From 7c5a4165648bccff6ea2bd3355ffd0e19a6dbac9 Mon Sep 17 00:00:00 2001 From: avisab-cx <53776974+cx-avi-sabzerou@users.noreply.github.com> Date: Sun, 2 Aug 2026 15:30:07 +0300 Subject: [PATCH 1/5] AST-162098: Migrate CI/CD from CircleCI to GitHub Actions CircleCI is no longer in use org-wide. Replaces the CircleCI lint job with a GitHub Actions workflow, migrates golangci-lint config to v2 (EOL v1 line), and adds govulncheck + PR title linting adopted from the ast-cli repo's GitHub Actions setup. Co-Authored-By: Claude Sonnet 5 --- .circleci/config.yml | 55 -------- .github/workflows/govulncheck.yaml | 39 ++++++ .github/workflows/lint.yaml | 49 ++++++++ .github/workflows/pr-linter.yaml | 27 ++++ .golangci.yml | 195 ++++++++++++++--------------- internal/secrets/maskSecrets.go | 10 +- 6 files changed, 215 insertions(+), 160 deletions(-) delete mode 100644 .circleci/config.yml create mode 100644 .github/workflows/govulncheck.yaml create mode 100644 .github/workflows/lint.yaml create mode 100644 .github/workflows/pr-linter.yaml diff --git a/.circleci/config.yml b/.circleci/config.yml deleted file mode 100644 index c636484..0000000 --- a/.circleci/config.yml +++ /dev/null @@ -1,55 +0,0 @@ -version: 2.1 -executors: - circle-machine: - machine: - image: default - docker_layer_caching: true - resource_class: small - go-container: - docker: - - image: golang:1.24.0 - resource_class: small - go-lint: - docker: - - image: golangci/golangci-lint:v1.56.2-alpine - resource_class: small - -jobs: - lint: - executor: - go-lint - working_directory: ~/repo - steps: - - checkout - - run: - name: Config GOPRIVATE environment variable - command: echo "export GOPRIVATE=github.com/CheckmarxDev/*,github.com/checkmarxDev/*" >> $BASH_ENV - - run: - name: Config Git credentials - command: git config --global url."https://${GITHUB_USER}:${GITHUB_TOKEN}@github.com".insteadOf "https://github.com" - - restore_cache: - keys: - - go-mod-v1-{{ checksum "go.sum" }} - - run: - name: Get latest go version (1.24.0) - command: cd /tmp && wget https://go.dev/dl/go1.24.0.linux-amd64.tar.gz && tar -xvf go1.24.0.linux-amd64.tar.gz && cp -rfv go/bin /usr/local/go && go version - - run: - name: Run golangci-lint - command: golangci-lint -v run ./... --timeout 10m - no_output_timeout: 10m - - - save_cache: # Store cache in the /go/pkg directory - key: go-mod-v1-{{ checksum "go.sum" }} - paths: - - "/go/pkg/mod" - -workflows: - Test-workflow: - jobs: - - lint: - filters: - branches: - ignore: - - master - - /^release\/v\d+\.\d+$/ - context: AWS \ No newline at end of file diff --git a/.github/workflows/govulncheck.yaml b/.github/workflows/govulncheck.yaml new file mode 100644 index 0000000..36b42f7 --- /dev/null +++ b/.github/workflows/govulncheck.yaml @@ -0,0 +1,39 @@ +name: Govulncheck + +on: + pull_request: + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +permissions: + contents: read + +jobs: + govulncheck: + runs-on: cx-public-ubuntu-x64 + steps: + - name: Checkout + uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + with: + persist-credentials: false + + - name: Set up Go + uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0 + with: + go-version-file: go.mod + + - name: Config Git credentials for private modules + run: git config --global url."https://${{ secrets.GITHUB_TOKEN }}@github.com".insteadOf "https://github.com" + env: + GOPRIVATE: github.com/CheckmarxDev/*,github.com/checkmarxDev/* + + - name: Install govulncheck + run: go install golang.org/x/vuln/cmd/govulncheck@0782b76014f15f24e22a438f30f308df42899ba1 # v1.3.0 + + - name: Run govulncheck + run: govulncheck ./... + env: + GOPRIVATE: github.com/CheckmarxDev/*,github.com/checkmarxDev/* + continue-on-error: true diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml new file mode 100644 index 0000000..31dfcb3 --- /dev/null +++ b/.github/workflows/lint.yaml @@ -0,0 +1,49 @@ +name: Lint + +on: + pull_request: + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +permissions: + contents: read + +jobs: + golangci-lint: + name: Lint (golangci-lint) + runs-on: cx-public-ubuntu-x64 + permissions: + contents: read # for actions/checkout to fetch code + pull-requests: read # for golangci-lint-action to fetch pull requests + + steps: + - name: Checkout code + uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + with: + persist-credentials: false + + - name: Set up Go + uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0 + with: + go-version-file: go.mod + + - name: Config Git credentials for private modules + run: git config --global url."https://${{ secrets.GITHUB_TOKEN }}@github.com".insteadOf "https://github.com" + env: + GOPRIVATE: github.com/CheckmarxDev/*,github.com/checkmarxDev/* + + - name: go mod tidy + run: go mod tidy + env: + GOPRIVATE: github.com/CheckmarxDev/*,github.com/checkmarxDev/* + + - name: Run golangci-lint + uses: step-security/golangci-lint-action@1797facf9ea427614d729a4e9cab0fae1a7852d9 # v9.2.0 + with: + version: v2.11.3 + args: -c .golangci.yml --timeout 10m + only-new-issues: true + env: + GOPRIVATE: github.com/CheckmarxDev/*,github.com/checkmarxDev/* diff --git a/.github/workflows/pr-linter.yaml b/.github/workflows/pr-linter.yaml new file mode 100644 index 0000000..50e3841 --- /dev/null +++ b/.github/workflows/pr-linter.yaml @@ -0,0 +1,27 @@ +name: PR Linter + +on: + pull_request: + types: [opened, edited] + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +permissions: + contents: read + +jobs: + lint: + name: Validate PR Title + runs-on: cx-public-ubuntu-x64 + steps: + - name: Check PR Title + env: + PR_TITLE: ${{ github.event.pull_request.title }} + run: | + if ! [[ "$PR_TITLE" =~ ^AST-[0-9]+:\ .+ ]]; then + echo "::error::PR title must start with a Jira ticket ID in the format 'AST-XXXX: Description'." + exit 1 + fi + shell: bash diff --git a/.golangci.yml b/.golangci.yml index 3698303..5ef3331 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -1,57 +1,6 @@ -linters-settings: - depguard: - list-type: blacklist - dupl: - threshold: 450 - funlen: - lines: 220 - statements: 100 - goconst: - min-len: 2 - min-occurrences: 2 - gocritic: - enabled-tags: - - diagnostic - - experimental - - opinionated - - performance - - style - disabled-checks: - - dupImport # https://github.com/go-critic/go-critic/issues/845 - - ifElseChain - - octalLiteral - - whyNoLint - - wrapperFunc - gocyclo: - min-complexity: 20 - goimports: - local-prefixes: github.com/golangci/golangci-lint - gomnd: - settings: - mnd: - # don't include the "operation" and "assign" - checks: argument,case,condition,return - ignored-numbers: 1,2,10 - govet: - check-shadowing: true - settings: - printf: - funcs: - - (github.com/golangci/golangci-lint/pkg/logutils.Log).Infof - - (github.com/golangci/golangci-lint/pkg/logutils.Log).Warnf - - (github.com/golangci/golangci-lint/pkg/logutils.Log).Errorf - - (github.com/golangci/golangci-lint/pkg/logutils.Log).Fatalf - lll: - line-length: 140 - maligned: - suggest-new: true - misspell: - locale: US - +version: "2" linters: - # please, do not use `enable-all`: it's deprecated and will be removed soon. - # inverted configuration with `enable-all` and `disable` is not scalable during updates of golangci-lint - disable-all: true + default: none enable: - bodyclose - dogsled @@ -62,64 +11,108 @@ linters: - goconst - gocritic - gocyclo - - gofmt - - goimports - - gomnd - goprintffuncname - gosec - - gosimple - govet - ineffassign - lll - misspell + - mnd - nakedret - rowserrcheck - - exportloopref - staticcheck - - stylecheck - - typecheck - unconvert - unparam - unused - whitespace - - # don't enable: - # - gochecknoglobals - # - gocognit - # - godox - # - maligned - # - prealloc - -issues: - # Excluding configuration per-path, per-linter, per-text and per-source - exclude-rules: - - path: / - linters: - - typecheck # why this is disabled? Because golangci-lint in its latest version was compiled against go 1.21 - # and the code we are linting is compiled against go 1.22.1 and we KNOW that it builds so it should - # not have typecheck errors, but indeed if we do not disabled it we get typecheck errors that are false positives - # so we need to disable it, but because in the pipelines there is a step that ensures that the code builds - # having this disabled is not an issue, and if golangci-lint gets update in a way that