Phase 3 of the SDK maturity plan (dev-docs/SDK_MATURITY_PLAN.md) asks for a modernizer pass per repo, reviewed as its own PR. This is that pass for bomly-cli.

Tool

go fix from the Go 1.27.0 toolchain — i.e. cmd/fix, which since Go 1.26 carries the modernizer analyzers that previously lived in golang.org/x/tools/gopls/internal/analysis/modernize. There is no separate modernize binary to fetch on this toolchain; go tool fix help lists the 27 registered analyzers, and go fix -diff prints the patch without applying it.

Every category was reviewed in -diff mode first, per analyzer, before anything was applied. The final command was:

go fix -embedlit=false -omitzero=false -stringsbuilder=false ./...

What changed

88 files, no behavior changes. Sites rewritten per analyzer:

stringsseq is the one with a real runtime effect: it drops the intermediate slice allocation in the lockfile and build-tool output parsers, which run per line over untrusted input.

What was rejected

The three disabled analyzers, plus two individual hunks. Each declined hunk that go fix will offer again now carries a short comment at the call site saying so, so the next pass does not re-litigate it from scrollback.

• embedlit (119 sites) — flattens Coordinates: sdk.Coordinates{...} into the surrounding literal at all 119 sites. Coordinates is a named identity concept (dev-docs/MODELS.md, ADR-0041); writing it explicitly is documentation, not redundancy. The rewrite also reflows multi-line literals badly (dangling }) and lost key alignment), and it would churn 49 files — 4 of them under internal/detectors/node/ — for no behavior or performance gain.
• omitzero (2 sites) — drops omitempty from struct-valued JSON fields in internal/output/view.go and internal/benchmark/summary.go. The tool's own preferred fix (omitempty → omitzero) is a behavior change it declines to make; the fallback it does offer has no upside and moves a published output contract that docs/schemas/* and the goldens key on.
• stringsbuilder (2 sites) — rewrites small bounded TUI concatenations into strings.Builder while still concatenating inside WriteString(" " + x). Readability loss, no allocation win.
• maps.Copy in mergeBunDependencyMaps (internal/detectors/node/bun/bun_lockfile_parser.go) — the variadic parameter is named maps, so the fix imports the stdlib package as maps0. The explicit loop reads better than the alias.
• max() in cycloneDXDocumentAssertions (internal/sbom/cyclonedx_assertions.go) — the rewrite hoists the ADR-0037 comment that explains the default into the middle of the max(...) call arguments.

Golden-backed areas

internal/sbom and internal/output were reviewed hunk by hunk. What landed there is slices.Contains, maps.Copy, and strings.SplitSeq in lookup/clone helpers — nothing that touches field ordering, tags, or emitted values. Confirmed by the suite and by make generate producing no drift.

Verification

make verify passes end to end: fmt-check, golangci-lint (0 issues), go vet on the default and lite build tags, go vet -tags smoke, both builds, go test ./..., and make generate with a clean git diff -- docs/.

Note for reviewers: overlap with the in-flight internal/detectors work

19 files under internal/detectors/ are touched here, in case a concurrent branch is routing purl-type literals through the SDK:

cargo/detector.go                 cargo/workspace.go
cocoapods/detector.go             conan/detector.go
gomod/detector.go                 gradle/detector.go
guards_test.go                    maven/detector.go
node/bun/bun_lockfile_parser.go   node/bun/bun_native_parser.go
node/lockfile_common.go           node/package_manager_warnings.go
node/pnpm/pnpm_lockfile_parser.go node/yarn/yarn_lockfile_parser.go
nuget/detector.go                 python/common.go
python/piplock_test.go            ruby/detector.go
sbt/sbt_native.go

All of it is line-local (slices.Contains, strings.Cut/CutPrefix, SplitSeq, maps.Copy, max()) inside parser and helper functions. Rejecting embedlit kept the sdk.Coordinates literals — the construct that branch is most likely editing — untouched.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Refactor

  • Modernized internal processing, iteration, string handling, collection checks, map copying, reflection, and layout calculations using current Go standard-library features.
  • Parsing, validation, dependency analysis, reporting, and terminal interface behavior remain unchanged.
  • Some line-processing paths avoid unnecessary intermediate allocations.

• Tests

  • Updated test utilities and loops to use modern Go syntax and standard-library helpers.
  • Existing assertions and coverage remain unchanged.