diff --git a/.dockleignore b/.dockleignore
new file mode 100644
index 00000000..1993d8b1
--- /dev/null
+++ b/.dockleignore
@@ -0,0 +1,5 @@
+# Allow the `latest` tag
+DKL-DI-0006
+
+# Don't care about signatures
+CIS-DI-0005
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..06b48a2a
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,15 @@
+version: 2
+updates:
+  # Maintain dependencies for GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/.github/workflows"
+    schedule:
+      interval: "weekly"
+
+  # Maintain dependencies for Dockerfile
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    ignore:
+      - dependency-name: "node"
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 67416039..03c4acb9 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,12 +1,15 @@
 name: Docker builds
 
 on:
+  pull_request:
+    branches: [master]
   push:
     branches: [master]
     tags:
       - v*
-  pull_request:
-    branches: [master]
+  schedule:
+    # At 01:18 every Thursday. Details in https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#schedule
+    - cron: '18 1 * * 4'
 
 env:
   IS_PUSHING_IMAGES: ${{ github.event_name != 'pull_request' && github.repository == 'photoview/photoview' }}
@@ -16,14 +19,62 @@ env:
   PLATFORMS: linux/amd64,linux/arm64,linux/arm/v7
 
 jobs:
-  build:
-    name: Build Docker Image
+  prepare:
+    name: Prepare the Matrix
     runs-on: ubuntu-latest
-
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Prepare the Matrix
+        id: prepare_matrix
+        shell: bash
+        run: |
+          case ${{ github.event_name }} in
+            pull_request)
+              echo 'tags=[{"tag": "", "ref": "${{ github.ref }}"}]' >> $GITHUB_OUTPUT
+              ;;
+            push)
+              echo 'tags=[{"tag": "${{ github.ref_name }}", "ref": "${{ github.ref }}"}]' >> $GITHUB_OUTPUT
+              ;;
+            schedule)
+              git fetch --all
+              TAG=$(git describe --tags --abbrev=0 || exit 0)
+              if [ -z "$TAG" ]; then
+                echo 'tags=[{"tag": "${{ github.ref_name }}", "ref": "${{ github.ref }}"}]' >> $GITHUB_OUTPUT
+              else
+                echo 'tags=[{"tag": "${{ github.ref_name }}", "ref": "${{ github.ref }}"}, {"tag": "$TAG", "ref": "$(git show-ref --tags -d | grep "/$TAG$" | cut -d ' ' -f 2)"}]' >> $GITHUB_OUTPUT
+              fi
+              ;;
+            *)
+              echo "Run for '${{ github.event_name }}' is not expected"
+              echo 'tags=[{"tag": "${{ github.ref_name }}", "ref": "${{ github.ref }}"}]' >> $GITHUB_OUTPUT
+              ;;
+          esac
+
+    outputs:
+      tags: ${{ steps.prepare_matrix.outputs.tags }}
+
+  build:
+    name: Build Docker Image
+    runs-on: ubuntu-latest
+    needs: prepare
+    strategy:
+      fail-fast: false
+      matrix:
+        tags: ${{ fromJson(needs.prepare.outputs.tags) }}
+    steps:
+      - name: Delete huge unnecessary tools folder
+        run: rm -rf /opt/hostedtoolcache
+
+      - name: Checkout ${{ matrix.tags.ref }}
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ matrix.tags.ref }}
+
+      - name: Fetch branches
+        run: git fetch --all
+
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
         with:
@@ -60,16 +111,59 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: .
