Update golangci-lint and gosec (#1609)

.github/workflows/lint.yml

@@ -16,5 +16,5 @@ jobs:
     - name: Run golangci-lint
       uses: golangci/golangci-lint-action@v3
       with:
-        version: v1.51.1
+        version: v1.54.2
         args: --enable=nolintlint,gochecknoinits,bodyclose,gofumpt --verbose

.github/workflows/security.yml

@@ -16,6 +16,6 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - name: Run Gosec Security Scanner
-        uses: securego/gosec@v2.14.0
+        uses: securego/gosec@v2.17.0
         with:
           args: '-exclude=G104,G304,G402 ./...'

b2s_old.go

@@ -11,6 +11,5 @@ import "unsafe"
 // Note it may break if string and/or slice header will change
 // in the future go versions.
 func b2s(b []byte) string {
-	/* #nosec G103 */
 	return *(*string)(unsafe.Pointer(&b))
 }

client.go

@@ -581,6 +581,7 @@ func (c *Client) mCleaner(m map[string]*HostClient) {
 		c.mLock.Lock()
 		for k, v := range m {
 			v.connsLock.Lock()
+			/* #nosec G601 */
 			if v.connsCount == 0 && atomic.LoadInt32(&v.pendingClientRequests) == 0 {
 				delete(m, k)
 			}

fasthttpadaptor/b2s_new.go

@@ -0,0 +1,12 @@
+//go:build go1.20
+// +build go1.20
+
+package fasthttpadaptor
+
+import "unsafe"
+
+// b2s converts byte slice to a string without memory allocation.
+// See https://groups.google.com/forum/#!msg/Golang-Nuts/ENgbUzYvCuU/90yGx7GUAgAJ .
+func b2s(b []byte) string {
+	return unsafe.String(unsafe.SliceData(b), len(b))
+}

fasthttpadaptor/b2s_old.go

@@ -0,0 +1,15 @@
+//go:build !go1.20
+// +build !go1.20
+
+package fasthttpadaptor
+
+import "unsafe"
+
+// b2s converts byte slice to a string without memory allocation.
+// See https://groups.google.com/forum/#!msg/Golang-Nuts/ENgbUzYvCuU/90yGx7GUAgAJ .
+//
+// Note it may break if string and/or slice header will change
+// in the future go versions.
+func b2s(b []byte) string {
+	return *(*string)(unsafe.Pointer(&b))
+}

fasthttpadaptor/request.go

@@ -5,7 +5,6 @@ import (
 	"io"
 	"net/http"
 	"net/url"
-	"unsafe"
 
 	"github.com/valyala/fasthttp"
 )
@@ -65,8 +64,3 @@ func ConvertRequest(ctx *fasthttp.RequestCtx, r *http.Request, forServer bool) e
 
 	return nil
 }
-
-func b2s(b []byte) string {
-	/* #nosec G103 */
-	return *(*string)(unsafe.Pointer(&b))
-}

headers.go

@@ -136,7 +136,7 @@ const (
 
 	// WebSockets
 	HeaderSecWebSocketAccept     = "Sec-WebSocket-Accept"
-	HeaderSecWebSocketExtensions = "Sec-WebSocket-Extensions"
+	HeaderSecWebSocketExtensions = "Sec-WebSocket-Extensions" /* #nosec G101 */
 	HeaderSecWebSocketKey        = "Sec-WebSocket-Key"
 	HeaderSecWebSocketProtocol   = "Sec-WebSocket-Protocol"
 	HeaderSecWebSocketVersion    = "Sec-WebSocket-Version"

lbclient.go

@@ -138,7 +138,7 @@ func (cc *LBClient) get() *lbClient {
 	minT := atomic.LoadUint64(&minC.total)
 	for _, c := range cs[1:] {
 		n := c.PendingRequests()
-		t := atomic.LoadUint64(&c.total)
+		t := atomic.LoadUint64(&c.total) /* #nosec G601 */
 		if n < minN || (n == minN && t < minT) {
 			minC = c
 			minN = n

s2b_old.go

@@ -13,9 +13,7 @@ import (
 // Note it may break if string and/or slice header will change
 // in the future go versions.
 func s2b(s string) (b []byte) {
-	/* #nosec G103 */
 	bh := (*reflect.SliceHeader)(unsafe.Pointer(&b))
-	/* #nosec G103 */
 	sh := (*reflect.StringHeader)(unsafe.Pointer(&s))
 	bh.Data = sh.Data
 	bh.Cap = sh.Len