mirror of
https://github.com/hanzoai/tasks.git
synced 2026-10-04 02:04:03 +00:00
KannanandGitHub
d2789d2365
## Summary Bumps dependencies to address security CVEs on `main`: - **CVE-2026-33186 (CRITICAL)**: `google.golang.org/grpc` v1.72.2 → v1.79.3 — authorization bypass via missing leading `/` in `:path` header - **CVE-2026-22184 (HIGH)**: Alpine `zlib` 1.3.1-r2 → 1.3.2-r0 — global buffer overflow in `untgz` utility Note: The other two CVEs from the v1.30.2 security review are already addressed on `main`: - otel/sdk v1.40.0 — already landed via #9442 - Go stdlib — `main` is on Go 1.26.0 (separate release series) ## Risk assessment - **grpc v1.72.2 → v1.79.3**: 7 minor version jump with ~23 transitive dependency upgrades. Builds cleanly. Same bump successfully applied to `release/v1.30.x` in #9610. - **zlib**: Alpine package upgrade via `apk upgrade --no-cache zlib` in both server and admin-tools Dockerfiles. ## Test plan - [ ] CI passes Made with [Cursor]()
177 lines
7.8 KiB
AMPL
177 lines
7.8 KiB
AMPL
module go.temporal.io/server
|
|
|
|
go 1.26.0
|
|
|
|
retract (
|
|
v1.30.0
|
|
v1.26.1 // Contains retractions only.
|
|
v1.26.0 // Published accidentally.
|
|
)
|
|
|
|
require (
|
|
cloud.google.com/go/storage v1.51.0
|
|
github.com/Masterminds/sprig/v3 v3.3.0
|
|
github.com/aws/aws-sdk-go v1.55.8
|
|
github.com/blang/semver/v4 v4.0.0
|
|
github.com/cactus/go-statsd-client/v5 v5.1.0
|
|
github.com/dgryski/go-farm v0.0.0-20240924180020-3414d57e47da
|
|
github.com/emirpasic/gods v1.18.1
|
|
github.com/fatih/color v1.18.0
|
|
github.com/go-faker/faker/v4 v4.6.0
|
|
github.com/go-jose/go-jose/v4 v4.1.3
|
|
github.com/go-sql-driver/mysql v1.9.0
|
|
github.com/gocql/gocql v1.7.0
|
|
github.com/golang-jwt/jwt/v4 v4.5.2
|
|
github.com/google/go-cmp v0.7.0
|
|
github.com/google/uuid v1.6.0
|
|
github.com/gorilla/mux v1.8.1
|
|
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1
|
|
github.com/iancoleman/strcase v0.3.0
|
|
github.com/jackc/pgx/v5 v5.7.2
|
|
github.com/jmoiron/sqlx v1.4.0
|
|
github.com/jstemmer/go-junit-report/v2 v2.1.0
|
|
github.com/lib/pq v1.10.9
|
|
github.com/maruel/panicparse/v2 v2.4.0
|
|
github.com/mitchellh/mapstructure v1.5.0
|
|
github.com/nexus-rpc/sdk-go v0.5.2-0.20260211051645-26b0b4c584e5
|
|
github.com/olekukonko/tablewriter v0.0.5
|
|
github.com/olivere/elastic/v7 v7.0.32
|
|
github.com/prometheus/client_golang v1.21.0
|
|
github.com/prometheus/client_model v0.6.2
|
|
github.com/prometheus/common v0.62.0
|
|
github.com/robfig/cron/v3 v3.0.1
|
|
github.com/sony/gobreaker v1.0.0
|
|
github.com/stretchr/testify v1.11.1
|
|
github.com/temporalio/ringpop-go v0.0.0-20250130211428-b97329e994f7
|
|
github.com/temporalio/sqlparser v0.0.0-20231115171017-f4060bcfa6cb
|
|
github.com/temporalio/tchannel-go v1.22.1-0.20240528171429-1db37fdea938
|
|
github.com/tidwall/btree v1.8.1
|
|
github.com/uber-go/tally/v4 v4.1.17
|
|
github.com/urfave/cli v1.22.16
|
|
github.com/urfave/cli/v2 v2.27.5
|
|
go.opentelemetry.io/collector/pdata v1.34.0
|
|
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.59.0
|
|
go.opentelemetry.io/otel v1.40.0
|
|
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.34.0
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0
|
|
go.opentelemetry.io/otel/exporters/prometheus v0.56.0
|
|
go.opentelemetry.io/otel/metric v1.40.0
|
|
go.opentelemetry.io/otel/sdk v1.40.0
|
|
go.opentelemetry.io/otel/sdk/metric v1.40.0
|
|
go.opentelemetry.io/otel/trace v1.40.0
|
|
go.temporal.io/api v1.62.5
|
|
go.temporal.io/sdk v1.38.0
|
|
go.uber.org/fx v1.24.0
|
|
go.uber.org/mock v0.6.0
|
|
go.uber.org/multierr v1.11.0
|
|
go.uber.org/zap v1.27.0
|
|
golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546
|
|
golang.org/x/oauth2 v0.34.0
|
|
golang.org/x/sync v0.19.0
|
|
golang.org/x/text v0.32.0
|
|
golang.org/x/time v0.10.0
|
|
google.golang.org/api v0.224.0
|
|
google.golang.org/grpc v1.79.3
|
|
google.golang.org/protobuf v1.36.10
|
|
gopkg.in/validator.v2 v2.0.1
|
|
gopkg.in/yaml.v3 v3.0.1
|
|
modernc.org/sqlite v1.44.3
|
|
)
|
|
|
|
require (
|
|
github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.2 // indirect
|
|
github.com/pkg/errors v0.9.1 // indirect
|
|
)
|
|
|
|
require (
|
|
cel.dev/expr v0.25.1 // indirect
|
|
cloud.google.com/go v0.118.3 // indirect; indirect e
|
|
cloud.google.com/go/auth v0.15.0 // indirect