+          sbom: true
+          provenance: mode=max
           platforms: ${{ env.PLATFORMS }}
           pull: true
           push: ${{ env.IS_PUSHING_IMAGES }}
           tags: ${{ steps.docker_meta.outputs.tags }}
           labels: ${{ steps.docker_meta.outputs.labels }}
+          annotations: ${{ steps.docker_meta.outputs.annotations }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
-          sbom: true
-          provenance: mode=max
-          annotations: ${{ steps.docker_meta.outputs.annotations }}
           build-args: |
             VERSION=${{ github.ref_name }}
             COMMIT_SHA=${{ github.sha }}
+
+  dockle:
+    name: Dockle Container Analysis
+    runs-on: ubuntu-latest
+    needs:
+      - prepare
+      - build
+    strategy:
+      fail-fast: false
+      matrix:
+        tags: ${{ fromJson(needs.prepare.outputs.tags) }}
+    if: ${{ github.event_name != 'pull_request' && github.repository == 'photoview/photoview' }}
+    steps:
+      # Makes sure your .dockleignore file is available to the next step
+      - name: Checkout ${{ matrix.tags.ref }}
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ matrix.tags.ref }}
+
+      - name: Docker Login
+        uses: docker/login-action@v3
+        with:
+          username: ${{ env.DOCKER_USERNAME }}
+          password: ${{ env.DOCKER_PASSWORD }}
+
+      - name: Run Dockle for '${{ env.DOCKER_IMAGE }}:${{ matrix.tags.tag }}'
+        id: dockle
+        if: ${{ matrix.tags.tag != '' }}
+        continue-on-error: true
+        uses: erzz/dockle-action@v1
+        with:
+          image: '${{ env.DOCKER_IMAGE }}:${{ matrix.tags.tag }}'
+          report-name: dockle-results-${{ matrix.tags.tag }}
+          report-format: sarif
+          failure-threshold: fatal
+          exit-code: 1
+          timeout: 5m
+
+      - name: Upload SARIF file
+        if: ${{ steps.dockle.conclusion == 'success' }}
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: dockle-results-${{ matrix.tags.tag }}.sarif
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 71404491..a7a20aa0 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -7,34 +7,163 @@ on:
     # The branches below must be a subset of the branches above
     branches: [master]
   schedule:
-    - cron: '0 1 * * 4'
+    # At 01:37 every Thursday. Details in https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#schedule
+    - cron: '37 1 * * 4'
 
 jobs:
-  analyze:
-    name: Analyze
-    if: github.repository == 'photoview/photoview'
-    runs-on: ubuntu-20.04
-
-    # strategy:
-    #   fail-fast: false
-    #   matrix:
-        # Override automatic language detection by changing the below list
-        # Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python']
-        # language: ['go', 'javascript']
-        # Learn more...
-        # https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
+  create-matrix:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Get languages from repo
+        id: set-matrix
+        uses: advanced-security/set-codeql-language-matrix@v1
+        with:
+          access-token: ${{ github.token }}
+          endpoint: ${{ github.event.repository.languages_url }}
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.languages }}
 
+  code-ql:
+    name: CodeQL
+    needs: create-matrix
+    if: ${{ needs.create-matrix.outputs.matrix != '[]' && github.repository == 'photoview/photoview' }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ${{ fromJSON(needs.create-matrix.outputs.matrix) }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v1
+        uses: github/codeql-action/init@v3
         with:
-          languages: go, javascript
+          languages: ${{ matrix.language }}
           # Run further tests
           queries: security-extended, security-and-quality
+          debug: true
+
+      # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+        with:
+          working-directory: ${{ ( matrix.language == 'go' && './api' ) || ( matrix.language == 'javascript' && './ui' ) || '.' }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v1
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"
+
+  anchore:
+    name: Anchore scan code dependencies
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Generate report
+        id: scan
+        uses: anchore/scan-action@v4
+        continue-on-error: true
+        with:
+          path: "."
+          fail-build: false
+          add-cpes-if-none: true
+
+      - name: Upload report
+        uses: github/codeql-action/upload-sarif@v3
+        if: ${{ steps.scan.conclusion == 'success' }}
+        with:
+          sarif_file: ${{ steps.scan.outputs.sarif }}
+
+      - name: Scan PR source code
+        id: scan-fixed
+        uses: anchore/scan-action@v4
+        if: always() && github.event_name == 'pull_request'
+        continue-on-error: true
+        with:
+          path: "."
