PATCH CI toolchain compatibility

- Move CI/docs builds to Node 22.12 for Astro 6
- golangci-lint to a Go 1.25-compatible v2 release
- lint config and fixes reported staticcheck issues

Author: ParleSec

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -88,7 +88,7 @@ body:
         - OS: macOS 14.2 / Ubuntu 22.04 / Windows 11
         - Browser: Chrome 120
         - Go: 1.25.9
-        - Node: 20.x
+        - Node: 22.12.x
 
   - type: textarea
     id: logs

.github/workflows/ci-cd.yml

@@ -12,7 +12,7 @@ permissions:
 
 env:
   GO_VERSION: '1.25.9'
-  NODE_VERSION: '20'
+  NODE_VERSION: '22.12.0'
 
 jobs:
   # Job 1: Frontend Security Scanning
@@ -277,9 +277,9 @@ jobs:
         run: go vet ./...
 
       - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@v7
         with:
-          version: latest
+          version: v2.4.0
           working-directory: backend
 
   # Job 6: Backend Tests

.github/workflows/docs-deploy.yml

@@ -16,7 +16,7 @@ permissions:
   contents: read
 
 env:
-  NODE_VERSION: "20"
+  NODE_VERSION: "22.12.0"
 
 jobs:
   build-and-validate:

.github/workflows/docs-quality.yml

@@ -15,7 +15,7 @@ permissions:
   contents: read
 
 env:
-  NODE_VERSION: "20"
+  NODE_VERSION: "22.12.0"
 
 jobs:
   openapi-lint:

CONTRIBUTING.md

@@ -33,7 +33,7 @@ Comment on the issue to let maintainers know you're working on it. If you don't
 | Tool | Version | Purpose |
 |------|---------|---------|
 | Go | 1.25+ | Backend development |
-| Node.js | 20+ | Frontend development |
+| Node.js | 22.12+ | Frontend and docs development |
 | Docker | Latest | Container orchestration |
 | Git | Latest | Version control |
 
@@ -186,7 +186,7 @@ Before submitting, verify:
 
 ```bash
 # Install linter
-go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
+go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.4.0
 
 # Run linter
 golangci-lint run ./...

README.md

@@ -306,7 +306,7 @@ ProtocolSoup/
 ### Prerequisites
 
 - Go 1.25+
-- Node.js 18+
+- Node.js 22.12+
 - Docker & Docker Compose
 
 ### Running Locally (without Docker)

backend/.golangci.yml

@@ -1,47 +1,45 @@
-# golangci-lint configuration
-# https://golangci-lint.run/usage/configuration/
-
+version: "2"
 run:
-  timeout: 5m
   modules-download-mode: readonly
-
 output:
   formats:
-    - format: colored-line-number
-
+    text:
+      path: stdout
 linters:
-  enable:
-    - errcheck
-    - gosimple
-    - govet
-    - ineffassign
-    - staticcheck
-    - unused
-
-linters-settings:
-  errcheck:
-    # Don't check errors for these functions (common in HTTP handlers)
-    exclude-functions:
-      - (net/http.ResponseWriter).Write
-      - (*encoding/json.Encoder).Encode
-      - (io.Writer).Write
-      - (*html/template.Template).Execute
-      - (*text/template.Template).Execute
-
+  settings:
+    errcheck:
+      exclude-functions:
+        - (net/http.ResponseWriter).Write
+        - (*encoding/json.Encoder).Encode
+        - (io.Writer).Write
+        - (*html/template.Template).Execute
+        - (*text/template.Template).Execute
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    rules:
+      - linters:
+          - errcheck
+        path: internal/lookingglass/
+        text: SetReadDeadline|SetWriteDeadline|WriteMessage
+      - linters:
+          - errcheck
+        text: rand.Read
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
 issues:
-  # Don't limit the number of issues per linter
   max-issues-per-linter: 0
   max-same-issues: 0
-  
-  exclude-rules:
-    # Ignore errcheck for SetReadDeadline/SetWriteDeadline in websocket code
-    - path: internal/lookingglass/
-      linters:
-        - errcheck
-      text: "SetReadDeadline|SetWriteDeadline|WriteMessage"
-    
-    # Ignore errcheck for rand.Read (crypto/rand never returns error on supported platforms)
-    - linters:
-        - errcheck
-      text: "rand.Read"
-
+formatters:
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

backend/internal/protocols/oid4vp/trust.go

@@ -174,7 +174,7 @@ func hasNonEmptyVerificationValue(raw interface{}) bool {
 // DIDWebDocumentURL converts a did:web identifier to its DID Document URL.
 func DIDWebDocumentURL(did string) (string, string, error) {
 	if !strings.HasPrefix(did, "did:web:") {
-		return "", "", fmt.Errorf("did must start with did:web:")
+		return "", "", fmt.Errorf("did must start with did:web")
 	}
 
 	identifier := strings.TrimPrefix(did, "did:web:")

backend/internal/protocols/oid4vp/verifier_identity.go

@@ -517,15 +517,15 @@ func verifyPrivateKeyMatchesCertificate(certificate *x509.Certificate, privateKe
 		if !ok {
 			return fmt.Errorf("certificate public key is not RSA")
 		}
-		if publicKey.E != typed.PublicKey.E || publicKey.N.Cmp(typed.PublicKey.N) != 0 {
+		if publicKey.E != typed.E || publicKey.N.Cmp(typed.N) != 0 {
 			return fmt.Errorf("rsa public key mismatch")
 		}
 	case *ecdsa.PrivateKey:
 		publicKey, ok := certificate.PublicKey.(*ecdsa.PublicKey)
 		if !ok {
 			return fmt.Errorf("certificate public key is not EC")
 		}
-		if publicKey.X.Cmp(typed.PublicKey.X) != 0 || publicKey.Y.Cmp(typed.PublicKey.Y) != 0 || publicKey.Curve != typed.PublicKey.Curve {
+		if publicKey.X.Cmp(typed.X) != 0 || publicKey.Y.Cmp(typed.Y) != 0 || publicKey.Curve != typed.Curve {
 			return fmt.Errorf("ecdsa public key mismatch")
 		}
 	case ed25519.PrivateKey:
@@ -609,15 +609,15 @@ func (p *Plugin) describeX509Chain() map[string]interface{} {
 	}
 
 	chain := map[string]interface{}{
-		"chain_depth":     len(certs),
+		"chain_depth":       len(certs),
 		"signing_algorithm": sigAlg,
 		"leaf": map[string]interface{}{
-			"subject":        leaf.Subject.CommonName,
-			"issuer":         leaf.Issuer.CommonName,
-			"dns_names":      leaf.DNSNames,
-			"serial":         leaf.SerialNumber.String(),
-			"not_before":     leaf.NotBefore.Format(time.RFC3339),
-			"not_after":      leaf.NotAfter.Format(time.RFC3339),
+			"subject":              leaf.Subject.CommonName,
+			"issuer":               leaf.Issuer.CommonName,
+			"dns_names":            leaf.DNSNames,
+			"serial":               leaf.SerialNumber.String(),
+			"not_before":           leaf.NotBefore.Format(time.RFC3339),
+			"not_after":            leaf.NotAfter.Format(time.RFC3339),
 			"public_key_algorithm": leaf.PublicKeyAlgorithm.String(),
 		},
 	}

backend/internal/protocols/scim/filter.go

@@ -371,7 +371,8 @@ func (p *Parser) parseExpression(precedence int) (FilterNode, error) {
 	var err error
 
 	// Handle NOT prefix
-	if p.current.Type == TokenNot {
+	switch p.current.Type {
+	case TokenNot:
 		p.nextToken()
 		if p.current.Type != TokenLParen {
 			return nil, fmt.Errorf("expected '(' after 'not', got %s", p.current)
@@ -386,7 +387,7 @@ func (p *Parser) parseExpression(precedence int) (FilterNode, error) {
 		}
 		p.nextToken()
 		left = &NotExpr{Expr: inner}
-	} else if p.current.Type == TokenLParen {
+	case TokenLParen:
 		// Grouped expression
 		p.nextToken()
 		left, err = p.parseExpression(precLowest)
@@ -397,7 +398,7 @@ func (p *Parser) parseExpression(precedence int) (FilterNode, error) {
 			return nil, fmt.Errorf("expected ')', got %s", p.current)
 		}
 		p.nextToken()
-	} else {
+	default:
 		// Attribute expression
 		left, err = p.parseAttrExpr()
 		if err != nil {