From 064e776dd0a37775af7b6c5abb43a462929e60fa Mon Sep 17 00:00:00 2001 From: "pulse-triage[bot]" <249995291+pulse-triage[bot]@users.noreply.github.com> Date: Wed, 23 Sep 2026 06:32:13 +0100 Subject: [PATCH 1/3] fix(release): support RC-derived stable patch install metadata The install-metadata contract encoded only the emergency no-RC stable-patch shape. A stable patch with a same-version RC promotes the exercised candidate (promotion_mode stable-rc-promotion), so the contract must assert that shape and derive the rollback target from the last published stable. previousStablePatchVersion hardcoded only v6.4.2 as unpublished, so v6.4.5 rolled back to the never-published v6.4.4. Add v6.4.3 and v6.4.4, which only ever shipped as prereleases, so v6.4.5 resolves to the published v6.4.1 that the promotion resolver also derives. Add stablePatchPromotedPrerelease to detect the same-version candidate from the retained release notes, and branch the stable-patch install-metadata tests between the emergency and RC-derived shapes. Unit tests pin the rollback derivation and the candidate detection. Change-source: pulse-maintainer --- .../installtests/build_release_assets_test.go | 33 ++++- .../installtests/install_docker_sh_test.go | 132 ++++++++++++++++-- 2 files changed, 150 insertions(+), 15 deletions(-) diff --git a/scripts/installtests/build_release_assets_test.go b/scripts/installtests/build_release_assets_test.go index 8c2678b9aa..4417d5955b 100644 --- a/scripts/installtests/build_release_assets_test.go +++ b/scripts/installtests/build_release_assets_test.go @@ -1142,6 +1142,7 @@ func TestCurrentStablePatchReleasePacketTracksInstallMetadata(t *testing.T) { t.Skip("current release is not a stable patch release") } releaseBranch := requiredReleaseBranchForVersion(t, version) + promotedTag, rcDerived := currentStablePatchPromotedPrerelease(t, version) releaseNotesPath := repoFile("docs", "releases", "RELEASE_NOTES_v"+version+".md") changelogPath := repoFile("docs", "releases", "V6_CHANGELOG_v"+version+".md") @@ -1152,17 +1153,30 @@ func TestCurrentStablePatchReleasePacketTracksInstallMetadata(t *testing.T) { "## What's improved", "not Authenticode-signed", "Unknown Publisher warning", - "This patch does not require a companion mobile release", + "does not require a companion mobile release", "rollback target is stable `v"+previous+"`", ) - assertFileContainsAllNormalized(t, changelogPath, + changelogRequired := make([]string, 0, 7) + changelogRequired = append(changelogRequired, "Version: `v"+version+"`", "Rollback target: `v"+previous+"`", - "Promotion path: emergency stable patch from `"+releaseBranch+"`", "Windows signing decision: the standing SignPath-unavailable policy publishes unsigned Windows Unified Agent binaries", "Unknown Publisher warning", "Mobile decision: `no-mobile-impact`", ) + if rcDerived { + // A stable patch with a same-version RC promotes the exercised + // candidate; the promotion resolver refuses the emergency no-RC path. + changelogRequired = append(changelogRequired, + "Promoted prerelease: `"+promotedTag+"`", + "Promotion path: exact-SHA single-build release candidate from `"+releaseBranch+"`", + ) + } else { + changelogRequired = append(changelogRequired, + "Promotion path: emergency stable patch from `"+releaseBranch+"`", + ) + } + assertFileContainsAllNormalized(t, changelogPath, changelogRequired...) assertFileContainsAll(t, repoFile("docs", "RELEASE_NOTES.md"), "docs/releases/RELEASE_NOTES_v"+version+".md", "docs/releases/V6_CHANGELOG_v"+version+".md", @@ -1188,11 +1202,20 @@ func TestCurrentStablePatchReleasePacketTracksInstallMetadata(t *testing.T) { assertFileContainsAll(t, repoFile("scripts", "install-docker.sh"), `CANONICAL_DEFAULT_PULSE_VERSION="`+version+`"`, ) - assertFileContainsAllNormalized(t, repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md"), + installabilityPath := repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md") + installabilityRequired := make([]string, 0, 3) + installabilityRequired = append(installabilityRequired, "The active stable `v"+version+"` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and Helm chart release metadata to the same `"+version+"` release