From 2a0603a0d8f18a95cd1a4314be2cac7b50b309a0 Mon Sep 17 00:00:00 2001 From: Chris Stockton Date: Mon, 11 May 2026 15:30:23 -0700 Subject: [PATCH 1/3] feat: fix the vulncheck-filter to parse the text format instead The existing parser wasn't decoding any values. Once I fixed the decoding it started printing 64 results. After looking into it I realized that govulncheck cmd does some additional aggregation. It turns out that it's non-trivial, rather than try to duplicate that I just parsed the text output instead. --- Makefile | 2 +- hack/vulncheck-filter/main.go | 101 +++++++++++++++++++++------------- 2 files changed, 63 insertions(+), 40 deletions(-) diff --git a/Makefile b/Makefile index 232af4beab..bde8af47a3 100644 --- a/Makefile +++ b/Makefile @@ -136,7 +136,7 @@ sec: | $(TOOL_BIN_DIR)/gosec # Check for security vulnerabilities $(CHECK_FILES) vulncheck: $(TOOL_BIN_DIR)/govulncheck # Check for known vulnerabilities - $(TOOL_BIN_DIR)/govulncheck -format json $(CHECK_FILES) | go run ./hack/vulncheck-filter + $(TOOL_BIN_DIR)/govulncheck $(CHECK_FILES) | go run ./hack/vulncheck-filter unused: | $(TOOL_BIN_DIR)/staticcheck # Look for unused code @echo "Unused code:" diff --git a/hack/vulncheck-filter/main.go b/hack/vulncheck-filter/main.go index 4bc5cd23c1..49467ecfac 100644 --- a/hack/vulncheck-filter/main.go +++ b/hack/vulncheck-filter/main.go @@ -1,10 +1,12 @@ package main import ( - "encoding/json" + "bufio" + "errors" "fmt" - "io" "os" + "slices" + "strings" ) // Vulnerabilities with no upstream fix — remove entries once fixed. @@ -12,50 +14,71 @@ var ignore = map[string]string{ "GO-2026-4518": "pgproto3/v2 DoS, no fix available (EOL). Transitive via pgconn v1 + pop/v6.", } -type message struct { - Finding *struct { - OSV *struct { - ID string `json:"id"` - } `json:"osv"` - } `json:"finding"` +func main() { + if err := run(); err != nil { + fmt.Fprintf(os.Stderr, "vulncheck-filter: %v\n", err) + os.Exit(1) + } } -func main() { - dec := json.NewDecoder(os.Stdin) +func run() error { + const ( + stInit = iota + stVulnOpen + ) - var unignored []string - seen := make(map[string]bool) - for { - var m message - if err := dec.Decode(&m); err != nil { - if err == io.EOF { - break + type vuln struct { + ID string `json:"id"` + Text string + } + + var ( + cur vuln + vulns []*vuln + ) + st := stInit + sc := bufio.NewScanner(os.Stdin) + for sc.Scan() { + v := sc.Text() + switch st { + case stInit: + if strings.HasPrefix(v, "Vulnerability ") { + st = stVulnOpen + _, id, ok := strings.Cut(v, ": ") + if !ok { + return errors.New("no longer able to parse format") + } + cur = vuln{ + ID: id, + } + } + case stVulnOpen: + cur.Text += v + "\n" + if v == "" { + st = stInit + cpy := cur + vulns = append(vulns, &cpy) } - // govulncheck JSON stream may contain objects we don't care about; skip decode errors - continue - } - if m.Finding == nil { - continue - } - if m.Finding.OSV == nil { - continue - } - id := m.Finding.OSV.ID - if seen[id] { - continue } - seen[id] = true - - if reason, ok := ignore[id]; ok { - fmt.Fprintf(os.Stderr, "ignoring %s: %s\n", id, reason) - } else { - fmt.Fprintf(os.Stderr, "ERROR: %s (not in ignore list)\n", id) - unignored = append(unignored, id) + } + if err := sc.Err(); err != nil { + return err + } + vulns = slices.DeleteFunc(vulns, func(v *vuln) bool { + reason, ok := ignore[v.ID] + if ok { + fmt.Fprintf(os.Stderr, "ignoring %s: %s\n", v.ID, reason) } + return ok + }) + if len(vulns) == 0 { + return nil } - if len(unignored) > 0 { - fmt.Fprintf(os.Stderr, "\n%d unignored vulnerability(ies) found\n", len(unignored)) - os.Exit(1) + fmt.Fprintf(os.Stderr, "\n") + for idx, vuln := range vulns { + msg := "Vulnerability #%d: %v\n%v" + fmt.Fprintf(os.Stderr, msg, idx+1, vuln.ID, vuln.Text) } + return fmt.Errorf("%d unignored vulnerability(ies) found", len(vulns)) } From 4b8b25ed6a610ce8f3af3608eb5b4ec32375cc62 Mon Sep 17 00:00:00 2001 From: Chris Stockton Date: Thu, 21 May 2026 08:26:05 -0700 Subject: [PATCH 2/3] fix: resolve all vulncheck findings and clean up parsing Resolved all findings from govulncheck, all of which were fixed with a go version upgrade. I changed vulncheck filter to parse the output of the command line instead of the JSON. This is because the CLI does a great deal of post processing after the fact that I did not want to emulate in the parser. It was much simpler to parse the text output. If it changes in the future the parser is simple to change. The parser is also much more strict, it expects vuln list or a success msg which should prevent silently passing with vulns found. --- Makefile | 1 + go.mod | 16 +- go.sum | 91 ---- hack/vulncheck-filter/main.go | 51 +- hack/vulncheck-filter/parse.go | 154 ++++++ hack/vulncheck-filter/parse_test.go | 458 ++++++++++++++++++ .../testdata/fail-11-vulns.txt | 135 ++++++ hack/vulncheck-filter/testdata/fail-basic.txt | 26 + hack/vulncheck-filter/testdata/test.txt | 54 +++ tools/Makefile | 10 +- tools/go.mod | 21 +- tools/go.sum | 198 +++++++- 12 files changed, 1058 insertions(+), 157 deletions(-) create mode 100644 hack/vulncheck-filter/parse.go create mode 100644 hack/vulncheck-filter/parse_test.go create mode 100644 hack/vulncheck-filter/testdata/fail-11-vulns.txt create mode 100644 hack/vulncheck-filter/testdata/fail-basic.txt create mode 100644 hack/vulncheck-filter/testdata/test.txt diff --git a/Makefile b/Makefile index bde8af47a3..62061b629e 100644 --- a/Makefile +++ b/Makefile @@ -181,6 +181,7 @@ format: gofmt -s -w . clean: + $(MAKE) -C tools clean rm -rf \ $(addprefix release-,$(RELEASE_TARGETS)) \ $(addprefix auth-,$(RELEASE_TARGETS)) \ diff --git a/go.mod b/go.mod index 958429e356..b7f02df886 100644 --- a/go.mod +++ b/go.mod @@ -40,12 +40,8 @@ require ( github.com/consensys/gnark-crypto v0.18.1 // indirect github.com/crate-crypto/go-eth-kzg v1.4.0 // indirect github.com/decred/dcrd/dcrec/secp256k1/v4 v4.3.0 // indirect - github.com/dprotaso/go-yit v0.0.0-20220510233725-9ba8df137936 // indirect github.com/ethereum/c-kzg-4844/v2 v2.1.5 // indirect - github.com/getkin/kin-openapi v0.131.0 // indirect github.com/go-jose/go-jose/v3 v3.0.4 // indirect - github.com/go-openapi/jsonpointer v0.21.0 // indirect - github.com/go-openapi/swag v0.23.0 // indirect github.com/go-viper/mapstructure/v2 v2.5.0 // indirect github.com/go-webauthn/x v0.2.3 // indirect github.com/gobuffalo/nulls v0.4.2 // indirect @@ -53,30 +49,21 @@ require ( github.com/google/go-tpm v0.9.8 // indirect github.com/holiman/uint256 v1.3.2 // indirect github.com/jackc/pgx/v4 v4.18.2 // indirect - github.com/josharian/intern v1.0.0 // indirect github.com/lestrrat-go/blackmagic v1.0.2 // indirect github.com/lestrrat-go/httpcc v1.0.1 // indirect github.com/lestrrat-go/httprc v1.0.5 // indirect github.com/lestrrat-go/iter v1.0.2 // indirect github.com/lestrrat-go/option v1.0.1 // indirect github.com/lib/pq v1.10.7 // indirect - github.com/mailru/easyjson v0.7.7 // indirect - github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 // indirect - github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 // indirect - github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 // indirect - github.com/perimeterx/marshmallow v1.1.5 // indirect github.com/philhofer/fwd v1.2.0 // indirect github.com/segmentio/asm v1.2.0 // indirect - github.com/speakeasy-api/openapi-overlay v0.9.0 // indirect github.com/supranational/blst v0.3.16-0.20250831170142-f48500c1fdbe // indirect github.com/tinylib/msgp v1.6.4 // indirect - github.com/vmware-labs/yaml-jsonpath v0.3.2 // indirect github.com/x448/float16 v0.8.4 // indirect github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // indirect github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect golang.org/x/mod v0.34.0 // indirect - golang.org/x/tools v0.43.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect ) @@ -108,7 +95,6 @@ require ( github.com/gobuffalo/pop/v6 v6.1.1 github.com/golang-jwt/jwt/v5 v5.3.1 github.com/lestrrat-go/jwx/v2 v2.1.0 - github.com/oapi-codegen/oapi-codegen/v2 v2.4.2-0.20250102212541-8bbe226927c9 github.com/oapi-codegen/runtime v1.1.1 github.com/standard-webhooks/standard-webhooks/libraries v0.0.0-20240303152453-e0e82adf1721 github.com/supabase/hibp v0.0.0-20231124125943-d225752ae869 @@ -186,4 +172,4 @@ require ( gopkg.in/yaml.v3 v3.0.1 // indirect ) -go 1.25.8 +go 1.25.10 diff --git a/go.sum b/go.sum index 84d2a797f0..2c9cc39260 100644 --- a/go.sum +++ b/go.sum @@ -51,9 +51,6 @@ github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1x github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw= github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= -github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI= -github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI= -github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU= github.com/cockroachdb/apd v1.1.0 h1:3LFP3629v+1aKXU5Q37mxmRxX/pIu1nijXydLShEq5I= github.com/cockroachdb/apd v1.1.0/go.mod h1:8Sl8LxpKi29FqWXR16WEFZRNSz3SoPzUzeMeY4+DwBQ= github.com/consensys/gnark-crypto v0.18.1 h1:RyLV6UhPRoYYzaFnPQA4qK3DyuDgkTgskDdoGqFt3fI= @@ -81,9 +78,6 @@ github.com/decred/dcrd/dcrec/secp256k1/v4 v4.3.0 h1:rpfIENRNNilwHwZeG5+P150SMrnN github.com/decred/dcrd/dcrec/secp256k1/v4 v4.3.0/go.mod h1:v57UDF4pDQJcEfFUCRop3lJL149eHGSe9Jvczhzjo/0= github.com/didip/tollbooth/v5 v5.1.1 h1:QpKFg56jsbNuQ6FFj++Z1gn2fbBsvAc1ZPLUaDOYW5k= github.com/didip/tollbooth/v5 v5.1.1/go.mod h1:d9rzwOULswrD3YIrAQmP3bfjxab32Df4IaO6+D25l9g= -github.com/dprotaso/go-yit v0.0.0-20191028211022-135eb7262960/go.mod h1:9HQzr9D/0PGwMEbC3d5AB7oi67+h4TsQqItC1GVYG58= -github.com/dprotaso/go-yit v0.0.0-20220510233725-9ba8df137936 h1:PRxIJD8XjimM5aTknUK9w6DHLDox2r2M3DI4i2pnd3w= -github.com/dprotaso/go-yit v0.0.0-20220510233725-9ba8df137936/go.mod h1:ttYvX5qlB+mlV1okblJqcSMtR4c52UKxDiX9GRBS8+Q= github.com/emicklei/dot v1.6.2 h1:08GN+DD79cy/tzN6uLCT84+2Wk9u+wvqP+Hkx/dIR8A= github.com/emicklei/dot v1.6.2/go.mod h1:DeV7GvQtIw4h2u73RKBkkFdvVAz0D9fzeJrgPW6gy/s= github.com/ethereum/c-kzg-4844/v2 v2.1.5 h1:aVtoLK5xwJ6c5RiqO8g8ptJ5KU+2Hdquf6G3aXiHh5s= @@ -100,13 +94,10 @@ github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSw github.com/ferranbt/fastssz v0.1.4 