fix(deps): update module github.com/golangci/golangci-lint to v1.60.2

bridges/otelslog/handler.go

@@ -425,7 +425,12 @@
 	case slog.KindTime:
 		return log.Int64Value(v.Time().UnixNano())
 	case slog.KindUint64:
-		return log.Int64Value(int64(v.Uint64()))
+		const maxInt64 = ^uint64(0) >> 1
+		u := v.Uint64()
+		if u > maxInt64 {
+			return log.Float64Value(float64(u))
+		}
+		return log.Int64Value(int64(u)) // nolint:gosec  // Overflow checked above.
 	case slog.KindGroup:
 		g := v.Group()
 		buf := newKVBuffer(len(g))

bridges/otelzap/encoder.go

@@ -175,7 +175,7 @@ func (m *objectEncoder) AddUint16(k string, v uint16) {
 }
 
 func (m *objectEncoder) AddUint8(k string, v uint8) {
-	m.AddInt64(k, int64(v))
+	m.AddInt64(k, int64(v)) // nolint: gosec  // https://github.com/securego/gosec/issues/1185
 }
 
 func (m *objectEncoder) AddUintptr(k string, v uintptr) {
@@ -187,7 +187,7 @@ func assignUintValue(v uint64) log.Value {
 	if v > maxInt64 {
 		return log.Float64Value(float64(v))
 	}
-	return log.Int64Value(int64(v))
+	return log.Int64Value(int64(v)) // nolint:gosec  // Overflow checked above.
 }
 
 // arrayEncoder implements [zapcore.ArrayEncoder].
@@ -272,8 +272,10 @@ func (a *arrayEncoder) AppendTime(v time.Time)         { a.AppendInt64(v.UnixNan
 func (a *arrayEncoder) AppendUint(v uint)              { a.AppendUint64(uint64(v)) }
 func (a *arrayEncoder) AppendUint32(v uint32)          { a.AppendInt64(int64(v)) }
 func (a *arrayEncoder) AppendUint16(v uint16)          { a.AppendInt64(int64(v)) }
-func (a *arrayEncoder) AppendUint8(v uint8)            { a.AppendInt64(int64(v)) }
 func (a *arrayEncoder) AppendUintptr(v uintptr)        { a.AppendUint64(uint64(v)) }
+func (a *arrayEncoder) AppendUint8(v uint8) {
+	a.AppendInt64(int64(v)) // nolint: gosec  // https://github.com/securego/gosec/issues/1185
+}
 
 func convertValue(v interface{}) log.Value {
 	switch v := v.(type) {

bridges/prometheus/producer.go

@@ -214,10 +214,10 @@ func convertExponentialBuckets(bucketSpans []*dto.BucketSpan, deltas []int64) me
 	initialOffset := bucketSpans[0].GetOffset() - 1
 	// We will have one bucket count for each delta, and zeros for the offsets
 	// after the initial offset.
-	lenCounts := int32(len(deltas))
+	lenCounts := len(deltas)
 	for i, bs := range bucketSpans {
 		if i != 0 {
-			lenCounts += bs.GetOffset()
+			lenCounts += int(bs.GetOffset())
 		}
 	}
 	counts := make([]uint64, lenCounts)

config/metric.go

@@ -8,6 +8,7 @@
 	"encoding/json"
 	"errors"
 	"fmt"
+	"math"
 	"net"
 	"net/http"
 	"net/url"
@@ -358,8 +359,8 @@
 
 	if aggr.Base2ExponentialBucketHistogram != nil {
 		return sdkmetric.AggregationBase2ExponentialHistogram{
-			MaxSize:  int32(intOrZero(aggr.Base2ExponentialBucketHistogram.MaxSize)),
-			MaxScale: int32(intOrZero(aggr.Base2ExponentialBucketHistogram.MaxScale)),
+			MaxSize:  int32OrZero(aggr.Base2ExponentialBucketHistogram.MaxSize),
+			MaxScale: int32OrZero(aggr.Base2ExponentialBucketHistogram.MaxScale),
 			// Need to negate because config has the positive action RecordMinMax.
 			NoMinMax: !boolOrFalse(aggr.Base2ExponentialBucketHistogram.RecordMinMax),
 		}
@@ -426,11 +427,18 @@
 	return *pBool
 }
 
