cmd/config.go:209:6: Function 'printSettings' has too many statements (59 > 50) (funlen)
func printSettings(ser *settings.Server, set *settings.Settings, auther auth.Auther) error {
     ^
cmd/root.go:384:6: Function 'quickSetup' is too long (106 > 100) (funlen)
func quickSetup(v *viper.Viper, s *storage.Storage) error {
     ^
files/mime.go:603:1: don't use `init` function (gochecknoinits)
func init() {
^
users/assets.go:12:1: don't use `init` function (gochecknoinits)
func init() {
^
cmd/utils.go:181:3: importShadow: shadow of imported from 'github.com/thevickypedia/filebrowser/v2/storage' package 'storage' (gocritic)
                storage, err := bolt.NewStorage(db)
                ^
img/service.go:187:3: emptyFallthrough: remove empty case containing only fallthrough to default case (gocritic)
                fallthrough
                ^
runner/runner.go:94:2: appendCombine: can combine chain of 4 appends into one (gocritic)
        cmd.Env = append(cmd.Env, fmt.Sprintf("SCOPE=%s", user.Scope))
        ^
users/users.go:94:50: filepathJoin: "/" contains a path separator (gocritic)
                scope = filepath.Join(baseScope, filepath.Join("/", scope))
                                                               ^
cmd/config.go:278:1: cyclomatic complexity 38 of func `getSettings` is high (> 15) (gocyclo)
func getSettings(flags *pflag.FlagSet, set *settings.Settings, ser *settings.Server, auther auth.Auther, all bool) (auth.Auther, error) {
^
cmd/root.go:277:1: cyclomatic complexity 21 of func `getServerSettings` is high (> 15) (gocyclo)
func getServerSettings(v *viper.Viper, st *storage.Storage) (*settings.Server, error) {
^
cmd/users.go:99:1: cyclomatic complexity 20 of func `getUserDefaults` is high (> 15) (gocyclo)
func getUserDefaults(flags *pflag.FlagSet, defaults *settings.UserDefaults, all bool) error {
^
http/static.go:124:1: cyclomatic complexity 16 of func `getStaticHandlers` is high (> 15) (gocyclo)
func getStaticHandlers(store *storage.Storage, server *settings.Server, assetsFs fs.FS) (index, static http.Handler) {
^
users/users.go:58:1: cyclomatic complexity 16 of func `(*User).Clean` is high (> 15) (gocyclo)
func (u *User) Clean(baseScope string, fields ...string) error {
^
cmd/root.go:56:2: cmd/root.go:56: Line contains TODO/BUG/FIXME: "TODO(remove): remove after July 2026." (godox)
// TODO(remove): remove after July 2026.
 ^
cmd/root.go:321:4: cmd/root.go:321: Line contains TODO/BUG/FIXME: "TODO(remove): remove after July 2026." (godox)
                // TODO(remove): remove after July 2026.
                 ^
settings/settings.go:48:1: File is not properly formatted (goimports)
        Root                  string `json:"root"`
^
auth/hook.go:106:9: G204: Subprocess launched with a potential tainted input or cmd arguments (gosec)
        cmd := exec.Command(command[0], command[1:]...)
               ^
cmd/docs.go:72:10: G306: Expect WriteFile permissions to be 0600 or less (gosec)
                        err = os.WriteFile(dstPath, data, 0666)
                              ^
diskcache/file_cache.go:5:2: G505: Blocklisted import crypto/sha1: weak cryptographic primitive (gosec)
        "crypto/sha1"
        ^
diskcache/file_cache.go:106:12: G401: Use of weak cryptographic primitive (gosec)
        hasher := sha1.New()
                  ^
files/file.go:4:2: G501: Blocklisted import crypto/md5: weak cryptographic primitive (gosec)
        "crypto/md5"
        ^
files/file.go:5:2: G505: Blocklisted import crypto/sha1: weak cryptographic primitive (gosec)
        "crypto/sha1"
        ^
files/file.go:188:7: G401: Use of weak cryptographic primitive (gosec)
                h = md5.New()
                    ^
files/file.go:190:7: G401: Use of weak cryptographic primitive (gosec)
                h = sha1.New()
                    ^
http/commands.go:88:9: G204: Subprocess launched with a potential tainted input or cmd arguments (gosec)
        cmd := exec.Command(command[0], command[1:]...)
               ^
http/public_test.go:22:8: G101: Potential hardcoded credentials (gosec)
        const passwordBcrypt = "$2y$10$TFAmdCbyd/mEZDe5fUeZJu.MaJQXRTwdqb/IQV.eTn6dWrF58gCSe"
              ^
runner/runner.go:92:9: G204: Subprocess launched with a potential tainted input or cmd arguments (gosec)
        cmd := exec.Command(command[0], command[1:]...)