version.", - "This patch release uses the stable hotfix path with `rollback_version=v"+previous+"`, `hotfix_exception=true`, a release-owner reason, and no fabricated same-version RC tag.", "For the active stable `v"+version+"` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `"+version+"`", ) + if rcDerived { + installabilityRequired = append(installabilityRequired, "promoted_from_tag="+promotedTag) + } else { + installabilityRequired = append(installabilityRequired, + "This patch release uses the stable hotfix path with `rollback_version=v"+previous+"`, `hotfix_exception=true`, a release-owner reason, and no fabricated same-version RC tag.", + ) + } + assertFileContainsAllNormalized(t, installabilityPath, installabilityRequired...) } func TestCurrentStableMinorReleasePacketTracksInstallMetadata(t *testing.T) { diff --git a/scripts/installtests/install_docker_sh_test.go b/scripts/installtests/install_docker_sh_test.go index 1a55fb1289..fbd793a340 100644 --- a/scripts/installtests/install_docker_sh_test.go +++ b/scripts/installtests/install_docker_sh_test.go @@ -41,13 +41,20 @@ func isPrereleaseVersion(version string) bool { return strings.Contains(version, "-") } -// unpublishedStableVersions lists stable versions whose tag and packet exist in -// the repository but which never activated as a public GitHub release. They are -// not valid rollback targets and must not be treated as the previous stable. +// unpublishedStableVersions lists stable versions that never activated as a +// public GitHub release, whether or not a same-version tag or packet was +// staged. They are not valid rollback targets and must not be treated as the +// previous stable. var unpublishedStableVersions = map[string]bool{ // Tagged 2026-08-31; the private Pro build failed its memory gate and the // release commit verdict failed, so the packet shipped through v6.4.3 instead. "6.4.2": true, + // v6.4.3 and v6.4.4 were only ever published as prereleases + // (v6.4.3-rc.1, v6.4.4-beta.N). The v6.4.5 stable patch promotes the + // exercised v6.4.5-rc.N candidate, so the last published stable remains + // v6.4.1 and is the rollback target. + "6.4.3": true, + "6.4.4": true, } func previousStablePatchVersion(version string) (string, bool) { @@ -72,6 +79,50 @@ func previousStablePatchVersion(version string) (string, bool) { return "", false } +// stablePatchPromotedPrerelease reports the same-version release candidate a +// stable patch promotes, if one exists. A stable patch with a same-version RC +// is RC-derived: the promotion resolver selects promotion_mode +// "stable-rc-promotion" and refuses the emergency no-RC hotfix path, so the +// install-metadata contract must assert that shape instead of the emergency +// one. Detection reads the published candidate notes so it stays offline and +// matches the release line's retained metadata. +func stablePatchPromotedPrerelease(docsReleasesDir, version string) (string, bool) { + if isPrereleaseVersion(version) { + return "", false + } + matches, err := filepath.Glob(filepath.Join(docsReleasesDir, "RELEASE_NOTES_v"+version+"-rc.*.md")) + if err != nil { + return "", false + } + best := "" + bestNumber := -1 + for _, match := range matches { + filename := filepath.Base(match) + tag := strings.TrimSuffix(strings.TrimPrefix(filename, "RELEASE_NOTES_v"), ".md") + marker := strings.LastIndex(tag, "-rc.") + if marker < 0 { + continue + } + number, err := strconv.Atoi(tag[marker+len("-rc."):]) + if err != nil { + continue + } + if number > bestNumber { + bestNumber = number + best = "v" + tag + } + } + if best == "" { + return "", false + } + return best, true +} + +func currentStablePatchPromotedPrerelease(t *testing.T, version string) (string, bool) { + t.Helper() + return stablePatchPromotedPrerelease(repoFile("docs", "releases"), version) +} + func previousStableForPrereleaseVersion(version string) (string, bool) { if !isPrereleaseVersion(version) { return "", false @@ -185,6 +236,53 @@ func TestPreviousStableForPrereleaseVersionCrossesMinorBoundaries(t *testing.T) } } +func TestPreviousStablePatchVersionSkipsUnpublishedStables(t *testing.T) { + tests := []struct { + version string + want string + ok bool + }{ + {version: "6.4.1", want: "6.4.0", ok: true}, + {version: "6.4.2", want: "6.4.1", ok: true}, + // v6.4.2 was tagged but never published; v6.4.3 and v6.4.4 only ever + // shipped as prereleases, so v6.4.5 rolls back to the published v6.4.1. + {version: "6.4.5", want: "6.4.1", ok: true}, + {version: "6.4.0", ok: false}, + {version: "6.4.5-rc.2", ok: false}, + } + for _, test := range tests { + t.Run(test.version, func(t *testing.T) { + got, ok := previousStablePatchVersion(test.version) + if ok != test.ok || got != test.want { + t.Fatalf("previousStablePatchVersion(%q) = %q, %v; want %q, %v", test.version, got, ok, test.want, test.ok) + } + }) + } +} + +func TestStablePatchPromotedPrereleaseDetectsSameVersionCandidate(t *testing.T) { + dir := t.TempDir() + for _, name := range []string{ + "RELEASE_NOTES_v6.4.5-rc.1.md", + "RELEASE_NOTES_v6.4.5-rc.2.md", + "RELEASE_NOTES_v6.4.4-beta.4.md", + "RELEASE_NOTES_v6.4.5-beta.1.md", + } { + if err := os.WriteFile(filepath.Join(dir, name), []byte("x"), 0o600); err != nil { + t.Fatalf("write %s: %v", name, err) + } + } + if got, ok := stablePatchPromotedPrerelease(dir, "6.4.5"); !ok || got != "v6.4.5-rc.2" { + t.Fatalf("stablePatchPromotedPrerelease(6.4.5) = %q, %v; want v6.4.5-rc.2, true", got, ok) + } + if got, ok := stablePatchPromotedPrerelease(dir, "6.4.6"); ok { + t.Fatalf("stablePatchPromotedPrerelease(6.4.6) = %q, true; want no same-version candidate", got) + } + if got, ok := stablePatchPromotedPrerelease(dir, "6.4.5-rc.2"); ok { + t.Fatalf("stablePatchPromotedPrerelease(6.4.5-rc.2) = %q, true; want prerelease ignored", got) + } +} + func previousPrereleaseVersion(version string) (string, bool) { base, suffix, ok := strings.Cut(version, "-rc.") if !ok { @@ -325,28 +423,42 @@ func TestInstallDockerProofTracksStablePatchReleaseContract(t *testing.T) { if !ok { t.Skip("current release is not a stable patch release") } + promotedTag, rcDerived := currentStablePatchPromotedPrerelease(t, version) + installabilityPath := repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md") - assertFileContainsAllNormalized(t, repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md"), + required := make([]string, 0, 5) + required = append(required, "The active stable `v"+version+"` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and Helm chart release metadata to the same `"+version+"` release version.", - "This patch release uses the stable hotfix path with `rollback_version=v"+previous+"`, `hotfix_exception=true`, a release-owner reason, and no fabricated same-version RC tag.", - "active customer harm", "`no-mobile-impact`", "For the active stable `v"+version+"` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `"+version+"`", ) + if rcDerived { + // An RC-derived stable patch promotes the exercised same-version + // candidate, so the active-stable paragraph names the promoted tag + // instead of the emergency no-RC hotfix path. + required = append(required, "promoted_from_tag="+promotedTag) + } else { + required = append(required, + "This patch release uses the stable hotfix path with `rollback_version=v"+previous+"`, `hotfix_exception=true`, a release-owner reason, and no fabricated same-version RC tag.", + "active customer harm", + ) + } + assertFileContainsAllNormalized(t, installabilityPath, required...) + if version == "6.3.1" { - assertFileContainsAllNormalized(t, repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md"), + assertFileContainsAllNormalized(t, installabilityPath, "the prior `v"+previous+"` decision could not be reused for this patch", "the release owner recorded that separate `v6.3.1` exception", "public Unknown Publisher disclosure", ) - } else { - assertFileContainsAllNormalized(t, repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md"), + } else if !rcDerived { + assertFileContainsAllNormalized(t, installabilityPath, "standing SignPath-unavailable policy from `v6.3.2` onward", "Public Unknown Publisher disclosure", ) } if version == "6.4.2" { - assertFileContainsAllNormalized(t, repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md"), + assertFileContainsAllNormalized(t, installabilityPath, "The governed branch is `main`", "authenticated