From e6db4564e614c6ae661a918a7ba4b23597f12a1a Mon Sep 17 00:00:00 2001
From: Yuqing Bai <baiyuq@gmail.com>
Date: Mon, 26 Oct 2026 19:34:05 +0800
Subject: [PATCH 1/3] Upgrade Go to 1.27.3

Set the go directive in go.mod to 1.27.3 to fix CVE-2026-111943. CI and
release workflows read the Go version from go.mod via setup-go
go-version-file, so they build with 1.27.3 after this change.
---
 go.mod | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/go.mod b/go.mod
index 48e010f3..8815abc4 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/tidbcloud/tidbcloud-cli
 
-go 1.24.0
+go 1.27.3
 
 require (
 	github.com/AlecAivazis/survey/v2 v2.3.6

From 9f81b15cbe768e88c1ebc03b3a2ca9cc97c55be8 Mon Sep 17 00:00:00 2001
From: Yuqing Bai <baiyuq@gmail.com>
Date: Mon, 26 Oct 2026 19:40:10 +0800
Subject: [PATCH 2/3] Upgrade golangci-lint to v2.15.0

golangci-lint v1.64.7 is built with go1.24 and refuses to run when
go.mod targets go 1.27.3. A v1.64.8 binary built with go1.27.3 reports
50 false typecheck errors because v1 cannot load Go 1.27 packages.

- golangci-lint-action v6 -> v9, golangci-lint v1.64.7 -> v2.15.0
- Convert .golangci.yml to the v2 format with `golangci-lint migrate`
- Suppress gosec G703 on the os.WriteFile call in
  cmd/manifest/update_latest_version.go: the path is a string constant
---
 .github/workflows/lint.yml            |  4 +-
 .golangci.yml                         | 92 ++++++++++++++++++---------
 Makefile                              |  2 +-
 cmd/manifest/update_latest_version.go |  2 +-
 4 files changed, 65 insertions(+), 35 deletions(-)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index c3a8dcf6..7c876bb7 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -28,9 +28,9 @@ jobs:
           go-version-file: './go.mod'
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@v9
         with:
-          version: v1.64.7
+          version: v2.15.0
 
   fmt:
     name: fmt
diff --git a/.golangci.yml b/.golangci.yml
index ec3319d6..d1cc1219 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,45 +1,75 @@
-run:
-  timeout: 10m
+version: "2"
 linters:
-  disable-all: true
+  default: none
   enable:
     - asciicheck
     - bodyclose
     - durationcheck
     - errcheck
-    - goimports
     - gosec
-    - gosimple
     - ineffassign
     - makezero
     - prealloc
     - predeclared
     - rowserrcheck
     - staticcheck
-    - stylecheck
-    - typecheck
     - unused
-
-linters-settings:
-  staticcheck:
-    checks: ["S1002","S1004","S1007","S1009","S1010","S1012","S1019","S1020","S1021","S1024","S1030","SA2*","SA3*","SA4009","SA5*","SA6000","SA6001","SA6005", "-SA2002"]
-  stylecheck:
-    checks: ["-ST1003"]
-  gosec:
-    severity: "low"
-    confidence: "low"
-    excludes:
-      - G101
-      - G115
-      - G404
-      # exclude warnings of using crypto/sha1
-      - G505
-
-issues:
-  exclude-rules:
-    - path: _test\.go
-      linters:
-        - errcheck
-        - gosec
-        - rowserrcheck
-        - makezero
+  settings:
+    gosec:
+      excludes:
+        - G101
+        - G115
+        - G404
+        # exclude warnings of using crypto/sha1
+        - G505
+      severity: low
+      confidence: low
+    staticcheck:
+      checks:
+        - -SA2002
+        - -ST1003
+        - S1002
+        - S1004
+        - S1007
+        - S1009
+        - S1010
+        - S1012
+        - S1019
+        - S1020
+        - S1021
+        - S1024
+        - S1030
+        - SA2*
+        - SA3*
+        - SA4009
+        - SA5*
+        - SA6000
+        - SA6001
+        - SA6005
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    rules:
+      - linters:
+          - errcheck
+          - gosec
+          - makezero
+          - rowserrcheck
+        path: _test\.go
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  enable:
+    - goimports
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
diff --git a/Makefile b/Makefile
index cd6ae38a..81c3ce24 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-GOLANGCI_VERSION=v1.64.7
+GOLANGCI_VERSION=v2.15.0
 COVERAGE=coverage.out
 
 .PHONY: deps
diff --git a/cmd/manifest/update_latest_version.go b/cmd/manifest/update_latest_version.go
index f5c5d3ef..6a8baf58 100644
--- a/cmd/manifest/update_latest_version.go
+++ b/cmd/manifest/update_latest_version.go
@@ -58,7 +58,7 @@ func main() {
 
 	latestTag = strings.TrimPrefix(latestTag, "v")
 	file = regexp.MustCompile("version=\".*\"").ReplaceAll(file, []byte(fmt.Sprintf("version=\"%s\"", latestTag)))
-	err = os.WriteFile("install.sh", file, 0600)
+	err = os.WriteFile("install.sh", file, 0600) //nolint:gosec // The path is the constant "install.sh".
 	if err != nil {
 		log.Fatalf("Failed to write install.sh file: %s", err.Error())
 	}

From 9f0416ae067d80df3fcf9c5c4dd4687b6baf3b71 Mon Sep 17 00:00:00 2001
From: Yuqing Bai <baiyuq@gmail.com>
Date: Mon, 26 Oct 2026 19:55:22 +0800
Subject: [PATCH 3/3] Restore golangci-lint run timeout of 10m

golangci-lint migrate drops run.timeout, and in v2 the default of 0
disables the timeout. Re-add the previous 10m value.
---
 .golangci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.golangci.yml b/.golangci.yml
index d1cc1219..25ce7c05 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,4 +1,6 @@
 version: "2"
+run:
+  timeout: 10m
 linters:
   default: none
   enable: