…ning (#1552)

Update the GitHub action to use gosec v2.24.0 and fix the docker image
signing

Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>

The relese process is extended to push also images to GHCR in addition
to DockerHub. This is in preparation to migrate to GHCR after the next
release.

Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>

#1554)

* fix(G705): eliminate false positive when guard type cannot be resolved

A guard cannot be satisfied when its type cannot be resolved.
Otherwise gosec fires for code like:
```go
package main

import (
	"fmt"
	"os"
)

func main() {
	fmt.Fprint(os.Stdout, os.Args[1])
}
```
In this case the guard type `http.ResponseWriter` cannot be resolved, all guards (1)
are satisfied and we have a false gosec warning.

Signed-off-by: leonnicolas <leonloechner@gmx.de>

* remove the http package from example

---------

Signed-off-by: leonnicolas <leonloechner@gmx.de>

…ecks (#1556)

Summary:
This change fixes the hang/perceived hang reported in issue #1555 when
scanning large codebases with complex SSA graphs. The fix is
intentionally scoped to G120 form parsing analysis only.

Root cause:
G120 wrapper/middleware protection logic repeatedly called
value-dependency checks across many function/call combinations. The
dependency traversal was depth-limited but not memoized, so cyclic and
branch-heavy SSA structures (especially Phi-related paths) caused
repeated re-traversal of the same graph regions and severe runtime
blowup.

What changed:
A cycle-safe, memoized dependency checker was added and used only inside
the G120 form parsing analysis flow. Existing G120 logic was kept
semantically equivalent while replacing repeated raw dependency
traversals with cached checks. Focused regression tests were added for
cyclic Phi graphs to verify both cases: no target reachable (false) and
target reachable (true), including stable repeated evaluation.

Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>

Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>

Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>

…hs (#1559)

Route redirect dependency checks through the cycle-safe
dependencyChecker instead of raw recursive valueDependsOn traversal.
This ensures Phi-cycle graphs terminate quickly and avoids recursive
work amplification that can look like hangs on large/generated
codebases.

Also remove the nil fallback in dependencyChecker.dependsOn so all
analyzer paths consistently use cycle-aware logic.

Add regression tests covering raw valueDependsOn behavior on:

Phi cycle without target (must return false)
Phi cycle with target path (must return true)
Self-referential Phi node (must return false)

Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>

…1561)

* chore(prompts): add supported Go version update skill and prompt

* docs: add usage for supported Go version update prompt