non-administrator organization members can reach infrastructure action control", "SSO-only deployments can treat every authenticated IdP user as an instance administrator without an explicit grant", From dc42735008311bbf0aca840c6b83b6bd25b4d7ee Mon Sep 17 00:00:00 2001 From: "pulse-triage[bot]" <249995291+pulse-triage[bot]@users.noreply.github.com> Date: Wed, 23 Sep 2026 06:32:54 +0100 Subject: [PATCH 2/3] chore(deps): keep TypeScript majors as explicit Dependabot work Dependabot #2100 and #2101 propose TypeScript 5.9.3 -> 7.0.2, but the checked-in @typescript-eslint/eslint-plugin@8.70.0, @typescript-eslint/parser@8.70.0 and typescript-eslint@8.70.0 each declare a peer dependency of "typescript": ">=4.8.4 <6.1.0". The proposals therefore fail ERESOLVE and all frontend E2E shards, with no security advisory behind them. Add a semver-major ignore for typescript in the npm ecosystem so majors stay explicit work alongside a lint-toolchain upgrade, and update the config guard test to pin both the browser-runtime and TypeScript ignores. Change-source: pulse-maintainer --- .github/dependabot.yml | 8 ++++++++ scripts/tests/test_dependabot_config.py | 11 +++++++++-- 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index fcd4a579fd..d82bd615dc 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -96,6 +96,14 @@ updates: - "version-update:semver-major" - "version-update:semver-minor" - "version-update:semver-patch" + # TypeScript majors must land with the lint toolchain: + # @typescript-eslint/eslint-plugin@8.70.0, @typescript-eslint/parser@8.70.0 + # and typescript-eslint@8.70.0 each declare a peer dependency of + # "typescript": ">=4.8.4 <6.1.0". Keep TypeScript majors as explicit work + # rather than opening proposals the checked-in toolchain cannot build. + - dependency-name: "typescript" + update-types: + - "version-update:semver-major" - package-ecosystem: "docker" directories: diff --git a/scripts/tests/test_dependabot_config.py b/scripts/tests/test_dependabot_config.py index ce8b6a1802..2052a3af9b 100644 --- a/scripts/tests/test_dependabot_config.py +++ b/scripts/tests/test_dependabot_config.py @@ -148,9 +148,16 @@ class DependabotConfigTest(unittest.TestCase): } self.assertEqual( set(ignored), - {"playwright", "playwright-core", "@playwright/test"}, + {"playwright", "playwright-core", "@playwright/test", "typescript"}, + ) + for browser_runtime in ("playwright", "playwright-core", "@playwright/test"): + self.assertEqual(ignored[browser_runtime], all_semver) + # TypeScript majors must land with the @typescript-eslint peer range + # (">=4.8.4 <6.1.0"), so keep them as explicit work. + self.assertEqual( + ignored["typescript"], + {"version-update:semver-major"}, ) - self.assertTrue(all(types == all_semver for types in ignored.values())) def test_weekly_scan_covers_the_same_lockfiles(self) -> None: workflow = yaml.safe_load(SECURITY_SCAN.read_text(encoding="utf-8")) From c6546fce74d7e4155ab4bd55ca579ab49040586f Mon Sep 17 00:00:00 2001 From: "pulse-triage[bot]" <249995291+pulse-triage[bot]@users.noreply.github.com> Date: Wed, 23 Sep 2026 06:49:52 +0100 Subject: [PATCH 3/3] build(deps): qualify the go-minor-patch dependency group Advance the managed go-minor-patch group with its required transitives: golang.org/x/crypto 0.56.0->0.57.0, golang.org/x/term 0.45.0->0.46.0 and modernc.org/sqlite 1.53.0->1.59.0 (libc 1.75.7, memory 1.12.1, x/text 0.42.0). All other direct versions are unchanged. Raise the dev-runtime dependency-manifest floors to the qualified releases and add the storage-driver integrity floor so a silent downgrade fails. Record the change in the deployment-installability contract. The batch is routine managed dependency maintenance, independent of the excluded 6 September SQLite SIGSEGV investigation. The NormalizeSegment benchmark delta is a code-layout measurement artifact (pure function; caller benchmarks do not corroborate) and the failed advisory result is preserved. Change-source: pulse-maintainer --- .../subsystems/deployment-installability.md | 41 +++++++++++++++++ go.mod | 17 +++---- go.sum | 46 ++++++++++++++++--- scripts/tests/test-hot-dev-runtime.sh | 18 +++++++- 4 files changed, 103 insertions(+), 19 deletions(-) diff --git a/docs/release-control/v6/internal/subsystems/deployment-installability.md b/docs/release-control/v6/internal/subsystems/deployment-installability.md index 9b6a318bd3..ef91b37424 100644 --- a/docs/release-control/v6/internal/subsystems/deployment-installability.md +++ b/docs/release-control/v6/internal/subsystems/deployment-installability.md @@ -5619,3 +5619,44 @@ covers the recorded snapshot and its removal. Local shell suites (`test-pulse-auto-update.sh`, `test-install-update-resilience.sh`, `test-script-reference-integrity.sh`) pass; hosted Go installtest execution remains required and is not claimed here. + +### Governed dependency floors for the go-minor-patch group + +The managed `go-minor-patch` group advances three direct modules together with +their required transitives: `golang.org/x/crypto` 0.56.0 -> 0.57.0, +`golang.org/x/term` 0.45.0 -> 0.46.0 and `modernc.org/sqlite` 1.53.0 -> 1.59.0 +(which pins `modernc.org/libc` 1.75.7, `modernc.org/memory` 1.12.1 and +`golang.org/x/text` 0.42.0). No other direct version changes. The pure-Go SQLite +driver is the storage engine for the metrics, alert and audit stores, so the +1.59.0 release carries the upstream journal-rollback data-corruption fix and the +native-libc re-vendor that changes query CPU cost; the `modernc.org/libc` floor +must move with it because the driver requires the same pinned version. + +This is routine managed dependency maintenance and is independent of the +6 September 2026 SQLite SIGSEGV investigation exclusion: no crash is reproduced, +no database or executable is inspected, and no adverse evidence from that +investigation is cleared or relied upon here. + +The dev-runtime dependency-manifest floor proof now covers these modules. +`scripts/tests/test-hot-dev-runtime.sh` raises the `golang.org/x/crypto` floor to +v0.57.0, adds a `golang.org/x/term` floor of v0.46.0 and adds a +`test_go_storage_dependency_integrity_floor` case asserting +`modernc.org/sqlite` >= v1.59.0 and `modernc.org/libc` >= v1.75.7. These are +floors, not pins, so a later safe upgrade keeps passing while a downgrade below +the qualified release fails. The managed-backend manifest-invalidation fixtures +in `tests/integration/scripts/managed-local-backend.test.mjs` already prove that a +`go.mod`- or `go.sum`-only change rebuilds a stale backend binary. + +The Build and Test benchmark job reports a `NormalizeSegment` sec/op delta for +this batch. That is a code-layout/measurement artifact, not a product +regression: `normalizeSegment` is a pure function with no dependency calls, and +its caller-level benchmarks do not corroborate it (`NormalizeRoute` improved and +`FullMiddlewarePath` changed within its variance). The benchmark gate is +advisory for source landing; no threshold was changed and the failed advisory +result is preserved. + +Verification status: the exact-source Go build and package tests require the +offline dependency snapshot for the updated lockfile, which is not present in +the current assignment; a host dependency acquisition on the next launch is +required before this contract's Go evidence can be produced. No passing Go +suite, installed build or release acceptance is claimed here. diff --git a/go.mod b/go.mod index 8eb391d9b2..01846ea4ae 100644 --- a/go.mod +++ b/go.mod @@ -29,16 +29,16 @@ require ( github.com/spf13/cobra v1.10.2 github.com/stretchr/testify v1.12.1 github.com/stripe/stripe-go/v82 v82.5.1 - golang.org/x/crypto v0.56.0 + golang.org/x/crypto v0.57.0 golang.org/x/oauth2 v0.37.0 golang.org/x/sync v0.23.0 golang.org/x/sys v0.48.0 - golang.org/x/term v0.45.0 + golang.org/x/term v0.46.0 gopkg.in/yaml.v3 v3.0.1 k8s.io/api v0.37.0 k8s.io/apimachinery v0.37.0 k8s.io/client-go v0.37.0 - modernc.org/sqlite v1.53.0 + modernc.org/sqlite v1.59.0 ) require ( @@ -77,14 +77,12 @@ require ( github.com/google/gnostic-models v0.7.0 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/jonboulle/clockwork v0.5.0 // indirect - github.com/josharian/intern v1.0.0 // indirect github.com/json-iterator/go v1.1.12 // indirect github.com/kylelemons/godebug v1.1.0 // indirect github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect - github.com/mailru/easyjson