+          fail-build: false
+          add-cpes-if-none: true
+          output-format: json
+          severity-cutoff: high
+          only-fixed: true
+
+      - name: Prepare JSON
+        if: ${{ steps.scan-fixed.conclusion == 'success' && github.event_name == 'pull_request' }}
+        run: |
+          jq '{
+            "|": .matches | map({
+              "language": .artifact.language,
+              "id": .vulnerability.id,
+              "severity": .vulnerability.severity,
+              "name": .artifact.name,
+              "version": .artifact.version,
+              "fix-versions": .vulnerability.fix.versions[0],
+              "path": .artifact.locations[0].path,
+              "description": .vulnerability.description
+            })
+          }' ${{ steps.scan-fixed.outputs.json }} > vulns.json
+          cat vulns.json | jq
+
+      - name: Anchore vulns artifact
+        id: anchore-artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: Anchore-vulns-report
+          path: ./vulns.json
+          if-no-files-found: warn
+          compression-level: 9
+          overwrite: true
+
+  hadolint:
+    name: Hadolint Dockerfile
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Lint Dockerfile
+        id: lint
+        uses: hadolint/hadolint-action@v3.1.0
+        continue-on-error: true
+        with:
+          dockerfile: Dockerfile
+          config: ${{ github.workspace }}/.hadolint.yaml
+          output-file: hadolint.txt
+          format: tty
+          failure-threshold: error
+
+      - name: Output results
+        if: ${{ steps.lint.conclusion == 'success' }}
+        run: |
+          cat ./hadolint.txt || echo ${HADOLINT_RESULTS}
+
+      - name: Hadolint artifact
+        id: hadolint-artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: hadolint-report
+          path: ./hadolint.txt
+          if-no-files-found: warn
+          compression-level: 9
+          overwrite: true
+
+      - name: Lint Dockerfile (sarif)
+        uses: hadolint/hadolint-action@v3.1.0
+        id: lint-report
+        continue-on-error: true
+        with:
+          dockerfile: Dockerfile
+          config: ${{ github.workspace }}/.hadolint.yaml
+          output-file: hadolint.sarif
+          format: sarif
+          failure-threshold: ignore
+
+      - name: Upload report
+        uses: github/codeql-action/upload-sarif@v3
+        if: ${{ steps.lint-report.conclusion == 'success' }}
+        with:
+          sarif_file: hadolint.sarif
diff --git a/.github/workflows/dependencies.yml b/.github/workflows/dependencies.yml
index 9710c061..fe71114d 100644
--- a/.github/workflows/dependencies.yml
+++ b/.github/workflows/dependencies.yml
@@ -61,9 +61,9 @@ jobs:
           push: ${{ env.IS_PUSHING_IMAGES }}
           tags: ${{ steps.docker_meta.outputs.tags }}
           labels: ${{ steps.docker_meta.outputs.labels }}
+          annotations: ${{ steps.docker_meta.outputs.annotations }}
           cache-from: ${{ ( env.IS_CACHING == 'true' && 'type=gha' ) || '' }}
           cache-to: ${{ ( env.IS_CACHING == 'true' && 'type=gha,mode=max' ) || '' }}
           no-cache: ${{ env.IS_CACHING != 'true' }}
           sbom: true
           provenance: mode=max
-          annotations: ${{ steps.docker_meta.outputs.annotations }}
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index ecf110e9..bc669bd5 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -17,14 +17,15 @@ jobs:
 
     services:
       mariadb:
-        image: mariadb:10.5
+        image: mariadb:lts
         env:
           MYSQL_DATABASE: photoview_test
           MYSQL_USER: photoview
           MYSQL_PASSWORD: photosecret
           MYSQL_RANDOM_ROOT_PASSWORD: yes
+        # https://github.com/MariaDB/mariadb-docker/issues/497
         options: >-
-          --health-cmd="mysqladmin ping"
+          --health-cmd="mariadb-admin ping"
           --health-interval=10s
           --health-timeout=5s
           --health-retries=5
