fix: bump go to 1.22.12 to fix vulns CF-2302 (#196)

* fix: minor bump CF-2302

* fix: bump opengrep CF-2302

* fix: integration tests CF-2302

* rewrite

* Fix integration tests

* bump opengrep to 1.16.4

---------

Co-authored-by: Hélio Rocha <helio@codacy.com>

Author: manufacturist

.codacy/codacy.yaml

@@ -3,13 +3,11 @@ runtimes:
     - java@17.0.10
     - node@22.2.0
     - python@3.11.11
-    - flutter@3.7.2
 tools:
     - eslint@9.38.0
     - lizard@1.17.31
+    - opengrep@1.16.4
     - pmd@6.55.0
     - pylint@3.3.9
     - revive@1.12.0
-    - opengrep@1.16.2
     - trivy@0.69.3
-    - dartanalyzer@3.7.2

go.mod

@@ -1,6 +1,6 @@
 module codacy/cli-v2
 
-go 1.22.4
+go 1.22.12
 
 require (
 	github.com/fatih/color v1.18.0

integration-tests/config-discover/expected/codacy.yaml

@@ -7,7 +7,7 @@ tools:
     - dartanalyzer@3.7.2
     - eslint@8.57.0
     - lizard@1.17.31
-    - opengrep@1.16.2
+    - opengrep@1.16.4
     - pmd@7.11.0
     - pylint@3.3.6
     - trivy@0.69.3

integration-tests/config-discover/expected/tools-configs/languages-config.yaml

@@ -11,6 +11,10 @@ tools:
       languages: [C, CPP, CSharp, Erlang, Fortran, Go, Java, Javascript, Kotlin, Lua, Objective C, PHP, Python, Ruby, Rust, Scala, Solidity, Swift, TypeScript]
       extensions: [.c, .cc, .cpp, .cs, .cxx, .gemspec, .go, .h, .hpp, .ino, .java, .jbuilder, .js, .jsm, .jsx, .kt, .kts, .m, .mjs, .opal, .php, .podspec, .py, .rake, .rb, .rlib, .rs, .scala, .swift, .ts, .tsx, .vue]
       files: []
+    - name: opengrep
+      languages: [Apex, C, CPP, CSharp, Dockerfile, Go, Java, Javascript, Kotlin, PHP, PLSQL, Python, Ruby, Rust, SQL, Scala, Shell, Swift, Terraform, TypeScript, YAML]
+      extensions: [.bash, .c, .cc, .cls, .cpp, .cs, .cxx, .dockerfile, .env, .fnc, .gemspec, .go, .h, .hpp, .ino, .java, .jbuilder, .js, .jsm, .jsx, .kt, .kts, .mjs, .opal, .pck, .php, .pkb, .pkh, .pks, .plb, .pld, .plh, .pls, .podspec, .prc, .py, .rake, .rb, .rlib, .rs, .scala, .sh, .sql, .swift, .tf, .tpb, .tps, .trg, .trigger, .ts, .tsx, .tyb, .typ, .vue, .yaml, .yml]
+      files: []
     - name: pmd
       languages: [Apex, JSP, Java, Javascript, PLSQL, SQL, Velocity, VisualForce, XML]
       extensions: [.cls, .component, .fnc, .java, .js, .jsm, .jsp, .jsx, .mjs, .page, .pck, .pkb, .pkh, .pks, .plb, .pld, .plh, .pls, .pom, .prc, .sql, .tpb, .tps, .trg, .trigger, .tyb, .typ, .vm, .vue, .wsdl, .xml, .xsl]
@@ -23,10 +27,6 @@ tools:
       languages: [Go]
       extensions: [.go]
       files: []
-    - name: opengrep
-      languages: [Apex, C, CPP, CSharp, Dockerfile, Go, Java, Javascript, Kotlin, PHP, PLSQL, Python, Ruby, Rust, SQL, Scala, Shell, Swift, Terraform, TypeScript, YAML]
-      extensions: [.bash, .c, .cc, .cls, .cpp, .cs, .cxx, .dockerfile, .env, .fnc, .gemspec, .go, .h, .hpp, .ino, .java, .jbuilder, .js, .jsm, .jsx, .kt, .kts, .mjs, .opal, .pck, .php, .pkb, .pkh, .pks, .plb, .pld, .plh, .pls, .podspec, .prc, .py, .rake, .rb, .rlib, .rs, .scala, .sh, .sql, .swift, .tf, .tpb, .tps, .trg, .trigger, .ts, .tsx, .tyb, .typ, .vue, .yaml, .yml]
-      files: []
     - name: trivy
       languages: [C, CPP, CSharp, Dart, Dockerfile, Elixir, Go, JSON, Java, Javascript, PHP, Python, Ruby, Rust, Scala, Swift, Terraform, TypeScript, XML, YAML]
       extensions: [.c, .cc, .cpp, .cs, .cxx, .dart, .dockerfile, .env, .ex, .exs, .gemspec, .go, .h, .hpp, .ino, .java, .jbuilder, .js, .jsm, .json, .jsx, .mjs, .opal, .php, .podspec, .pom, .py, .rake, .rb, .rlib, .rs, .scala, .swift, .tf, .ts, .tsx, .vue, .wsdl, .xml, .xsl, .yaml, .yml]