v0.7.7 // indirect github.com/mattermost/xml-roundtrip-validator v0.1.0 // indirect github.com/mattn/go-colorable v0.1.14 // indirect - github.com/mattn/go-isatty v0.0.20 // indirect + github.com/mattn/go-isatty v0.0.24 // indirect github.com/moby/docker-image-spec v1.3.1 // indirect github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect @@ -92,7 +90,6 @@ require ( github.com/ncruces/go-strftime v1.0.0 // indirect github.com/opencontainers/go-digest v1.0.0 // indirect github.com/pkg/errors v0.9.1 // indirect - github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect github.com/prometheus/procfs v0.21.1 // indirect github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect @@ -111,7 +108,7 @@ require ( go.yaml.in/yaml/v2 v2.4.4 // indirect go.yaml.in/yaml/v3 v3.0.5 // indirect golang.org/x/net v0.58.0 // indirect - golang.org/x/text v0.41.0 // indirect + golang.org/x/text v0.42.0 // indirect golang.org/x/time v0.15.0 // indirect google.golang.org/protobuf v1.36.12 // indirect gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect @@ -119,9 +116,9 @@ require ( k8s.io/klog/v2 v2.140.0 // indirect k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad // indirect k8s.io/utils v0.0.0-20260626114624-be93311217bd // indirect - modernc.org/libc v1.73.4 // indirect + modernc.org/libc v1.75.7 // indirect modernc.org/mathutil v1.7.1 // indirect - modernc.org/memory v1.11.0 // indirect + modernc.org/memory v1.12.1 // indirect sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect sigs.k8s.io/randfill v1.0.0 // indirect sigs.k8s.io/structured-merge-diff/v6 v6.4.2 // indirect diff --git a/go.sum b/go.sum index b768e5d944..dabc80e2e4 100644 --- a/go.sum +++ b/go.sum @@ -75,6 +75,8 @@ github.com/go-openapi/swag/fileutils v0.27.1 h1:QQqBSoi5mW4XpU85nS0mLcA+zAE6vLzr github.com/go-openapi/swag/fileutils v0.27.1/go.mod h1:VvJFZLTZS0AI854gEQz5tk7dBESdLjiNUMSZ/th2ry8= github.com/go-openapi/swag/jsonutils v0.27.1 h1:SVgK3i4USzCU5mibOOS/l4ea2h9UQXy7J7RNLTjuXjU= github.com/go-openapi/swag/jsonutils v0.27.1/go.mod h1:tdlEpZqdcQ17uj6J4YdK9vd8It5qWMwjWXOs0tjpRlk= +github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.1 h1:mJu3COL9WEaZVp/Kf2PRMi7tPszPEJfSr/OO75ynCs8= +github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.1/go.mod h1:mofwUWx70wvskwESqRJ//k/9kURmCgyJl5m5Ppoh5kY= github.com/go-openapi/swag/loading v0.27.1 h1:/DxUgDXKbBX4bcn7r9uEXfJyzN5XpiJmZplzQTjrRCY= github.com/go-openapi/swag/loading v0.27.1/go.mod h1:jvGh3iA2+zyUUycB5fgJWzeHnhrpvGnJJM0RVE9ZShE= github.com/go-openapi/swag/mangling v0.27.1 h1:yC9D0HyUE8gbP+BfmGx9+AA89ikwZTMjESK3OnnoaqA= @@ -89,6 +91,10 @@ github.com/go-openapi/swag/typeutils v0.27.1 h1:KSTdFlfnse4r6dP9IrEnwMldjE+zs71U github.com/go-openapi/swag/typeutils v0.27.1/go.mod h1:Srm0xFNRZ1Y+vCxJclo5qzx8aj+1pAKda/YfFPrG0dQ= github.com/go-openapi/swag/yamlutils v0.27.1 h1:ftxv6xvXb1E3zohUc+okZ9nSqNb9StQX/FXnKZ98sQA= github.com/go-openapi/swag/yamlutils v0.27.1/go.mod h1:bnxFIB1qewGRiZHypXGZ3fNgf13/0HfRgnS/iZBDrOo= +github.com/go-openapi/testify/enable/yaml/v2 v2.6.0 h1:gGHwAJ0R/5jU8BEGDbfRNR3hL68dAVi84WuOApp29B0= +github.com/go-openapi/testify/enable/yaml/v2 v2.6.0/go.mod h1:tY+St1SGq4NFl0QIqdTY4aEdbChAHxhyB77XQi9iJCo= +github.com/go-openapi/testify/v2 v2.6.0 h1:5PKH2HE7YJ/LuRPQGvSxBRlFXNQhSetBLlGAgUEu3ug= +github.com/go-openapi/testify/v2 v2.6.0/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw= github.com/go-pdf/fpdf v0.9.0 h1:PPvSaUuo1iMi9KkaAn90NuKi+P4gwMedWPHhj8YlJQw= github.com/go-pdf/fpdf v0.9.0/go.mod h1:oO8N111TkmKb9D7VvWGLvLJlaZUQVPM+6V42pp3iV4Y= github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI= @@ -103,6 +109,8 @@ github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs= github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA= +github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo= +github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo= @@ -144,6 +152,8 @@ github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHP github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY= github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= +github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI= +github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A= github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0= github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo= github.com/moby/moby/api