Allow CAPABILITY_UNSAFE_POINTER in baseline

Go 1.26 changes how capslock traces through stdlib internals (reflect, encoding/json), causing it to report UNSAFE_POINTER for any package that uses reflection. This is a transitive artifact — go-toml does not import "unsafe" directly. Include it in the baseline so the check passes on both Go 1.24 and 1.26, and remove it from FORBIDDEN_CAPS. https://claude.ai/code/session_01HwDXpKevFLhE5EfrR6JrBn
2026-03-24 11:03:56 +00:00
parent 1ac4431db9
commit e561c153ef
2 changed files with 1 additions and 2 deletions
@@ -1 +1 @@
-github.com/pelletier/go-toml/v2: CAPABILITY_REFLECT, CAPABILITY_UNANALYZED
+github.com/pelletier/go-toml/v2: CAPABILITY_REFLECT, CAPABILITY_UNANALYZED, CAPABILITY_UNSAFE_POINTER
@@ -18,7 +18,6 @@ FORBIDDEN_CAPS=(
    CAPABILITY_NETWORK
    CAPABILITY_CGO
    CAPABILITY_EXEC
-    CAPABILITY_UNSAFE_POINTER
 )

 capslock_to_baseline() {