               ^
cmd/root.go:201:9: shadow: declaration of "err" shadows declaration at line 173 (govet)
                        cer, err := tls.LoadX509KeyPair(server.TLSCert, server.TLSKey)
                             ^
cmd/users_import.go:91:23: shadow: declaration of "err" shadows declaration at line 79 (govet)
                                        if conflictuous, err := st.Users.Get("", user.Username); err == nil {
                                                         ^
cmd/utils.go:61:7: shadow: declaration of "err" shadows declaration at line 52 (govet)
                        if err := os.MkdirAll(d, 0700); err != nil {
                           ^
cmd/utils.go:97:9: shadow: declaration of "err" shadows declaration at line 90 (govet)
                home, err := homedir.Dir()
                      ^
files/file.go:93:7: shadow: declaration of "err" shadows declaration at line 81 (govet)
                        if err := file.readListing(opts.Checker, opts.ReadHeader); err != nil {
                           ^
http/commands.go:51:11: shadow: declaration of "err" shadows declaration at line 42 (govet)
                _, msg, err := conn.ReadMessage()
                        ^
http/commands.go:65:6: shadow: declaration of "err" shadows declaration at line 42 (govet)
                if err := conn.WriteMessage(websocket.TextMessage, cmdNotAllowed); err != nil {
                   ^
http/commands.go:74:6: shadow: declaration of "err" shadows declaration at line 42 (govet)
                if err := conn.WriteMessage(websocket.TextMessage, []byte(err.Error())); err != nil {
                   ^
http/public_test.go:73:9: shadow: declaration of "err" shadows declaration at line 67 (govet)
                                        if err := db.Close(); err != nil {
                                           ^
http/raw.go:35:4: shadow: declaration of "name" shadows declaration at line 34 (govet)
                        name, err := url.QueryUnescape(strings.ReplaceAll(name, "+", "%2B"))
                        ^
http/share.go:114:8: shadow: declaration of "err" shadows declaration at line 104 (govet)
                num, err := strconv.Atoi(body.Expires)
                     ^
http/static.go:57:6: shadow: declaration of "err" shadows declaration at line 25 (govet)
                _, err := os.Stat(fPath)
                   ^
http/static.go:69:8: shadow: declaration of "err" shadows declaration at line 25 (govet)
                raw, err := d.store.Auth.Get(d.settings.AuthMethod)
                     ^
users/storage.go:66:6: shadow: declaration of "err" shadows declaration at line 60 (govet)
                if err := user.Clean(baseScope); err != nil {
                   ^
cmd/docs.go:38:61: unused-parameter: parameter 'f' seems to be unused, consider removing or renaming it as _ (revive)
                err = doc.GenMarkdownTreeCustom(cmd.Root(), tempDir, func(f string) string {
                                                                          ^
cmd/root.go:57:23: unused-parameter: parameter 'f' seems to be unused, consider removing or renaming it as _ (revive)
func migrateFlagNames(f *pflag.FlagSet, name string) pflag.NormalizedName {
                      ^
cmd/root.go:149:31: unused-parameter: parameter 'cmd' seems to be unused, consider removing or renaming it as _ (revive)
        RunE: withViperAndStore(func(cmd *cobra.Command, _ []string, v *viper.Viper, st *store) error {
                                     ^
cmd/utils.go:196:67: unused-parameter: parameter 'v' seems to be unused, consider removing or renaming it as _ (revive)
        return withViperAndStore(func(cmd *cobra.Command, args []string, v *viper.Viper, store *store) error {
                                                                         ^
diskcache/file_cache_test.go:43:31: context-as-argument: context.Context should be the first parameter of a function (revive)
func checkValue(t *testing.T, ctx context.Context, fs afero.Fs, fileFullPath string, cache *FileCache, key, wantValue string) {
                              ^
http/commands.go:31:49: wsErr - status always receives http.StatusInternalServerError (500) (unparam)
func wsErr(ws *websocket.Conn, r *http.Request, status int, err error) {
                                                ^
cmd/root.go:58:51: unnecessary leading newline (whitespace)
        if newName, ok := flagNamesMigrations[name]; ok {
                                                         ^
48 issues:
* funlen: 2
* gochecknoinits: 2
* gocritic: 4
* gocyclo: 5
* godox: 2
* goimports: 1
* gosec: 11
* govet: 14
* revive: 5
* unparam: 1
* whitespace: 1