-func intOrZero(pInt *int) int {
+func int32OrZero(pInt *int) int32 {
 	if pInt == nil {
 		return 0
 	}
-	return *pInt
+	i := *pInt
+	if i > math.MaxInt32 {
+		return math.MaxInt32
+	}
+	if i < math.MinInt32 {
+		return math.MinInt32
+	}
+	return int32(i) // nolint: gosec  // Overflow and underflow checked above.
 }
 
 func strOrEmpty(pStr *string) string {

config/resource.go

@@ -23,7 +23,7 @@ func keyVal(k string, v any) attribute.KeyValue {
 	case int8:
 		return attribute.Int64(k, int64(val))
 	case uint8:
-		return attribute.Int64(k, int64(val))
+		return attribute.Int64(k, int64(val)) // nolint: gosec  // https://github.com/securego/gosec/issues/1185
 	case int16:
 		return attribute.Int64(k, int64(val))
 	case uint16:

instrumentation/github.com/emicklei/go-restful/otelrestful/internal/semconvutil/netconv.go

@@ -195,7 +195,7 @@ func splitHostPort(hostport string) (host string, port int) {
 	if err != nil {
 		return
 	}
-	return host, int(p)
+	return host, int(p) // nolint: gosec  // Bitsize checked to be 16 above.
 }
 
 func netProtocol(proto string) (name string, version string) {

instrumentation/github.com/gin-gonic/gin/otelgin/internal/semconvutil/netconv.go

@@ -195,7 +195,7 @@ func splitHostPort(hostport string) (host string, port int) {
 	if err != nil {
 		return
 	}
-	return host, int(p)
+	return host, int(p) // nolint: gosec  // Bitsize checked to be 16 above.
 }
 
 func netProtocol(proto string) (name string, version string) {

instrumentation/github.com/gorilla/mux/otelmux/internal/semconvutil/netconv.go

@@ -195,7 +195,7 @@ func splitHostPort(hostport string) (host string, port int) {
 	if err != nil {
 		return
 	}
-	return host, int(p)
+	return host, int(p) // nolint: gosec  // Bitsize checked to be 16 above.
 }
 
 func netProtocol(proto string) (name string, version string) {

instrumentation/github.com/labstack/echo/otelecho/internal/semconvutil/netconv.go

@@ -195,7 +195,7 @@ func splitHostPort(hostport string) (host string, port int) {
 	if err != nil {
 		return
 	}
-	return host, int(p)
+	return host, int(p) // nolint: gosec  // Bitsize checked to be 16 above.
 }
 
 func netProtocol(proto string) (name string, version string) {

instrumentation/google.golang.org/grpc/otelgrpc/internal/test/test_utils.go

@@ -44,12 +44,12 @@ import (
 )
 
 var (
-	reqSizes            = []int{27182, 8, 1828, 45904}
-	respSizes           = []int{31415, 9, 2653, 58979}
-	largeReqSize        = 271828
-	largeRespSize       = 314159
-	initialMetadataKey  = "x-grpc-test-echo-initial"
-	trailingMetadataKey = "x-grpc-test-echo-trailing-bin"
+	reqSizes                  = []int32{27182, 8, 1828, 45904}
+	respSizes                 = []int32{31415, 9, 2653, 58979}
+	largeReqSize              = 271828
+	largeRespSize       int32 = 314159
+	initialMetadataKey        = "x-grpc-test-echo-initial"
+	trailingMetadataKey       = "x-grpc-test-echo-trailing-bin"
 
