Can I get golangci-lint to use a local version of gosec?

[amyango]

I currently run into a panic in gosec when running golangci-lint on my project. I'm guessing this specific to the M1 chip on my new Mac (darwin/arm64) since my other x86 laptop doesn't have this issue.

ERRO Running error: 1 error occurred:
	* can't run linter goanalysis_metalinter: goanalysis_metalinter: gosec: package "linuxsubscription" (isInitialPkg: true, needAnalyzeSource: true): runtime error: invalid memory address or nil pointer dereference

This issue was fixed Mar 7th in the gosec repo, but gosec hasn't released a version with this fix included yet.

I currently disable gosec in .golangci.yaml and then run the local version of gosec I built separately, which contains the above fix. (I did verify that running gosec v2.15.0 produces the same crash as when golangci-lint calls it)
Is there a way to point golangci-lint to this local version that contains the fix I need so I don't have to run them separately?

I tried building golangci-lint from source as well to see if there was a way to specify in the repo, but it fails a clean build due to some test failing so stopped pursuing that route:

    --- FAIL: TestSourcesFromTestdata/go-header_bad.go (0.31s)

[ldez]

Hello,

golangci-lint doesn't use binaries: the linters are imported as a lib.

So you cannot use a local version of gosec.

But you can build your own version of golangci-lint locally and then update the go.mod accordingly.