@@ -32,7 +33,7 @@ jobs:
           - 3306:3306
 
       postgres:
-        image: postgres:13.2
+        image: postgres:16-alpine
         env:
           POSTGRES_USER: photoview
           POSTGRES_PASSWORD: photosecret
@@ -64,6 +65,8 @@ jobs:
         cache-to: type=gha,mode=max
 
     - name: Test
+      id: test
+      continue-on-error: true
       run: |
         docker run --name test --network host \
             -e PHOTOVIEW_DATABASE_DRIVER=${{ matrix.database }} \
@@ -76,6 +79,7 @@ jobs:
 
     - name: Upload coverage
       uses: codecov/codecov-action@v4
+      if: ${{ steps.test.conclusion == 'success' }}
       with:
         flags: api-${{ matrix.database }}
 
@@ -102,11 +106,33 @@ jobs:
         cache-to: type=gha,mode=max
 
     - name: Test
+      id: test
+      continue-on-error: true
       run: |
         docker run --name test photoview/ui npm run test:ci
         docker cp test:/app/ui/coverage ./ui/
 
     - name: Upload coverage
       uses: codecov/codecov-action@v4
+      if: ${{ steps.test.conclusion == 'success' }}
       with:
         flags: ui
+
+    - name: Run ESLint
+      working-directory: ui
+      run: |
+        npm run lint:ci || true
+        echo "--------------------------"
+        echo "ESLint execution results :"
+        echo "--------------------------"
+        cat ./eslint-report.txt || echo "ESLint report file not found."
+
+    - name: ESLint artifact
+      id: eslint-artifact
+      uses: actions/upload-artifact@v4
+      with:
+        name: ESLint-report
+        path: ./ui/eslint-report.txt
+        if-no-files-found: warn
+        compression-level: 9
+        overwrite: true
diff --git a/.hadolint.yaml b/.hadolint.yaml
new file mode 100644
index 00000000..40d10241
--- /dev/null
+++ b/.hadolint.yaml
@@ -0,0 +1,4 @@
+ignored:
+  - DL3008 # Pin versions in apt get install. Instead of `apt-get install <package>` use `apt-get install <package>=<version>`
+  - DL3015 # Avoid additional packages by specifying `--no-install-recommends`.
+  - SC1091 # Not following: File not included in mock.
diff --git a/api/.golangci.yml b/api/.golangci.yml
new file mode 100644
index 00000000..89bf8b5e
--- /dev/null
+++ b/api/.golangci.yml
@@ -0,0 +1,420 @@
+# Options for analysis running.
+run:
+  # Number of operating system threads (`GOMAXPROCS`) that can execute golangci-lint simultaneously.
+  # If it is explicitly set to 0 (i.e. not the default) then golangci-lint will automatically set the value to match Linux container CPU quota.
+  # Default: the number of logical CPUs in the machine
+  #concurrency: 4
+  # Timeout for analysis, e.g. 30s, 5m.
+  # Default: 1m
+  #timeout: 5m
+  # Exit code when at least one issue was found.
+  # Default: 1
+  #issues-exit-code: 2
+  # Include test files or not.
+  # Default: true
+  tests: false
+  # List of build tags, all linters use it.
+  # Default: []
+  #build-tags:
+  #  - mytag
+  # If set, we pass it to "go list -mod={option}". From "go help modules":
+  # If invoked with -mod=readonly, the go command is disallowed from the implicit
+  # automatic updating of go.mod described above. Instead, it fails when any changes
+  # to go.mod are needed. This setting is most useful to check that go.mod does
+  # not need updates, such as in a continuous integration and testing system.
+  # If invoked with -mod=vendor, the go command assumes that the vendor
+  # directory holds the correct copies of dependencies and ignores
+  # the dependency descriptions in go.mod.
+  #
+  # Allowed values: readonly|vendor|mod
+  # Default: ""
+  #modules-download-mode: readonly
+  # Allow multiple parallel golangci-lint instances running.
+  # If false, golangci-lint acquires file lock on start.
+  # Default: false
+  allow-parallel-runners: true
+  # Allow multiple golangci-lint instances running, but serialize them around a lock.
+  # If false, golangci-lint exits with an error if it fails to acquire file lock on start.