 	logger = grpclog.Component("interop")
 )
@@ -87,7 +87,7 @@ func DoLargeUnaryCall(ctx context.Context, tc testpb.TestServiceClient, args ...
 	pl := ClientNewPayload(testpb.PayloadType_COMPRESSABLE, largeReqSize)
 	req := &testpb.SimpleRequest{
 		ResponseType: testpb.PayloadType_COMPRESSABLE,
-		ResponseSize: int32(largeRespSize),
+		ResponseSize: largeRespSize,
 		Payload:      pl,
 	}
 	reply, err := tc.UnaryCall(ctx, req, args...)
@@ -96,7 +96,7 @@ func DoLargeUnaryCall(ctx context.Context, tc testpb.TestServiceClient, args ...
 	}
 	t := reply.GetPayload().GetType()
 	s := len(reply.GetPayload().GetBody())
-	if t != testpb.PayloadType_COMPRESSABLE || s != largeRespSize {
+	if t != testpb.PayloadType_COMPRESSABLE || s != int(largeRespSize) {
 		logger.Fatalf("Got the reply with type %d len %d; want %d, %d", t, s, testpb.PayloadType_COMPRESSABLE, largeRespSize)
 	}
 }
@@ -107,9 +107,9 @@ func DoClientStreaming(ctx context.Context, tc testpb.TestServiceClient, args ..
 	if err != nil {
 		logger.Fatalf("%v.StreamingInputCall(_) = _, %v", tc, err)
 	}
-	var sum int
+	var sum int32
 	for _, s := range reqSizes {
-		pl := ClientNewPayload(testpb.PayloadType_COMPRESSABLE, s)
+		pl := ClientNewPayload(testpb.PayloadType_COMPRESSABLE, int(s))
 		req := &testpb.StreamingInputCallRequest{
 			Payload: pl,
 		}
@@ -122,7 +122,7 @@ func DoClientStreaming(ctx context.Context, tc testpb.TestServiceClient, args ..
 	if err != nil {
 		logger.Fatalf("%v.CloseAndRecv() got error %v, want %v", stream, err, nil)
 	}
-	if reply.GetAggregatedPayloadSize() != int32(sum) {
+	if reply.GetAggregatedPayloadSize() != sum {
 		logger.Fatalf("%v.CloseAndRecv().GetAggregatePayloadSize() = %v; want %v", stream, reply.GetAggregatedPayloadSize(), sum)
 	}
 }
@@ -132,7 +132,7 @@ func DoServerStreaming(ctx context.Context, tc testpb.TestServiceClient, args ..
 	respParam := make([]*testpb.ResponseParameters, len(respSizes))
 	for i, s := range respSizes {
 		respParam[i] = &testpb.ResponseParameters{
-			Size: int32(s),
+			Size: s,
 		}
 	}
 	req := &testpb.StreamingOutputCallRequest{
@@ -157,7 +157,7 @@ func DoServerStreaming(ctx context.Context, tc testpb.TestServiceClient, args ..
 			logger.Fatalf("Got the reply of type %d, want %d", t, testpb.PayloadType_COMPRESSABLE)
 		}
 		size := len(reply.GetPayload().GetBody())
-		if size != respSizes[index] {
+		if size != int(respSizes[index]) {
 			logger.Fatalf("Got reply body of length %d, want %d", size, respSizes[index])
 		}
 		index++
@@ -181,10 +181,10 @@ func DoPingPong(ctx context.Context, tc testpb.TestServiceClient, args ...grpc.C
 	for index < len(reqSizes) {
 		respParam := []*testpb.ResponseParameters{
 			{
-				Size: int32(respSizes[index]),
+				Size: respSizes[index],
 			},
 		}
-		pl := ClientNewPayload(testpb.PayloadType_COMPRESSABLE, reqSizes[index])
+		pl := ClientNewPayload(testpb.PayloadType_COMPRESSABLE, int(reqSizes[index]))
 		req := &testpb.StreamingOutputCallRequest{
 			ResponseType:       testpb.PayloadType_COMPRESSABLE,
 			ResponseParameters: respParam,
@@ -202,7 +202,7 @@ func DoPingPong(ctx context.Context, tc testpb.TestServiceClient, args ...grpc.C
 			logger.Fatalf("Got the reply of type %d, want %d", t, testpb.PayloadType_COMPRESSABLE)
 		}
 		size := len(reply.GetPayload().GetBody())
-		if size != respSizes[index] {
+		if size != int(respSizes[index]) {
 			logger.Fatalf("Got reply body of length %d, want %d", size, respSizes[index])
 		}
 		index++
@@ -304,19 +304,21 @@ func (s *testServer) StreamingOutputCall(args *testpb.StreamingOutputCallRequest
 }
 
 func (s *testServer) StreamingInputCall(stream testpb.TestService_StreamingInputCallServer) error {
-	var sum int
+	var sum int32
 	for {
 		in, err := stream.Recv()
 		if errors.Is(err, io.EOF) {
 			return stream.SendAndClose(&testpb.StreamingInputCallResponse{
-				AggregatedPayloadSize: int32(sum),
+				AggregatedPayloadSize: sum,
 			})
 		}
 		if err != nil {
 			return err
 		}
-		p := in.GetPayload().GetBody()
-		sum += len(p)
+		n := len(in.GetPayload().GetBody())
+		// This could overflow, but given this is a test and the negative value
+		// should be detectable this should be good enough.
+		sum += int32(n) // nolint: gosec
 	}
 }
 

