chore(ci): bump securego/gosec from 2.25.0 to 2.26.1

[dependabot]

Bumps securego/gosec from 2.25.0 to 2.26.1.

Release notes

Sourced from securego/gosec's releases.

v2.26.1

Changelog

• 4a3bd8af174872c778439083ded7adbf3747e770 Update cosign to v3.0.6 (#1659)

Commits

• 4a3bd8a Update cosign to v3.0.6 (#1659)
• 553d8a5 Sync taint rule docs and add missing CWE mappings for G113/G307 (#1658)
• bf0ccd3 Update all dependencies (#1657)
• 4ead098 Add G710 rule for open redirect via taint analysis (#1654)
• 8ff985f Fix formatting
• a1aad0c Update the default models use by autofix and phase out the older models
• 74bdf7f Format and clean-up the README
• 74dc989 Add HTTP file-serving function to the skins of pathtraversal analyzer (#1647)
• 7020111 Skip flaging the TLS min version for go 1.18+ (#1646)
• d5869fc chore(deps): bump go.opentelemetry.io/otel from 1.39.0 to 1.41.0 (#1645)
• Additional commits viewable in compare view

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/securego/gosec	4a3bd8af174872c778439083ded7adbf3747e770	🟢 5.9	Details Check Score Reason Code-Review ⚠️ 2 Found 6/21 approved changesets -- score normalized to 2 Dangerous-Workflow ⚠️ 0 dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 8 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 Security-Policy ⚠️ 0 security policy file not detected CII-Best-Practices 🟢 5 badge detected: Passing Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Packaging 🟢 10 packaging workflow detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases 🟢 8 5 out of the last 5 releases have a total of 5 signed artifacts. SAST 🟢 10 SAST tool is run on all commits

Scanned Files

• .github/workflows/ci.yml

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (1 file)

• .github/workflows/ci.yml - Bumped securego/gosec from v2.25.0 to v2.26.1 (line 118)

---

_{Reviewed by nemotron-3-super-120b-a12b-20230311:free · 281,874 tokens}

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[dependabot]

Superseded by #109.