does not give false positives - # then we can enabled it again, but that would still be rechecing again what another step is already checking (the build step) - # ref: https://github.com/golangci/golangci-lint/issues/3718 - - path: _test\.go - linters: - - gomnd - - gosec - - staticcheck - - lll - - gocritic - -run: - skip-dirs: - - test/testdata_etc - - internal/cache - - internal/renameio - - internal/robustio - -# golangci.com configuration -# https://github.com/golangci/golangci/wiki/Configuration -service: - golangci-lint-version: 1.42.1 # use the fixed version to not introduce new linters unexpectedly - prepare: - - echo "here I can run custom commands, but no preparation needed for this repo" + settings: + dupl: + threshold: 450 + funlen: + lines: 220 + statements: 100 + goconst: + min-len: 2 + min-occurrences: 2 + gocritic: + disabled-checks: + - dupImport + - ifElseChain + - octalLiteral + - whyNoLint + - wrapperFunc + enabled-tags: + - diagnostic + - experimental + - opinionated + - performance + - style + gocyclo: + min-complexity: 20 + govet: + settings: + printf: + funcs: + - (github.com/golangci/golangci-lint/pkg/logutils.Log).Infof + - (github.com/golangci/golangci-lint/pkg/logutils.Log).Warnf + - (github.com/golangci/golangci-lint/pkg/logutils.Log).Errorf + - (github.com/golangci/golangci-lint/pkg/logutils.Log).Fatalf + lll: + line-length: 140 + misspell: + locale: US + mnd: + checks: + - argument + - case + - condition + - return + ignored-numbers: + - "1" + - "2" + - "10" + - "1024" + - "0700" + - "0600" + exclusions: + generated: lax + presets: + - comments + - common-false-positives + - legacy + - std-error-handling + rules: + - linters: + - gocritic + - goconst + - gosec + - lll + - mnd + - staticcheck + path: _test\.go + paths: + - test/testdata_etc + - internal/cache + - internal/renameio + - internal/robustio + - third_party$ + - builtin$ + - examples$ +formatters: + enable: + - gofmt + - goimports + settings: + goimports: + local-prefixes: + - github.com/golangci/golangci-lint + exclusions: + generated: lax + paths: + - test/testdata_etc + - internal/cache + - internal/renameio + - internal/robustio + - third_party$ + - builtin$ + - examples$ diff --git a/internal/secrets/maskSecrets.go b/internal/secrets/maskSecrets.go index 2d21177..2345bb0 100644 --- a/internal/secrets/maskSecrets.go +++ b/internal/secrets/maskSecrets.go @@ -14,6 +14,8 @@ import ( const ( Base64Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" HexChars = "1234567890abcdefABCDEF" + + severityHigh = "HIGH" ) //go:embed regex_rules.json @@ -215,9 +217,9 @@ func ReplaceMatches(fileName string, result string, regexs []SecretRegex, allowR if re.SpecialMask != nil { startOfMatch = re.SpecialMask.FindString(line) } - maskedSecret := fmt.Sprintf("%s", startOfMatch) - results = append(results, Result{QueryName: "Passwords And Secrets - " + re.QueryName, Line: index + 1, FileName: fileName, Severity: "HIGH"}) - return maskedSecret + maskedValue := fmt.Sprintf("%s", startOfMatch) + results = append(results, Result{QueryName: "Passwords And Secrets - " + re.QueryName, Line: index + 1, FileName: fileName, Severity: severityHigh}) + return maskedValue }) if originalLine != lines[index] { // Add the masked string to return @@ -274,7 +276,7 @@ func ReplaceMatches(fileName string, result string, regexs []SecretRegex, allowR } maskedSecret := fmt.Sprintf("%s", startOfMatch) - results = append(results, Result{QueryName: "Passwords And Secrets - " + re.QueryName, Line: lineOfSecret, FileName: fileName, Severity: "HIGH"}) + results = append(results, Result{QueryName: "Passwords And Secrets - " + re.QueryName, Line: lineOfSecret, FileName: fileName, Severity: severityHigh}) maskedMatchString := strings.Replace(matchString, stringToMask, maskedSecret, 1) From 056cae96721adb6f662bdc413285f53f2dc991eb Mon Sep 17 00:00:00 2001 From: avisab-cx <53776974+cx-avi-sabzerou@users.noreply.github.com> Date: Sun, 2 Aug 2026 15:40:44 +0300 Subject: [PATCH 2/5] AST-162098: Fix Zizmor template-injection findings in CI workflows Move secrets.GITHUB_TOKEN out of inline run: script interpolation and into env:, since GitHub expands ${{ }} before the shell sees it, making inline use flaggable as template injection. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/govulncheck.yaml | 4 +++- .github/workflows/lint.yaml | 3 ++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/govulncheck.yaml b/.github/workflows/govulncheck.yaml index 36b42f7..6d5b2c1 100644 --- a/.github/workflows/govulncheck.yaml +++ b/.github/workflows/govulncheck.yaml @@ -12,6 +12,7 @@ permissions: jobs: govulncheck: + name: Govulncheck runs-on: cx-public-ubuntu-x64 steps: - name: Checkout @@ -25,8 +26,9 @@ jobs: go-version-file: go.mod - name: Config Git credentials for private modules - run: git config --global url."https://${{ secrets.GITHUB_TOKEN }}@github.com".insteadOf "https://github.com" + run: git config --global url."https://${GH_TOKEN}@github.com".insteadOf "https://github.com" env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} GOPRIVATE: github.com/CheckmarxDev/*,github.com/checkmarxDev/* - name: Install govulncheck diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml index 31dfcb3..217c99b 100644 --- a/.github/workflows/lint.yaml +++ b/.github/workflows/lint.yaml @@ -30,8 +30,9 @@ jobs: go-version-file: go.mod - name: Config Git credentials for private modules - run: git config --global url."https://${{ secrets.GITHUB_TOKEN }}@github.com".insteadOf "https://github.com" + run: git config --global url."https://${GH_TOKEN}@github.com".insteadOf "https://github.com" env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} GOPRIVATE: github.com/CheckmarxDev/*,github.com/checkmarxDev/* - name: go mod tidy From c89c93d8a7ad2be6b5d1b4a29805cd50f10eb5b8 Mon Sep 17 00:00:00 2001 From: avisab-cx <53776974+cx-avi-sabzerou@users.noreply.github.com> Date: Sun, 2 Aug 2026 15:44:45 +0300 Subject: [PATCH 3/5] AST-162098: Allowlist CLAUDE.md in .gitignore The repo's allowlist-style .gitignore silently dropped CLAUDE.md since *.md wasn't in the allowed patterns, so it was never actually tracked. Co-Authored-By: Claude Sonnet 5 --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index 079a8d8..924056b 100644 --- a/.gitignore +++ b/.gitignore @@ -18,6 +18,7 @@ !README.md !LICENSE +!CLAUDE.md !*.yml !*.json From 1c8f8b94e5e90d2fa9a980ace446fd88bd31800d Mon Sep 17 00:00:00 2001 From: avisab-cx <53776974+cx-avi-sabzerou@users.noreply.github.com> Date: Sun, 2 Aug 2026 15:44:48 +0300 Subject: [PATCH 4/5] AST-162098: Add CLAUDE.md project guidance Co-Authored-By: Claude Sonnet 5 --- CLAUDE.md | 56 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 CLAUDE.md diff --git a/CLAUDE.md b/CLAUDE.md new file mode 100644 index 0000000..c5f864a --- /dev/null +++ b/CLAUDE.md @@ -0,0 +1,56 @@ +# CLAUDE.md + +This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository. + +## Overview + +GenAi-Wrapper is a private Go SDK maintained by the Checkmarx AI Squad that abstracts calls to LLM providers (OpenAI, Checkmarx's internal CxOne AI gateway, and a LiteLLM proxy). It provides stateless and stateful chat wrappers, conversation history persistence, and secret-masking of prompts/responses before they're sent or logged. + +## Commands + +```bash +go build ./... # build everything +go test ./... # run all tests +go test ./pkg/wrapper/... # run tests for a single package +go test ./pkg/wrapper/ -run TestName -v # run a single test +go test ./... -coverpkg=./... -coverprofile cover.out # coverage (matches CI) +go vet ./... +golangci-lint run -c .golangci.yml --timeout 10m # matches the Lint GitHub Action (v2.11.3) +go mod tidy # required before lint in CI +govulncheck ./... # matches the Govulncheck GitHub Action +``` + +CI (GitHub Actions, `.github/workflows/`) runs lint, govulncheck, a Codecov coverage scan (`go test ./... -coverpkg=./...