From 174668beeffd61ab3a10377fe06d1577030dbcbf Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 9 Jul 2026 12:12:08 +0000
Subject: [PATCH 1/4] Bump golang.org/x/crypto from 0.19.0 to 0.52.0

Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.19.0 to 0.52.0.
- [Commits](https://github.com/golang/crypto/compare/v0.19.0...v0.52.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.52.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 10 +++++-----
 go.sum | 16 ++++++++--------
 2 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/go.mod b/go.mod
index 61ad0a7..ad084d2 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/hypersequent/qasphere-csv
 
-go 1.23.4
+go 1.25.0
 
 require (
 	github.com/go-playground/validator/v10 v10.23.0
@@ -17,9 +17,9 @@ require (
 	github.com/hashicorp/errwrap v1.0.0 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	golang.org/x/crypto v0.19.0 // indirect
-	golang.org/x/net v0.21.0 // indirect
-	golang.org/x/sys v0.17.0 // indirect
-	golang.org/x/text v0.14.0 // indirect
+	golang.org/x/crypto v0.52.0 // indirect
+	golang.org/x/net v0.54.0 // indirect
+	golang.org/x/sys v0.45.0 // indirect
+	golang.org/x/text v0.37.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/go.sum b/go.sum
index 7873bea..78ccdbe 100644
--- a/go.sum
+++ b/go.sum
@@ -22,14 +22,14 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-golang.org/x/crypto v0.19.0 h1:ENy+Az/9Y1vSrlrvBSyna3PITt4tiZLf7sgCjZBX7Wo=
-golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
-golang.org/x/net v0.21.0 h1:AQyQV4dYCvJ7vGmJyKki9+PBdyvhkSd8EIx/qb0AYv4=
-golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
-golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y=
-golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
+golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
+golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
+golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

From 2e76ecc252efe6ff21da54bb60ec69614df7692f Mon Sep 17 00:00:00 2001
From: Andrian Budantsov <a@hypersequent.com>
Date: Wed, 15 Jul 2026 16:12:15 +0400
Subject: [PATCH 2/4] Fix gofumpt formatting and bump golang.org/x/net to
 v0.55.0

- Remove redundant parens in addTCase flagged by newer gofumpt
- Bump x/net 0.54.0 -> 0.55.0 to address GHSA advisory (HTML parser DoS)
---
 go.mod    | 2 +-
 go.sum    | 4 ++--
 qascsv.go | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/go.mod b/go.mod
index ad084d2..787cdf7 100644
--- a/go.mod
+++ b/go.mod
@@ -18,7 +18,7 @@ require (
 	github.com/leodido/go-urn v1.4.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	golang.org/x/crypto v0.52.0 // indirect
-	golang.org/x/net v0.54.0 // indirect
+	golang.org/x/net v0.55.0 // indirect
 	golang.org/x/sys v0.45.0 // indirect
 	golang.org/x/text v0.37.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
diff --git a/go.sum b/go.sum
index 78ccdbe..4c93546 100644
--- a/go.sum
+++ b/go.sum
@@ -24,8 +24,8 @@ github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOf
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
 golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
-golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
-golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
+golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
+golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
 golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
 golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
diff --git a/qascsv.go b/qascsv.go
index 4dd68fc..3e444db 100644
--- a/qascsv.go
+++ b/qascsv.go
@@ -337,7 +337,7 @@ func (q *QASphereCSV) addTCase(tc TestCase) {
 	q.folderTCaseMap[folderPath] = append(q.folderTCaseMap[folderPath], tc)
 
 	q.numTCases++
-	if (len(tc.Steps)) > q.maxSteps {
+	if len(tc.Steps) > q.maxSteps {
 		q.maxSteps = len(tc.Steps)
 	}
 }

From 64631107d89735e585fa9b42e0a0a91296eb4de3 Mon Sep 17 00:00:00 2001
From: Andrian Budantsov <a@hypersequent.com>
Date: Wed, 15 Jul 2026 16:15:40 +0400
Subject: [PATCH 3/4] Upgrade golangci-lint to v2.12.2 and fix errcheck issues

golangci-lint v1.62.2 (built with go1.23) cannot load modules targeting
go 1.25, which the x/crypto v0.52.0 bump requires. v2 also drops the
legacy default errcheck exclusions, so check the previously ignored
Close/Remove return values.
---
 .github/workflows/ci.yml | 6 +++---
 qacsv_test.go            | 4 ++--
 qascsv.go                | 5 ++---
 3 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ec9eac5..41cfd16 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -36,10 +36,10 @@ jobs:
         run: diff <(echo -n) <(gofumpt -d .)
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@v9
         with:
-          version: v1.62.2
-          args: --verbose --timeout=3m
+          version: v2.12.2
+          args: --verbose
 
       - name: Build examples
         run: make build-examples
diff --git a/qacsv_test.go b/qacsv_test.go
index 5b80714..35fab5a 100644
--- a/qacsv_test.go
+++ b/qacsv_test.go
@@ -409,8 +409,8 @@ func TestWriteCSVMultipleTCasesSuccess(t *testing.T) {
 	f, err := os.Open(tempFileName)
 	require.NoError(t, err)
 	defer func() {
-		f.Close()
-		os.Remove(tempFileName)
+		_ = f.Close()
+		_ = os.Remove(tempFileName)
 	}()
 
 	b, err := io.ReadAll(f)
diff --git a/qascsv.go b/qascsv.go
index 3e444db..a4f5166 100644
--- a/qascsv.go
+++ b/qascsv.go
@@ -280,13 +280,12 @@ func (q *QASphereCSV) WriteCSVToFile(file string) error {
 	if err != nil {
 		return errors.Wrap(err, "create csv")
 	}
-	defer f.Close()
-
 	if err := q.writeCSV(f); err != nil {
+		_ = f.Close()
 		return errors.Wrap(err, "write csv")
 	}
 
-	return nil
+	return errors.Wrap(f.Close(), "close csv")
 }
 
 func validateFolderSegments(segments []string) error {

From 018195a34094dcd5a80ba0600dc3923b32b1b0fb Mon Sep 17 00:00:00 2001
From: Andrian Budantsov <a@hypersequent.com>
Date: Wed, 15 Jul 2026 16:21:03 +0400
Subject: [PATCH 4/4] Exclude no-test examples packages from coverage test run

go test -cover on packages with no test files shells out to
'go tool covdata', which fails on CI (golang/go#75031, fixed
only in Go 1.27). Examples are still compiled via build-examples.
Also bump the local lint install pin to golangci-lint v2.12.2.
---
 Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index b9e1ee1..49c8569 100644
--- a/Makefile
+++ b/Makefile
@@ -3,14 +3,14 @@ GOCMD=GO111MODULE=on go
 linters-install:
 	@golangci-lint --version >/dev/null 2>&1 || { \
 		echo "installing linting tools..."; \
-		curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s v1.62.2; \
+		curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s v2.12.2; \
 	}
 
 lint: linters-install
 	golangci-lint run
 
 test:
-	$(GOCMD) test -v -cover -race ./...
+	$(GOCMD) test -v -cover -race $$(go list ./... | grep -v /examples/)
 
 build-examples:
 	$(GOCMD) build ./examples/...