mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
Sahil BansalandGitHub
d9240eed82
* fix(deps): update golang.org/x modules to latest on the Go 1.25 line Clears the x/crypto, x/net, x/sys and x/text vulnerability findings reported against the pmg binary by image scanners. Deliberately kept back: the go directive stays 1.25.1 because the Go 1.26 move is blocked on goproxy URL parsing (see #390), and grpc stays pinned at v1.81.0 due to the trailers regression with v1.82.x. * fix(container): move runtime base to debian 13 and refresh builder pin The bullseye runtime base and the stale golang:1.25-bookworm digest (go1.25.5) accounted for most of the vulnerability findings in the published image. debian:13-slim is current stable and the refreshed golang digest carries go1.25.12, covering every flagged stdlib CVE.
90 lines
3.9 KiB
AMPL
90 lines
3.9 KiB
AMPL
module github.com/safedep/pmg
|
|
|
|
go 1.25.1
|
|
|
|
require (
|
|
buf.build/gen/go/safedep/api/grpc/go v1.6.2-20260528074646-b9e182189444.1
|
|
buf.build/gen/go/safedep/api/protocolbuffers/go v1.36.11-20260713161921-716fa3011a21.1
|
|
github.com/Masterminds/semver v1.5.0
|
|
github.com/elazarl/goproxy v1.8.1
|
|
github.com/fatih/color v1.18.0
|
|
github.com/goccy/go-yaml v1.19.2
|
|
github.com/gofrs/flock v0.13.0
|
|
github.com/google/uuid v1.6.0
|
|
github.com/jedib0t/go-pretty/v6 v6.7.9
|
|
github.com/landlock-lsm/go-landlock v0.7.0
|
|
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
|
|
github.com/posthog/posthog-go v1.5.12
|
|
github.com/safedep/dry v0.0.0-20260716095238-84cd2b3cd3a4
|
|
github.com/safedep/ptyx v0.2.1-0.20260529140457-d1f745842a6a
|
|
github.com/sony/gobreaker/v2 v2.4.0
|
|
github.com/spf13/cobra v1.9.1
|
|
github.com/spf13/pflag v1.0.10
|
|
github.com/spf13/viper v1.21.0
|
|
github.com/stretchr/testify v1.11.1
|
|
golang.org/x/mod v0.37.0
|
|
golang.org/x/net v0.57.0
|
|
golang.org/x/sync v0.22.0
|
|
golang.org/x/sys v0.47.0
|
|
golang.org/x/term v0.45.0
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171
|
|
google.golang.org/grpc v1.81.0
|
|
google.golang.org/protobuf v1.36.11
|
|
gopkg.in/yaml.v3 v3.0.1
|
|
)
|
|
|
|
require (
|
|
al.essio.dev/pkg/shellescape v1.5.1 // indirect
|
|
buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260415201107-50325440f8f2.1 // indirect
|
|
github.com/Masterminds/semver/v3 v3.3.1 // indirect
|
|
github.com/caarlos0/env/v11 v11.3.1 // indirect
|
|
github.com/clipperhouse/stringish v0.1.1 // indirect
|
|
github.com/clipperhouse/uax29/v2 v2.5.0 // indirect
|
|
github.com/danieljoos/wincred v1.2.2 // indirect
|
|
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
|
github.com/denisbrodbeck/machineid v1.0.1 // indirect
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/fsnotify/fsnotify v1.9.0 // indirect
|
|
github.com/gabriel-vasile/mimetype v1.4.13 // indirect
|
|
github.com/go-playground/locales v0.14.1 // indirect
|
|
github.com/go-playground/universal-translator v0.18.1 // indirect
|
|
github.com/go-playground/validator/v10 v10.30.2 // indirect
|
|
github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
|
|
github.com/godbus/dbus/v5 v5.1.0 // indirect
|
|
github.com/golang-jwt/jwt/v5 v5.3.0 // indirect
|
|
github.com/golang/protobuf v1.5.4 // indirect
|
|
github.com/google/go-github/v74 v74.0.0 // indirect
|
|
github.com/google/go-querystring v1.1.0 // indirect
|
|
github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
|
|
github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/leodido/go-urn v1.4.0 // indirect
|
|
github.com/mattn/go-colorable v0.1.14 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/mattn/go-runewidth v0.0.19 // indirect
|
|
github.com/ncruces/go-strftime v1.0.0 // indirect
|
|
github.com/oklog/ulid/v2 v2.1.1 // indirect
|
|
github.com/package-url/packageurl-go v0.1.3 // indirect
|
|
github.com/pelletier/go-toml/v2 v2.2.4 // indirect
|
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
|
github.com/rogpeppe/go-internal v1.14.1 // indirect
|
|
github.com/sagikazarmark/locafero v0.11.0 // indirect
|
|
github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
|
|
github.com/spf13/afero v1.15.0 // indirect
|
|
github.com/spf13/cast v1.10.0 // indirect
|
|
github.com/subosito/gotenv v1.6.0 // indirect
|
|
github.com/zalando/go-keyring v0.2.6 // indirect
|
|
go.uber.org/multierr v1.11.0 // indirect
|
|
go.uber.org/zap v1.27.0 // indirect
|
|
go.yaml.in/yaml/v3 v3.0.4 // indirect
|
|
golang.org/x/crypto v0.54.0 // indirect
|
|
golang.org/x/text v0.40.0 // indirect
|
|
gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
|
|
kernel.org/pub/linux/libs/security/libcap/psx v1.2.77 // indirect
|
|
modernc.org/libc v1.70.0 // indirect
|
|
modernc.org/mathutil v1.7.1 // indirect
|
|
modernc.org/memory v1.11.0 // indirect
|
|
modernc.org/sqlite v1.48.1 // indirect
|
|
sigs.k8s.io/yaml v1.4.0 // indirect
|
|
)
|