instrumentation/gopkg.in/macaron.v1/otelmacaron/internal/semconvutil/netconv.go

@@ -195,7 +195,7 @@ func splitHostPort(hostport string) (host string, port int) {
 	if err != nil {
 		return
 	}
-	return host, int(p)
+	return host, int(p) // nolint: gosec  // Bitsize checked to be 16 above.
 }
 
 func netProtocol(proto string) (name string, version string) {

instrumentation/host/host.go

@@ -6,6 +6,7 @@
 import (
 	"context"
 	"fmt"
+	"math"
 	"os"
 	"sync"
 
@@ -118,7 +119,11 @@
 		lock sync.Mutex
 	)
 
-	proc, err := process.NewProcess(int32(os.Getpid()))
+	pid := os.Getpid()
+	if pid > math.MaxInt32 || pid < math.MinInt32 {
+		return fmt.Errorf("invalid process ID: %d", pid)
+	}
+	proc, err := process.NewProcess(int32(pid)) // nolint: gosec  // Overflow checked above.
 	if err != nil {
 		return fmt.Errorf("could not find this process: %w", err)
 	}
@@ -246,9 +251,9 @@
 
 			// Host memory usage
 			opt = metric.WithAttributeSet(AttributeMemoryUsed)
-			o.ObserveInt64(hostMemoryUsage, int64(vmStats.Used), opt)
+			o.ObserveInt64(hostMemoryUsage, clampInt64(vmStats.Used), opt)
 			opt = metric.WithAttributeSet(AttributeMemoryAvailable)
-			o.ObserveInt64(hostMemoryUsage, int64(vmStats.Available), opt)
+			o.ObserveInt64(hostMemoryUsage, clampInt64(vmStats.Available), opt)
 
 			// Host memory utilization
 			opt = metric.WithAttributeSet(AttributeMemoryUsed)
@@ -262,9 +267,9 @@
 			// interface, with similar questions to those posed
 			// about per-CPU measurements above.
 			opt = metric.WithAttributeSet(AttributeNetworkTransmit)
-			o.ObserveInt64(networkIOUsage, int64(ioStats[0].BytesSent), opt)
+			o.ObserveInt64(networkIOUsage, clampInt64(ioStats[0].BytesSent), opt)
 			opt = metric.WithAttributeSet(AttributeNetworkReceive)
-			o.ObserveInt64(networkIOUsage, int64(ioStats[0].BytesRecv), opt)
+			o.ObserveInt64(networkIOUsage, clampInt64(ioStats[0].BytesRecv), opt)
 
 			return nil
 		},
@@ -280,3 +285,10 @@
 
 	return nil
 }
+
+func clampInt64(v uint64) int64 {
+	if v > math.MaxInt64 {
+		return math.MaxInt64
+	}
+	return int64(v) // nolint: gosec  // Overflow checked.
+}

instrumentation/net/http/httptrace/otelhttptrace/internal/semconvutil/netconv.go

@@ -195,7 +195,7 @@ func splitHostPort(hostport string) (host string, port int) {
 	if err != nil {
 		return
 	}
-	return host, int(p)
+	return host, int(p) // nolint: gosec  // Bitsize checked to be 16 above.
 }
 
 func netProtocol(proto string) (name string, version string) {

instrumentation/net/http/otelhttp/internal/semconv/util.go

@@ -50,7 +50,7 @@ func splitHostPort(hostport string) (host string, port int) {
 	if err != nil {
 		return
 	}
-	return host, int(p)
+	return host, int(p) // nolint: gosec  // Byte size checked 16 above.
 }
 
 func requiredHTTPPort(https bool, port int) int { // nolint:revive

instrumentation/net/http/otelhttp/internal/semconvutil/netconv.go

@@ -195,7 +195,7 @@ func splitHostPort(hostport string) (host string, port int) {
 	if err != nil {
 		return
 	}
-	return host, int(p)
+	return host, int(p) // nolint: gosec  // Bitsize checked to be 16 above.
 }
 
 func netProtocol(proto string) (name string, version string) {