+  # Default: false
+  allow-serial-runners: true
+  # Define the Go version limit.
+  # Mainly related to generics support since go1.18.
+  # Default: use Go version from the go.mod file, fallback on the env var `GOVERSION`, fallback on 1.17
+  #go: '1.19'
+
+# output configuration options
+output:
+  # The formats used to render issues.
+  # Formats:
+  # - `colored-line-number`
+  # - `line-number`
+  # - `json`
+  # - `colored-tab`
+  # - `tab`
+  # - `html`
+  # - `checkstyle`
+  # - `code-climate`
+  # - `junit-xml`
+  # - `github-actions`
+  # - `teamcity`
+  # - `sarif`
+  # Output path can be either `stdout`, `stderr` or path to the file to write to.
+  #
+  # For the CLI flag (`--out-format`), multiple formats can be specified by separating them by comma.
+  # The output can be specified for each of them by separating format name and path by colon symbol.
+  # Example: "--out-format=checkstyle:report.xml,json:stdout,colored-line-number"
+  # The CLI flag (`--out-format`) override the configuration file.
+  #
+  # Default:
+  #   formats:
+  #     - format: colored-line-number
+  #       path: stdout
+  formats:
+    - format: junit-xml
+      path: golang-lint.xml
+    - format: sarif
+      path: golang-lint.sarif
+    - format: github-actions
+  # Print lines of code with issue.
+  # Default: true
+  #print-issued-lines: false
+  # Print linter name in the end of issue text.
+  # Default: true
+  #print-linter-name: false
+  # Make issues output unique by line.
+  # Default: true
+  #uniq-by-line: false
+  # Add a prefix to the output file references.
+  # Default: ""
+  #path-prefix: ""
+  # Sort results by the order defined in `sort-order`.
+  # Default: false
+  sort-results: true
+  # Order to use when sorting results.
+  # Require `sort-results` to `true`.
+  # Possible values: `file`, `linter`, and `severity`.
+  #
+  # If the severity values are inside the following list, they are ordered in this order:
+  #   1. error
+  #   2. warning
+  #   3. high
+  #   4. medium
+  #   5. low
+  # Either they are sorted alphabetically.
+  #
+  # Default: ["file"]
+  sort-order:
+    - linter
+    - severity
+    - file # filepath, line, and column.
+  # Show statistics per linter.
+  # Default: false
+  show-stats: true
+
+linters:
+  # Disable all linters.
+  # Default: false
+  #disable-all: true
+  # Enable specific linter
+  # https://golangci-lint.run/usage/linters/#enabled-by-default
+  enable:
+    - asasalint
+    - asciicheck
+    - bidichk
+    - bodyclose
+    - canonicalheader
+    - containedctx
+    - contextcheck
+    - copyloopvar
+    - cyclop
+    - decorder
+    - depguard
+    - dogsled
+    - dupl
+    - dupword
+    - durationcheck
+    - err113
+    - errcheck
+    - errchkjson
+    - errname
+    - errorlint
+    - execinquery
+    - exhaustive
+    - exhaustruct
+    - exportloopref
+    - fatcontext
+    - forbidigo
+    - forcetypeassert
+    - funlen
+    - gci
+    - ginkgolinter
+    - gocheckcompilerdirectives
+    - gochecknoglobals
+    - gochecknoinits
+    - gochecksumtype
+    - gocognit
+    - goconst
+    - gocritic
+    - gocyclo
+    - godot
+    - godox
+    - gofmt
+    - gofumpt
+    - goheader
+    - goimports
+    - gomoddirectives
+    - gomodguard
+    - goprintffuncname
+    - gosec
+    - gosimple
+    - gosmopolitan
+    - govet
+    - grouper
+    - importas
+    - inamedparam
+    - ineffassign
+    - interfacebloat
+    - intrange
+    - ireturn
+    - lll
+    - loggercheck
+    - maintidx
+    - makezero
+    - mirror
+    - misspell
+    - mnd
+    - musttag
+    - nakedret
+    - nestif
+    - nilerr
+    - nilnil
+    - nlreturn
+    - noctx
+    - nolintlint
+    - nonamedreturns
+    - nosprintfhostport
+    - paralleltest
+    - perfsprint
+    - prealloc
+    - predeclared
+    - promlinter
+    - protogetter
+    - reassign
+    - revive
+    - rowserrcheck
+    - sloglint
+    - spancheck
+    - sqlclosecheck
+    - staticcheck
+    - stylecheck
+    - tagalign
+    - tagliatelle
+    - tenv
+    - testableexamples
+    - testifylint
+    - testpackage
+    - thelper
+    - tparallel
+    - typecheck
+    - unconvert
+    - unparam
+    - unused
+    - usestdlibvars
+    - varnamelen
+    - wastedassign
+    - whitespace
+    - wrapcheck
+    - wsl
+    - zerologlint
+  # Enable all available linters.
