From 556f345a10ed600aefd75810b2412c37f05bf8b2 Mon Sep 17 00:00:00 2001
From: Deluan <deluan@navidrome.org>
Date: Fri, 1 May 2026 14:22:51 -0400
Subject: [PATCH] chore(lint): upgrade golangci-lint, fix/ignore new errors

Signed-off-by: Deluan <deluan@navidrome.org>
---
 Makefile                           | 2 +-
 server/subsonic/api_test.go        | 2 +-
 server/subsonic/media_retrieval.go | 2 +-
 server/subsonic/middlewares.go     | 6 ++++--
 4 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/Makefile b/Makefile
index ad96afd31..e303017c7 100644
--- a/Makefile
+++ b/Makefile
@@ -20,7 +20,7 @@ IMAGE_PLATFORMS ?= $(shell echo $(SUPPORTED_PLATFORMS) | tr ',' '\n' | grep "lin
 PLATFORMS ?= $(SUPPORTED_PLATFORMS)
 DOCKER_TAG ?= deluan/navidrome:develop
 
-GOLANGCI_LINT_VERSION ?= v2.11.1
+GOLANGCI_LINT_VERSION ?= v2.12.0
 
 UI_SRC_FILES := $(shell find ui -type f -not -path "ui/build/*" -not -path "ui/node_modules/*")
 
diff --git a/server/subsonic/api_test.go b/server/subsonic/api_test.go
index 3b88704b1..f3053c8af 100644
--- a/server/subsonic/api_test.go
+++ b/server/subsonic/api_test.go
@@ -156,7 +156,7 @@ var _ = Describe("sendResponse", func() {
 	It("updates status pointer when an error occurs", func() {
 		pointer := int32(0)
 
-		ctx := context.WithValue(r.Context(), subsonicErrorPointer, &pointer)
+		ctx := context.WithValue(r.Context(), subsonicErrorPointer, &pointer) //nolint:govet
 		r = r.WithContext(ctx)
 
 		payload.Status = responses.StatusFailed
diff --git a/server/subsonic/media_retrieval.go b/server/subsonic/media_retrieval.go
index 3faae1650..9ab3a20b0 100644
--- a/server/subsonic/media_retrieval.go
+++ b/server/subsonic/media_retrieval.go
@@ -37,7 +37,7 @@ func (api *Router) GetAvatar(w http.ResponseWriter, r *http.Request) (*responses
 		log.Warn(ctx, "User needs an email for gravatar to work", "username", username)
 		return api.getPlaceHolderAvatar(w, r)
 	}
-	http.Redirect(w, r, gravatar.Url(u.Email, 0), http.StatusFound)
+	http.Redirect(w, r, gravatar.Url(u.Email, 0), http.StatusFound) //nolint:gosec // URL is not constructed from user input
 	return nil, nil
 }
 
diff --git a/server/subsonic/middlewares.go b/server/subsonic/middlewares.go
index 2d8b1fd94..5832bb1de 100644
--- a/server/subsonic/middlewares.go
+++ b/server/subsonic/middlewares.go
@@ -199,7 +199,7 @@ func getPlayer(players core.Players) func(next http.Handler) http.Handler {
 				}
 				r = r.WithContext(ctx)
 
-				cookie := &http.Cookie{
+				cookie := &http.Cookie{ //nolint:gosec // Secure omitted: Navidrome may run over plain HTTP
 					Name:     playerIDCookieName(userName),
 					Value:    player.ID,
 					MaxAge:   consts.CookieExpiry,
@@ -239,7 +239,9 @@ func playerIDCookieName(userName string) string {
 	return cookieName
 }
 
-const subsonicErrorPointer = "subsonicErrorPointer"
+type contextKey string
+
+const subsonicErrorPointer contextKey = "subsonicErrorPointer"
 
 func recordStats(metrics metrics.Metrics) func(next http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {