George Karr
af51636bda
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** NA — resolves high-severity code-scanning alerts in `tools/` Bumps the outdated `golang.org/x/net` and `golang.org/x/crypto` indirect dependencies in the four `tools/` Go modules to clear 39 high-severity code-scanning (SCA) alerts on `main`. Target versions match the root Fleet module. | Module | x/net | x/crypto | | --- | --- | --- | | `tools/dibble` | v0.53.0 → **v0.55.0** | v0.50.0 → **v0.52.0** | | `tools/hangar` | v0.53.0 → **v0.55.0** | v0.50.0 → **v0.52.0** | | `tools/terraform` | v0.48.0 → **v0.55.0** | v0.46.0 → **v0.52.0** | | `tools/github-manage` | v0.38.0 → **v0.55.0** | — | CVEs cleared: - **x/net v0.55.0**: CVE-2026-25681, -27136, -33814, -39821, -42502 - **x/crypto v0.52.0**: CVE-2026-39827, -39828, -39829, -39830, -39832, -39835, -42508, -46595, -46597 All four modules `go mod verify` clean and build. Dependency-only change to internal dev tooling — no product code, no user-visible behavior. > The remaining 8 high-severity alerts in `tools/` are OpenSSF Scorecard > "Binary-Artifacts" findings for embedded dibble seed installers; those are > tracked separately and not addressed here. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated several bundled Go dependencies across internal tooling to newer versions. * This includes refreshes to common networking, cryptography, text, and system packages, plus one added telemetry-related dependency. * No user-facing features or behavior changes were introduced. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
48 lines
1.9 KiB
AMPL
48 lines
1.9 KiB
AMPL
module fleetdm/gm
|
|
|
|
go 1.26.4
|
|
|
|
require (
|
|
github.com/charmbracelet/bubbles v0.21.0
|
|
github.com/charmbracelet/bubbletea v1.3.6
|
|
github.com/charmbracelet/glamour v0.10.0
|
|
github.com/charmbracelet/lipgloss v1.1.1-0.20250404203927-76690c660834
|
|
github.com/mattn/go-isatty v0.0.20
|
|
github.com/spf13/cobra v1.9.1
|
|
github.com/spf13/pflag v1.0.6
|
|
)
|
|
|
|
require (
|
|
github.com/alecthomas/chroma/v2 v2.14.0 // indirect
|
|
github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
|
|
github.com/aymerick/douceur v0.2.0 // indirect
|
|
github.com/charmbracelet/colorprofile v0.3.1 // indirect
|
|
github.com/charmbracelet/harmonica v0.2.0 // indirect
|
|
github.com/charmbracelet/x/ansi v0.9.3 // indirect
|
|
github.com/charmbracelet/x/cellbuf v0.0.13 // indirect
|
|
github.com/charmbracelet/x/exp/slice v0.0.0-20250327172914-2fdc97757edf // indirect
|
|
github.com/charmbracelet/x/term v0.2.1 // indirect
|
|
github.com/dlclark/regexp2 v1.11.0 // indirect
|
|
github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
|
|
github.com/gorilla/css v1.0.1 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
|
|
github.com/mattn/go-localereader v0.0.1 // indirect
|
|
github.com/mattn/go-runewidth v0.0.16 // indirect
|
|
github.com/microcosm-cc/bluemonday v1.0.27 // indirect
|
|
github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
|
|
github.com/muesli/cancelreader v0.2.2 // indirect
|
|
github.com/muesli/reflow v0.3.0 // indirect
|
|
github.com/muesli/termenv v0.16.0 // indirect
|
|
github.com/rivo/uniseg v0.4.7 // indirect
|
|
github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
|
|
github.com/yuin/goldmark v1.7.8 // indirect
|
|
github.com/yuin/goldmark-emoji v1.0.5 // indirect
|
|
golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b // indirect
|
|
golang.org/x/net v0.55.0 // indirect
|
|
golang.org/x/sync v0.20.0 // indirect
|
|
golang.org/x/sys v0.45.0 // indirect
|
|
golang.org/x/term v0.43.0 // indirect
|
|
golang.org/x/text v0.37.0 // indirect
|
|
)
|