972f41af79
Upgrades validator from v10.28.0 to v10.30.1, which transitively upgrades golang.org/x/crypto from v0.42.0 (vulnerable) to v0.46.0 (patched). Remediates: - GHSA-j5w8-q4qc-rx2x (SSH connection handling vulnerability) - GHSA-f6x5-jh6r-wrfv (SSH key parsing vulnerability) Previously attempted replace directive approach did not work because Go embeds original dependency versions in binary metadata, which scanners read. Direct dependency upgrade is the correct solution. Expected impact: Reduces Medium vulnerabilities from 8 to 4 (Alpine CVEs only) Testing: All backend unit tests passing
97 lines
4.1 KiB
Modula-2
97 lines
4.1 KiB
Modula-2
module github.com/Wikid82/charon/backend
|
|
|
|
go 1.25.5
|
|
|
|
require (
|
|
github.com/containrrr/shoutrrr v0.8.0
|
|
github.com/docker/docker v28.5.2+incompatible
|
|
github.com/gin-contrib/gzip v1.2.5
|
|
github.com/gin-gonic/gin v1.11.0
|
|
github.com/golang-jwt/jwt/v5 v5.3.0
|
|
github.com/google/uuid v1.6.0
|
|
github.com/gorilla/websocket v1.5.3
|
|
github.com/oschwald/geoip2-golang/v2 v2.1.0
|
|
github.com/prometheus/client_golang v1.23.2
|
|
github.com/robfig/cron/v3 v3.0.1
|
|
github.com/sirupsen/logrus v1.9.3
|
|
github.com/stretchr/testify v1.11.1
|
|
golang.org/x/crypto v0.46.0
|
|
golang.org/x/net v0.47.0
|
|
gopkg.in/natefinch/lumberjack.v2 v2.2.1
|
|
gorm.io/driver/sqlite v1.6.0
|
|
gorm.io/gorm v1.31.1
|
|
)
|
|
|
|
require (
|
|
github.com/Microsoft/go-winio v0.6.2 // indirect
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/bytedance/gopkg v0.1.3 // indirect
|
|
github.com/bytedance/sonic v1.14.1 // indirect
|
|
github.com/bytedance/sonic/loader v0.3.0 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/cloudwego/base64x v0.1.6 // indirect
|
|
github.com/containerd/errdefs v1.0.0 // indirect
|
|
github.com/containerd/errdefs/pkg v0.3.0 // indirect
|
|
github.com/containerd/log v0.1.0 // indirect
|
|
github.com/davecgh/go-spew v1.1.1 // indirect
|
|
github.com/distribution/reference v0.6.0 // indirect
|
|
github.com/docker/go-connections v0.6.0 // indirect
|
|
github.com/docker/go-units v0.5.0 // indirect
|
|
github.com/fatih/color v1.15.0 // indirect
|
|
github.com/felixge/httpsnoop v1.0.4 // indirect
|
|
github.com/gabriel-vasile/mimetype v1.4.12 // indirect
|
|
github.com/gin-contrib/sse v1.1.0 // indirect
|
|
github.com/go-logr/logr v1.4.3 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/go-playground/locales v0.14.1 // indirect
|
|
github.com/go-playground/universal-translator v0.18.1 // indirect
|
|
github.com/go-playground/validator/v10 v10.30.1 // indirect
|
|
github.com/goccy/go-json v0.10.5 // indirect
|
|
github.com/goccy/go-yaml v1.18.0 // indirect
|
|
github.com/jinzhu/inflection v1.0.0 // indirect
|
|
github.com/jinzhu/now v1.1.5 // indirect
|
|
github.com/json-iterator/go v1.1.12 // indirect
|
|
github.com/klauspost/cpuid/v2 v2.3.0 // indirect
|
|
github.com/kylelemons/godebug v1.1.0 // indirect
|
|
github.com/leodido/go-urn v1.4.0 // indirect
|
|
github.com/mattn/go-colorable v0.1.13 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/mattn/go-sqlite3 v1.14.22 // indirect
|
|
github.com/moby/docker-image-spec v1.3.1 // indirect
|
|
github.com/moby/sys/atomicwriter v0.1.0 // indirect
|
|
github.com/moby/term v0.5.2 // indirect
|
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
|
github.com/modern-go/reflect2 v1.0.2 // indirect
|
|
github.com/morikuni/aec v1.0.0 // indirect
|
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
|
github.com/onsi/ginkgo/v2 v2.9.5 // indirect
|
|
github.com/opencontainers/go-digest v1.0.0 // indirect
|
|
github.com/opencontainers/image-spec v1.1.1 // indirect
|
|
github.com/oschwald/maxminddb-golang/v2 v2.1.1 // indirect
|
|
github.com/pelletier/go-toml/v2 v2.2.4 // indirect
|
|
github.com/pkg/errors v0.9.1 // indirect
|
|
github.com/pmezard/go-difflib v1.0.0 // indirect
|
|
github.com/prometheus/client_model v0.6.2 // indirect
|
|
github.com/prometheus/common v0.66.1 // indirect
|
|
github.com/prometheus/procfs v0.16.1 // indirect
|
|
github.com/quic-go/qpack v0.6.0 // indirect
|
|
github.com/quic-go/quic-go v0.57.1 // indirect
|
|
github.com/stretchr/objx v0.5.2 // indirect
|
|
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
|
|
github.com/ugorji/go/codec v1.3.0 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect
|
|
go.opentelemetry.io/otel v1.38.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.38.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.38.0 // indirect
|
|
go.opentelemetry.io/otel/trace v1.38.0 // indirect
|
|
go.yaml.in/yaml/v2 v2.4.2 // indirect
|
|
golang.org/x/arch v0.22.0 // indirect
|
|
golang.org/x/sys v0.40.0 // indirect
|
|
golang.org/x/text v0.33.0 // indirect
|
|
golang.org/x/time v0.14.0 // indirect
|
|
google.golang.org/protobuf v1.36.10 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
gotest.tools/v3 v3.5.2 // indirect
|
|
)
|