`), and a Checkmarx One scan (`cx-one-scan.yaml`) on every PR. `pr-linter.yaml` enforces PR title/metadata conventions. There is no Makefile; use `go` and `golangci-lint` directly. + +## Architecture + +The codebase is organized as three layers, from low-level HTTP transport up to the public API: + +1. **`internal/`** — raw HTTP transport to LLM providers, hidden from consumers. + - `internal/genaiExternal.go` (`WrapperImpl`) — generic OpenAI-compatible chat completion caller. Handles Checkmarx-gateway auth (`cxAuth` + `MetaData` headers: `X-Request-ID`, `X-Tenant-ID`, `X-Feature`, etc.) vs. direct OpenAI auth (plain API key), and injects `setupMessages` (system/developer prompts registered via `SetupCall`) into the message list at the right position depending on model (GPT-4 vs. others, which insert after the last user message). + - `internal/litellm_wrapper.go` (`LitellmWrapper`) — separate, simpler transport for the LiteLLM proxy; always uses Bearer auth + `MetaData` headers, no setup-message injection. + - `internal/gpt.go` — shared request/response types (`ChatCompletionRequest/Response`, `ErrorResponse`) and the `Wrapper` interface both transports implement; also `NewWrapperFactory` / `NewLitellmWrapperFactory`. + - `internal/codes.go` — provider error code / finish-reason constants (e.g. `context_length_exceeded`, `FinishReasonLength`) used to trigger history truncation. + - `internal/secrets/` — regex+entropy-based secret detector (`MaskSecrets`), rules loaded from an embedded `regex_rules.json`. Used to redact secrets from conversation content before it's sent upstream or surfaced back. + - `internal/api/redirect_prompt/` — generated protobuf/gRPC code (not yet wired into any wrapper). + +2. **`pkg/wrapper/`** — public wrapper implementations built on `internal.Wrapper`: + - `StatelessWrapper` (`stateless_wrapper.go`) — takes explicit `history []message.Message` on every call, masks secrets in the full conversation, enforces an optional user-message `limit`, and on a `FinishReasonLength` response recursively retries after dropping `dropLen` oldest messages from history. + - `StatefulWrapper` (`stateful_wrapper.go`) — wraps a `StatelessWrapper` plus a `connector.Connector`; looks up history by `uuid.UUID`, delegates the call, then appends and persists the updated history. `NewStatefulWrapper` (non-`New` variant) is deprecated in favor of `NewStatefulWrapperNew`. + - `LitellmWrapper` (`litellm_wrapper.go`) — thin pass-through to `internal.LitellmWrapper`, defaults to `models.DefaultModel` if none given. + +3. **`pkg/connector/`** — history persistence abstraction (`Connector` interface: `HistoryById` / `SaveHistory` / `DeleteHistory`). `FileSystemConnector` is the only implementation, storing one JSON file per conversation UUID under `/cx-gpt/`. It defends against path traversal via `safeBasePath`/`validatePath`, which resolve and confirm paths stay inside the base directory before any read/write. + +4. **`pkg/message/`, `pkg/role/`, `pkg/models/`, `pkg/maskedSecret/`** — shared value types: `Message`/`ChatResponse`/`MetaData`/`TokenUsage`, role constants (`system`/`assistant`/`user`/`developer`), model name constants (OpenAI + Claude), and the masked-secret result type. + +5. **`example/`** — standalone `main` demonstrating the SDK as a CLI chat tool (`example/main.go` + `cxoneai.go`/`openai.go`/`utils.go` for provider-specific key/endpoint lookup). Currently only wires up the LiteLLM path end-to-end; OpenAI/CxOne key-fetching helpers exist but `CallAIandPrintResponse` only supports `-ai LiteLLM`. + +### Key request flow + +`StatefulWrapper.SecureCall` → loads history via `Connector` → `StatelessWrapper.SecureCallReturningFullResponse` (masks secrets, builds `ChatCompletionRequest`) → `internal.Wrapper.Call` (injects setup messages, sets auth headers, does the HTTP POST) → on `context_length_exceeded` / `FinishReasonLength`, the call recurses with `dropLen` messages trimmed from the front of history → response is appended to history and persisted. + +### Auth model + +Two auth modes distinguished by whether `MetaData` is nil: +- `MetaData != nil` → Checkmarx gateway mode: `Authorization: Bearer ` plus `X-Request-ID`/`X-Tenant-ID`/`User-Agent`/`X-Feature` headers, and gateway-specific error handling via the `X-Gen-Ai-ErrorCode` response header. +- `MetaData == nil` → direct OpenAI mode: `Authorization: Bearer ` (the wrapper's own configured key), standard OpenAI error body parsing. From c21745a03127d775fb6425952ae2717ef2eab9c7 Mon Sep 17 00:00:00 2001 From: avisab-cx <53776974+cx-avi-sabzerou@users.noreply.github.com> Date: Sun, 2 Aug 2026 15:46:56 +0300 Subject: [PATCH 5/5] AST-162098: Fix cx-one-scan SCA findings (grpc-go, x/net) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Upgrade google.golang.org/grpc v1.80.0 -> v1.82.1, remediating GHSA-hrxh-6v49-42gf (High, CVSS 8.8): xDS RBAC authorization bypass and HTTP/2 Rapid Reset DoS in grpc-go. Upgrade golang.org/x/net v0.54.0 -> v0.57.0, remediating CVE-2026-25680 (Medium, CVSS 6.5): excessive CPU consumption when parsing crafted HTML. The manual golang.org/x/crypto and github.com/go-jose/go-jose/v4 pins are no longer needed as explicit requires — the upgraded grpc and x/net now pull the same safe versions (v0.54.0 / v4.1.4) transitively, confirmed via `go list -m all`. Co-Authored-By: Claude Sonnet 5 --- go.mod | 16 ++++++---------- go.sum | 24 ++++++++++-------------- 2 files changed, 16 insertions(+), 24 deletions(-) diff --git a/go.mod b/go.mod index 143cc98..ec930da 100644 --- a/go.mod +++ b/go.mod @@ -6,15 +6,11 @@ require ( github.com/google/uuid v1.6.0 github.com/spf13/viper v1.21.0 github.com/stretchr/testify v1.11.1 - google.golang.org/grpc v1.80.0 + google.golang.org/grpc v1.82.1 // upgraded to remediate GHSA-hrxh-6v49-42gf google.golang.org/protobuf v1.36.11 ) -require ( - github.com/go-jose/go-jose/v4 v4.1.4 // indirect; pinned to remediate CVE-2026-34986 (grpc pulls v4.1.3) - github.com/rogpeppe/go-internal v1.14.1 // indirect - golang.org/x/crypto v0.52.0 // indirect; pinned to remediate CVE-2026-46595, CVE-2026-39829, CVE-2026-39835 (x/net pulls v0.51.0) -) +require github.com/rogpeppe/go-internal v1.14.1 // indirect require ( github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect @@ -30,10 +26,10 @@ require ( go.opentelemetry.io/otel v1.44.0 // indirect go.opentelemetry.io/otel/sdk/metric v1.44.0 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect - golang.org/x/net v0.54.0 // indirect; upgraded to remediate CVE-2026-39821 - golang.org/x/sys v0.45.0 // indirect - golang.org/x/text v0.37.0 // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260120221211-b8f7ae30c516 // indirect + golang.org/x/net v0.57.0 // indirect; upgraded to remediate CVE-2026-39821, CVE-2026-25680 + golang.org/x/sys v0.47.0 // indirect + golang.org/x/text v0.40.0 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect gopkg.in/yaml.v3 v3.0.1 // indirect ) diff --git a/go.sum b/go.sum index d7a496b..14d021f 100644 --- a/go.sum +++ b/go.sum @@ -6,8 +6,6 @@ github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHk github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0= github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k= github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0= -github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= -github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= @@ -61,20 +59,18 @@ go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/ go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= -golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988= -golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc= -golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w= -golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ= -golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY= -golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc= -golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38= +golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= +golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= +golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= +golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= +golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260120221211-b8f7ae30c516 h1:sNrWoksmOyF5bvJUcnmbeAmQi8baNhqg5IWaI3llQqU= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260120221211-b8f7ae30c516/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ= -google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM= -google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 h1:RmoJA1ujG+/lRGNfUnOMfhCy5EipVMyvUE+KNbPbTlw= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE= +google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=