multiple linters missed issues in scanning

[ParlamLiao]

Overview of the Situation
A large-scale project is being integrated with golangci-lint, starting with scanning the entire project to understand the current issues. Under consistent versions of Go, golangci-lint, and the configuration file golangci-lint.yml, there are some pre-existing issues that were not detected in earlier scans. These issues only started to be detected after the project went through several iterations unrelated to the original issues.

Go Version
1.20

golangci-lint Versions
v1.51.0
v1.53.3
v1.55.2

Installation Method

curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh | sh -s -- -b $(go env GOPATH)/bin <golangci-lint version>

Linters currently observed to have missed issues
gosec / gocognit / errname

example 1

example 2

example 3

[ldez]

Without your configuration, it's not possible to understand the context.

Note: you are using very old versions of Go and golangci-lint (3 years)

[ParlamLiao]

Our project now using old go version. and it's difficult to upgrade go version (for lots of dependencies)
As a result, we can not use newer version of golangci-lint.

Here is the config setting. All scans use the this same config.

linters-settings:
  staticcheck:
    checks:
      - all
      - '-SA1019'  # github.com/golang/protobuf/proto is allowed only by msg.TypeMsgCodec.Marshal/ExtractEndpoint
  depguard:
    list-type: blacklist
    packages:
      # logging is allowed only by logutils.Log, logrus
      # is allowed to use only in logutils package
      - github.com/sirupsen/logrus
    packages-with-error-message:
      - github.com/sirupsen/logrus: "logging is allowed only by logutils.Log"
  gocognit:
    # Minimal code complexity to report.
    # Default: 30 (but we recommend 10-20)
    min-complexity: 18
  dupl:
    threshold: 100
  exhaustive:
    default-signifies-exhaustive: false
  funlen:
    lines: 120
    statements: 50
  gci:
    local-prefixes: github.com/golangci/golangci-lint
  goconst:
    min-len: 2
    min-occurrences: 2
  gocritic:
    enabled-tags:
      - diagnostic
      - experimental
      - opinionated
      - performance
      - style
    disabled-checks:
      - dupImport # https://github.com/go-critic/go-critic/issues/845
      - ifElseChain
      - octalLiteral
      - whyNoLint
      - wrapperFunc
  goimports:
    local-prefixes: github.com/golangci/golangci-lint
  govet:
    check-shadowing: false
    settings:
      printf:
        funcs:
          - (github.com/golangci/golangci-lint/pkg/logutils.Log).Infof
          - (github.com/golangci/golangci-lint/pkg/logutils.Log).Warnf
          - (github.com/golangci/golangci-lint/pkg/logutils.Log).Errorf
          - (github.com/golangci/golangci-lint/pkg/logutils.Log).Fatalf
  misspell:
    locale: US
  nolintlint:
    allow-leading-space: true # don't require machine-readable nolint directives (i.e. with no leading space)
    allow-unused: false # report any unused nolint directives
    require-explanation: false # don't require an explanation for nolint directives
    require-specific: false # don't require nolint directives to be specific about which linter is being skipped
  gosec:
    excludes:
      - G404

linters:
  # please, do not use `enable-all`: it's deprecated and will be removed soon.
  # inverted configuration with `enable-all` and `disable` is not scalable during updates of golangci-lint
  disable-all: true
  enable:
    - errcheck
    - gosimple
    - govet
    - ineffassign
    - staticcheck
    - unused

    - asasalint
    - asciicheck
    - bidichk
    #    - contextcheck
    - depguard
    - dogsled
    - dupl
    - dupword  
    - durationcheck
    - errchkjson
    - errname
    - execinquery
    #    - exhaustive
    - exportloopref
    - funlen
    - gocognit
    - goconst
    - gofmt
    - goimports
    - goprintffuncname
    - gosec
    #    - ireturn
    - loggercheck  
    - makezero
    - misspell
    - nakedret
    - nilnil
    - nolintlint
    - predeclared
    - reassign   
    #    - sqlclosecheck
    - stylecheck
    #    - tagliatelle
    - tenv
    - typecheck
    - unconvert
    - whitespace

issues:
  # Excluding configuration per-path, per-linter, per-text and per-source
  exclude-rules:
    - path: _test\.go
      linters:
        - gomnd

run:
  skip-dirs:
    - vendor
  skip-files:
    - ".*_test\\.go$"
  # Allow multiple parallel golangci-lint instances running.
  # If false, golangci-lint acquires file lock on start.
  # Default: false
  allow-parallel-runners: true

# golangci.com configuration
# https://github.com/golangci/golangci/wiki/Configuration
service:
  golangci-lint-version: 1.51.2 # use the fixed version to not introduce new linters unexpectedly
  prepare:
    - echo "here I can run custom commands, but no preparation needed for this repo"

[bombsimon]

Not really related but Go is almost always backwards compatible and the version used in go.mod is minimum version but you're fine using a newer one too. golangci-lint latest version built with Go 1.24 can lint any code with an older Go version in their go.mod.

[ParlamLiao]

Not really related but Go is almost always backwards compatible and the version used in go.mod is minimum version but you're fine using a newer one too. golangci-lint latest version built with Go 1.24 can lint any code with an older Go version in their go.mod.

thanks for reply. And would you pls talk more about "Ensure the version of golangci-lint is built with a compatible version of Go." in the FAQ of typecheck. https://golangci-lint.run/welcome/faq/
I do not understand this quite well.

[bombsimon]

If you're linting code requiring version x.y you need a version of golangci-lint built with this version (or newer).

The pre-built binaries are built with latest version of Go at the time of building so this is usually not an issue unless you build golangci-lint from source (which is not recommended).

You should be safe running and linting Go 1.18 code with latest version of Go and golangci-lint if you want to.

Because of the aim to not break previous versions, Go officially only supports the last two versions of Go (as of this writing Go 1.23 and 1.24).

[ParlamLiao]

Can I assume that when golangci-lint scans the entire codebase of a large project, it may still miss some issues even if the settings for max-issues-per-linter and max-same-issues are adjusted to their maximum values? @ldez

[ldez]

To get all the issues, you should use 0 for max-issues-per-linter and max-same-issues.
In this context, golangci-lint will report all issues except those on the same line.
If you want to show all the issues, even those on the same line, you should also use uniq-by-line: false.

[ldez]

Also, since you are pinging me explicitly only for a configuration question, I suggest you donate:

• https://donate.golangci.org
• https://donate.ldez.dev