|
|
cloud.google.com/go/auth/oauth2adapt v0.2.7 // indirect
|
|
cloud.google.com/go/compute/metadata v0.9.0 // indirect
|
|
cloud.google.com/go/iam v1.4.2 // indirect
|
|
cloud.google.com/go/monitoring v1.24.1 // indirect
|
|
dario.cat/mergo v1.0.1 // indirect
|
|
filippo.io/edwards25519 v1.1.1 // indirect
|
|
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0 // indirect
|
|
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.51.0 // indirect
|
|
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.51.0 // indirect
|
|
github.com/Masterminds/goutils v1.1.1 // indirect
|
|
github.com/Masterminds/semver/v3 v3.3.0 // indirect
|
|
github.com/apache/thrift v0.21.0 // indirect
|
|
github.com/benbjohnson/clock v1.3.5 // indirect
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/cactus/go-statsd-client/statsd v0.0.0-20200423205355-cb0885a1018c // indirect
|
|
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 // indirect
|
|
github.com/cpuguy83/go-md2man/v2 v2.0.6 // indirect
|
|
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/envoyproxy/go-control-plane/envoy v1.36.0 // indirect
|
|
github.com/envoyproxy/protoc-gen-validate v1.3.0 // indirect
|
|
github.com/facebookgo/clock v0.0.0-20150410010913-600d898af40a // indirect
|
|
github.com/felixge/httpsnoop v1.0.4 // indirect
|
|
github.com/go-logr/logr v1.4.3 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/gogo/protobuf v1.3.2 // indirect
|
|
github.com/golang/mock v1.6.0 // indirect
|
|
github.com/golang/snappy v0.0.4 // indirect
|
|
github.com/google/s2a-go v0.1.9 // indirect
|
|
github.com/googleapis/enterprise-certificate-proxy v0.3.5 // indirect
|
|
github.com/googleapis/gax-go/v2 v2.14.1 // indirect
|
|
github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed // indirect
|
|
github.com/huandu/xstrings v1.5.0 // indirect
|
|
github.com/jackc/pgpassfile v1.0.0 // indirect
|
|
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
|
|
github.com/jackc/puddle/v2 v2.2.2 // indirect
|
|
github.com/jmespath/go-jmespath v0.4.0 // indirect
|
|
github.com/josharian/intern v1.0.0 // indirect
|
|
github.com/json-iterator/go v1.1.12 // indirect
|
|
github.com/klauspost/compress v1.18.0 // indirect
|
|
github.com/mailru/easyjson v0.9.0 // indirect
|
|
github.com/mattn/go-colorable v0.1.14 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/mattn/go-runewidth v0.0.16 // indirect
|
|
github.com/mitchellh/copystructure v1.2.0 // indirect
|
|
github.com/mitchellh/reflectwalk v1.0.2 // indirect
|
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
|
github.com/modern-go/reflect2 v1.0.2 // indirect
|
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
|
github.com/ncruces/go-strftime v1.0.0 // indirect
|
|
github.com/opentracing/opentracing-go v1.2.0 // indirect
|
|
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
|
|
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
|
|
github.com/prometheus/procfs v0.15.1 // indirect
|
|
github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
|
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
|
github.com/rivo/uniseg v0.4.7 // indirect
|
|
github.com/robfig/cron v1.2.0 // indirect
|
|
github.com/russross/blackfriday/v2 v2.1.0 // indirect
|
|
github.com/shopspring/decimal v1.4.0 // indirect
|
|
github.com/sirupsen/logrus v1.9.3 // indirect
|
|
github.com/spf13/cast v1.7.0 // indirect
|
|
github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
|
|
github.com/stretchr/objx v0.5.2 // indirect
|
|
github.com/twmb/murmur3 v1.1.8 // indirect
|
|
github.com/uber-common/bark v1.3.0 // indirect
|
|
github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
|
go.opentelemetry.io/contrib/detectors/gcp v1.39.0 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0
|
|
go.opentelemetry.io/proto/otlp v1.7.1
|
|
go.uber.org/atomic v1.11.0 // indirect
|
|
go.uber.org/dig v1.19.0 // indirect
|
|
golang.org/x/crypto v0.46.0 // indirect
|
|
golang.org/x/net v0.48.0 // indirect
|
|
golang.org/x/sys v0.40.0 // indirect
|
|
google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb // indirect
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
|
|
gopkg.in/inf.v0 v0.9.1 // indirect
|
|
modernc.org/libc v1.67.6 // indirect
|
|
modernc.org/mathutil v1.7.1 // indirect
|
|
modernc.org/memory v1.11.0 // indirect
|
|
)
|