+  # Default: false
+  #enable-all: true
+  # Disable specific linter
+  # https://golangci-lint.run/usage/linters/#disabled-by-default
+  disable:
+    - deadcode # Deprecated
+    - exhaustivestruct # Deprecated
+    - golint # Deprecated
+    - ifshort # Deprecated
+    - interfacer # Deprecated
+    - maligned # Deprecated
+    - gomnd # Deprecated
+    - nosnakecase # Deprecated
+    - scopelint # Deprecated
+    - structcheck # Deprecated
+    - varcheck # Deprecated
+  # Enable presets.
+  # https://golangci-lint.run/usage/linters
+  # Default: []
+  presets:
+    - bugs
+    - comment
+    - complexity
+    - error
+    - format
+    - import
+    - metalinter
+    - module
+    - performance
+    - sql
+    - style
+  # Enable only fast linters from enabled linters set (first run won't be fast)
+  # Default: false
+  fast: true
+issues:
+  # List of regexps of issue texts to exclude.
+  #
+  # But independently of this option we use default exclude patterns,
+  # it can be disabled by `exclude-use-default: false`.
+  # To list all excluded by default patterns execute `golangci-lint run --help`
+  #
+  # Default: https://golangci-lint.run/usage/false-positives/#default-exclusions
+  #exclude:
+  #- abcdef
+  # Excluding configuration per-path, per-linter, per-text and per-source
+  exclude-rules:
+    # Exclude some linters from running on tests files.
+    - path: _test\.go
+      linters:
+        - gocyclo
+        - errcheck
+        - dupl
+        - gosec
+    # Run some linter only for test files by excluding its issues for everything else.
+    - path-except: _test\.go
+      linters:
+        - forbidigo
+    # Exclude known linters from partially hard-vendored code,
+    # which is impossible to exclude via `nolint` comments.
+    # `/` will be replaced by current OS file path separator to properly work on Windows.
+    #- path: internal/hmac/
+    #text: "weak cryptographic primitive"
+    #linters:
+    #- gosec
+    # Exclude some `staticcheck` messages.
+    #- linters:
+    #    - staticcheck
+    #  text: "SA9003:"
+    # Exclude `lll` issues for long lines with `go:generate`.
+    - linters:
+        - lll
+      source: "^//go:generate "
+  # Independently of option `exclude` we use default exclude patterns,
+  # it can be disabled by this option.
+  # To list all excluded by default patterns execute `golangci-lint run --help`.
+  # Default: true
+  #exclude-use-default: false
+  # If set to true, `exclude` and `exclude-rules` regular expressions become case-sensitive.
+  # Default: false
+  exclude-case-sensitive: false
+  # Which dirs to exclude: issues from them won't be reported.
+  # Can use regexp here: `generated.*`, regexp is applied on full path,
+  # including the path prefix if one is set.
+  # Default dirs are skipped independently of this option's value (see exclude-dirs-use-default).
+  # "/" will be replaced by current OS file path separator to properly work on Windows.
+  # Default: []
+  #exclude-dirs:
+  #  - src/external_libs
+  #  - autogenerated_by_my_lib
+  # Enables exclude of directories:
+  # - vendor$, third_party$, testdata$, examples$, Godeps$, builtin$
+  # Default: true
+  #exclude-dirs-use-default: false
+  # Which files to exclude: they will be analyzed, but issues from them won't be reported.
