Panic during sqlclosecheck

[Hellseher]

Welcome

• Yes, I'm using a binary release within 2 latest releases. Only such installations are supported.
• Yes, I've searched similar issues on GitHub and didn't find any.
• Yes, I've read the typecheck section of the FAQ.
• Yes, I've tried with the standalone linter if available (e.g., gocritic, go vet, etc.).
• I agree to follow this project's Code of Conduct

How did you install golangci-lint?

Docker

Description of the problem

Hi,

sqlclosecheck has a know bug and CVE but the changes providing the fix are not tagged yet, see ryanrolds/sqlclosecheck#44

Currently it's panic during check:

golangci-lint run --max-issues-per-linter 0 --max-same-issues 0 --verbose ./...;
level=info msg="golangci-lint has version 2.11.3 built with go1.26.1 from 6008b81b on 2026-03-10T10:25:44Z"
level=info msg="[config_reader] Config search paths: [./ /opt/mw /opt / /root]"
level=info msg="[config_reader] Used config file .golangci.yml"
level=info msg="[config_reader] Module name \"github.com/mirrorweb/go-api-capture\""
level=info msg="[goenv] Read go env for 2.232112ms: map[string]string{\"GOCACHE\":\"/root/.cache/go-build\", \"GOROOT\":\"/usr/local/go\"}"
level=info msg="[lintersdb] Active 96 linters: [arangolint asasalint asciicheck bidichk bodyclose canonicalheader containedctx contextcheck copyloopvar cyclop decorder depguard dogsled dupl dupword durationcheck embeddedstructfieldcheck err113 errcheck errchkjson errname errorlint exhaustive exptostd fatcontext forbidigo forcetypeassert funlen gocheckcompilerdirectives gochecknoinits gochecksumtype gocognit goconst gocritic gocyclo godoclint godot gofmt gofumpt goheader goimports gomoddirectives gomodguard goprintffuncname gosec gosmopolitan govet grouper iface importas inamedparam ineffassign interfacebloat intrange iotamixing ireturn lll loggercheck maintidx makezero mirror misspell mnd modernize nakedret nestif nilerr nilnesserr nilnil noctx nolintlint nosprintfhostport perfsprint prealloc predeclared promlinter protogetter reassign recvcheck revive rowserrcheck sloglint spancheck sqlclosecheck staticcheck swaggo tagalign unconvert unparam unqueryvet unused usestdlibvars wastedassign whitespace wsl_v5 zerologlint]"
level=info msg="[loader] Go packages loading at mode 8767 (exports_file|files|imports|compiled_files|deps|name|types_sizes) took 9.665264265s"
level=info msg="[runner/filename_unadjuster] Pre-built 0 adjustments in 11.687451ms"
level=info msg="[linters_context] importas settings found, but no aliases listed. List aliases under alias: key."
level=info msg="[linters_context/goanalysis] analyzers took 18.882366255s with top 10 stages: buildir: 9.422545631s, buildssa: 3.134029227s, exhaustive: 1.135344877s, printf: 678.577265ms, fact_purity: 290.73495ms, fact_deprecated: 288.34175ms, inspect: 263.438648ms, nilness: 233.370138ms, SA5012: 220.441273ms, ctrlflow: 182.917475ms"
level=error msg="[runner] Panic: sqlclosecheck: package \"database\" (isInitialPkg: true, needAnalyzeSource: true): runtime error: invalid memory address or nil pointer dereference: goroutine 7754 [running]:\nruntime/debug.Stack()\n\truntime/debug/stack.go:26 +0x64\ngithub.com/golangci/golangci-lint/v2/pkg/goanalysis.(*action).analyzeSafe.func1()\n\tgithub.com/golangci/golangci-lint/v2/pkg/goanalysis/runner_action.go:55 +0x1d0\npanic({0xf88860?, 0x2326360?})\n\truntime/panic.go:860 +0x12c\ngithub.com/ryanrolds/sqlclosecheck/pkg/analyzer.getAction({0x155a840?, 0x2b0258385140}, {0x2b025bd7a140, 0x4, 0x4})\n\tgithub.com/ryanrolds/sqlclosecheck@v0.5.1/pkg/analyzer/analyzer.go:287 +0xec\ngithub.com/ryanrolds/sqlclosecheck/pkg/analyzer.checkClosed(0x2b025afdc700?, {0x2b025bd7a140, 0x4, 0x4})\n\tgithub.com/ryanrolds/sqlclosecheck@v0.5.1/pkg/analyzer/analyzer.go:221 +0x7c\ngithub.com/ryanrolds/sqlclosecheck/pkg/analyzer.run(0x2b025afdc700)\n\tgithub.com/ryanrolds/sqlclosecheck@v0.5.1/pkg/analyzer/analyzer.go:78 +0x1e8\ngithub.com/golangci/golangci-lint/v2/pkg/goanalysis.(*action).analyze.func3(...)\n\tgithub.com/golangci/golangci-lint/v2/pkg/goanalysis/runner_checker.go:183\ngithub.com/golangci/golangci-lint/v2/pkg/goanalysis.(*action).analyze(0x2b0252ca2e80)\n\tgithub.com/golangci/golangci-lint/v2/pkg/goanalysis/runner_checker.go:209 +0x9dc\ngithub.com/golangci/golangci-lint/v2/pkg/timeutils.(*Stopwatch).TrackStage(0x2b024fd4c0a0, {0x11f280d, 0xd}, 0x2b0251a28f00)\n\tgithub.com/golangci/golangci-lint/v2/pkg/timeutils/stopwatch.go:111 +0x44\ngithub.com/golangci/golangci-lint/v2/pkg/goanalysis.(*action).analyzeSafe(0x2b0252ca2e80?)\n\tgithub.com/golangci/golangci-lint/v2/pkg/goanalysis/runner_action.go:59 +0x64\ngithub.com/golangci/golangci-lint/v2/pkg/goanalysis.(*loadingPackage).analyze.func2()\n\tgithub.com/golangci/golangci-lint/v2/pkg/goanalysis/runner_loadingpackage.go:107 +0x6c\ngolang.org/x/sync/errgroup.(*Group).Go.func1()\n\tgolang.org/x/sync@v0.20.0/errgroup/errgroup.go:93 +0x4c\ncreated by golang.org/x/sync/errgroup.(*Group).Go in goroutine 727\n\tgolang.org/x/sync@v0.20.0/errgroup/errgroup.go:78 +0x90\n"

Version of golangci-lint

Details

level=info msg="golangci-lint has version 2.11.3 built with go1.26.1 from 6008b81b on 2026-03-10T10:25:44Z"

Configuration

Details

golangci-lint run --max-issues-per-linter 0 --max-same-issues 0 --verbose ./...;

Go environment

Details

$ go version && go env
# paste output here

Verbose output of running

Details

$ golangci-lint cache clean
$ golangci-lint run -v
# paste output here

A minimal reproducible example or link to a public repository

Details

// add your code here

Validation

• Yes, I've included all information above (version, config, etc.).

Supporter

• I am a sponsor/backer of this project.

[ldez]

Hello, could you fill the issue with the require information?

The issue, you are quoting, is only about update of the dependencies, the dependencies are already up-to-date inside golangci-lint, so this is unrelated to your problem.

[ldez]

There is already a PR open about the bug: ryanrolds/sqlclosecheck#46

[ldez]

I need a reproducible example.

[Hellseher]

A fresh version is released https://github.com/ryanrolds/sqlclosecheck/releases/tag/v0.6.0