mirror of
https://github.com/hanzoai/tasks.git
synced 2026-10-04 02:04:03 +00:00
Alex StanfieldandGitHub
a020cbdecf
## Summary Bumps Go module dependencies to address known CVEs found via `govulncheck` on the v1.29.x release branch. ### Bumped | Module | Previous | Updated | CVEs Addressed | |--------|----------|---------|----------------| | `golang.org/x/crypto` | v0.37.0 | v0.45.0 | [GO-2025-4116](https://pkg.go.dev/vuln/GO-2025-4116) (ssh/agent DoS), [GO-2025-4134](https://pkg.go.dev/vuln/GO-2025-4134) (ssh unbounded memory), [GO-2025-4135](https://pkg.go.dev/vuln/GO-2025-4135) (ssh/agent malformed constraint DoS) | | `golang.org/x/net` | v0.39.0 | v0.47.0 | [GO-2026-4440](https://pkg.go.dev/vuln/GO-2026-4440) (html quadratic parsing), [GO-2026-4441](https://pkg.go.dev/vuln/GO-2026-4441) (infinite parsing loop) | | `golang.org/x/sync` | v0.13.0 | v0.18.0 | transitive (required by x/crypto) | | `golang.org/x/sys` | v0.32.0 | v0.38.0 | transitive (required by x/crypto) | | `golang.org/x/text` | v0.24.0 | v0.31.0 | transitive (required by x/crypto) | | `go` directive | 1.25.0 | 1.25.7 | Standard library CVEs in crypto/tls, crypto/x509, archive/zip | ### Not bumped (with rationale) | Module | CVE | Reason | |--------|-----|--------| | `go.opentelemetry.io/otel/sdk` v1.34.0 | [GO-2026-4394](https://pkg.go.dev/vuln/GO-2026-4394) (PATH hijacking, CVSS 7.0 High) | Fix requires v1.40.0 which introduces breaking Prometheus behavioral changes (metric naming, scrape error handling, translation strategy defaults). The vulnerability is **macOS/Darwin only** (exploits the `ioreg` binary) and requires local filesystem write access to PATH. Not applicable to Linux server deployments. Inappropriate risk for a patch release. | | `filippo.io/edwards25519` v1.1.0 | [GO-2026-4503](https://pkg.go.dev/vuln/GO-2026-4503) (invalid result/undefined behavior in `MultiScalarMult`) | The [upstream advisory](https://github.com/FiloSottile/edwards25519/security/advisories/GHSA-fw7p-63qq-7hpr) explicitly states: "if you only depend on `filippo.io/edwards25519` via `github.com/go-sql-driver/mysql`, **you are not affected**." This module is an indirect dependency pulled in solely through `go-sql-driver/mysql` (confirmed via `go mod graph`), so we are not affected. | | `github.com/aws/aws-sdk-go` v1.55.6 | [GO-2022-0646](https://pkg.go.dev/vuln/GO-2022-0646), [GO-2022-0635](https://pkg.go.dev/vuln/GO-2022-0635) (S3 Crypto SDK issues) | No fix available (aws-sdk-go v1 is in maintenance mode). Vulnerabilities are in the S3 Crypto SDK which this project does not use. |
184 lines
8.1 KiB
AMPL
184 lines
8.1 KiB
AMPL
module go.temporal.io/server
|
|
|
|
go 1.25.7
|
|
|
|
retract (
|
|
v1.26.1 // Contains retractions only.
|
|
v1.26.0 // Published accidentally.