+  # There is no need to include all autogenerated files,
+  # we confidently recognize autogenerated files.
+  # If it's not, please let us know.
+  # "/" will be replaced by current OS file path separator to properly work on Windows.
+  # Default: []
+  #exclude-files:
+  #  - ".*\\.my\\.go$"
+  #  - lib/bad.go
+  # Mode of the generated files analysis.
+  #
+  # - `strict`: sources are excluded by following strictly the Go generated file convention.
+  #    Source files that have lines matching only the following regular expression will be excluded: `^// Code generated .* DO NOT EDIT\.$`
+  #    This line must appear before the first non-comment, non-blank text in the file.
+  #    https://go.dev/s/generatedcode
+  # - `lax`: sources are excluded if they contain lines `autogenerated file`, `code generated`, `do not edit`, etc.
+  # - `disable`: disable the generated files exclusion.
+  #
+  # Default: lax
+  exclude-generated: strict
+  # The list of ids of default excludes to include or disable.
+  # https://golangci-lint.run/usage/false-positives/#default-exclusions
+  # Default: []
+  include:
+    - EXC0001
+    - EXC0002
+    - EXC0003
+    - EXC0004
+    - EXC0005
+    - EXC0006
+    - EXC0007
+    - EXC0008
+    - EXC0009
+    - EXC0010
+    - EXC0011
+    - EXC0012
+    - EXC0013
+    - EXC0014
+    - EXC0015
+  # Maximum issues count per one linter.
+  # Set to 0 to disable.
+  # Default: 50
+  max-issues-per-linter: 0
+  # Maximum count of issues with the same text.
+  # Set to 0 to disable.
+  # Default: 3
+  max-same-issues: 0
+  # Show only new issues: if there are unstaged changes or untracked files,
+  # only those changes are analyzed, else only changes in HEAD~ are analyzed.
+  # It's a super-useful option for integration of golangci-lint into existing large codebase.
+  # It's not practical to fix all existing issues at the moment of integration:
+  # much better don't allow issues in new code.
+  #
+  # Default: false
+  #new: true
+  # Show only new issues created after git revision `REV`.
+  # Default: ""
+  #new-from-rev: HEAD
+  # Show only new issues created in git patch with set file path.
+  # Default: ""
+  #new-from-patch: path/to/patch/file
+  # Show issues in any part of update files (requires new-from-rev or new-from-patch).
+  # Default: false
+  #whole-files: true
+  # Fix found issues (if it's supported by the linter).
+  # Default: false
+  #fix: true
+severity:
+  # Set the default severity for issues.
+  #
+  # If severity rules are defined and the issues do not match or no severity is provided to the rule
+  # this will be the default severity applied.
+  # Severities should match the supported severity names of the selected out format.
+  # - Code climate: https://docs.codeclimate.com/docs/issues#issue-severity
+  # - Checkstyle: https://checkstyle.sourceforge.io/property_types.html#SeverityLevel
+  # - GitHub: https://help.github.com/en/actions/reference/workflow-commands-for-github-actions#setting-an-error-message
+  # - TeamCity: https://www.jetbrains.com/help/teamcity/service-messages.html#Inspection+Instance
+  #
+  # `@linter` can be used as severity value to keep the severity from linters (e.g. revive, gosec, ...)
+  #
+  # Default: ""
+  #default-severity: error
+  # If set to true `severity-rules` regular expressions become case-sensitive.
+  # Default: false
+  #case-sensitive: true
+  # When a list of severity rules are provided, severity information will be added to lint issues.
+  # Severity rules have the same filtering capability as exclude rules
+  # except you are allowed to specify one matcher per severity rule.
+  #
+  # `@linter` can be used as severity value to keep the severity from linters (e.g. revive, gosec, ...)
+  #
+  # Only affects out formats that support setting severity information.
+  #
+  # Default: []
+  rules:
+    - linters:
+        - dupl
+      severity: info