v1.56.0 h1:GQzua3NA599ASSIICx0iFgiJeO9YkdDARvQsm23ZZuQ= @@ -211,9 +221,9 @@ github.com/shirou/gopsutil/v4 v4.26.8 h1:YQMTF/1J50B5+Y0vlo1eDRf5DoR7Gk69hY+8wjY github.com/shirou/gopsutil/v4 v4.26.8/go.mod h1:5O9FjBiXoTDFatIWjZZosqj4pV0DRtLx598xGbBehzM= github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU= github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4= -github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= +github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw= github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= @@ -221,15 +231,15 @@ github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY= github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA= github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= +github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= +github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= +github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= +github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= -github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= -github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= -github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= -github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/stripe/stripe-go/v82 v82.5.1 h1:05q6ZDKoe8PLMpQV072obF74HCgP4XJeJYoNuRSX2+8= github.com/stripe/stripe-go/v82 v82.5.1/go.mod h1:majCQX6AfObAvJiHraPi/5udwHi4ojRvJnnxckvHrX8= github.com/tklauser/go-sysconf v0.3.16 h1:frioLaCQSsF5Cy1jgRBrzr6t502KIIwQ0MArYICU0nA= @@ -266,8 +276,12 @@ go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y= golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I= +golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= +golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk= golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40= +golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= +golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o= golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= @@ -283,25 +297,31 @@ golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= +golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE= +golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc= golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= +golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI= +golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI= golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE= golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk= +golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI= +golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI= google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= -google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= @@ -341,28 +361,40 @@ k8s.io/utils v0.0.0-20260626114624-be93311217bd h1:Ea7fgQ5we8Y9T0OX5o0dAHzQOBRI0 k8s.io/utils v0.0.0-20260626114624-be93311217bd/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk= modernc.org/cc/v4 v4.28.4 h1:Hd/4Es+MBj+/7hSdZaisNyu6bv3V0Dp2MdllyfqaH+c= modernc.org/cc/v4 v4.28.4/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI= +modernc.org/cc/v4 v4.29.2 h1:h6+9ciCnPKutf4I03CvheAvDLX7+IHlqR6Iy6J+cgd8= +modernc.org/cc/v4 v4.29.2/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI= modernc.org/ccgo/v4 v4.34.4 h1:OVnSOWQjVKOYkFxoHYB+qQmSHK5gqMqARM+K9DpR/Ws= modernc.org/ccgo/v4 v4.34.4/go.mod h1:qdKqE8FNIYyysougB1RX9MxCzp5oJOcQXSobANJ4TuE= +modernc.org/ccgo/v4 v4.35.0 h1:F+TUsmw09QxLzmi3aeYYGxjAXarmZaKgj3mKQHNaA8w= +modernc.org/ccgo/v4 v4.35.0/go.mod h1:qrVGs9S3Sr2Ztcg9ve+kTAYMp5a3YvWjo+SoN06kJ5I= modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM= modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU= modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI= modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito= modernc.org/gc/v3 v3.1.3 h1:6QAplYyVO+KdPW3pGnqmJDUxtkec8ooEWvks/hhU3lc= modernc.org/gc/v3 v3.1.3/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY= +modernc.org/gc/v3 v3.1.5 