			"--porcelain=v2",
-		)
+		cmd := exec.Command("git", "-C", c.dirname.String(), "status", "--porcelain=v2")
 		cmd.Stderr = os.Stderr
 		output, err := cmd.Output()
 		if err != nil {

internal/cmd/dopplertemplatefuncs.go

@@ -83,7 +83,7 @@ func (c *Config) dopplerOutput(args []string) ([]byte, error) {
 	if data, ok := c.Doppler.outputCache[key]; ok {
 		return data, nil
 	}
-	cmd := exec.Command(c.Doppler.Command, args...) //nolint:gosec
+	cmd := exec.Command(c.Doppler.Command, args...)
 	// Always run the doppler command in the destination path because doppler uses
 	// relative paths to find its .doppler.json config file.
 	cmd.Dir = c.DestDirAbsPath.String()

internal/cmd/hcpvaultsecretsttemplatefuncs.go

@@ -90,7 +90,7 @@ func (c *Config) vltOutput(args []string) ([]byte, error) {
 		return data, nil
 	}
 
-	cmd := exec.Command(c.HCPVaultSecrets.Command, args...) //nolint:gosec
+	cmd := exec.Command(c.HCPVaultSecrets.Command, args...)
 	// Always run the vlt command in the destination path because vlt uses
 	// relative paths to find its .vlt.json config file.
 	cmd.Dir = c.DestDirAbsPath.String()

internal/cmd/inittemplatefuncs.go

@@ -20,7 +20,7 @@ func (c *Config) stdinIsATTYInitTemplateFunc() bool {
 	if !ok {
 		return false
 	}
-	return term.IsTerminal(int(file.Fd())) //nolint:gosec
+	return term.IsTerminal(int(file.Fd()))
 }
 
 func (c *Config) writeToStdout(args ...string) string {

internal/cmd/keepassxctemplatefuncs.go

@@ -167,7 +167,7 @@ func (c *Config) keepassxcOutputCachePassword(command string, args ...string) ([
 	cmdArgs = append(cmdArgs, c.Keepassxc.Args...)
 	cmdArgs = append(cmdArgs, c.Keepassxc.Database.String())
 	cmdArgs = append(cmdArgs, args...)
-	cmd := exec.Command(c.Keepassxc.Command, cmdArgs...) //nolint:gosec
+	cmd := exec.Command(c.Keepassxc.Command, cmdArgs...)
 	if c.Keepassxc.password == "" && c.Keepassxc.Prompt {
 		password, err := c.readPassword(fmt.Sprintf("Enter password to unlock %s: ", c.Keepassxc.Database))
 		if err != nil {
@@ -204,7 +204,7 @@ func (c *Config) keepassxcOutputOpen(command string, args ...string) ([]byte, er
 		cmdArgs := []string{"open"}
 		cmdArgs = append(cmdArgs, c.Keepassxc.Args...)
 		cmdArgs = append(cmdArgs, c.Keepassxc.Database.String())
-		cmd := exec.Command(c.Keepassxc.Command, cmdArgs...) //nolint:gosec
+		cmd := exec.Command(c.Keepassxc.Command, cmdArgs...)
 		env := os.Environ()
 		// Ensure prompt is in English.
 		env = append(env, "LANGUAGE=en")

internal/cmd/onepasswordtemplatefuncs.go

@@ -181,7 +181,7 @@ func (c *Config) onepasswordGetOrRefreshSessionToken(args *onepasswordArgs) (str
 		commandArgs = append(commandArgs, "--session", session)
 	}
 
-	cmd := exec.Command(c.Onepassword.Command, commandArgs...) //nolint:gosec
+	cmd := exec.Command(c.Onepassword.Command, commandArgs...)
 	cmd.Stdin = os.Stdin
 	cmd.Stderr = os.Stderr
 	output, err := chezmoilog.LogCmdOutput(c.logger, cmd)
@@ -235,7 +235,7 @@ func (c *Config) onepasswordOutput(args *onepasswordArgs, withSessionToken withS
 		}
 	}
 
-	cmd := exec.Command(c.Onepassword.Command, commandArgs...) //nolint:gosec
+	cmd := exec.Command(c.Onepassword.Command, commandArgs...)
 	cmd.Stdin = os.Stdin
 	cmd.Stderr = os.Stderr
 	output, err := chezmoilog.LogCmdOutput(c.logger, cmd)

internal/cmd/passtemplatefuncs.go

@@ -51,7 +51,7 @@ func (c *Config) passOutput(id string) ([]byte, error) {
 	}
 
 	args := []string{"show", id}
-	cmd := exec.Command(c.Pass.Command, args...) //nolint:gosec
+	cmd := exec.Command(c.Pass.Command, args...)
 	cmd.Stdin = os.Stdin
 	cmd.Stderr = os.Stderr
 	output, err := chezmoilog.LogCmdOutput(c.logger, cmd)

internal/cmd/rbwtemplatefuncs.go

@@ -58,7 +58,7 @@ func (c *Config) rbwOutput(args []string) ([]byte, error) {
 		return data, nil
 	}
 
-	cmd := exec.Command(c.RBW.Command, args...) //nolint:gosec
+	cmd := exec.Command(c.RBW.Command, args...)
 	cmd.Stdin = os.Stdin
 	cmd.Stderr = os.Stderr
 	output, err := chezmoilog.LogCmdOutput(c.logger, cmd)

internal/cmd/secrettemplatefuncs.go

@@ -45,7 +45,7 @@ func (c *Config) secretOutput(args []string) ([]byte, error) {
 	}
 
 	args = append(slices.Clone(c.Secret.Args), args...)
-	cmd := exec.Command(c.Secret.Command, args...) //nolint:gosec
+	cmd := exec.Command(c.Secret.Command, args...)
 	cmd.Stdin = os.Stdin
 	cmd.Stderr = os.Stderr
 	output, err := chezmoilog.LogCmdOutput(c.logger, cmd)

internal/cmd/textconv.go

@@ -37,7 +37,7 @@ func (t textConv) convert(path string, data []byte) ([]byte, error) {
 		return data, nil
 	}
 
-	cmd := exec.Command(longestPatternElement.Command, longestPatternElement.Args...) //nolint:gosec
+	cmd := exec.Command(longestPatternElement.Command, longestPatternElement.Args...)
 	cmd.Stdin = bytes.NewReader(data)
 	cmd.Stderr = os.Stderr
 	return chezmoilog.LogCmdOutput(slog.Default(), cmd)

internal/cmd/vaulttemplatefuncs.go

@@ -19,7 +19,7 @@ func (c *Config) vaultTemplateFunc(key string) any {
 	}
 
 	args := []string{"kv", "get", "-format=json", key}
-	cmd := exec.Command(c.Vault.Command, args...) //nolint:gosec
+	cmd := exec.Command(c.Vault.Command, args...)
 	cmd.Stdin = os.Stdin
 	cmd.Stderr = os.Stderr
 	output, err := chezmoilog.LogCmdOutput(c.logger, cmd)