972f41af79
Upgrades validator from v10.28.0 to v10.30.1, which transitively upgrades golang.org/x/crypto from v0.42.0 (vulnerable) to v0.46.0 (patched). Remediates: - GHSA-j5w8-q4qc-rx2x (SSH connection handling vulnerability) - GHSA-f6x5-jh6r-wrfv (SSH key parsing vulnerability) Previously attempted replace directive approach did not work because Go embeds original dependency versions in binary metadata, which scanners read. Direct dependency upgrade is the correct solution. Expected impact: Reduces Medium vulnerabilities from 8 to 4 (Alpine CVEs only) Testing: All backend unit tests passing
Backend Service
This folder contains the Go API for CaddyProxyManager+.
Prerequisites
- Go 1.24+
Getting started
cp .env.example .env # optional
cd backend
go run ./cmd/api
Tests
cd backend
go test ./...