From 3cd5d16b0ae615d155d9a1320ee44a977e8bbde3 Mon Sep 17 00:00:00 2001
From: Deluan <deluan@navidrome.org>
Date: Fri, 6 Mar 2026 19:23:47 -0500
Subject: [PATCH] chore: upgrade golangci-lint to 2.11 and fix lint issues

Signed-off-by: Deluan <deluan@navidrome.org>
---
 .golangci.yml                  | 5 +++++
 Makefile                       | 2 +-
 plugins/host_taskqueue.go      | 2 +-
 scanner/watcher.go             | 2 +-
 server/nativeapi/playlists.go  | 2 +-
 server/subsonic/middlewares.go | 2 ++
 utils/pl/pipelines.go          | 4 ++--
 7 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/.golangci.yml b/.golangci.yml
index 1937c2f7..b6c632de 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -40,6 +40,11 @@ linters:
       enable:
         - nilness
   exclusions:
+    rules:
+      - linters:
+          - gosec
+        path: _test\.go
+        text: "G703"
     generated: lax
     presets:
       - comments
diff --git a/Makefile b/Makefile
index f7b7b1b0..559a34c3 100644
--- a/Makefile
+++ b/Makefile
@@ -21,7 +21,7 @@ DOCKER_TAG ?= deluan/navidrome:develop
 
 # Taglib version to use in cross-compilation, from https://github.com/navidrome/cross-taglib
 CROSS_TAGLIB_VERSION ?= 2.2.0-1
-GOLANGCI_LINT_VERSION ?= v2.10.0
+GOLANGCI_LINT_VERSION ?= v2.11.1
 
 UI_SRC_FILES := $(shell find ui -type f -not -path "ui/build/*" -not -path "ui/node_modules/*")
 
diff --git a/plugins/host_taskqueue.go b/plugins/host_taskqueue.go
index 283bc963..9f2ed85f 100644
--- a/plugins/host_taskqueue.go
+++ b/plugins/host_taskqueue.go
@@ -101,7 +101,7 @@ func newTaskQueueService(pluginName string, manager *Manager, maxConcurrency int
 		return nil, fmt.Errorf("creating taskqueue schema: %w", err)
 	}
 
-	ctx, cancel := context.WithCancel(manager.ctx)
+	ctx, cancel := context.WithCancel(manager.ctx) //nolint:gosec // cancel is stored in struct and called in Close()
 
 	s := &taskQueueServiceImpl{
 		pluginName:     pluginName,
diff --git a/scanner/watcher.go b/scanner/watcher.go
index 101e3793..62fcc934 100644
--- a/scanner/watcher.go
+++ b/scanner/watcher.go
@@ -158,7 +158,7 @@ func (w *watcher) Watch(ctx context.Context, lib *model.Library) error {
 	}
 
 	// Start new watcher
-	watcherCtx, cancel := context.WithCancel(w.mainCtx)
+	watcherCtx, cancel := context.WithCancel(w.mainCtx) //nolint:gosec // cancel is stored in instance and called on shutdown
 	instance := &libraryWatcherInstance{
 		library: lib,
 		cancel:  cancel,
diff --git a/server/nativeapi/playlists.go b/server/nativeapi/playlists.go
index 797654a3..118528f6 100644
--- a/server/nativeapi/playlists.go
+++ b/server/nativeapi/playlists.go
@@ -247,7 +247,7 @@ func uploadPlaylistImage(pls playlists.Playlists) http.HandlerFunc {
 		p := req.Params(r)
 		playlistId, _ := p.String(":id")
 
-		if err := r.ParseMultipartForm(maxImageSize); err != nil {
+		if err := r.ParseMultipartForm(maxImageSize); err != nil { //nolint:gosec // size is limited by maxImageSize parameter
 			log.Error(ctx, "Error parsing multipart form", err)
 			http.Error(w, "file too large or invalid form", http.StatusBadRequest)
 			return
diff --git a/server/subsonic/middlewares.go b/server/subsonic/middlewares.go
index 7698a3c7..2d8b1fd9 100644
--- a/server/subsonic/middlewares.go
+++ b/server/subsonic/middlewares.go
@@ -31,9 +31,11 @@ import (
 
 func postFormToQueryParams(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		r.Body = http.MaxBytesReader(w, r.Body, 10<<20) // 10MB
 		err := r.ParseForm()
 		if err != nil {
 			sendError(w, r, newError(responses.ErrorGeneric, err.Error()))
+			return
 		}
 		var parts []string
 		for key, values := range r.Form {
diff --git a/utils/pl/pipelines.go b/utils/pl/pipelines.go
index 981b8688..df4ee030 100644
--- a/utils/pl/pipelines.go
+++ b/utils/pl/pipelines.go
@@ -29,7 +29,7 @@ func Stage[In any, Out any](
 	limit := int64(maxWorkers)
 	sem1 := semaphore.NewWeighted(limit)
 
-	go func() {
+	go func() { //nolint:gosec // intentional context.Background() below to wait for workers after ctx cancellation
 		defer close(outputChannel)
 		defer close(errorChannel)
 
@@ -58,7 +58,7 @@ func Stage[In any, Out any](
 		// By using context.Background() here we are assuming the fn will stop when the context
 		// is canceled. This is required so we can wait for the workers to finish and avoid closing
 		// the outputChannel before they are done.
-		if err := sem1.Acquire(context.Background(), limit); err != nil {
+		if err := sem1.Acquire(context.Background(), limit); err != nil { //nolint:gosec // intentional: must wait for workers after ctx cancellation
 			log.Error(ctx, "Failed waiting for workers", err)
 		}
 	}()