> golangci-lint gets updated and all CI builds start failing because of newly added linters
IMHO a choice would be nice.
If my policy is “this project should pass golangci-lint”, not “should pass golangci-lint vx.y”, I do want to be alerted to the slightly unlikely scenario of code falling out of compliance with newly added default-on linters. Having it automatically occur with the latest version is certainly better than having to update the version all the time, even if there’s a dependabot submitting PRs (still requires some effort, and pollutes commit history).
Other people can choose to pin versions, of course, especially on highly active projects.