mirror of
https://github.com/PerpetualSoftware/pad.git
synced 2026-10-26 22:37:03 +00:00
xarmian
7c9f29b2f3
* fix(ci): Go toolchain 1.26.10 for GO-2026-6809, markdown-it 14.3.3 for npm audit (TASK-4007) Main CI is red on both gates. - govulncheck: GO-2026-6809 (crypto/x509) is fixed in go1.26.10. The go.mod toolchain line and the Dockerfile's golang image move to 1.26.10. The workflow comments that name the toolchain value follow it, and go.mod's comment records the raise. - Nix: its artifact is built with nixos-26.05's go, which predates 1.26.10, so GO-2026-6809 joins nix/accepted-advisories.txt the way the 1.26.9 block did, with the same removal condition. - npm audit: markdown-it up to 14.3.2 has two high quadratic-time DoS advisories (GHSA-vfgh-jcmw-g37q, GHSA-gfr2-rv44-r23c). The overrides pin goes ^14.3.0 -> ^14.3.3; the lock moves markdown-it 14.3.2 -> 14.3.3 and nothing else. Claude-Session: https://claude.ai/code/session_01JRXHP9ZVfEN3YEuzmucxP3 * ci(deps): allow markdown-it 14.3.3 under the 7-day age check, a security fix (TASK-4007) Dependency age (advisory) flagged only markdown-it@14.3.3, published 2026-10-16: the fix for GHSA-vfgh-jcmw-g37q and GHSA-gfr2-rv44-r23c. pad-merge-pr requires every check at the head to be SUCCESS, so the advisory red blocked the merge. A security fix cannot wait out the window. The allow line is the file's own remedy for this case; its removal after the version ages past 7 days is a filed follow-up. Claude-Session: https://claude.ai/code/session_01JRXHP9ZVfEN3YEuzmucxP3
161 lines
7.6 KiB
Modula-2
161 lines
7.6 KiB
Modula-2
module github.com/PerpetualSoftware/pad
|
|
|
|
go 1.26.5
|
|
|
|
// BUG-2565: build with go1.26.6, which fixes 8 reachable standard-library
|
|
// advisories (GO-2026-5942 and friends — net.Resolver.LookupCNAME,
|
|
// http.Client.Do) that turned CI's govulncheck gate red on 2026-08-13
|
|
// without any commit causing it. A `toolchain` line, not a raise of the
|
|
// `go` directive above, on purpose: GOTOOLCHAIN=auto (every GitHub
|
|
// Actions job sets it) fetches 1.26.6 and stamps it into the binary,
|
|
// while builders pinned to GOTOOLCHAIN=local ignore this line and keep
|
|
// satisfying the 1.26.5 floor. nixpkgs nixos-26.05 still ships go 1.26.5,
|
|
// so raising the floor would break the Nix build outright; see BUG-2567
|
|
// for the Nix-packaged binary, which stays on 1.26.5 until nixpkgs
|
|
// catches up.
|
|
//
|
|
// Raised to go1.26.9 (2026-10-08) for twelve more standard-library advisories
|
|
// in net/http and html/template (GO-2026-6603, GO-2026-6600, GO-2026-6599 and
|
|
// others), fixed in 1.26.9, which turned govulncheck red on every PR the same way.
|
|
//
|
|
// Raised to go1.26.10 (2026-10-21) for GO-2026-6809 (crypto/x509), fixed in
|
|
// 1.26.10, which turned govulncheck red the same way again (TASK-4007).
|
|
toolchain go1.26.10
|
|
|
|
require (
|
|
github.com/BurntSushi/toml v1.6.0
|
|
github.com/JohannesKaufmann/html-to-markdown/v2 v2.5.2
|
|
github.com/alicebob/miniredis/v2 v2.39.0
|
|
github.com/disintegration/imaging v1.6.2
|
|
github.com/dop251/goja v0.0.0-20260926152631-39ec2650adc9
|
|
github.com/fatih/color v1.19.0
|
|
github.com/go-chi/chi/v5 v5.3.2
|
|
github.com/go-chi/cors v1.2.2
|
|
github.com/go-json-experiment/json v0.0.0-20260820222146-c27c302e5fc3
|
|
github.com/go-shiori/go-readability v0.0.0-20251205110129-5db1dc9836f0
|
|
github.com/google/uuid v1.6.0
|
|
github.com/gorilla/websocket v1.5.3
|
|
github.com/jackc/pgx/v5 v5.11.0
|
|
github.com/mark3labs/mcp-go v1.1.0
|
|
github.com/ory/fosite v0.49.0
|
|
github.com/pb33f/go-yaml v0.1.1
|
|
github.com/pb33f/libopenapi v0.41.5
|
|
github.com/pquerna/otp v1.5.0
|
|
github.com/prometheus/client_golang v1.24.1
|
|
github.com/prometheus/client_model v0.6.3
|
|
github.com/prometheus/common v0.72.0
|
|
github.com/redis/go-redis/v9 v9.23.0
|
|
github.com/santhosh-tekuri/jsonschema/v6 v6.0.3
|
|
github.com/sergi/go-diff v1.4.0
|
|
github.com/spf13/cobra v1.10.2
|
|
github.com/spf13/pflag v1.0.10
|
|
github.com/trustelem/zxcvbn v1.0.1
|
|
go.yaml.in/yaml/v4 v4.0.0-rc.6
|
|
golang.org/x/crypto v0.57.0
|
|
golang.org/x/image v0.46.0
|
|
golang.org/x/sys v0.49.0
|
|
golang.org/x/term v0.46.0
|
|
golang.org/x/text v0.42.0
|
|
golang.org/x/time v0.16.0
|
|
golang.org/x/tools v0.51.0
|
|
modernc.org/sqlite v1.60.1
|
|
)
|
|
|
|
require (
|
|
github.com/JohannesKaufmann/dom v0.3.1 // indirect
|
|
github.com/andybalholm/cascadia v1.3.4 // indirect
|
|
github.com/araddon/dateparse v0.0.0-20210429162001-6b43995a97de // indirect
|
|
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
