chore: modernize Go to 1.25 idioms

cmd/bumblebee/main.go

@@ -50,7 +50,7 @@ type stringList []string
 
 func (s *stringList) String() string { return strings.Join(*s, ",") }
 func (s *stringList) Set(v string) error {
-	for _, x := range strings.Split(v, ",") {
+	for x := range strings.SplitSeq(v, ",") {
 		x = strings.TrimSpace(x)
 		if x != "" {
 			*s = append(*s, x)
@@ -426,7 +426,7 @@ func parseEcosystemFilter(values []string) (map[string]bool, error) {
 	filter := make(map[string]bool, len(values))
 	var invalid []string
 	for _, value := range values {
-		for _, part := range strings.Split(value, ",") {
+		for part := range strings.SplitSeq(value, ",") {
 			ecosystem := strings.TrimSpace(part)
 			if ecosystem == "" {
 				continue

internal/ecosystem/mcp/mcp.go

@@ -37,9 +37,11 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"maps"
 	"net/url"
 	"os"
 	"path/filepath"
+	"slices"
 	"sort"
 	"strings"
 
@@ -83,7 +85,7 @@ func IsGeminiSettingsJSON(path string) bool {
 type serverEntry struct {
 	Command   string                 `json:"command"`
 	Args      []string               `json:"args"`
-	Env       map[string]interface{} `json:"env"`
+	Env       map[string]any         `json:"env"`
 	URL       string                 `json:"url"`
 	ServerURL string                 `json:"serverUrl"`
 	HTTPURL   string                 `json:"httpUrl"`
@@ -157,9 +159,7 @@ func (s *Scanner) ScanConfig(path string, base model.Record) error {
 	servers := map[string]serverEntry{}
 	envErr := json.Unmarshal(data, &env1)
 	if envErr == nil {
-		for k, v := range env1.MCPServers {
-			servers[k] = v
-		}
+		maps.Copy(servers, env1.MCPServers)
 		for k, v := range env1.Servers {
 			if _, ok := servers[k]; !ok {
 				servers[k] = v
@@ -302,7 +302,7 @@ func looksUnresolvedShellVar(s string) bool {
 	}
 	// $VAR — require a leading "$" followed by an identifier char so a
 	// literal "$" elsewhere in a path doesn't trigger.
-	for i := 0; i < len(s)-1; i++ {
+	for i := range len(s) - 1 {
 		if s[i] == '$' {
 			c := s[i+1]
 			if c == '_' || (c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z') {
@@ -398,14 +398,8 @@ func inferPackageFromArgs(cmd string, args []string) (spec, launcher string) {
 		// spec so the caller falls back to the server id with low
 		// confidence. "uv tool run <pkg>" is a published-tool invocation
 		// and is handled below.
-		hasTool := false
-		for _, a := range args {
-			if a == "tool" {
-				hasTool = true
-				break
-			}
-		}
-		for i := 0; i < len(args); i++ {
+		hasTool := slices.Contains(args, "tool")
+		for i := range len(args) {
 			if args[i] == "--from" && i+1 < len(args) {
 				return args[i+1], "uv"
 			}
@@ -419,7 +413,7 @@ func inferPackageFromArgs(cmd string, args []string) (spec, launcher string) {
 	case "pipx":
 		// pipx is the PyPI-equivalent of npx and uvx. Honor "pipx run --spec <pkg> <entry>"
 		// so an explicit --spec wins over the entry-point name when they differ.
-		for i := 0; i < len(args); i++ {
+		for i := range len(args) {
 			if args[i] == "--spec" && i+1 < len(args) {
 				return args[i+1], "pipx"
 			}
@@ -497,8 +491,8 @@ func scanExplicitPackage(args []string, skip map[string]bool) string {
 		if a == "--" {
 			return ""
 		}
-		if strings.HasPrefix(a, "--package=") {
-			return strings.TrimPrefix(a, "--package=")
+		if pkg, ok := strings.CutPrefix(a, "--package="); ok {
+			return pkg
 		}
 		if a == "--package" && i+1 < len(args) {
 			return args[i+1]

internal/ecosystem/pnpm/pnpm.go

@@ -447,8 +447,8 @@ func parsePnpmImporterDirects(data []byte) map[string]struct{} {
 
 		// Indent 6: entry. Either `name:` (v6/v9 nested) or `name: version`.
 		if indent == 6 {
-			if strings.HasSuffix(trim, ":") {
-				curName = strings.Trim(strings.TrimSuffix(trim, ":"), "'\"")
+			if name, ok := strings.CutSuffix(trim, ":"); ok {
+				curName = strings.Trim(name, "'\"")
 				continue
 			}
 			if i := strings.IndexByte(trim, ':'); i > 0 {
@@ -515,7 +515,7 @@ func parseFlowMap(body string) map[string]string {
 	depth := 0
 	inStr := byte(0)
 	start := 0
-	for i := 0; i < len(body); i++ {
+	for i := range len(body) {
 		c := body[i]
 		if inStr != 0 {
 			if c == inStr {
@@ -547,7 +547,7 @@ func parseFlowMap(body string) map[string]string {
 		// a `:` inside a quoted key is not treated as the separator.
 		sep := -1
 		qs := byte(0)
-		for i := 0; i < len(f); i++ {
+		for i := range len(f) {
 			c := f[i]
 			if qs != 0 {
 				if c == qs {

internal/ecosystem/pypi/pypi.go

@@ -185,7 +185,7 @@ func parseRFC822NameVersion(data []byte) (name, version string) {
 		// Continuation lines start with whitespace; skip them (we only
 		// care about Name/Version which are single-line in practice).
 		if len(trim) > 0 && (trim[0] == ' ' || trim[0] == '\t') {
-			if err == io.EOF {
+			if errors.Is(err, io.EOF) {
 				break
 			}
 			continue

internal/ecosystem/rubygems/rubygems.go

@@ -209,7 +209,7 @@ func looksLikeRubyABI(s string) bool {
 		return false
 	}
 	hasDigit := false
-	for i := 0; i < len(s); i++ {
+	for i := range len(s) {
 		c := s[i]
 		if c >= '0' && c <= '9' {
 			hasDigit = true

internal/output/httpsink_test.go

@@ -77,7 +77,7 @@ func TestHTTPSink_BearerAuth_BatchAndFlush(t *testing.T) {
 	}
 
 	e := New(sink, io.Discard, "run-1")
-	for i := 0; i < 3; i++ {
+	for i := range 3 {
 		if _, err := e.Emit(model.Record{
 			Ecosystem:      "npm",
 			NormalizedName: "a",
@@ -187,7 +187,7 @@ func TestHTTPSink_GzipEncodesBody(t *testing.T) {
 		t.Fatal(err)
 	}
 	e := New(sink, io.Discard, "run-1")
-	for i := 0; i < 3; i++ {
+	for i := range 3 {
 		if _, err := e.Emit(model.Record{
 			Ecosystem:      "npm",
 			NormalizedName: "lodash",

internal/scanner/scanner.go

@@ -260,10 +260,8 @@ func Run(ctx context.Context, cfg Config) (Result, error) {
 	jobs := make(chan job, 256)
 
 	var wg sync.WaitGroup
-	for i := 0; i < cfg.Concurrency; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
+	for range cfg.Concurrency {
+		wg.Go(func() {
 			for j := range jobs {
 				select {
 				case <-ctx.Done():
@@ -319,7 +317,7 @@ func Run(ctx context.Context, cfg Config) (Result, error) {
 					cfg.Emitter.Diag("error", j.path, err.Error())
 				}
 			}
-		}()
+		})
 	}
 
 	var filesConsidered int