all: sync with master

scripts/make/Dockerfile

@@ -48,6 +48,9 @@ RUN setcap 'cap_net_bind_service=+eip' /opt/adguardhome/AdGuardHome
 # 5443   : TCP, UDP : DNSCrypt (alt)
 # 6060   : TCP      : HTTP (pprof)
 # 8853   :      UDP : DNS-over-QUIC (experimental)
+#
+# TODO(a.garipov): Remove the old, non-standard 784 and 8853 ports for
+# DNS-over-QUIC in a future release.
 EXPOSE 53/tcp 53/udp 67/udp 68/udp 80/tcp 443/tcp 443/udp 784/udp\
 	853/tcp 853/udp 3000/tcp 3000/udp 3001/tcp 3001/udp 5443/tcp\
 	5443/udp 6060/tcp 8853/udp

scripts/make/go-lint.sh

@@ -218,14 +218,17 @@ exit_on_output gofumpt --extra -e -l .
 
 "$GO" vet ./...
 
+govulncheck ./...
+
 # Apply more lax standards to the code we haven't properly refactored yet.
-gocyclo --over 17 ./internal/dhcpd/ ./internal/dnsforward/\
-	./internal/filtering/ ./internal/home/ ./internal/querylog/
+gocyclo --over 17 ./internal/querylog/
+gocyclo --over 15 ./internal/home/ ./internal/dhcpd
+gocyclo --over 13 ./internal/filtering/
 
 # Apply stricter standards to new or somewhat refactored code.
 gocyclo --over 10 ./internal/aghio/ ./internal/aghnet/ ./internal/aghos/\
-	./internal/aghtest/ ./internal/stats/ ./internal/tools/\
-	./internal/updater/ ./internal/version/ ./main.go
+	./internal/aghtest/ ./internal/dnsforward/ ./internal/stats/\
+	./internal/tools/ ./internal/updater/ ./internal/version/ ./main.go
 
 ineffassign ./...
 

scripts/make/go-tools.sh

@@ -32,10 +32,13 @@ readonly go
 # prevent the "cannot install cross-compiled binaries when GOBIN is set" error.
 env\
 	GOARCH=""\
-	GOOS=""\
 	GOBIN="${PWD}/bin"\
-	"$go" install --modfile=./internal/tools/go.mod\
-	$v_flags $x_flags\
+	GOOS=""\
+	GOWORK='off'\
+	"$go" install\
+	--modfile=./internal/tools/go.mod\
+	$v_flags\
+	$x_flags\
 	github.com/fzipp/gocyclo/cmd/gocyclo\
 	github.com/golangci/misspell/cmd/misspell\
 	github.com/gordonklaus/ineffassign\
@@ -44,6 +47,7 @@ env\
 	github.com/securego/gosec/v2/cmd/gosec\
 	golang.org/x/tools/go/analysis/passes/nilness/cmd/nilness\
 	golang.org/x/tools/go/analysis/passes/shadow/cmd/shadow\
+	golang.org/x/vuln/cmd/govulncheck\
 	honnef.co/go/tools/cmd/staticcheck\
 	mvdan.cc/gofumpt\
 	mvdan.cc/unparam\

scripts/translations/download.js

@@ -1,3 +1,6 @@
+// TODO(a.garipov): Rewrite this in Go; add better concurrency controls; add
+// features for easier maintenance.
+
 const fs = require('fs');
 const path = require('path');
 const requestPromise = require('request-promise');
@@ -107,7 +110,7 @@ const download = async () => {
 
         // Don't request the Crowdin API too aggressively to prevent spurious
         // 400 errors.
-        await sleep(200);
+        await sleep(400);
     }
 
     Promise