mirror of
https://github.com/PerpetualSoftware/pad.git
synced 2026-09-10 15:05:40 +00:00
dependabot[bot]
31d11e76ea
* chore(deps)(deps): bump github.com/mark3labs/mcp-go from 0.58.0 to 1.0.0 Bumps [github.com/mark3labs/mcp-go](https://github.com/mark3labs/mcp-go) from 0.58.0 to 1.0.0. - [Release notes](https://github.com/mark3labs/mcp-go/releases) - [Commits](https://github.com/mark3labs/mcp-go/compare/v0.58.0...v1.0.0) --- updated-dependencies: - dependency-name: github.com/mark3labs/mcp-go dependency-version: 1.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * fix(mcp): pad owns the protocol revision it advertises, not the library (TASK-2972) mcp-go 1.0 moves LATEST_PROTOCOL_VERSION to 2026-07-28. `MetaPayload. MCPProtocolVersion` was sourced from that constant, on the reasoning — written in the comment — that doing so meant the value "never drifts from what NewMCPServer actually advertises in the handshake". 1.0 falsified that, and in the direction the comment was guarding against. The handshake answers through `mcp.NegotiateLegacyVersion`, which returns at most LATEST_LEGACY_PROTOCOL_VERSION and CANNOT return the modern revision at all: measured, a client asking for 2026-07-28 is told 2025-11-25, and a client that sends nothing is told 2025-03-26. So the bump would have left the handshake where it was and moved the meta document alone — publishing a claim to negotiate a revision this server cannot negotiate. The advertised revision is now a pad-owned literal. Moving it means reading the new revision's delta against this server's surface first; a library bump must not move it on its own. The test that should have caught this was a tautology: it compared the payload against the same constant the payload was built from, so it could not fail, and it would have passed through this bump. Replaced with two assertions that each catch what the other cannot — against the LITERAL, so moving pad's claim is a deliberate edit visible in a diff, and against what the library's handshake ACTUALLY answers, which is the property the old comment claimed and never had. Both legs verified to fail when the constant is moved. Refs: TASK-2972 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: xarmian <xarmian@gmail.com>
148 lines
6.9 KiB
Modula-2
148 lines
6.9 KiB
Modula-2
module github.com/PerpetualSoftware/pad
|
|
|
|
go 1.26.5
|
|
|
|
// BUG-2565: build with go1.26.6, which fixes 8 reachable standard-library
|
|
// advisories (GO-2026-5942 and friends — net.Resolver.LookupCNAME,
|
|
// http.Client.Do) that turned CI's govulncheck gate red on 2026-08-13
|
|
// without any commit causing it. A `toolchain` line, not a raise of the
|
|
// `go` directive above, on purpose: GOTOOLCHAIN=auto (every GitHub
|
|
// Actions job sets it) fetches 1.26.6 and stamps it into the binary,
|
|
// while builders pinned to GOTOOLCHAIN=local ignore this line and keep
|
|
// satisfying the 1.26.5 floor. nixpkgs nixos-26.05 still ships go 1.26.5,
|
|
// so raising the floor would break the Nix build outright; see BUG-2567
|
|
// for the Nix-packaged binary, which stays on 1.26.5 until nixpkgs
|
|
// catches up.
|
|
toolchain go1.26.6
|
|
|
|
require (
|
|
github.com/BurntSushi/toml v1.6.0
|
|
github.com/JohannesKaufmann/html-to-markdown/v2 v2.5.2
|
|
github.com/alicebob/miniredis/v2 v2.39.0
|
|
github.com/disintegration/imaging v1.6.2
|
|
github.com/fatih/color v1.19.0
|
|
github.com/go-chi/chi/v5 v5.3.2
|
|
github.com/go-chi/cors v1.2.2
|
|
github.com/go-shiori/go-readability v0.0.0-20251205110129-5db1dc9836f0
|
|
github.com/google/uuid v1.6.0
|
|
github.com/gorilla/websocket v1.5.3
|
|
github.com/jackc/pgx/v5 v5.10.0
|
|
github.com/mark3labs/mcp-go v1.0.0
|
|
github.com/ory/fosite v0.49.0
|
|
github.com/pb33f/libopenapi v0.38.7
|
|
github.com/pquerna/otp v1.5.0
|
|
github.com/prometheus/client_golang v1.24.1
|
|
github.com/prometheus/client_model v0.6.3
|
|
github.com/prometheus/common v0.71.0
|
|
github.com/redis/go-redis/v9 v9.22.0
|
|
github.com/santhosh-tekuri/jsonschema/v6 v6.0.3
|
|
github.com/sergi/go-diff v1.4.0
|
|
github.com/spf13/cobra v1.10.2
|
|
github.com/spf13/pflag v1.0.10
|
|
github.com/trustelem/zxcvbn v1.0.1
|
|
go.yaml.in/yaml/v4 v4.0.0-rc.6
|
|
golang.org/x/crypto v0.56.0
|
|
golang.org/x/image v0.45.0
|
|
golang.org/x/sys v0.48.0
|
|
golang.org/x/term v0.45.0
|
|
golang.org/x/text v0.41.0
|
|
golang.org/x/time v0.16.0
|
|
modernc.org/sqlite v1.58.0
|
|
)
|
|
|
|
require (
|
|
github.com/JohannesKaufmann/dom v0.3.1 // indirect
|
|
github.com/andybalholm/cascadia v1.3.4 // indirect
|
|
github.com/araddon/dateparse v0.0.0-20210429162001-6b43995a97de // indirect
|
|
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
|
|
github.com/bahlo/generic-list-go v0.2.0 // indirect
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
|
|
github.com/buger/jsonparser v1.1.2 // indirect
|
|
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/cristalhq/jwt/v4 v4.0.2 // indirect
|
|
github.com/dgraph-io/ristretto v1.0.0 // indirect
|
|
github.com/dlclark/regexp2 v1.12.0 // indirect
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/felixge/httpsnoop v1.0.4 // indirect
|
|
github.com/fsnotify/fsnotify v1.6.0 // indirect
|
|
github.com/go-jose/go-jose/v3 v3.0.5 // indirect
|
|
github.com/go-logr/logr v1.4.4 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/go-shiori/dom v0.0.0-20230515143342-73569d674e1c // indirect
|
|
github.com/gobuffalo/pop/v6 v6.1.1 // indirect
|
|
github.com/gogo/protobuf v1.3.2 // indirect
|
|
github.com/gogs/chardet v0.0.0-20211120154057-b7413eaefb8f // indirect
|
|
github.com/golang/mock v1.6.0 // indirect
|
|
github.com/google/jsonschema-go v0.4.2 // indirect
|
|
github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
|
|
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
|
|
github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
|
|
github.com/hashicorp/hcl v1.0.0 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/jackc/pgpassfile v1.0.0 // indirect
|
|
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
|
|
github.com/jackc/puddle/v2 v2.2.2 // indirect
|
|
github.com/magiconair/properties v1.8.7 // indirect
|
|
github.com/mattn/go-colorable v0.1.14 // indirect
|
|
github.com/mattn/go-isatty v0.0.24 // indirect
|
|
github.com/mattn/goveralls v0.0.12 // indirect
|
|
github.com/mitchellh/mapstructure v1.5.0 // indirect
|
|
github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 // indirect
|
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
|
github.com/ncruces/go-strftime v1.0.0 // indirect
|
|
github.com/openzipkin/zipkin-go v0.4.2 // indirect
|
|
github.com/ory/go-acc v0.2.9-0.20230103102148-6b1c9a70dbbe // indirect
|
|
github.com/ory/go-convenience v0.1.0 // indirect
|
|
github.com/ory/x v0.0.665 // indirect
|
|
github.com/pb33f/jsonpath v0.8.2 // indirect
|
|
github.com/pb33f/ordered-map/v2 v2.3.1 // indirect
|
|
github.com/pelletier/go-toml/v2 v2.0.9 // indirect
|
|
github.com/pkg/errors v0.9.1 // indirect
|
|
github.com/prometheus/procfs v0.21.1 // indirect
|
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
|
github.com/seatgeek/logrus-gelf-formatter v0.0.0-20210414080842-5b05eb8ff761 // indirect
|
|
github.com/sirupsen/logrus v1.9.3 // indirect
|
|
github.com/spf13/afero v1.9.5 // indirect
|
|
github.com/spf13/cast v1.7.1 // indirect
|
|
github.com/spf13/jwalterweatherman v1.1.0 // indirect
|
|
github.com/spf13/viper v1.16.0 // indirect
|
|
github.com/stretchr/testify v1.12.1 // indirect
|
|
github.com/subosito/gotenv v1.4.2 // indirect
|
|
github.com/test-go/testify v1.1.4 // indirect
|
|
github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
|
|
github.com/yuin/gopher-lua v1.1.1 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.46.1 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
|
|
go.opentelemetry.io/contrib/propagators/b3 v1.21.0 // indirect
|
|
go.opentelemetry.io/contrib/propagators/jaeger v1.21.1 // indirect
|
|
go.opentelemetry.io/contrib/samplers/jaegerremote v0.15.1 // indirect
|
|
go.opentelemetry.io/otel v1.45.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/jaeger v1.17.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.45.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/zipkin v1.21.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.45.0 // indirect
|
|
go.opentelemetry.io/otel/sdk v1.45.0 // indirect
|
|
go.opentelemetry.io/otel/trace v1.45.0 // indirect
|
|
go.opentelemetry.io/proto/otlp v1.11.0 // indirect
|
|
go.uber.org/atomic v1.11.0 // indirect
|
|
go.yaml.in/yaml/v3 v3.0.5 // indirect
|
|
golang.org/x/mod v0.38.0 // indirect
|
|
golang.org/x/net v0.58.0 // indirect
|
|
golang.org/x/oauth2 v0.36.0 // indirect
|
|
golang.org/x/sync v0.22.0 // indirect
|
|
golang.org/x/tools v0.48.0 // indirect
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect
|
|
google.golang.org/grpc v1.83.0 // indirect
|
|
google.golang.org/protobuf v1.36.12 // indirect
|
|
gopkg.in/ini.v1 v1.67.0 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
modernc.org/libc v1.75.6 // indirect
|
|
modernc.org/mathutil v1.7.1 // indirect
|
|
modernc.org/memory v1.12.1 // indirect
|
|
)
|