h1:OCDB+dYDEQDvAgtAGnTSidK1Pe2tW3nFV40XyMkTeDY= github.com/ferranbt/fastssz v0.1.4/go.mod h1:Ea3+oeoRGGLGm5shYAeDgu6PGUlcvQhE2fILyD9+tGg= github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo= -github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ= github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA= github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM= github.com/fxamacker/cbor/v2 v2.9.1 h1:2rWm8B193Ll4VdjsJY28jxs70IdDsHRWgQYAI80+rMQ= github.com/fxamacker/cbor/v2 v2.9.1/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ= -github.com/getkin/kin-openapi v0.131.0 h1:NO2UeHnFKRYhZ8wg6Nyh5Cq7dHk4suQQr72a4pMrDxE= -github.com/getkin/kin-openapi v0.131.0/go.mod h1:3OlG51PCYNsPByuiMB0t4fjnNlIDnaEDsjiKUV8nL58= github.com/go-chi/chi/v5 v5.2.4 h1:WtFKPHwlywe8Srng8j2BhOD9312j9cGUxG1SP4V2cR4= github.com/go-chi/chi/v5 v5.2.4/go.mod h1:X7Gx4mteadT3eDOMTsXzmI4/rwUpOwBHLpAfupzFJP0= github.com/go-jose/go-jose/v3 v3.0.4 h1:Wp5HA7bLQcKnf6YYao/4kpRpVMp/yf6+pJKV8WFSaNY= @@ -120,17 +111,10 @@ github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE= github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78= -github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ= -github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY= -github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE= -github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ= github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg= github.com/go-sql-driver/mysql v1.7.0 h1:ueSltNNllEqE3qcWBTD0iQd3IpL/6U+mJxLkazJ7YPc= github.com/go-sql-driver/mysql v1.7.0/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI= github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY= -github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE= -github.com/go-test/deep v1.0.8 h1:TDsG77qcSprGbC6vTN8OuXp5g+J+b5Pcguhf7Zt61VM= -github.com/go-test/deep v1.0.8/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE= github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro= github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM= github.com/go-webauthn/webauthn v0.16.5 h1:x+vADHlaiIjta23kGhtwyCIlB5mayKx6SBlpwQ5NF9A= @@ -179,22 +163,10 @@ github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY= github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE= github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= -github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8= -github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA= -github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs= -github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w= -github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0= -github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI= -github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk= -github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY= github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek= github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= github.com/golang/snappy v1.0.0 h1:Oy607GVXHs7RtbggtPBnr2RmDArIsAefDwvrdWvRhGs= github.com/golang/snappy v1.0.0/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q= -github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= -github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= -github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= -github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= @@ -202,7 +174,6 @@ github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo= github.com/google/go-tpm v0.9.8/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY= github.com/google/go-tpm-tools v0.3.13-0.20230620182252-4639ecce2aba h1:qJEJcuLzH5KDR0gKc0zcktin6KSAwL7+jWKBYceddTc= github.com/google/go-tpm-tools v0.3.13-0.20230620182252-4639ecce2aba/go.mod h1:EFYHy8/1y2KfgTAsx7Luu7NGhoxtuVHnNo8jE7FikKc= -github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE= github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= @@ -215,7 +186,6 @@ github.com/h2non/parth v0.0.0-20190131123155-b4df798d6542/go.mod h1:Ow0tF8D4Kplb github.com/holiman/uint256 v1.3.2 h1:a9EgMPSC1AAaj1SZL5zIQD3WbwTuHrMGOerLjGmM/TA= github.com/holiman/uint256 v1.3.2/go.mod h1:EOMSn4q6Nyt9P6efbI3bueV4e1b3dGlUCXeiRV4ng7E= github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU= -github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc= github.com/inconshreveable/mousetrap v1.0.1/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= @@ -281,8 +251,6 @@ github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0= github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4= github.com/jonboulle/clockwork v0.5.0 h1:Hyh9A8u51kptdkR+cqRpT1EebBwTn1oK9YfGYbdFz6I= github.com/jonboulle/clockwork v0.5.0/go.mod h1:3mZlmanh0g2NDKO5TWZVJAfofYk64M7XN3SzBPjZF60= -github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY= -github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y= github.com/jrick/logrotate v1.0.0/go.mod h1:LNinyqDIJnpAur+b8yyulnQw/wDuN1+BYKlTRt3OuAQ= github.com/juju/gnuflag v0.0.0-20171113085948-2ce1bb71843d/go.mod h1:2PavIy+JPciBPrBUjwbNvtwB6RQlve+hkpll6QSNmOE= github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs= @@ -327,8 +295,6 @@ github.com/lib/pq v1.10.7 h1:p7ZhMD+KsSRozJr34udlUrhboJwWAgCg34+/ZZNvZZw= github.com/lib/pq v1.10.7/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o= github.com/luna-duclos/instrumentedsql v1.1.3 h1:t7mvC0z1jUt5A0UQ6I/0H31ryymuQRnJcWCiqV3lSAA= github.com/luna-duclos/instrumentedsql v1.1.3/go.mod h1:9J1njvFds+zN7y85EDhN9XNQLANWwZt2ULeIC8yMNYs= -github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0= -github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc= github.com/mattermost/xml-roundtrip-validator v0.1.0 h1:RXbVD2UAl7A7nOTR4u7E3ILa4IbtvKBHw64LDsmu9hU= github.com/mattermost/xml-roundtrip-validator v0.1.0/go.mod h1:qccnGMcpgwcNaBnxqpJpWWUiPNr5H3O8eDgGV9gT5To= github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ= @@ -355,43 +321,18 @@ github.com/minio/sha256-simd v1.0.0 h1:v1ta+49hkWZyvaKwrQB8elexRqm6Y0aMLjCNsrYxo github.com/minio/sha256-simd v1.0.0/go.mod h1:OuYzVNI5vcoYIAmbIvHPl3N3jUzVedXbKy5RFepssQM= github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY= github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo= -github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 h1:RWengNIwukTxcDr9M+97sNutRR1RKhG96O6jWumTTnw= -github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8= github.com/mrjones/oauth v0.0.0-20190623134757-126b35219450 h1:j2kD3MT1z4PXCiUllUJF9mWUESr9TWKS7iEKsQ/IipM= github.com/mrjones/oauth v0.0.0-20190623134757-126b35219450/go.mod h1:skjdDftzkFALcuGzYSklqYd8gvat6F1gZJ4YPVbkZpM= github.com/nbio/st v0.0.0-20140626010706-e9e8d9816f32 h1:W6apQkHrMkS0Muv8G/TipAy/FJl/rCYT0+EuS8+Z0z4= github.com/nbio/st v0.0.0-20140626010706-e9e8d9816f32/go.mod h1:9wM+0iRr9ahx58uYLpLIr5fm8diHn0JbqRycJi6w0Ms= -github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A= -github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE= -github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU= -github.com/oapi-codegen/oapi-codegen/v2 v2.4.2-0.20250102212541-8bbe226927c9 h1:KXRttm+U6P6gZ5wiOPuAblyxGLEXlT+qjC3vPhe8cg4= -github.com/oapi-codegen/oapi-codegen/v2 v2.4.2-0.20250102212541-8bbe226927c9/go.mod h1:Lzhz8QiRu5FjGuXPT03q6nbgaTZAqidN17pyOKjuXeE= github.com/oapi-codegen/runtime v1.1.1 h1:EXLHh0DXIJnWhdRPN2w4MXAzFyE4CskzhNLUmtpMYro= github.com/oapi-codegen/runtime v1.1.1/go.mod h1:SK9X900oXmPWilYR5/WKPzt3Kqxn/uS/+lbpREv+eCg= -github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 h1:G7ERwszslrBzRxj//JalHPu/3yz+De2J+4aLtSRlHiY= -github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037/go.mod h1:2bpvgLBZEtENV5scfDFEtB/5+1M4hkQhDQrccEJ/qGw= -github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 h1:bQx3WeLcUWy+RletIKwUIt4x3t8n2SxavmoclizMb8c= -github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90/go.mod h1:y5+oSEHCPT/DGrS++Wc/479ERge0zTFxaF8PbGKcg2o= github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= -github.com/onsi/ginkgo v1.10.2/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= -github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk= -github.com/onsi/ginkgo v1.16.4 h1:29JGrr5oVBm5ulCWet69zQkzWipVXIol6ygQUe/EzNc= -github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0= -github.com/onsi/ginkgo/v2 v2.1.3/go.mod h1:vw5CSIxN1JObi/U8gcbwft7ZxR2dgaR70JSE3/PpL4c= github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY= -github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY= -github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY= -github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo= -github.com/onsi/gomega v1.17.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY= -github.com/onsi/gomega v1.19.0/go.mod h1:LY+I3pBVzYsTBU1AnDwOSxaYi9WoWiqgwooUqq9yPro= -github.com/onsi/gomega v1.27.6 h1:ENqfyGeS5AX/rlXDd/ETokDz93u0YufY1Pgxuy/PvWE= -github.com/onsi/gomega v1.27.6/go.mod h1:PIQNjfQwkP3aQAH7lf7j87O/5FiNr+ZR8+ipb+qQlhg= github.com/patrickmn/go-cache v0.0.0-20170418232947-7ac151875ffb/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ= github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc= github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ= -github.com/perimeterx/marshmallow v1.1.5 h1:a2LALqQ1BlHM8PZblsDdidgv1mWi1DgC2UmX50IvK2s= -github.com/perimeterx/marshmallow v1.1.5/go.mod h1:dsXbUu8CRzfYP5a87xpp0xq9S3u0Vchtcl8we9tYaXw= github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM= github.com/philhofer/fwd v1.2.0/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM= github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA= @@ -427,7 +368,6 @@ github.com/sebest/xff v0.0.0-20160910043805-6c115e0ffa35 h1:eajwn6K3weW5cd1ZXLu2 github.com/sebest/xff v0.0.0-20160910043805-6c115e0ffa35/go.mod h1:wozgYq9WEBQBaIJe4YZ0qTSFAMxmcwBhQH0fO0R34Z0= github.com/segmentio/asm v1.2.0 h1:9BQrFxC+YOHJlTlHGkTrFWf59nbL3XnCoFLTwDCI7ys= github.com/segmentio/asm v1.2.0/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs= -github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM= github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ= github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM= github.com/sethvargo/go-password