exclude crypto/rand.Read by default

[pitku]

Also mentioned in docs with examples. See - https://pkg.go.dev/crypto/rand#Read

[kisielk]

What's the reason the minimum version needs to be bumped for this?

[pitku]

Opps! a bit of a rabbit hole with this one,

rand.Read is documented to not return errors in go 1.24 and later.
but in 1.23 or later it will not return errors but it is just not documented.
99522de1c38e4915e061cd2dac7d34ee888c8318
switched to arc4random (which is included in 1.23)

[pitku]

If user is using Go 1.22 there are still some codepaths in some exotic configurations which may return error for rand.Read. Ideally go mod should specify 1.24 as minimum, as only 1.24 and above guarantee that rand.Read does not return errors. But it could be left to 1.23 as well as there are no code paths which return error on rand.Read.

I would be happy to put this on hold if you/your downstream dependencies are not comfortable bumping the minimum go version.

[kisielk]

Honestly I think we can ignore the calls and stick with 1.22 as the minimum version. Users should eventually be moving to a later version of go and the lack of error checking on that function even if they are still on 1.22 is unlikely to cause problems. On Apr 3, 2025, at 10:56, Prasad ***@***.***> wrote: If user is using Go 1.22 there are still some codepaths in some exotic configurations which may return error for rand.Read. Ideally go mod should specify 1.24 as minimum, as only 1.24 and above guarantee that rand.Read does not return errors. But it could be left to 1.23 as well as there are no code paths which return error on rand.Read. I would be happy to put this on hold if you/your downstream dependencies are not comfortable bumping the minimum go version.—Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you commented.Message ID: ***@***.***> spillway left a comment (kisielk/errcheck#269) If user is using Go 1.22 there are still some codepaths in some exotic configurations which may return error for rand.Read. Ideally go mod should specify 1.24 as minimum, as only 1.24 and above guarantee that rand.Read does not return errors. But it could be left to 1.23 as well as there are no code paths which return error on rand.Read. I would be happy to put this on hold if you/your downstream dependencies are not comfortable bumping the minimum go version. —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you commented.Message ID: ***@***.***>

[pitku]

I have removed go mod changes.