integration-tests/init-with-token/expected/codacy.yaml

@@ -5,7 +5,7 @@ runtimes:
 tools:
     - eslint@8.57.0
     - lizard@1.17.31
-    - opengrep@1.16.2
+    - opengrep@1.16.4
     - pmd@6.55.0
     - pylint@3.3.9
     - trivy@0.69.3

integration-tests/init-with-token/expected/tools-configs/languages-config.yaml

@@ -1,11 +1,15 @@
 tools:
     - name: eslint
-      languages: [Javascript]
-      extensions: [.js, .jsm, .jsx, .mjs, .vue]
+      languages: [Javascript, TypeScript]
+      extensions: [.js, .jsm, .jsx, .mjs, .ts, .tsx, .vue]
       files: []
     - name: lizard
-      languages: [Java, Javascript, Python]
-      extensions: [.java, .js, .jsm, .jsx, .mjs, .py, .vue]
+      languages: [Java, Javascript, Python, TypeScript]
+      extensions: [.java, .js, .jsm, .jsx, .mjs, .py, .ts, .tsx, .vue]
+      files: []
+    - name: opengrep
+      languages: [Java, Javascript, Python, TypeScript]
+      extensions: [.java, .js, .jsm, .jsx, .mjs, .py, .ts, .tsx, .vue]
       files: []
     - name: pmd
       languages: [Java, Javascript]
@@ -15,11 +19,7 @@ tools:
       languages: [Python]
       extensions: [.py]
       files: []
-    - name: opengrep
-      languages: [Java, Javascript, Python]
-      extensions: [.java, .js, .jsm, .jsx, .mjs, .py, .vue]
-      files: []
     - name: trivy
-      languages: [JSON, Java, Javascript, Python]
-      extensions: [.java, .js, .jsm, .json, .jsx, .mjs, .py, .vue]
-      files: [Pipfile.lock, gradle.lockfile, package-lock.json, package.json, pnpm-lock.yaml, poetry.lock, pom.xml, requirements.txt, uv.lock, yarn.lock]
+      languages: [JSON, Java, Javascript, Python, TypeScript]
+      extensions: [.java, .js, .jsm, .json, .jsx, .mjs, .py, .ts, .tsx, .vue]
+      files: [Pipfile.lock, gradle.lockfile, package-lock.json, package.json, pnpm-lock.yaml, poetry.lock, pom.xml, requirements.txt, uv.lock, yarn.lock]

integration-tests/init-without-token/expected/codacy.yaml

@@ -8,7 +8,7 @@ tools:
     - dartanalyzer@3.7.2
     - eslint@8.57.0
     - lizard@1.17.31
-    - opengrep@1.16.2
+    - opengrep@1.16.4
     - pmd@7.11.0
     - pylint@3.3.6
     - revive@1.7.0

integration-tests/init-without-token/expected/tools-configs/languages-config.yaml