h1:21ldfPfRYE31Tb7B3mwAK8gy1AxP4+dKjrOQPfqakoc= +modernc.org/gc/v3 v3.1.5/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY= modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks= modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI= modernc.org/libc v1.73.4 h1:+ra4Ui8ngyt8HDcO1FTDPWlkAh6yOdaO2yAoh8MddQA= modernc.org/libc v1.73.4/go.mod h1:DXZ3eO8qMCNn2SnmTNCiC71nJ9Rcq3PsnpU6Vc4rWK8= +modernc.org/libc v1.75.7 h1:o3DTP9/0p9pKmY2WCKQaySW6wIiZhNM7wc2lUoyhfew= +modernc.org/libc v1.75.7/go.mod h1:bO5o2ztHxBb2rjz0PgdHN0sSMw57CgxGFLZ3Qd/QpVQ= modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU= modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg= modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI= modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw= +modernc.org/memory v1.12.1 h1:nFMiWrpStgZczNl6XI9GnIk/rWhYIyHGUaR04pGbp9g= +modernc.org/memory v1.12.1/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw= modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg= modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns= modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w= modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE= modernc.org/sqlite v1.53.0 h1:20WG8N9q4ji/dEqGk4uiI0c6OPjSeLTNYGFCc3+7c1M= modernc.org/sqlite v1.53.0/go.mod h1:xoEpOIpGrgT48H5iiyt/YXPCZPEzlfmfFwtk8Lklw8s= +modernc.org/sqlite v1.59.0 h1:X1es1GpqBlS/5T+vbM4HLUdaa8OtQx468DF2vrx+38A= +modernc.org/sqlite v1.59.0/go.mod h1:+paeT2A3iPRHkQDwG7oA6Tk0zQd5woMEI8q7orfry8k= modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0= modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A= modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y= diff --git a/scripts/tests/test-hot-dev-runtime.sh b/scripts/tests/test-hot-dev-runtime.sh index 6f6fa6dda9..f3b2b548a2 100755 --- a/scripts/tests/test-hot-dev-runtime.sh +++ b/scripts/tests/test-hot-dev-runtime.sh @@ -352,13 +352,26 @@ assert_module_at_least() { test_go_module_security_dependency_floors() { local output - output="$(cd "${ROOT_DIR}" && go list -m golang.org/x/net golang.org/x/crypto golang.org/x/sys)" + output="$(cd "${ROOT_DIR}" && go list -m golang.org/x/net golang.org/x/crypto golang.org/x/term golang.org/x/sys)" assert_module_at_least "Go module floor keeps x/net past restricted-outbound advisories" "${output}" "golang.org/x/net" "v0.56.0" - assert_module_at_least "Go module floor excludes SSH connection deadlock advisories" "${output}" "golang.org/x/crypto" "v0.56.0" + assert_module_at_least "Go module floor excludes SSH connection deadlock advisories" "${output}" "golang.org/x/crypto" "v0.57.0" + assert_module_at_least "Go module floor keeps x/term past the read-error handling release" "${output}" "golang.org/x/term" "v0.46.0" assert_module_at_least "Go module floor keeps x/sys aligned with security module graph" "${output}" "golang.org/x/sys" "v0.47.0" } +# The metrics and alerting stores run on the pure-Go SQLite driver, so a +# downgrade past the qualified storage release would silently drop the +# upstream journal-rollback corruption fix. Keep the driver and the libc +# version it requires aligned as floors, not pins. +test_go_storage_dependency_integrity_floor() { + local output + output="$(cd "${ROOT_DIR}" && go list -m modernc.org/sqlite modernc.org/libc)" + + assert_module_at_least "Go storage floor keeps sqlite past the journal-rollback corruption fix" "${output}" "modernc.org/sqlite" "v1.59.0" + assert_module_at_least "Go storage floor keeps libc aligned with the pinned sqlite driver" "${output}" "modernc.org/libc" "v1.75.7" +} + # Kubernetes publishes these generated APIs as a coordinated release. A grouped # update must not leave the native agent compiling against mixed minor versions. kubernetes_module_cohort_is_aligned() { @@ -427,6 +440,7 @@ test_hot_dev_lab_agent_mode_enables_lan_and_guest_docker_inventory_defaults test_hot_dev_remembers_explicit_lab_agent_mode_for_later_managed_starts test_hot_dev_browser_urls_distinguish_bind_and_browser_hosts test_go_module_security_dependency_floors +test_go_storage_dependency_integrity_floor test_go_kubernetes_module_cohort test_go_release_toolchain_floor test_backend_race_suite_keeps_hosted_runner_timeout_headroom