chore: upgrade golangci-lint to 2.11 and fix lint issues

Signed-off-by: Deluan <deluan@navidrome.org>

.golangci.yml

@@ -40,6 +40,11 @@ linters:
       enable:
         - nilness
   exclusions:
+    rules:
+      - linters:
+          - gosec
+        path: _test\.go
+        text: "G703"
     generated: lax
     presets:
       - comments

Makefile

@@ -21,7 +21,7 @@ DOCKER_TAG ?= deluan/navidrome:develop
 
 # Taglib version to use in cross-compilation, from https://github.com/navidrome/cross-taglib
 CROSS_TAGLIB_VERSION ?= 2.2.0-1
-GOLANGCI_LINT_VERSION ?= v2.10.0
+GOLANGCI_LINT_VERSION ?= v2.11.1
 
 UI_SRC_FILES := $(shell find ui -type f -not -path "ui/build/*" -not -path "ui/node_modules/*")
 

plugins/host_taskqueue.go

@@ -101,7 +101,7 @@ func newTaskQueueService(pluginName string, manager *Manager, maxConcurrency int
 		return nil, fmt.Errorf("creating taskqueue schema: %w", err)
 	}
 
-	ctx, cancel := context.WithCancel(manager.ctx)
+	ctx, cancel := context.WithCancel(manager.ctx) //nolint:gosec // cancel is stored in struct and called in Close()
 
 	s := &taskQueueServiceImpl{
 		pluginName:     pluginName,

scanner/watcher.go

@@ -158,7 +158,7 @@ func (w *watcher) Watch(ctx context.Context, lib *model.Library) error {
 	}
 
 	// Start new watcher
-	watcherCtx, cancel := context.WithCancel(w.mainCtx)
+	watcherCtx, cancel := context.WithCancel(w.mainCtx) //nolint:gosec // cancel is stored in instance and called on shutdown
 	instance := &libraryWatcherInstance{
 		library: lib,
 		cancel:  cancel,

server/nativeapi/playlists.go

@@ -247,7 +247,7 @@ func uploadPlaylistImage(pls playlists.Playlists) http.HandlerFunc {
 		p := req.Params(r)
 		playlistId, _ := p.String(":id")
 
-		if err := r.ParseMultipartForm(maxImageSize); err != nil {
+		if err := r.ParseMultipartForm(maxImageSize); err != nil { //nolint:gosec // size is limited by maxImageSize parameter
 			log.Error(ctx, "Error parsing multipart form", err)
 			http.Error(w, "file too large or invalid form", http.StatusBadRequest)
 			return

server/subsonic/middlewares.go

@@ -31,9 +31,11 @@ import (
 
 func postFormToQueryParams(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		r.Body = http.MaxBytesReader(w, r.Body, 10<<20) // 10MB
 		err := r.ParseForm()
 		if err != nil {
 			sendError(w, r, newError(responses.ErrorGeneric, err.Error()))
+			return
 		}
 		var parts []string
 		for key, values := range r.Form {

utils/pl/pipelines.go

@@ -29,7 +29,7 @@ func Stage[In any, Out any](
 	limit := int64(maxWorkers)
 	sem1 := semaphore.NewWeighted(limit)
 
-	go func() {
+	go func() { //nolint:gosec // intentional context.Background() below to wait for workers after ctx cancellation
 		defer close(outputChannel)
 		defer close(errorChannel)
 
@@ -58,7 +58,7 @@ func Stage[In any, Out any](
 		// By using context.Background() here we are assuming the fn will stop when the context
 		// is canceled. This is required so we can wait for the workers to finish and avoid closing
 		// the outputChannel before they are done.
-		if err := sem1.Acquire(context.Background(), limit); err != nil {
+		if err := sem1.Acquire(context.Background(), limit); err != nil { //nolint:gosec // intentional: must wait for workers after ctx cancellation
 			log.Error(ctx, "Failed waiting for workers", err)
 		}
 	}()