mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-25 21:20:00 +00:00
rcourtman
02e53bc777
Go 1.26.10 (20 October) distrusts the compromised eMudhra intermediate CAs in crypto/x509 (CVE-2026-111943). Binaries built with 1.26.9 still accept chains through them, so every verified outbound TLS connection Pulse makes (licence, updates, webhooks, AI providers) stays open to interception by a holder of those keys. govulncheck does not flag a trust-store change as a called symbol, so the scheduled scan stayed green while the gap existed. Advance the governed toolchain floor and every pin together: go.mod, the toolchain installer and release-script guards, the source-built container stages (manifest-list digests for golang:1.26.10-alpine and the Debian dev container image), the root-pair diagnostic, and their tests. Vite 6.4.3 bundles a launch-editor with three advisories (GHSA-587h-7wmj-h5pm, GHSA-r825-w8mm-5pxw, GHSA-698v-4r3x-3vcv) that failed the daily advisory watch. 6.4.4 bundles the fixed launch-editor and 6.4.5 adds the dev-server server.fs query check. Both reach only the local dev server, not the built product. The lockfile changes only the vite entry, and dependencySecurity.test.ts now pins the floor.
127 lines
5.5 KiB
Modula-2
127 lines
5.5 KiB
Modula-2
module github.com/rcourtman/pulse-go-rewrite
|
|
|
|
go 1.26.0
|
|
|
|
toolchain go1.26.10
|
|
|
|
require (
|
|
github.com/IGLOU-EU/go-wildcard/v2 v2.1.1
|
|
github.com/containerd/errdefs v1.0.0
|
|
github.com/coreos/go-oidc/v3 v3.21.0
|
|
github.com/crewjam/saml v0.5.1
|
|
github.com/fsnotify/fsnotify v1.10.1
|
|
github.com/go-pdf/fpdf v0.9.0
|
|
github.com/golang-jwt/jwt/v5 v5.3.1
|
|
github.com/google/uuid v1.6.0
|
|
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674
|
|
github.com/joho/godotenv v1.5.1
|
|
github.com/klauspost/compress v1.20.1
|
|
github.com/moby/moby/api v1.56.0
|
|
github.com/moby/moby/client v0.6.0
|
|
github.com/oklog/ulid/v2 v2.1.2
|
|
github.com/opencontainers/image-spec v1.1.1
|
|
github.com/prometheus/client_golang v1.24.1
|
|
github.com/prometheus/client_model v0.6.3
|
|
github.com/prometheus/common v0.71.0
|
|
github.com/rs/dnscache v0.0.0-20230804202142-fc85eb664529
|
|
github.com/rs/zerolog v1.35.1
|
|
github.com/shirou/gopsutil/v4 v4.26.8
|
|
github.com/spf13/cobra v1.10.2
|
|
github.com/stretchr/testify v1.12.1
|
|
github.com/stripe/stripe-go/v82 v82.5.1
|
|
golang.org/x/crypto v0.57.0
|
|
golang.org/x/oauth2 v0.37.0
|
|
golang.org/x/sync v0.23.0
|
|
golang.org/x/sys v0.48.0
|
|
golang.org/x/term v0.46.0
|
|
gopkg.in/yaml.v3 v3.0.1
|
|
k8s.io/api v0.37.1
|
|
k8s.io/apimachinery v0.37.1
|
|
k8s.io/client-go v0.37.1
|
|
modernc.org/sqlite v1.59.0
|
|
)
|
|
|
|
require (
|
|
github.com/Microsoft/go-winio v0.6.2 // indirect
|
|
github.com/beevik/etree v1.6.0 // indirect
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/containerd/errdefs/pkg v0.3.0 // indirect
|
|
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
|
github.com/distribution/reference v0.6.0 // indirect
|
|
github.com/docker/go-connections v0.7.0 // indirect
|
|
github.com/docker/go-units v0.5.0 // indirect
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/ebitengine/purego v0.10.2 // indirect
|
|
github.com/emicklei/go-restful/v3 v3.13.0 // indirect
|
|
github.com/felixge/httpsnoop v1.0.4 // indirect
|
|
github.com/fxamacker/cbor/v2 v2.9.1 // indirect
|
|
github.com/go-jose/go-jose/v4 v4.1.4 // indirect
|
|
github.com/go-logr/logr v1.4.3 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/go-ole/go-ole v1.2.6 // indirect
|
|
github.com/go-openapi/jsonpointer v1.0.0 // indirect
|
|
github.com/go-openapi/jsonreference v1.0.0 // indirect
|
|
github.com/go-openapi/swag v0.27.1 // indirect
|
|
github.com/go-openapi/swag/cmdutils v0.27.1 // indirect
|
|
github.com/go-openapi/swag/conv v0.27.1 // indirect
|
|
github.com/go-openapi/swag/fileutils v0.27.1 // indirect
|
|
github.com/go-openapi/swag/jsonutils v0.27.1 // indirect
|
|
github.com/go-openapi/swag/loading v0.27.1 // indirect
|
|
github.com/go-openapi/swag/mangling v0.27.1 // indirect
|
|
github.com/go-openapi/swag/netutils v0.27.1 // indirect
|
|
github.com/go-openapi/swag/pools v0.27.1 // indirect
|
|
github.com/go-openapi/swag/stringutils v0.27.1 // indirect
|
|
github.com/go-openapi/swag/typeutils v0.27.1 // indirect
|
|
github.com/go-openapi/swag/yamlutils v0.27.1 // indirect
|
|
github.com/google/gnostic-models v0.7.0 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/jonboulle/clockwork v0.5.0 // indirect
|
|
github.com/json-iterator/go v1.1.12 // indirect
|
|
github.com/kylelemons/godebug v1.1.0 // indirect
|
|
github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
|
|
github.com/mattermost/xml-roundtrip-validator v0.1.0 // indirect
|
|
github.com/mattn/go-colorable v0.1.14 // indirect
|
|
github.com/mattn/go-isatty v0.0.24 // indirect
|
|
github.com/moby/docker-image-spec v1.3.1 // indirect
|
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
|
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
|
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
|
github.com/ncruces/go-strftime v1.0.0 // indirect
|
|
github.com/opencontainers/go-digest v1.0.0 // indirect
|
|
github.com/pkg/errors v0.9.1 // indirect
|
|
github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
|
|
github.com/prometheus/procfs v0.21.1 // indirect
|
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
|
github.com/russellhaering/goxmldsig v1.6.0 // indirect
|
|
github.com/spf13/pflag v1.0.10 // indirect
|
|
github.com/stretchr/objx v0.5.3 // indirect
|
|
github.com/tklauser/go-sysconf v0.3.16 // indirect
|
|
github.com/tklauser/numcpus v0.11.0 // indirect
|
|
github.com/x448/float16 v0.8.4 // indirect
|
|
github.com/yusufpapurcu/wmi v1.2.4 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 // indirect
|
|
go.opentelemetry.io/otel v1.44.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.44.0 // indirect
|
|
go.opentelemetry.io/otel/trace v1.44.0 // indirect
|
|
go.yaml.in/yaml/v2 v2.4.4 // indirect
|
|
go.yaml.in/yaml/v3 v3.0.5 // indirect
|
|
golang.org/x/net v0.60.0 // indirect
|
|
golang.org/x/text v0.42.0 // indirect
|
|
golang.org/x/time v0.15.0 // indirect
|
|
google.golang.org/protobuf v1.36.12 // indirect
|
|
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
|
|
gopkg.in/inf.v0 v0.9.1 // indirect
|
|
k8s.io/klog/v2 v2.140.0 // indirect
|
|
k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad // indirect
|
|
k8s.io/utils v0.0.0-20260626114624-be93311217bd // indirect
|
|
modernc.org/libc v1.75.7 // indirect
|
|
modernc.org/mathutil v1.7.1 // indirect
|
|
modernc.org/memory v1.12.1 // indirect
|
|
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
|
|
sigs.k8s.io/randfill v1.0.0 // indirect
|
|
sigs.k8s.io/structured-merge-diff/v6 v6.4.2 // indirect
|
|
sigs.k8s.io/yaml v1.6.0 // indirect
|
|
)
|