v0.2.0 h1:BTDl4CC/gjf/axHMaDQtw507ogrXLci6XRiLc7i/UHI= @@ -446,8 +386,6 @@ github.com/sourcegraph/annotate v0.0.0-20160123013949-f4cad6c6324d h1:yKm7XZV6j9 github.com/sourcegraph/annotate v0.0.0-20160123013949-f4cad6c6324d/go.mod h1:UdhH50NIW0fCiwBSr0co2m7BnFLdv4fQTgdqdJTHFeE= github.com/sourcegraph/syntaxhighlight v0.0.0-20170531221838-bd320f5d308e h1:qpG93cPwA5f7s/ZPBJnGOYQNK/vKsaDaseuKT5Asee8= github.com/sourcegraph/syntaxhighlight v0.0.0-20170531221838-bd320f5d308e/go.mod h1:HuIsMU8RRBOtsCgI77wP899iHVBQpCmg4ErYMZB+2IA= -github.com/speakeasy-api/openapi-overlay v0.9.0 h1:Wrz6NO02cNlLzx1fB093lBlYxSI54VRhy1aSutx0PQg= -github.com/speakeasy-api/openapi-overlay v0.9.0/go.mod h1:f5FloQrHA7MsxYg9djzMD5h6dxrHjVVByWKh7an8TRc= github.com/spf13/cobra v1.6.1/go.mod h1:IOw/AERYS7UzyrGinqmz6HLUo219MORXGxhbaJUqzrY= github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM= github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y= @@ -487,10 +425,6 @@ github.com/tklauser/numcpus v0.6.1 h1:ng9scYS7az0Bk4OZLvrNXNSAO2Pxr1XXRAPyjhIx+F github.com/tklauser/numcpus v0.6.1/go.mod h1:1XfjsgE2zo8GVw7POkMbHENHzVg3GzmoZ9fESEdAacY= github.com/twmb/murmur3 v1.1.6 h1:mqrRot1BRxm+Yct+vavLMou2/iJt0tNVTTC0QoIjaZg= github.com/twmb/murmur3 v1.1.6/go.mod h1:Qq/R7NUyOfr65zD+6Q5IHKsJLwP7exErjN6lyyq3OSQ= -github.com/ugorji/go/codec v1.2.11 h1:BMaWp1Bb6fHwEtbplGBGJ498wD+LKlNSl25MjdZY4dU= -github.com/ugorji/go/codec v1.2.11/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg= -github.com/vmware-labs/yaml-jsonpath v0.3.2 h1:/5QKeCBGdsInyDCyVNLbXyilb61MXGi9NP674f9Hobk= -github.com/vmware-labs/yaml-jsonpath v0.3.2/go.mod h1:U6whw1z03QyqgWdgXxvVnQ90zN1BWz5V+51Ewf8k+rQ= github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM= github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg= github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f h1:J9EGpcZtP0E/raorCMxlFGSTBrsSlaDGf3jU/qvAE2c= @@ -579,12 +513,9 @@ golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= -golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= -golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk= golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= -golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk= golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.0.0-20220826154423-83b083e8dc8b/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk= golang.org/x/net v0.0.0-20221002022538-bcab6841153b/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk= @@ -610,22 +541,15 @@ golang.org/x/sys v0.0.0-20190403152447-81d4e9dc473e/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= @@ -667,17 +591,13 @@ golang.org/x/tools v0.0.0-20191029041327-9cc4af7d6b2c/go.mod h1:b+2E5dAYhXwXZwtn golang.org/x/tools v0.0.0-20191029190741-b9c20aec41a5/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.0.0-20200103221440-774c71fcf114/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= -golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0= golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= -golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s= -golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0= golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= -golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk= gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E= @@ -687,14 +607,6 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 h1: google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ= google.golang.org/grpc v1.78.0 h1:K1XZG/yGDJnzMdd/uZHAkVqJE+xIDOcmdSFZkBUicNc= google.golang.org/grpc v1.78.0/go.mod h1:I47qjTo4OKbMkjA/aOOwxDIiPSBofUtQUI5EfpWvW7U= -google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= -google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0= -google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM= -google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE= -google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo= -google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU= -google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw= -google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc h1:2gGKlE2+asNV9m7xrywl36YYNnBG5ZQ0r/BOOxqPpmk= @@ -711,15 +623,12 @@ gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df/go.mod h1:LRQQ+SO6ZHR7tOkp gopkg.in/h2non/gock.v1 v1.1.2 h1:jBbHXgGBK/AoPVfJh5x4r/WxIrElvbLel8TCZkkZJoY= gopkg.in/h2non/gock.v1 v1.1.2/go.mod h1:n7UGz/ckNChHiK05rDoiC4MYSunEC/lyaUm2WWaDva0= gopkg.in/inconshreveable/log15.v2 v2.0.0-20180818164646-67afb5ed74ec/go.mod h1:aPpfJ7XW+gOuirDoZ8gHhLh3kZ1B08FtV2bbmy7Jv3s= -gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ= gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw= gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= -gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY= gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= -gopkg.in/yaml.v3 v3.0.0-20191026110619-0b21df46bc1d/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= diff --git a/hack/vulncheck-filter/main.go b/hack/vulncheck-filter/main.go index 49467ecfac..8f7d413b4b 100644 --- a/hack/vulncheck-filter/main.go +++ b/hack/vulncheck-filter/main.go @@ -1,12 +1,9 @@ package main import ( - "bufio" - "errors" "fmt" "os" "slices" - "strings" ) // Vulnerabilities with no upstream fix — remove entries once fixed. @@ -22,49 +19,13 @@ func main() { } func run() error { - const ( - stInit = iota - stVulnOpen - ) - - type vuln struct { - ID string `json:"id"` - Text string - } - - var ( - cur vuln - vulns []*vuln - ) - st := stInit - sc := bufio.NewScanner(os.Stdin) - for sc.Scan() { - v := sc.Text() - switch st { - case stInit: - if strings.HasPrefix(v, "Vulnerability ") { - st = stVulnOpen - _, id, ok := strings.Cut(v, ": ") - if !ok { - return errors.New("no longer able to parse format") - } - cur = vuln{ - ID: id, - } - } - case stVulnOpen: - cur.Text += v + "\n" - if v == "" { - st = stInit - cpy := cur - vulns = append(vulns, &cpy) - } - } - } - if err := sc.Err(); err != nil { + res, err := Parse(os.Stdin) + if err != nil { return err } - vulns = slices.DeleteFunc(vulns, func(v *vuln) bool { + + vulns := res.Vulns + vulns = slices.DeleteFunc(vulns, func(v *Vulnerability) bool { reason, ok := ignore[v.ID] if ok { fmt.Fprintf(os.Stderr, "ignoring %s: %s\n", v.ID, reason) @@ -78,7 +39,7 @@ func run() error { fmt.Fprintf(os.Stderr, "\n") for idx, vuln := range vulns { msg := "Vulnerability #%d: %v\n%v" - fmt.Fprintf(os.Stderr, msg, idx+1, vuln.ID, vuln.Text) + fmt.Fprintf(os.Stderr, msg, idx+1, vuln.ID, vuln.Text+"\n") } return fmt.Errorf("%d unignored vulnerability(ies) found", len(vulns)) } diff --git a/hack/vulncheck-filter/parse.go b/hack/vulncheck-filter/parse.go new file mode 100644 index 0000000000..6b27324063 --- /dev/null +++ b/hack/vulncheck-filter/parse.go @@ -0,0 +1,154 @@ +package main + +import ( + "bufio" + "errors" + "fmt" + "io" + "strings" +) + +type Result struct { + Msg string + Vulns []*Vulnerability +} + +type Vulnerability struct { + ID string + Text string +} + +var errParse = errors.New("parse error") + +type parseState struct { + lines []string + pos int + res Result +} + +func Parse(r io.Reader) (*Result, error) { + ps := &parseState{pos: -1} + sc := bufio.NewScanner(r) + for sc.Scan() { + ps.lines = append(ps.lines, sc.Text()) + } + if err := sc.Err(); err != nil { + return nil, err + } + if err := ps.parse(); err != nil { + return nil, err + } + return &ps.res, nil +} + +func (o *parseState) fail(format string, args ...any) error { + msg := fmt.Sprintf(format, args...) + return fmt.Errorf("%w; %v [line %v]", errParse, msg, o.pos+1) +} + +func (o *parseState) scan() bool { + o.pos++ + return o.pos < len(o.lines) +} + +func (o *parseState) text() string { + if o.pos < 0 || o.pos >= len(o.lines) { + // panic("parse control flow error") + return "" + } + return o.lines[o.pos] +} + +func (o *parseState) next() (string, bool) { + next := o.pos + 1 + if next >= len(o.lines) { + return "", false + } + return o.lines[next], true +} + +func (o *parseState) parse() error { + if !o.scan() { + return o.fail("empty output") + } + switch v := o.text(); v { + case "No vulnerabilities found.": + if o.scan() { + return o.fail( + "success followed by unexpected output: %q", o.text()) + } + o.res.Msg = v + "\n" + return nil + case "=== Symbol Results ===": + return o.parseSection() + default: + return o.fail("unexpected line: %q", o.text()) + } +} + +func (o *parseState) parseSection() error { + if !o.scan() || o.text() != "" { + return o.fail("section was not followed by blank line") + } + + var n int + for o.scan() { + if err := o.parseVuln(); err != nil { + return err + } + n++ + } + if n == 0 || len(o.res.Vulns) == 0 { + return o.fail("section contains no vulns") + } + return nil +} + +func (o *parseState) parseVuln() error { + if !startsVuln(o.text()) { + return o.parseSummary() + } + + _, id, ok := strings.Cut(o.text(), ": ") + if !ok || id == "" { + return o.fail("vuln header invalid: %q", o.text()) + } + + cur := &Vulnerability{ID: id} + for o.scan() { + v := o.text() + switch { + case v == "" && strings.TrimSpace(cur.Text) == "": + return o.fail("vuln %q has empty details", cur.ID) + case v == "": + next, ok := o.next() + if !ok || startsVuln(next) || startsSummary(next) { + o.res.Vulns = append(o.res.Vulns, cur) + return nil + } + cur.Text += "\n" + case strings.HasPrefix(v, " "): + cur.Text += v + "\n" + default: + return o.fail("vuln %q has unexpected details: %q", cur.ID, v) + } + } + return o.fail("vuln %q is malformed", cur.ID) +} + +func (o *parseState) parseSummary() error { + for { + o.res.Msg += o.text() + "\n" + if !o.scan() { + return nil + } + } +} + +func startsVuln(s string) bool { + return strings.HasPrefix(s, "Vulnerability ") +} + +func startsSummary(s string) bool { + return s != "" && !strings.HasPrefix(s, " ") +} diff --git a/hack/vulncheck-filter/parse_test.go b/hack/vulncheck-filter/parse_test.go new file mode 100644 index 0000000000..cb86767c93 --- /dev/null +++ b/hack/vulncheck-filter/parse_test.go @@ -0,0 +1,458 @@ +package main + +import ( + "os" + "path/filepath" + "strings" + "testing" + + "github.com/stretchr/testify/require" +) + +func TestParse(t *testing.T) { + join := func(s ...string) string { + return strings.Join(s, "\n") + } + + type test struct { + name string + from string + exp *Result + errStr string + } + tests := []*test{ + { + from: join( + "=== Symbol Results ===", + "", + "Vulnerability #1: vuln01", + " details vuln01 line one", + " details vuln01 line two", + "", + " details vuln01 continue after linebreak", + " vuln01 more01", + " vuln01 more02", + "", + "summary", + ), + exp: &Result{ + Msg: "summary\n", + Vulns: []*Vulnerability{ + { + ID: "vuln01", + Text: join( + " details vuln01 line one", + " details vuln01 line two", + "", + " details vuln01 continue after linebreak", + " vuln01 more01", + " vuln01 more02", + "", + ), + }, + }, + }, + }, + { + from: join( + "=== Symbol Results ===", + "", + "Vulnerability #1: vuln01", + " details vuln01 line one", + " details vuln01 line two", + "", + " details vuln01 continue after linebreak", + " vuln01 more01", + " vuln01 more02", + "", + "Vulnerability #2: vuln02", + " details vuln02 line one", + " details vuln02 line two", + "", + " details vuln02 continue after linebreak", + " vuln02 more01", + " vuln02 more02", + "", + "summary", + ), + exp: &Result{ + Msg: "summary\n", + Vulns: []*Vulnerability{ + { + ID: "vuln01", + Text: join( + " details vuln01 line one", + " details vuln01 line two", + "", + " details vuln01 continue after linebreak", + " vuln01 more01", + " vuln01 more02", + "", + ), + }, + { + ID: "vuln02", + Text: join( + " details vuln02 line one", + " details vuln02 line two", + "", + " details vuln02 continue after linebreak", + " vuln02 more01", + " vuln02 more02", + "", + ), + }, + }, + }, + }, + { + from: join( + "=== Symbol Results ===", + "", + "Vulnerability #1: vuln01", + " details vuln01 line one", + " details vuln01 line two", + "", + " details vuln01 continue after linebreak", + " vuln01 more01", + " vuln01 more02", + "", + "Vulnerability #2: vuln02", + " details vuln02 line one", + " details vuln02 line two", + " details vuln02 continue after linebreak", + " vuln02 more01", + " vuln02 more02", + "", + "summary", + ), + exp: &Result{ + Msg: "summary\n", + Vulns: []*Vulnerability{ + { + ID: "vuln01", + Text: join( + " details vuln01 line one", + " details vuln01 line two", + "", + " details vuln01 continue after linebreak", + " vuln01 more01", + " vuln01 more02", + "", + ), + }, + { + ID: "vuln02", + Text: join( + " details vuln02 line one", + " details vuln02 line two", + " details vuln02 continue after linebreak", + " vuln02 more01", + " vuln02 more02", + "", + ), + }, + }, + }, + }, + + { + name: "basic success case", + from: "No vulnerabilities found.\n", + exp: &Result{ + Msg: "No vulnerabilities found.\n", + }, + }, + { + from: join( + "=== Symbol Results ===", + "", + "Vulnerability #1: summary01", + " details", + "", + "summary", + ), + exp: &Result{ + Msg: "summary\n", + Vulns: []*Vulnerability{ + { + ID: "summary01", + Text: " details\n", + }, + }, + }, + }, + { + from: join( + "=== Symbol Results ===", + "", + "Vulnerability #1: summary02", + " details", + "", + "summary\n\n", + ), + exp: &Result{ + Msg: "summary\n\n", + Vulns: []*Vulnerability{ + { + ID: "summary02", + Text: " details\n", + }, + }, + }, + }, + + { + from: join( + "No vulnerabilities found.", + "", + "", + ), + errStr: "success followed by unexpected output", + }, + { + from: join( + "No vulnerabilities found.", + "", + "unexpected output", + ), + errStr: "success followed by unexpected output", + }, + { + name: "empty", + from: "", + errStr: `empty output`, + }, + { + name: "space", + from: " ", + errStr: `unexpected line`, + }, + { + name: "space and newlines", + from: join(" ", " "), + errStr: `unexpected line`, + }, + { + from: "=== Symbol Results ===", + errStr: `section was not followed by blank line`, + }, + { + from: join( + "=== Symbol Results ===", + "", + ), + errStr: `section was not followed by blank line`, + }, + { + from: join( + "=== Symbol Results ===", + "", + "", + ), + errStr: `section contains no vulns`, + }, + { + from: join( + "=== Symbol Results ===", + "", + "Vulnerability #1: ", + ), + errStr: `vuln header invalid`, + }, + { + from: join( + "=== Symbol Results ===", + "", + "Vulnerability #1: 01", + ), + errStr: `vuln "01" is malformed`, + }, + { + from: join( + "=== Symbol Results ===", + "", + "Vulnerability #1: 02", + "", + ), + errStr: `vuln "02" is malformed`, + }, + { + from: join( + "=== Symbol Results ===", + "", + "Vulnerability #1: 03", + "", + "\n", + ), + errStr: `vuln "03" has empty details`, + }, + { + from: join( + "=== Symbol Results ===", + "", + "Vulnerability #1: 04", + "", + "", + ), + errStr: `vuln "04" has empty details`, + }, + { + from: join( + "=== Symbol Results ===", + "", + "Vulnerability #1: 05", + "", + " ", + ), + errStr: `vuln "05" has empty details`, + }, + { + from: join( + "=== Symbol Results ===", + "", + "Vulnerability #1: 06", + " ", + ), + errStr: `vuln "06" has unexpected details: " "`, + }, + { + from: join( + "=== Symbol Results ===", + "", + "Vulnerability #1: 07", + " ", + ), + errStr: `vuln "07" is malformed`, + }, + { + from: join( + "=== Symbol Results ===", + "", + "Vulnerability #1: 08", + " ", + ), + errStr: `vuln "08" is malformed`, + }, + { + from: join( + "=== Symbol Results ===", + "", + "Vulnerability #1: 09", + " a", + "", + ), + errStr: `vuln "09" is malformed`, + }, + { + from: join( + "=== Symbol Results ===", + "", + "Vulnerability #1: 10", + " aaa", + ), + errStr: `vuln "10" has unexpected details`, + }, + { + name: "pass with vulns", + from: loadTestdata(t, "fail-basic.txt"), + exp: &Result{ + Msg: "Your code is affected by 2 vulnerabilities from 1 module and the Go standard library.\nThis scan also found 4 vulnerabilities in packages you import and 1\nvulnerability in modules you require, but your code doesn't appear to call these\nvulnerabilities.\nUse '-show verbose' for more details.\n", + Vulns: []*Vulnerability{ + { + ID: "GO-2026-4986", + Text: " Quadratic string concatentation in consumeComment in net/mail\n More info: https://pkg.go.dev/vuln/GO-2026-4986\n Standard library\n Found in: net/mail@go1.25.8\n Fixed in: net/mail@go1.25.10\n Example traces found:\n #1: internal/mailer/validateclient/validateclient.go:259:30: validateclient.emailValidator.validateStatic calls mail.ParseAddress\n", + }, + { + ID: "GO-2026-4982", + Text: " Bypass of meta content URL escaping causes XSS in html/template\n More info: https://pkg.go.dev/vuln/GO-2026-4982\n Standard library\n Found in: html/template@go1.25.8\n Fixed in: html/template@go1.25.10\n Example traces found:\n #1: internal/mailer/templatemailer/template.go:139:30: templatemailer.tplCacheEntry.execute calls template.Template.Execute\n #2: internal/api/api.go:480:21: api.API.ServeHTTP calls http.HandlerFunc.ServeHTTP, which eventually calls template.Template.ExecuteTemplate\n", + }, + }, + }, + }, + { + name: "pass with 11 vulns", + from: loadTestdata(t, "fail-11-vulns.txt"), + exp: &Result{ + Msg: "Your code is affected by 11 vulnerabilities from 1 module and the Go standard library.\nThis scan also found 4 vulnerabilities in packages you import and 1\nvulnerability in modules you require, but your code doesn't appear to call these\nvulnerabilities.\nUse '-show verbose' for more details.\n", + Vulns: []*Vulnerability{ + { + ID: "GO-2026-4986", + Text: " Quadratic string concatentation in consumeComment in net/mail\n More info: https://pkg.go.dev/vuln/GO-2026-4986\n Standard library\n Found in: net/mail@go1.25.8\n Fixed in: net/mail@go1.25.10\n Example traces found:\n #1: internal/mailer/validateclient/validateclient.go:259:30: validateclient.emailValidator.validateStatic calls mail.ParseAddress\n", + }, + { + ID: "GO-2026-4982", + Text: " Bypass of meta content URL escaping causes XSS in html/template\n More info: https://pkg.go.dev/vuln/GO-2026-4982\n Standard library\n Found in: html/template@go1.25.8\n Fixed in: html/template@go1.25.10\n Example traces found:\n #1: internal/mailer/templatemailer/template.go:139:30: templatemailer.tplCacheEntry.execute calls template.Template.Execute\n #2: internal/api/api.go:480:21: api.API.ServeHTTP calls http.HandlerFunc.ServeHTTP, which eventually calls template.Template.ExecuteTemplate\n", + }, + { + ID: "GO-2026-4980", + Text: " Escaper bypass leads to XSS in html/template\n More info: https://pkg.go.dev/vuln/GO-2026-4980\n Standard library\n Found in: html/template@go1.25.8\n Fixed in: html/template@go1.25.10\n Example traces found:\n #1: internal/mailer/templatemailer/template.go:139:30: templatemailer.tplCacheEntry.execute calls template.Template.Execute\n #2: internal/api/api.go:480:21: api.API.ServeHTTP calls http.HandlerFunc.ServeHTTP, which eventually calls template.Template.ExecuteTemplate\n", + }, + { + ID: "GO-2026-4977", + Text: " Quadratic string concatenation in consumePhrase in net/mail\n More info: https://pkg.go.dev/vuln/GO-2026-4977\n Standard library\n Found in: net/mail@go1.25.8\n Fixed in: net/mail@go1.25.10\n Example traces found:\n #1: internal/mailer/validateclient/validateclient.go:259:30: validateclient.emailValidator.validateStatic calls mail.ParseAddress\n", + }, + { + ID: "GO-2026-4971", + Text: " Panic in Dial and LookupPort when handling NUL byte on Windows in net\n More info: https://pkg.go.dev/vuln/GO-2026-4971\n Standard library\n Found in: net@go1.25.8\n Fixed in: net@go1.25.10\n Example traces found:\n #1: internal/mailer/mailmeclient/mailmeclient.go:83:28: mailmeclient.Client.Mail calls gomail.Dialer.DialAndSend, which eventually calls net.DialTimeout\n #2: internal/storage/dial.go:214:23: storage.Connection.ApplyConfig calls sql.DB.SetMaxIdleConns, which eventually calls net.Dialer.Dial\n #3: internal/indexworker/indexworker.go:62:19: indexworker.CreateIndexes calls pop.Connection.Open, which eventually calls net.Dialer.DialContext\n #4: internal/observability/profiler.go:48:34: observability.ConfigureProfiler calls http.Server.ListenAndServe, which calls net.Listen\n #5: cmd/serve_cmd.go:201:28: cmd.serve calls net.ListenConfig.Listen\n #6: internal/utilities/url_validator.go:53:26: utilities.ValidateOAuthURL calls net.LookupIP\n #7: internal/mailer/validateclient/validateclient.go:399:48: validateclient.emailValidator.validateHost calls net.Resolver.LookupHost\n #8: internal/mailer/validateclient/validateclient.go:394:44: validateclient.emailValidator.validateHost calls net.Resolver.LookupMX\n", + }, + { + ID: "GO-2026-4947", + Text: " Unexpected work during chain building in crypto/x509\n More info: https://pkg.go.dev/vuln/GO-2026-4947\n Standard library\n Found in: crypto/x509@go1.25.8\n Fixed in: crypto/x509@go1.25.9\n Example traces found:\n #1: internal/api/passkey_authentication.go:143:64: api.API.PasskeyAuthenticationVerify calls webauthn.WebAuthn.ValidatePasskeyLogin, which eventually calls x509.Certificate.Verify\n", + }, + { + ID: "GO-2026-4946", + Text: " Inefficient policy validation in crypto/x509\n More info: https://pkg.go.dev/vuln/GO-2026-4946\n Standard library\n Found in: crypto/x509@go1.25.8\n Fixed in: crypto/x509@go1.25.9\n Example traces found:\n #1: internal/api/passkey_authentication.go:143:64: api.API.PasskeyAuthenticationVerify calls webauthn.WebAuthn.ValidatePasskeyLogin, which eventually calls x509.Certificate.Verify\n", + }, + { + ID: "GO-2026-4918", + Text: " Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in\n net/http/internal/http2 in golang.org/x/net\n More info: https://pkg.go.dev/vuln/GO-2026-4918\n Module: golang.org/x/net\n Found in: golang.org/x/net@v0.52.0\n Fixed in: golang.org/x/net@v0.53.0\n\n Standard library\n Found in: net/http@go1.25.8\n Fixed in: net/http@go1.25.10\n Example traces found:\n #1: internal/utilities/url_validator.go:181:24: utilities.FetchURLWithTimeout calls http.Client.Do\n #2: internal/api/provider/provider.go:167:24: provider.makeRequest calls http.Client.Get\n #3: internal/tokens/service.go:976:38: tokens.validateTokenClaims calls gojsonschema.Validate, which eventually calls http.Get\n #4: internal/e2e/e2ehooks/e2ehooks.go:39:3: e2ehooks.New calls httptest.Server.Close, which calls http.Transport.CloseIdleConnections\n #5: internal/utilities/url_validator.go:204:25: utilities.ssrfProtectedTransport.RoundTrip calls http.Transport.RoundTrip\n", + }, + { + ID: "GO-2026-4870", + Text: " Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection\n retention and DoS in crypto/tls\n More info: https://pkg.go.dev/vuln/GO-2026-4870\n Standard library\n Found in: crypto/tls@go1.25.8\n Fixed in: crypto/tls@go1.25.9\n Example traces found:\n #1: internal/indexworker/indexworker.go:62:19: indexworker.CreateIndexes calls pop.Connection.Open, which eventually calls tls.Conn.Handshake\n #2: internal/observability/profiler.go:48:34: observability.ConfigureProfiler calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext\n #3: internal/godotenv/godotenv.go:32:19: godotenv.Parse calls io.Copy, which eventually calls tls.Conn.Read\n #4: hack/vulncheck-filter/main.go:19:14: vulncheck.main calls fmt.Fprintf, which calls tls.Conn.Write\n #5: internal/utilities/url_validator.go:204:25: utilities.ssrfProtectedTransport.RoundTrip calls http.Transport.RoundTrip, which eventually calls tls.Dialer.DialContext\n", + }, + { + ID: "GO-2026-4865", + Text: " JsBraceDepth Context Tracking Bugs (XSS) in html/template\n More info: https://pkg.go.dev/vuln/GO-2026-4865\n Standard library\n Found in: html/template@go1.25.8\n Fixed in: html/template@go1.25.9\n Example traces found:\n #1: internal/tokens/service.go:212:64: tokens.Service.RefreshTokenGrant calls template.Error.Error\n #2: client/admin/client.go:1192:50: admin.NewPutAdminUsersUserIdFactorsFactorIdRequestWithBody calls runtime.StyleParamWithLocation, which eventually calls template.HTMLEscaper\n #3: internal/mailer/templatemailer/template.go:139:30: templatemailer.tplCacheEntry.execute calls template.Template.Execute\n #4: internal/api/api.go:480:21: api.API.ServeHTTP calls http.HandlerFunc.ServeHTTP, which eventually calls template.Template.ExecuteTemplate\n #5: internal/observability/metrics.go:164:16: observability.ConfigureMetrics calls sync.Once.Do, which eventually calls template.Template.Funcs\n #6: internal/mailer/templatemailer/template.go:591:39: templatemailer.checkDefaults calls template.Template.Parse\n #7: client/admin/client.go:1192:50: admin.NewPutAdminUsersUserIdFactorsFactorIdRequestWithBody calls runtime.StyleParamWithLocation, which eventually calls template.context.String\n", + }, + { + ID: "GO-2026-4518", + Text: " Denial of service in github.com/jackc/pgproto3/v2\n More info: https://pkg.go.dev/vuln/GO-2026-4518\n Module: github.com/jackc/pgproto3/v2\n Found in: github.com/jackc/pgproto3/v2@v2.3.3\n Fixed in: N/A\n Example traces found:\n #1: internal/e2e/e2eapi/e2eapi.go:82:3: e2eapi.Instance.Close calls sql.noteUnusedDriverStatement, which eventually calls pgproto3.Frontend.Receive\n", + }, + }, + }, + }, + } + + for _, tt := range tests { + name := tt.name + if name == "" { + name = tt.errStr + } + t.Run(name, func(t *testing.T) { + rdr := strings.NewReader(tt.from) + res, err := Parse(rdr) + if tt.errStr != "" { + require.Error(t, err) + require.Contains(t, err.Error(), tt.errStr) + return + } + require.NoError(t, err) + require.NotNil(t, res) + + if tt.exp != nil { + require.Equal(t, tt.exp, res) + } + }) + } +} + +func loadTestdata(t testing.TB, name string) string { + t.Helper() + data, err := os.ReadFile(filepath.Join("testdata", name)) + if err != nil { + t.Fatal(err) + } + return string(data) +} diff --git a/hack/vulncheck-filter/testdata/fail-11-vulns.txt b/hack/vulncheck-filter/testdata/fail-11-vulns.txt new file mode 100644 index 0000000000..489d6c4e76 --- /dev/null +++ b/hack/vulncheck-filter/testdata/fail-11-vulns.txt @@ -0,0 +1,135 @@ +=== Symbol Results === + +Vulnerability #1: GO-2026-4986 + Quadratic string concatentation in consumeComment in net/mail + More info: https://pkg.go.dev/vuln/GO-2026-4986 + Standard library + Found in: net/mail@go1.25.8 + Fixed in: net/mail@go1.25.10 + Example traces found: + #1: internal/mailer/validateclient/validateclient.go:259:30: validateclient.emailValidator.validateStatic calls mail.ParseAddress + +Vulnerability #2: GO-2026-4982 + Bypass of meta content URL escaping causes XSS in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4982 + Standard library + Found in: html/template@go1.25.8 + Fixed in: html/template@go1.25.10 + Example traces found: + #1: internal/mailer/templatemailer/template.go:139:30: templatemailer.tplCacheEntry.execute calls template.Template.Execute + #2: internal/api/api.go:480:21: api.API.ServeHTTP calls http.HandlerFunc.ServeHTTP, which eventually calls template.Template.ExecuteTemplate + +Vulnerability #3: GO-2026-4980 + Escaper bypass leads to XSS in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4980 + Standard library + Found in: html/template@go1.25.8 + Fixed in: html/template@go1.25.10 + Example traces found: + #1: internal/mailer/templatemailer/template.go:139:30: templatemailer.tplCacheEntry.execute calls template.Template.Execute + #2: internal/api/api.go:480:21: api.API.ServeHTTP calls http.HandlerFunc.ServeHTTP, which eventually calls template.Template.ExecuteTemplate + +Vulnerability #4: GO-2026-4977 + Quadratic string concatenation in consumePhrase in net/mail + More info: https://pkg.go.dev/vuln/GO-2026-4977 + Standard library + Found in: net/mail@go1.25.8 + Fixed in: net/mail@go1.25.10 + Example traces found: + #1: internal/mailer/validateclient/validateclient.go:259:30: validateclient.emailValidator.validateStatic calls mail.ParseAddress + +Vulnerability #5: GO-2026-4971 + Panic in Dial and LookupPort when handling NUL byte on Windows in net + More info: https://pkg.go.dev/vuln/GO-2026-4971 + Standard library + Found in: net@go1.25.8 + Fixed in: net@go1.25.10 + Example traces found: + #1: internal/mailer/mailmeclient/mailmeclient.go:83:28: mailmeclient.Client.Mail calls gomail.Dialer.DialAndSend, which eventually calls net.DialTimeout + #2: internal/storage/dial.go:214:23: storage.Connection.ApplyConfig calls sql.DB.SetMaxIdleConns, which eventually calls net.Dialer.Dial + #3: internal/indexworker/indexworker.go:62:19: indexworker.CreateIndexes calls pop.Connection.Open, which eventually calls net.Dialer.DialContext + #4: internal/observability/profiler.go:48:34: observability.ConfigureProfiler calls http.Server.ListenAndServe, which calls net.Listen + #5: cmd/serve_cmd.go:201:28: cmd.serve calls net.ListenConfig.Listen + #6: internal/utilities/url_validator.go:53:26: utilities.ValidateOAuthURL calls net.LookupIP + #7: internal/mailer/validateclient/validateclient.go:399:48: validateclient.emailValidator.validateHost calls net.Resolver.LookupHost + #8: internal/mailer/validateclient/validateclient.go:394:44: validateclient.emailValidator.validateHost calls net.Resolver.LookupMX + +Vulnerability #6: GO-2026-4947 + Unexpected work during chain building in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4947 + Standard library + Found in: crypto/x509@go1.25.8 + Fixed in: crypto/x509@go1.25.9 + Example traces found: + #1: internal/api/passkey_authentication.go:143:64: api.API.PasskeyAuthenticationVerify calls webauthn.WebAuthn.ValidatePasskeyLogin, which eventually calls x509.Certificate.Verify + +Vulnerability #7: GO-2026-4946 + Inefficient policy validation in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4946 + Standard library + Found in: crypto/x509@go1.25.8 + Fixed in: crypto/x509@go1.25.9 + Example traces found: + #1: internal/api/passkey_authentication.go:143:64: api.API.PasskeyAuthenticationVerify calls webauthn.WebAuthn.ValidatePasskeyLogin, which eventually calls x509.Certificate.Verify + +Vulnerability #8: GO-2026-4918 + Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in + net/http/internal/http2 in golang.org/x/net + More info: https://pkg.go.dev/vuln/GO-2026-4918 + Module: golang.org/x/net + Found in: golang.org/x/net@v0.52.0 + Fixed in: golang.org/x/net@v0.53.0 + + Standard library + Found in: net/http@go1.25.8 + Fixed in: net/http@go1.25.10 + Example traces found: + #1: internal/utilities/url_validator.go:181:24: utilities.FetchURLWithTimeout calls http.Client.Do + #2: internal/api/provider/provider.go:167:24: provider.makeRequest calls http.Client.Get + #3: internal/tokens/service.go:976:38: tokens.validateTokenClaims calls gojsonschema.Validate, which eventually calls http.Get + #4: internal/e2e/e2ehooks/e2ehooks.go:39:3: e2ehooks.New calls httptest.Server.Close, which calls http.Transport.CloseIdleConnections + #5: internal/utilities/url_validator.go:204:25: utilities.ssrfProtectedTransport.RoundTrip calls http.Transport.RoundTrip + +Vulnerability #9: GO-2026-4870 + Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection + retention and DoS in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-4870 + Standard library + Found in: crypto/tls@go1.25.8 + Fixed in: crypto/tls@go1.25.9 + Example traces found: + #1: internal/indexworker/indexworker.go:62:19: indexworker.CreateIndexes calls pop.Connection.Open, which eventually calls tls.Conn.Handshake + #2: internal/observability/profiler.go:48:34: observability.ConfigureProfiler calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext + #3: internal/godotenv/godotenv.go:32:19: godotenv.Parse calls io.Copy, which eventually calls tls.Conn.Read + #4: hack/vulncheck-filter/main.go:19:14: vulncheck.main calls fmt.Fprintf, which calls tls.Conn.Write + #5: internal/utilities/url_validator.go:204:25: utilities.ssrfProtectedTransport.RoundTrip calls http.Transport.RoundTrip, which eventually calls tls.Dialer.DialContext + +Vulnerability #10: GO-2026-4865 + JsBraceDepth Context Tracking Bugs (XSS) in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4865 + Standard library + Found in: html/template@go1.25.8 + Fixed in: html/template@go1.25.9 + Example traces found: + #1: internal/tokens/service.go:212:64: tokens.Service.RefreshTokenGrant calls template.Error.Error + #2: client/admin/client.go:1192:50: admin.NewPutAdminUsersUserIdFactorsFactorIdRequestWithBody calls runtime.StyleParamWithLocation, which eventually calls template.HTMLEscaper + #3: internal/mailer/templatemailer/template.go:139:30: templatemailer.tplCacheEntry.execute calls template.Template.Execute + #4: internal/api/api.go:480:21: api.API.ServeHTTP calls http.HandlerFunc.ServeHTTP, which eventually calls template.Template.ExecuteTemplate + #5: internal/observability/metrics.go:164:16: observability.ConfigureMetrics calls sync.Once.Do, which eventually calls template.Template.Funcs + #6: internal/mailer/templatemailer/template.go:591:39: templatemailer.checkDefaults calls template.Template.Parse + #7: client/admin/client.go:1192:50: admin.NewPutAdminUsersUserIdFactorsFactorIdRequestWithBody calls runtime.StyleParamWithLocation, which eventually calls template.context.String + +Vulnerability #11: GO-2026-4518 + Denial of service in github.com/jackc/pgproto3/v2 + More info: https://pkg.go.dev/vuln/GO-2026-4518 + Module: github.com/jackc/pgproto3/v2 + Found in: github.com/jackc/pgproto3/v2@v2.3.3 + Fixed in: N/A + Example traces found: + #1: internal/e2e/e2eapi/e2eapi.go:82:3: e2eapi.Instance.Close calls sql.noteUnusedDriverStatement, which eventually calls pgproto3.Frontend.Receive + +Your code is affected by 11 vulnerabilities from 1 module and the Go standard library. +This scan also found 4 vulnerabilities in packages you import and 1 +vulnerability in modules you require, but your code doesn't appear to call these +vulnerabilities. +Use '-show verbose' for more details. diff --git a/hack/vulncheck-filter/testdata/fail-basic.txt b/hack/vulncheck-filter/testdata/fail-basic.txt new file mode 100644 index 0000000000..b832066eba --- /dev/null +++ b/hack/vulncheck-filter/testdata/fail-basic.txt @@ -0,0 +1,26 @@ +=== Symbol Results === + +Vulnerability #1: GO-2026-4986 + Quadratic string concatentation in consumeComment in net/mail + More info: https://pkg.go.dev/vuln/GO-2026-4986 + Standard library + Found in: net/mail@go1.25.8 + Fixed in: net/mail@go1.25.10 + Example traces found: + #1: internal/mailer/validateclient/validateclient.go:259:30: validateclient.emailValidator.validateStatic calls mail.ParseAddress + +Vulnerability #2: GO-2026-4982 + Bypass of meta content URL escaping causes XSS in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4982 + Standard library + Found in: html/template@go1.25.8 + Fixed in: html/template@go1.25.10 + Example traces found: + #1: internal/mailer/templatemailer/template.go:139:30: templatemailer.tplCacheEntry.execute calls template.Template.Execute + #2: internal/api/api.go:480:21: api.API.ServeHTTP calls http.HandlerFunc.ServeHTTP, which eventually calls template.Template.ExecuteTemplate + +Your code is affected by 2 vulnerabilities from 1 module and the Go standard library. +This scan also found 4 vulnerabilities in packages you import and 1 +vulnerability in modules you require, but your code doesn't appear to call these +vulnerabilities. +Use '-show verbose' for more details. diff --git a/hack/vulncheck-filter/testdata/test.txt b/hack/vulncheck-filter/testdata/test.txt new file mode 100644 index 0000000000..4a260c4b94 --- /dev/null +++ b/hack/vulncheck-filter/testdata/test.txt @@ -0,0 +1,54 @@ +=== Symbol Results === + +Vulnerability #8: GO-2026-4918 + Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in + net/http/internal/http2 in golang.org/x/net + More info: https://pkg.go.dev/vuln/GO-2026-4918 + Module: golang.org/x/net + Found in: golang.org/x/net@v0.52.0 + Fixed in: golang.org/x/net@v0.53.0 + + Standard library + Found in: net/http@go1.25.8 + Fixed in: net/http@go1.25.10 + Example traces found: + #1: internal/utilities/url_validator.go:181:24: utilities.FetchURLWithTimeout calls http.Client.Do + #2: internal/api/provider/provider.go:167:24: provider.makeRequest calls http.Client.Get + #3: internal/tokens/service.go:976:38: tokens.validateTokenClaims calls gojsonschema.Validate, which eventually calls http.Get + #4: internal/e2e/e2ehooks/e2ehooks.go:39:3: e2ehooks.New calls httptest.Server.Close, which calls http.Transport.CloseIdleConnections + #5: internal/utilities/url_validator.go:204:25: utilities.ssrfProtectedTransport.RoundTrip calls http.Transport.RoundTrip + +Vulnerability #9: GO-2026-4870 + Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection + retention and DoS in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-4870 + Standard library + Found in: crypto/tls@go1.25.8 + Fixed in: crypto/tls@go1.25.9 + Example traces found: + #1: internal/indexworker/indexworker.go:62:19: indexworker.CreateIndexes calls pop.Connection.Open, which eventually calls tls.Conn.Handshake + #2: internal/observability/profiler.go:48:34: observability.ConfigureProfiler calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext + #3: internal/godotenv/godotenv.go:32:19: godotenv.Parse calls io.Copy, which eventually calls tls.Conn.Read + #4: hack/vulncheck-filter/main.go:19:14: vulncheck.main calls fmt.Fprintf, which calls tls.Conn.Write + #5: internal/utilities/url_validator.go:204:25: utilities.ssrfProtectedTransport.RoundTrip calls http.Transport.RoundTrip, which eventually calls tls.Dialer.DialContext + +Vulnerability #10: GO-2026-4865 + JsBraceDepth Context Tracking Bugs (XSS) in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4865 + Standard library + Found in: html/template@go1.25.8 + Fixed in: html/template@go1.25.9 + Example traces found: + #1: internal/tokens/service.go:212:64: tokens.Service.RefreshTokenGrant calls template.Error.Error + #2: client/admin/client.go:1192:50: admin.NewPutAdminUsersUserIdFactorsFactorIdRequestWithBody calls runtime.StyleParamWithLocation, which eventually calls template.HTMLEscaper + #3: internal/mailer/templatemailer/template.go:139:30: templatemailer.tplCacheEntry.execute calls template.Template.Execute + #4: internal/api/api.go:480:21: api.API.ServeHTTP calls http.HandlerFunc.ServeHTTP, which eventually calls template.Template.ExecuteTemplate + #5: internal/observability/metrics.go:164:16: observability.ConfigureMetrics calls sync.Once.Do, which eventually calls template.Template.Funcs + #6: internal/mailer/templatemailer/template.go:591:39: templatemailer.checkDefaults calls template.Template.Parse + #7: client/admin/client.go:1192:50: admin.NewPutAdminUsersUserIdFactorsFactorIdRequestWithBody calls runtime.StyleParamWithLocation, which eventually calls template.context.String + +Your code is affected by 11 vulnerabilities from 1 module and the Go standard library. +This scan also found 4 vulnerabilities in packages you import and 1 +vulnerability in modules you require, but your code doesn't appear to call these +vulnerabilities. +Use '-show verbose' for more details. diff --git a/tools/Makefile b/tools/Makefile index 5963f43adf..47010adf69 100644 --- a/tools/Makefile +++ b/tools/Makefile @@ -1,10 +1,12 @@ BIN_DIR := $(CURDIR)/bin - -all: \ +BIN_TARGETS := \ $(BIN_DIR)/gosec \ $(BIN_DIR)/staticcheck \ $(BIN_DIR)/govulncheck +.PHONY: all +all: $(BIN_TARGETS) + $(BIN_DIR)/gosec: | $(BIN_DIR) GOBIN=$(BIN_DIR) go install github.com/securego/gosec/v2/cmd/gosec @@ -16,3 +18,7 @@ $(BIN_DIR)/govulncheck: | $(BIN_DIR) $(BIN_DIR): mkdir -p $(@) + +.PHONY: clean +clean: + rm -f $(BIN_TARGETS) \ No newline at end of file diff --git a/tools/go.mod b/tools/go.mod index ab401fb477..6971c137ab 100644 --- a/tools/go.mod +++ b/tools/go.mod @@ -1,6 +1,6 @@ module github.com/supabase/auth/tools -go 1.25.8 +go 1.25.10 tool ( github.com/securego/gosec/v2/cmd/gosec @@ -8,6 +8,8 @@ tool ( honnef.co/go/tools/cmd/staticcheck ) +require github.com/oapi-codegen/oapi-codegen/v2 v2.7.0 + require ( cloud.google.com/go v0.121.2 // indirect cloud.google.com/go/auth v0.16.5 // indirect @@ -18,9 +20,13 @@ require ( github.com/buger/jsonparser v1.1.2 // indirect github.com/ccojocar/zxcvbn-go v1.0.4 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect + github.com/dprotaso/go-yit v0.0.0-20220510233725-9ba8df137936 // indirect github.com/felixge/httpsnoop v1.0.4 // indirect + github.com/getkin/kin-openapi v0.135.0 // indirect github.com/go-logr/logr v1.4.3 // indirect github.com/go-logr/stdr v1.2.2 // indirect + github.com/go-openapi/jsonpointer v0.22.4 // indirect + github.com/go-openapi/swag/jsonname v0.25.4 // indirect github.com/google/go-cmp v0.7.0 // indirect github.com/google/s2a-go v0.1.9 // indirect github.com/google/uuid v1.6.0 // indirect @@ -29,14 +35,23 @@ require ( github.com/gookit/color v1.6.0 // indirect