|
|
github.com/bahlo/generic-list-go v0.2.0 // indirect
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
|
|
github.com/buger/jsonparser v1.1.2 // indirect
|
|
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/cristalhq/jwt/v4 v4.0.2 // indirect
|
|
github.com/dgraph-io/ristretto v1.0.0 // indirect
|
|
github.com/dlclark/regexp2 v1.12.0 // indirect
|
|
github.com/dlclark/regexp2/v2 v2.5.2 // indirect
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/felixge/httpsnoop v1.0.4 // indirect
|
|
github.com/fsnotify/fsnotify v1.6.0 // indirect
|
|
github.com/go-jose/go-jose/v3 v3.0.5 // indirect
|
|
github.com/go-logr/logr v1.4.4 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/go-shiori/dom v0.0.0-20230515143342-73569d674e1c // indirect
|
|
github.com/go-sourcemap/sourcemap v2.1.3+incompatible // indirect
|
|
github.com/gobuffalo/pop/v6 v6.1.1 // indirect
|
|
github.com/gogo/protobuf v1.3.2 // indirect
|
|
github.com/gogs/chardet v0.0.0-20211120154057-b7413eaefb8f // indirect
|
|
github.com/golang/mock v1.6.0 // indirect
|
|
github.com/google/jsonschema-go v0.4.2 // indirect
|
|
github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 // indirect
|
|
github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
|
|
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
|
|
github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
|
|
github.com/hashicorp/hcl v1.0.0 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/jackc/pgpassfile v1.0.0 // indirect
|
|
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
|
|
github.com/jackc/puddle/v2 v2.2.2 // indirect
|
|
github.com/magiconair/properties v1.8.7 // indirect
|
|
github.com/mattn/go-colorable v0.1.14 // indirect
|
|
github.com/mattn/go-isatty v0.0.24 // indirect
|
|
github.com/mattn/goveralls v0.0.12 // indirect
|
|
github.com/mitchellh/mapstructure v1.5.0 // indirect
|
|
github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 // indirect
|
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
|
github.com/ncruces/go-strftime v1.0.0 // indirect
|
|
github.com/openzipkin/zipkin-go v0.4.3 // indirect
|
|
github.com/ory/go-acc v0.2.9-0.20230103102148-6b1c9a70dbbe // indirect
|
|
github.com/ory/go-convenience v0.1.0 // indirect
|
|
github.com/ory/x v0.0.665 // indirect
|
|
github.com/pb33f/jsonpath v0.8.4 // indirect
|
|
github.com/pb33f/ordered-map/v2 v2.3.2 // indirect
|
|
github.com/pelletier/go-toml/v2 v2.0.9 // indirect
|
|
github.com/pkg/errors v0.9.1 // indirect
|
|
github.com/prometheus/procfs v0.21.1 // indirect
|
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
|
github.com/seatgeek/logrus-gelf-formatter v0.0.0-20210414080842-5b05eb8ff761 // indirect
|
|
github.com/sirupsen/logrus v1.9.3 // indirect
|
|
github.com/spf13/afero v1.9.5 // indirect
|
|
github.com/spf13/cast v1.7.1 // indirect
|
|
github.com/spf13/jwalterweatherman v1.1.0 // indirect
|
|
github.com/spf13/viper v1.16.0 // indirect
|
|
github.com/stretchr/testify v1.12.1 // indirect
|
|
github.com/subosito/gotenv v1.4.2 // indirect
|
|
github.com/test-go/testify v1.1.4 // indirect
|
|
github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
|
|
github.com/yuin/gopher-lua v1.1.1 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.46.1 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
|
|
go.opentelemetry.io/contrib/propagators/b3 v1.21.0 // indirect
|
|
go.opentelemetry.io/contrib/propagators/jaeger v1.21.1 // indirect
|
|
go.opentelemetry.io/contrib/samplers/jaegerremote v0.15.1 // indirect
|
|
go.opentelemetry.io/otel v1.45.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/jaeger v1.17.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.45.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/zipkin v1.45.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.45.0 // indirect
|
|
go.opentelemetry.io/otel/sdk v1.45.0 // indirect
|
|
go.opentelemetry.io/otel/trace v1.45.0 // indirect
|
|
go.opentelemetry.io/proto/otlp v1.11.0 // indirect
|
|
go.uber.org/atomic v1.12.0 // indirect
|
|
go.yaml.in/yaml/v3 v3.0.5 // indirect
|
|
golang.org/x/mod v0.41.0 // indirect
|
|
golang.org/x/net v0.60.0 // indirect
|
|
golang.org/x/oauth2 v0.37.0 // indirect
|
|
golang.org/x/sync v0.23.0 // indirect
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect
|
|
google.golang.org/grpc v1.83.2 // indirect
|
|
google.golang.org/protobuf v1.36.12 // indirect
|
|
gopkg.in/ini.v1 v1.67.0 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
modernc.org/libc v1.77.1 // indirect
|
|
modernc.org/mathutil v1.7.1 // indirect
|
|
modernc.org/memory v1.12.1 // indirect
|
|
)
|