@@ -11,6 +11,10 @@ tools:
       languages: [C, CPP, CSharp, Erlang, Fortran, Go, Java, Javascript, Kotlin, Lua, Objective C, PHP, Python, Ruby, Rust, Scala, Solidity, Swift, TypeScript]
       extensions: [.c, .cc, .cpp, .cs, .cxx, .gemspec, .go, .h, .hpp, .ino, .java, .jbuilder, .js, .jsm, .jsx, .kt, .kts, .m, .mjs, .opal, .php, .podspec, .py, .rake, .rb, .rlib, .rs, .scala, .swift, .ts, .tsx, .vue]
       files: []
+    - name: opengrep
+      languages: [Apex, C, CPP, CSharp, Dockerfile, Go, Java, Javascript, Kotlin, PHP, PLSQL, Python, Ruby, Rust, SQL, Scala, Shell, Swift, Terraform, TypeScript, YAML]
+      extensions: [.bash, .c, .cc, .cls, .cpp, .cs, .cxx, .dockerfile, .env, .fnc, .gemspec, .go, .h, .hpp, .ino, .java, .jbuilder, .js, .jsm, .jsx, .kt, .kts, .mjs, .opal, .pck, .php, .pkb, .pkh, .pks, .plb, .pld, .plh, .pls, .podspec, .prc, .py, .rake, .rb, .rlib, .rs, .scala, .sh, .sql, .swift, .tf, .tpb, .tps, .trg, .trigger, .ts, .tsx, .tyb, .typ, .vue, .yaml, .yml]
+      files: []
     - name: pmd
       languages: [Apex, JSP, Java, Javascript, PLSQL, SQL, Velocity, VisualForce, XML]
       extensions: [.cls, .component, .fnc, .java, .js, .jsm, .jsp, .jsx, .mjs, .page, .pck, .pkb, .pkh, .pks, .plb, .pld, .plh, .pls, .pom, .prc, .sql, .tpb, .tps, .trg, .trigger, .tyb, .typ, .vm, .vue, .wsdl, .xml, .xsl]
@@ -23,10 +27,6 @@ tools:
       languages: [Go]
       extensions: [.go]
       files: []
-    - name: opengrep
-      languages: [Apex, C, CPP, CSharp, Dockerfile, Go, Java, Javascript, Kotlin, PHP, PLSQL, Python, Ruby, Rust, SQL, Scala, Shell, Swift, Terraform, TypeScript, YAML]
-      extensions: [.bash, .c, .cc, .cls, .cpp, .cs, .cxx, .dockerfile, .env, .fnc, .gemspec, .go, .h, .hpp, .ino, .java, .jbuilder, .js, .jsm, .jsx, .kt, .kts, .mjs, .opal, .pck, .php, .pkb, .pkh, .pks, .plb, .pld, .plh, .pls, .podspec, .prc, .py, .rake, .rb, .rlib, .rs, .scala, .sh, .sql, .swift, .tf, .tpb, .tps, .trg, .trigger, .ts, .tsx, .tyb, .typ, .vue, .yaml, .yml]
-      files: []
     - name: trivy
       languages: [C, CPP, CSharp, Dart, Dockerfile, Elixir, Go, JSON, Java, Javascript, PHP, Python, Ruby, Rust, Scala, Swift, Terraform, TypeScript, XML, YAML]
       extensions: [.c, .cc, .cpp, .cs, .cxx, .dart, .dockerfile, .env, .ex, .exs, .gemspec, .go, .h, .hpp, .ino, .java, .jbuilder, .js, .jsm, .json, .jsx, .mjs, .opal, .php, .podspec, .pom, .py, .rake, .rb, .rlib, .rs, .scala, .swift, .tf, .ts, .tsx, .vue, .wsdl, .xml, .xsl, .yaml, .yml]

plugins/tools/opengrep/plugin.yaml

@@ -1,6 +1,6 @@
 name: opengrep
 description: Opengrep is an open-source static analysis tool and community fork of Semgrep for finding bugs and enforcing code standards.
-default_version: 1.16.2
+default_version: 1.16.4
 download:
   url_template: "https://github.com/opengrep/opengrep/releases/download/v{{.Version}}/opengrep_{{.OS}}_{{.Arch}}{{.Extension}}"
   file_name_template: "opengrep_{{.OS}}_{{.Arch}}"