github.com/gorilla/websocket v1.5.3 // indirect github.com/invopop/jsonschema v0.13.0 // indirect - github.com/mailru/easyjson v0.7.7 // indirect + github.com/josharian/intern v1.0.0 // indirect + github.com/mailru/easyjson v0.9.1 // indirect + github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 // indirect + github.com/oasdiff/yaml v0.0.9 // indirect + github.com/oasdiff/yaml3 v0.0.9 // indirect github.com/openai/openai-go/v3 v3.32.0 // indirect + github.com/perimeterx/marshmallow v1.1.5 // indirect github.com/securego/gosec/v2 v2.26.1 // indirect + github.com/speakeasy-api/jsonpath v0.6.3 // indirect + github.com/speakeasy-api/openapi v1.19.2 // indirect github.com/tidwall/gjson v1.18.0 // indirect github.com/tidwall/match v1.1.1 // indirect github.com/tidwall/pretty v1.2.1 // indirect github.com/tidwall/sjson v1.2.5 // indirect + github.com/vmware-labs/yaml-jsonpath v0.3.2 // indirect github.com/wk8/go-ordered-map/v2 v2.1.8 // indirect + github.com/woodsbury/decimal128 v1.4.0 // indirect github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect @@ -53,6 +68,8 @@ require ( golang.org/x/telemetry v0.0.0-20260409153401-be6f6cb8b1fa // indirect golang.org/x/text v0.36.0 // indirect golang.org/x/tools v0.44.0 // indirect + golang.org/x/tools/go/expect v0.1.1-deprecated // indirect + golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated // indirect golang.org/x/vuln v1.1.4 // indirect google.golang.org/genai v1.54.0 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect diff --git a/tools/go.sum b/tools/go.sum index fb55e35c7e..75d8d23e5b 100644 --- a/tools/go.sum +++ b/tools/go.sum @@ -6,6 +6,8 @@ cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdB cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10= github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk= github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho= +github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0= +github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM= github.com/anthropics/anthropic-sdk-go v1.38.0 h1:bA4DcK+91gorIX+5VTONnynyt9LRU4nnN6rRQ+j/NIg= github.com/anthropics/anthropic-sdk-go v1.38.0/go.mod h1:d288C1L+m74OYuYBvc4UFtR1Q8J0gC55oYDh2t+XxdI= github.com/bahlo/generic-list-go v0.2.0 h1:5sz/EEAK+ls5wF+NeqDpk5+iNdMDXrh3z3nPnH1Wvgk= @@ -16,15 +18,66 @@ github.com/ccojocar/zxcvbn-go v1.0.4 h1:FWnCIRMXPj43ukfX000kvBZvV6raSxakYr1nzyNr github.com/ccojocar/zxcvbn-go v1.0.4/go.mod h1:3GxGX+rHmueTUMvm5ium7irpyjmm7ikxYFOSJB21Das= github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= +github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI= +github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI= +github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU= +github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= +github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/dnaeon/go-vcr v1.2.0 h1:zHCHvJYTMh1N7xnV7zf1m1GPBF9Ad0Jk/whtQ1663qI= +github.com/dnaeon/go-vcr v1.2.0/go.mod h1:R4UdLID7HZT3taECzJs4YgbbH6PIGXB6W/sc5OLb6RQ= +github.com/dprotaso/go-yit v0.0.0-20191028211022-135eb7262960/go.mod h1:9HQzr9D/0PGwMEbC3d5AB7oi67+h4TsQqItC1GVYG58= +github.com/dprotaso/go-yit v0.0.0-20220510233725-9ba8df137936 h1:PRxIJD8XjimM5aTknUK9w6DHLDox2r2M3DI4i2pnd3w= +github.com/dprotaso/go-yit v0.0.0-20220510233725-9ba8df137936/go.mod h1:ttYvX5qlB+mlV1okblJqcSMtR4c52UKxDiX9GRBS8+Q= github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg= github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= +github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo= +github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4= +github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ= +github.com/getkin/kin-openapi v0.135.0 h1:751SjYfbiwqukYuVjwYEIKNfrSwS5YpA7DZnKSwQgtg= +github.com/getkin/kin-openapi v0.135.0/go.mod h1:6dd5FJl6RdX4usBtFBaQhk9q62Yb2J0Mk5IhUO/QqFI= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= +github.com/go-openapi/jsonpointer v0.22.4 h1:dZtK82WlNpVLDW2jlA1YCiVJFVqkED1MegOUy9kR5T4= +github.com/go-openapi/jsonpointer v0.22.4/go.mod h1:elX9+UgznpFhgBuaMQ7iu4lvvX1nvNsesQ3oxmYTw80= +github.com/go-openapi/swag/jsonname v0.25.4 h1:bZH0+MsS03MbnwBXYhuTttMOqk+5KcQ9869Vye1bNHI= +github.com/go-openapi/swag/jsonname v0.25.4/go.mod h1:GPVEk9CWVhNvWhZgrnvRA6utbAltopbKwDu8mXNUMag= +github.com/go-openapi/testify/v2 v2.0.2 h1:X999g3jeLcoY8qctY/c/Z8iBHTbwLz7R2WXd6Ub6wls= +github.com/go-openapi/testify/v2 v2.0.2/go.mod h1:HCPmvFFnheKK2BuwSA0TbbdxJ3I16pjwMkYkP4Ywn54= +github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 h1:p104kn46Q8WdvHunIJ9dAyjPVtrBPhSr3KT2yUst43I= +github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE= +github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI= +github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8= +github.com/go-test/deep v1.0.8 h1:TDsG77qcSprGbC6vTN8OuXp5g+J+b5Pcguhf7Zt61VM= +github.com/go-test/deep v1.0.8/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE= +github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= +github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8= +github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA= +github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs= +github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w= +github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0= +github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI= +github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk= +github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY= +github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek= +github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= +github.com/google/go-cmdtest v0.4.1-0.20220921163831-55ab3332a786 h1:rcv+Ippz6RAtvaGgKxc+8FQIpxHgsF+HBzPyYL2cyVU= +github.com/google/go-cmdtest v0.4.1-0.20220921163831-55ab3332a786/go.mod h1:apVn/GCasLZUVpAJ6oWAuyP7Ne7CEsQbTnc0plM3m+o= +github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= +github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= +github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= +github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= +github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE= +github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 h1:z2ogiKUYzX5Is6zr/vP9vJGqPwcdqsWjOt+V8J7+bTc= +github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI= +github.com/google/renameio v0.1.0 h1:GOZbcHa3HfsPKPlmyPyN2KEohoMXOhdMbHrvbpl2QaA= +github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI= github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0= github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= @@ -33,19 +86,79 @@ github.com/googleapis/enterprise-certificate-proxy v0.3.6 h1:GW/XbdyBFQ8Qe+YAmFU github.com/googleapis/enterprise-certificate-proxy v0.3.6/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA= github.com/googleapis/gax-go/v2 v2.15.0 h1:SyjDc1mGgZU5LncH8gimWo9lW1DtIfPibOG81vgd/bo= github.com/googleapis/gax-go/v2 v2.15.0/go.mod h1:zVVkkxAQHa1RQpg9z2AUCMnKhi0Qld9rcmyfL1OZhoc= +github.com/gookit/assert v0.1.1 h1:lh3GcawXe/p+cU7ESTZ5Ui3Sm/x8JWpIis4/1aF0mY0= +github.com/gookit/assert v0.1.1/go.mod h1:jS5bmIVQZTIwk42uXl4lyj4iaaxx32tqH16CFj0VX2E= github.com/gookit/color v1.6.0 h1:JjJXBTk1ETNyqyilJhkTXJYYigHG24TM9Xa2M1xAhRA= github.com/gookit/color v1.6.0/go.mod h1:9ACFc7/1IpHGBW8RwuDm/0YEnhg3dwwXpoMsmtyHfjs= github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg= github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE= +github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU= +github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc= github.com/invopop/jsonschema v0.13.0 h1:KvpoAJWEjR3uD9Kbm2HWJmqsEaHt8lBUpd0qHcIi21E= github.com/invopop/jsonschema v0.13.0/go.mod h1:ffZ5Km5SWWRAIN6wbDXItl95euhFz2uON45H2qjYt+0= +github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY= github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y= -github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0= -github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc= +github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= +github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= +github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= +github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= +github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= +github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= +github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= +github.com/mailru/easyjson v0.9.1 h1:LbtsOm5WAswyWbvTEOqhypdPeZzHavpZx96/n553mR8= +github.com/mailru/easyjson v0.9.1/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU= +github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 h1:RWengNIwukTxcDr9M+97sNutRR1RKhG96O6jWumTTnw= +github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8= +github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A= +github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE= +github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU= +github.com/oapi-codegen/oapi-codegen/v2 v2.7.0 h1:/8daqIYZfwnsHEAZdHUu9m0D5LA+5DoJCP7zLlT5Cs0= +github.com/oapi-codegen/oapi-codegen/v2 v2.7.0/go.mod h1:qzFy6iuobJw/hD1aRILee4G87/ShmhR0xYCwcUtZMCw= +github.com/oasdiff/yaml v0.0.9 h1:zQOvd2UKoozsSsAknnWoDJlSK4lC0mpmjfDsfqNwX48= +github.com/oasdiff/yaml v0.0.9/go.mod h1:8lvhgJG4xiKPj3HN5lDow4jZHPlx1i7dIwzkdAo6oAM= +github.com/oasdiff/yaml3 v0.0.9 h1:rWPrKccrdUm8J0F3sGuU+fuh9+1K/RdJlWF7O/9yw2g= +github.com/oasdiff/yaml3 v0.0.9/go.mod h1:y5+oSEHCPT/DGrS++Wc/479ERge0zTFxaF8PbGKcg2o= +github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= +github.com/onsi/ginkgo v1.10.2/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= +github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk= +github.com/onsi/ginkgo v1.16.4 h1:29JGrr5oVBm5ulCWet69zQkzWipVXIol6ygQUe/EzNc= +github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0= +github.com/onsi/ginkgo/v2 v2.1.3/go.mod h1:vw5CSIxN1JObi/U8gcbwft7ZxR2dgaR70JSE3/PpL4c= +github.com/onsi/ginkgo/v2 v2.28.2 h1:DTrMfpqxiNUyQ3Y0zhn1n3cOO2euFgQPYIpkWwxVFps= +github.com/onsi/ginkgo/v2 v2.28.2/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE= +github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY= +github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY= +github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo= +github.com/onsi/gomega v1.17.