|
|
)
|
|
|
|
require (
|
|
cloud.google.com/go/storage v1.51.0
|
|
github.com/Masterminds/sprig/v3 v3.3.0
|
|
github.com/aws/aws-sdk-go v1.55.6
|
|
github.com/blang/semver/v4 v4.0.0
|
|
github.com/cactus/go-statsd-client/v5 v5.1.0
|
|
github.com/dgryski/go-farm v0.0.0-20240924180020-3414d57e47da
|
|
github.com/emirpasic/gods v1.18.1
|
|
github.com/fatih/color v1.18.0
|
|
github.com/go-faker/faker/v4 v4.6.0
|
|
github.com/go-jose/go-jose/v4 v4.0.5
|
|
github.com/go-sql-driver/mysql v1.9.0
|
|
github.com/gocql/gocql v1.7.0
|
|
github.com/golang-jwt/jwt/v4 v4.5.2
|
|
github.com/google/go-cmp v0.7.0
|
|
github.com/google/uuid v1.6.0
|
|
github.com/gorilla/mux v1.8.1
|
|
github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.1
|
|
github.com/iancoleman/strcase v0.3.0
|
|
github.com/jackc/pgx/v5 v5.7.2
|
|
github.com/jmoiron/sqlx v1.4.0
|
|
github.com/jstemmer/go-junit-report/v2 v2.1.0
|
|
github.com/lib/pq v1.10.9
|
|
github.com/maruel/panicparse/v2 v2.4.0
|
|
github.com/mitchellh/mapstructure v1.5.0
|
|
github.com/nexus-rpc/sdk-go v0.3.0
|
|
github.com/olekukonko/tablewriter v0.0.5
|
|
github.com/olivere/elastic/v7 v7.0.32
|
|
github.com/pborman/uuid v1.2.1
|
|
github.com/pkg/errors v0.9.1
|
|
github.com/prometheus/client_golang v1.21.0
|
|
github.com/prometheus/client_model v0.6.1
|
|
github.com/prometheus/common v0.62.0
|
|
github.com/robfig/cron/v3 v3.0.1
|
|
github.com/sony/gobreaker v1.0.0
|
|
github.com/stretchr/testify v1.10.0
|
|
github.com/temporalio/ringpop-go v0.0.0-20250130211428-b97329e994f7
|
|
github.com/temporalio/sqlparser v0.0.0-20231115171017-f4060bcfa6cb
|
|
github.com/temporalio/tchannel-go v1.22.1-0.20240528171429-1db37fdea938
|
|
github.com/temporalio/tctl-kit v0.0.0-20250107205014-58462b03dfb2
|
|
github.com/uber-go/tally/v4 v4.1.17
|
|
github.com/urfave/cli v1.22.16
|
|
github.com/urfave/cli/v2 v2.27.5
|
|
go.opentelemetry.io/collector/pdata v1.34.0
|
|
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.59.0
|
|
go.opentelemetry.io/otel v1.34.0
|
|
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.34.0
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0
|
|
go.opentelemetry.io/otel/exporters/prometheus v0.56.0
|
|
go.opentelemetry.io/otel/metric v1.34.0
|
|
go.opentelemetry.io/otel/sdk v1.34.0
|
|
go.opentelemetry.io/otel/sdk/metric v1.34.0
|
|
go.opentelemetry.io/otel/trace v1.34.0
|
|
go.temporal.io/api v1.53.0
|
|
go.temporal.io/sdk v1.35.0
|
|
go.uber.org/fx v1.23.0
|
|
go.uber.org/mock v0.5.0
|
|
go.uber.org/multierr v1.11.0
|
|
go.uber.org/zap v1.27.0
|
|
golang.org/x/exp v0.0.0-20250218142911-aa4b98e5adaa
|
|
golang.org/x/oauth2 v0.28.0
|
|
golang.org/x/sync v0.18.0
|
|
golang.org/x/text v0.31.0
|
|
golang.org/x/time v0.10.0
|
|
google.golang.org/api v0.224.0
|
|
google.golang.org/grpc v1.72.2
|
|
google.golang.org/protobuf v1.36.6
|
|
gopkg.in/validator.v2 v2.0.1
|
|
gopkg.in/yaml.v3 v3.0.1
|
|
modernc.org/sqlite v1.34.1
|
|
)
|
|
|
|
require (
|
|
cel.dev/expr v0.20.0 // indirect
|
|
cloud.google.com/go v0.118.3 // indirect; indirect e
|
|
cloud.google.com/go/auth v0.15.0 // indirect
|
|
cloud.google.com/go/auth/oauth2adapt v0.2.7 // indirect
|
|
cloud.google.com/go/compute/metadata v0.6.0 // indirect
|
|
cloud.google.com/go/iam v1.4.2 // indirect
|
|
cloud.google.com/go/monitoring v1.24.1 // indirect
|
|
dario.cat/mergo v1.0.1 // indirect
|
|
filippo.io/edwards25519 v1.1.0 // indirect
|
|
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.27.0 // indirect
|
|
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.51.0 // indirect
|
|
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.51.0 // indirect
|
|
github.com/Masterminds/goutils v1.1.1 // indirect
|
|
github.com/Masterminds/semver/v3 v3.3.0 // indirect
|
|
github.com/apache/thrift v0.21.0 // indirect
|
|
github.com/benbjohnson/clock v1.3.5 // indirect
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/cactus/go-statsd-client/statsd v0.0.0-20200423205355-cb0885a1018c // indirect
|
|
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/cncf/xds/go v0.0.0-20250121191232-2f005788dc42 // indirect
|
|
github.com/cpuguy83/go-md2man/v2 v2.0.6 // indirect
|
|
github.com/davecgh/go-spew v1.1.1 // indirect
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/envoyproxy/go-control-plane/envoy v1.32.4 // indirect
|
|
github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
|
|
github.com/facebookgo/clock v0.0.0-20150410010913-600d898af40a // indirect
|
|
github.com/felixge/httpsnoop v1.0.4 // indirect
|
|
github.com/go-logr/logr v1.4.2 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/gogo/protobuf v1.3.2 // indirect
|
|
github.com/golang/mock v1.6.0 // indirect
|
|
github.com/golang/snappy v0.0.4 // indirect
|
|
github.com/google/pprof v0.0.0-20250208200701-d0013a598941 // indirect
|
|
github.com/google/s2a-go v0.1.9 // indirect
|
|
github.com/googleapis/enterprise-certificate-proxy v0.3.5 // indirect
|
|
github.com/googleapis/gax-go/v2 v2.14.1 // indirect
|
|
github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
|
|
github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed // indirect
|
|
github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
|
|
github.com/huandu/xstrings v1.5.0 // indirect
|
|
github.com/jackc/pgpassfile v1.0.0 // indirect
|
|
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
|
|
github.com/jackc/puddle/v2 v2.2.2 // indirect
|
|
github.com/jmespath/go-jmespath v0.4.0 // indirect
|
|
github.com/josharian/intern v1.0.0 // indirect
|
|
github.com/json-iterator/go v1.1.12 // indirect
|
|
github.com/klauspost/compress v1.18.0 // indirect
|
|
github.com/mailru/easyjson v0.9.0 // indirect
|
|
github.com/mattn/go-colorable v0.1.14 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/mattn/go-runewidth v0.0.16 // indirect
|
|
github.com/mitchellh/copystructure v1.2.0 // indirect
|
|
github.com/mitchellh/reflectwalk v1.0.2 // indirect
|
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
|
github.com/modern-go/reflect2 v1.0.2 // indirect
|
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
|
github.com/ncruces/go-strftime v0.1.9 // indirect
|
|
github.com/opentracing/opentracing-go v1.2.0 // indirect
|
|
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
|
|
github.com/pmezard/go-difflib v1.0.0 // indirect
|
|
github.com/prometheus/procfs v0.15.1 // indirect
|
|
github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
|
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
|
github.com/rivo/uniseg v0.4.7 // indirect
|
|
github.com/robfig/cron v1.2.0 // indirect
|
|
github.com/russross/blackfriday/v2 v2.1.0 // indirect
|
|
github.com/shopspring/decimal v1.4.0 // indirect
|
|
github.com/sirupsen/logrus v1.9.3 // indirect
|
|
github.com/spf13/cast v1.7.0 // indirect
|
|
github.com/spiffe/go-spiffe/v2 v2.5.0 // indirect
|
|
github.com/stretchr/objx v0.5.2 // indirect
|
|
github.com/twmb/murmur3 v1.1.8 // indirect
|
|
github.com/uber-common/bark v1.3.0 // indirect
|
|
github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect
|
|
github.com/zeebo/errs v1.4.0 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
|
|
go.opentelemetry.io/contrib/detectors/gcp v1.34.0 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0
|
|
go.opentelemetry.io/proto/otlp v1.5.0
|
|
go.uber.org/atomic v1.11.0 // indirect
|
|
go.uber.org/dig v1.18.0 // indirect
|
|
golang.org/x/crypto v0.45.0 // indirect
|
|
golang.org/x/net v0.47.0 // indirect
|
|
golang.org/x/sys v0.38.0 // indirect
|
|
google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb // indirect
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20250303144028-a0af3efb3deb // indirect
|
|
gopkg.in/inf.v0 v0.9.1 // indirect
|
|
modernc.org/cc/v4 v4.24.4 // indirect
|
|
modernc.org/ccgo/v4 v4.20.4 // indirect
|
|
modernc.org/gc/v2 v2.6.3 // indirect
|
|
modernc.org/gc/v3 v3.0.0-20250121204235-2db1fde51ea4 // indirect
|
|
modernc.org/libc v1.55.3 // indirect
|
|
modernc.org/mathutil v1.7.1 // indirect
|
|
modernc.org/memory v1.8.2 // indirect
|
|
modernc.org/opt v0.1.4 // indirect
|
|
modernc.org/strutil v1.2.1 // indirect
|
|
modernc.org/token v1.1.0 // indirect
|
|
)
|