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY= +github.com/onsi/gomega v1.19.0/go.mod h1:LY+I3pBVzYsTBU1AnDwOSxaYi9WoWiqgwooUqq9yPro= +github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28= +github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg= github.com/openai/openai-go/v3 v3.32.0 h1:aHp/3wkX1W6jB8zTtf9xV0aK0qPFSVDqS7AHmlJ4hXs= github.com/openai/openai-go/v3 v3.32.0/go.mod h1:cdufnVK14cWcT9qA1rRtrXx4FTRsgbDPW7Ia7SS5cZo= +github.com/perimeterx/marshmallow v1.1.5 h1:a2LALqQ1BlHM8PZblsDdidgv1mWi1DgC2UmX50IvK2s= +github.com/perimeterx/marshmallow v1.1.5/go.mod h1:dsXbUu8CRzfYP5a87xpp0xq9S3u0Vchtcl8we9tYaXw= +github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= +github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= +github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= +github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ= +github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU= github.com/securego/gosec/v2 v2.26.1 h1:gdkttGhQFVehqRJ8grKH4DrpqM/QlPKNHBnl8QgcEC4= github.com/securego/gosec/v2 v2.26.1/go.mod h1:57UW4p0uoP3kxoTkhoo3axLdVAi+OWrLg/Ax/kdqtPE= +github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0= +github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM= +github.com/speakeasy-api/jsonpath v0.6.3 h1:c+QPwzAOdrWvzycuc9HFsIZcxKIaWcNpC+xhOW9rJxU= +github.com/speakeasy-api/jsonpath v0.6.3/go.mod h1:2cXloNuQ+RSXi5HTRaeBh7JEmjRXTiaKpFTdZiL7URI= +github.com/speakeasy-api/openapi v1.19.2 h1:md90tE71/M8jS3cuRlsuWP5Aed4xoG5PSRvXeZgCv/M= +github.com/speakeasy-api/openapi v1.19.2/go.mod h1:UfKa7FqE4jgexJZuj51MmdHAFGmDv0Zaw3+yOd81YKU= +github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= +github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY= +github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA= +github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4= +github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA= +github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= +github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk= github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY= github.com/tidwall/gjson v1.18.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk= @@ -56,10 +169,17 @@ github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4= github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU= github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY= github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28= +github.com/ugorji/go/codec v1.2.11 h1:BMaWp1Bb6fHwEtbplGBGJ498wD+LKlNSl25MjdZY4dU= +github.com/ugorji/go/codec v1.2.11/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg= +github.com/vmware-labs/yaml-jsonpath v0.3.2 h1:/5QKeCBGdsInyDCyVNLbXyilb61MXGi9NP674f9Hobk= +github.com/vmware-labs/yaml-jsonpath v0.3.2/go.mod h1:U6whw1z03QyqgWdgXxvVnQ90zN1BWz5V+51Ewf8k+rQ= github.com/wk8/go-ordered-map/v2 v2.1.8 h1:5h/BUHu93oj4gIdvHHHGsScSTMijfx5PeYkE/fJgbpc= github.com/wk8/go-ordered-map/v2 v2.1.8/go.mod h1:5nJHM5DyteebpVlHnWMV0rPz6Zp7+xBAnxjb1X5vnTw= +github.com/woodsbury/decimal128 v1.4.0 h1:xJATj7lLu4f2oObouMt2tgGiElE5gO6mSWUjQsBgUlc= +github.com/woodsbury/decimal128 v1.4.0/go.mod h1:BP46FUrVjVhdTbKT+XuQh2xfQaGki9LMIRJSFuh6THU= github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no= github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM= +github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus= @@ -68,40 +188,114 @@ go.opentelemetry.io/otel v1.41.0 h1:YlEwVsGAlCvczDILpUXpIpPSL/VPugt7zHThEMLce1c= go.opentelemetry.io/otel v1.41.0/go.mod h1:Yt4UwgEKeT05QbLwbyHXEwhnjxNO6D8L5PQP51/46dE= go.opentelemetry.io/otel/metric v1.41.0 h1:rFnDcs4gRzBcsO9tS8LCpgR0dxg4aaxWlJxCno7JlTQ= go.opentelemetry.io/otel/metric v1.41.0/go.mod h1:xPvCwd9pU0VN8tPZYzDZV/BMj9CM9vs00GuBjeKhJps= +go.opentelemetry.io/otel/sdk v1.39.0 h1:nMLYcjVsvdui1B/4FRkwjzoRVsMK8uL/cj0OyhKzt18= +go.opentelemetry.io/otel/sdk v1.39.0/go.mod h1:vDojkC4/jsTJsE+kh+LXYQlbL8CgrEcwmt1ENZszdJE= +go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2WKg+sEJTtB8= +go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew= go.opentelemetry.io/otel/trace v1.41.0 h1:Vbk2co6bhj8L59ZJ6/xFTskY+tGAbOnCtQGVVa9TIN0= go.opentelemetry.io/otel/trace v1.41.0/go.mod h1:U1NU4ULCoxeDKc09yCWdWe+3QoyweJcISEVa1RBzOis= go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= +golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= +golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= +golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI= golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q= golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa h1:FRnLl4eNAQl8hwxVVC17teOw8kdjVDVAiFMtgUdTSRQ= +golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa/go.mod h1:zk2irFbV9DP96SEBUUAy67IdHUaZuSnrz1n472HUCLE= golang.org/x/exp/typeparams v0.0.0-20231108232855-2478ac86f678 h1:1P7xPZEwZMoBoz0Yze5Nx2/4pxj6nw9ZqHWXqP0iRgQ= golang.org/x/exp/typeparams v0.0.0-20231108232855-2478ac86f678/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk= +golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM= golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU= +golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= +golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= +golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= +golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= +golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk= +golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk= golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA= golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs= +golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4= golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= +golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= +golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI= golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/telemetry v0.0.0-20260409153401-be6f6cb8b1fa h1:efT73AJZfAAUV7SOip6pWGkwJDzIGiKBZGVzHYa+ve4= golang.org/x/telemetry v0.0.0-20260409153401-be6f6cb8b1fa/go.mod h1:kHjTxDEnAu6/Nl9lDkzjWpR+bmKfxeiRuSDlsMb70gE= +golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= +golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= +golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= +golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= +golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= +golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg= golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164= +golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= +golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= +golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c= golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI= +golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM= +golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY= +golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM= +golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated/go.mod h1:RVAQXBGNv1ib0J382/DPCRS/BPnsGebyM1Gj5VSDpG8= golang.org/x/vuln v1.1.4 h1:Ju8QsuyhX3Hk8ma3CesTbO8vfJD9EvUBgHvkxHBzj0I= golang.org/x/vuln v1.1.4/go.mod h1:F+45wmU18ym/ca5PLTPLsSzr2KppzswxPP603ldA67s= +golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk= +gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E= google.golang.org/genai v1.54.0 h1:ZQCa70WMTJDI11FdqWCzGvZ5PanpcpfoO6jl/lrSnGU= google.golang.org/genai v1.54.0/go.mod h1:A3kkl0nyBjyFlNjgxIwKq70julKbIxpSxqKO5gw/gmk= google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 h1:gRkg/vSppuSQoDjxyiGfN4Upv/h/DQmIR10ZU8dh4Ww= google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk= google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE= google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ= +google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= +google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0= +google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM= +google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE= +google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo= +google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU= +google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw= +google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE= google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= +gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= +gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys= +gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ= +gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw= +gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= +gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= +gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= +gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= +gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY= +gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= +gopkg.in/yaml.v3 v3.0.0-20191026110619-0b21df46bc1d/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= +gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= honnef.co/go/tools v0.6.1 h1:R094WgE8K4JirYjBaOpz/AvTyUu/3wbmAoskKN/pxTI= From b18d593af09c2c002690f44bb7d3c84f8366f556 Mon Sep 17 00:00:00 2001 From: Chris Stockton Date: Thu, 21 May 2026 08:30:52 -0700 Subject: [PATCH 3/3] chore: gosec noise --- hack/vulncheck-filter/parse_test.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/hack/vulncheck-filter/parse_test.go b/hack/vulncheck-filter/parse_test.go index cb86767c93..df61a86115 100644 --- a/hack/vulncheck-filter/parse_test.go +++ b/hack/vulncheck-filter/parse_test.go @@ -450,7 +450,9 @@ func TestParse(t *testing.T) { func loadTestdata(t testing.TB, name string) string { t.Helper() - data, err := os.ReadFile(filepath.Join("testdata", name)) + // Not a vulnerability, tests are _ALREADY_ rooted and this value + // comes from a const. + data, err := os.ReadFile(filepath.Join("testdata", name)) //#nosec G304 if err != nil { t.Fatal(err) }