Skip to content

Commit 13c921b

Browse files
egeozcanclaude
egeozcan
and
claude
committed
chore(deps): update Go to 1.26.4 and remediate 44 govulncheck findings
Bump the Go toolchain and patch all modules flagged by `govulncheck -scan module` (44 -> 0 vulnerabilities). - go.mod go directive 1.25.6 -> 1.26.4 (fixes ~37 stdlib CVEs; GOTOOLCHAIN=auto and CI's go-version-file build against the patched 1.26.4 stdlib) - Dockerfile builder golang:1.21-alpine -> golang:1.26-alpine - golang.org/x/crypto v0.49.0 -> v0.52.0 (ssh agent/knownhosts/tls) - golang.org/x/image v0.37.0 -> v0.41.0 (tiff/bmp DoS/OOM) - golang.org/x/net v0.52.0 -> v0.55.0 (html XSS, idna, DoS) - github.com/jackc/pgx/v5 v5.6.0 -> v5.9.0 (CVE-2026-33815/33816) - transitive: x/sys -> v0.45.0, x/text -> v0.37.0; tidy moved spf13/pflag indirect -> direct (directly imported by CLI commands) Verified: go build (server + CLI), go vet, go unit tests, Go Postgres tests (pgx + gorm), and E2E browser+CLI + E2E Postgres all pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1 parent 8262c5c commit 13c921b

3 files changed

Lines changed: 23 additions & 23 deletions

File tree

‎Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ COPY index.css vite.config.js postcss.config.js ./
88
RUN npm run build-css && npm run build-js
99

1010
# Stage 2: Build Go binary
11-
FROM golang:1.21-alpine AS go-builder
11+
FROM golang:1.26-alpine AS go-builder
1212
RUN apk add --no-cache gcc musl-dev sqlite-dev
1313
WORKDIR /app
1414
COPY go.mod go.sum ./

‎go.mod‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module mahresources
22

3-
go 1.25.6
3+
go 1.26.4
44

55
require (
66
github.com/Nr90/imgsim v0.0.0-20180202144352-5caa057144b0
@@ -24,14 +24,15 @@ require (
2424
github.com/santhosh-tekuri/jsonschema/v6 v6.0.2
2525
github.com/spf13/afero v1.15.0
2626
github.com/spf13/cobra v1.10.2
27+
github.com/spf13/pflag v1.0.10
2728
github.com/srwiley/oksvg v0.0.0-20221011165216-be6e8873101c
2829
github.com/srwiley/rasterx v0.0.0-20220730225603-2ab79fcdd4ef
2930
github.com/stretchr/testify v1.11.1
3031
github.com/testcontainers/testcontainers-go v0.41.0
3132
github.com/testcontainers/testcontainers-go/modules/postgres v0.41.0
3233
github.com/yuin/goldmark v1.7.16
3334
github.com/yuin/gopher-lua v1.1.1
34-
golang.org/x/image v0.37.0
35+
golang.org/x/image v0.41.0
3536
gopkg.in/yaml.v3 v3.0.1
3637
gorm.io/driver/postgres v1.6.0
3738
gorm.io/driver/sqlite v1.6.0
@@ -69,7 +70,7 @@ require (
6970
github.com/inconshreveable/mousetrap v1.1.0 // indirect
7071
github.com/jackc/pgpassfile v1.0.0 // indirect
7172
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
72-
github.com/jackc/pgx/v5 v5.6.0 // indirect
73+
github.com/jackc/pgx/v5 v5.9.0 // indirect
7374
github.com/jackc/puddle/v2 v2.2.2 // indirect
7475
github.com/jinzhu/inflection v1.0.0 // indirect
7576
github.com/jinzhu/now v1.1.5 // indirect
@@ -99,7 +100,6 @@ require (
99100
github.com/russross/blackfriday/v2 v2.1.0 // indirect
100101
github.com/shirou/gopsutil/v4 v4.26.2 // indirect
101102
github.com/sirupsen/logrus v1.9.3 // indirect
102-
github.com/spf13/pflag v1.0.10 // indirect
103103
github.com/tklauser/go-sysconf v0.3.16 // indirect
104104
github.com/tklauser/numcpus v0.11.0 // indirect
105105
github.com/woodsbury/decimal128 v1.3.0 // indirect
@@ -109,11 +109,11 @@ require (
109109
go.opentelemetry.io/otel v1.41.0 // indirect
110110
go.opentelemetry.io/otel/metric v1.41.0 // indirect
111111
go.opentelemetry.io/otel/trace v1.41.0 // indirect
112-
golang.org/x/crypto v0.49.0 // indirect
113-
golang.org/x/net v0.52.0 // indirect
112+
golang.org/x/crypto v0.52.0 // indirect
113+
golang.org/x/net v0.55.0 // indirect
114114
golang.org/x/sync v0.20.0 // indirect
115-
golang.org/x/sys v0.42.0 // indirect
116-
golang.org/x/text v0.35.0 // indirect
115+
golang.org/x/sys v0.45.0 // indirect
116+
golang.org/x/text v0.37.0 // indirect
117117
google.golang.org/grpc v1.79.1 // indirect
118118
google.golang.org/protobuf v1.36.11 // indirect
119119
)

‎go.sum‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -107,8 +107,8 @@ github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsI
107107
github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
108108
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
109109
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
110-
github.com/jackc/pgx/v5 v5.6.0 h1:SWJzexBzPL5jb0GEsrPMLIsi/3jOo7RHlzTjcAeDrPY=
111-
github.com/jackc/pgx/v5 v5.6.0/go.mod h1:DNZ/vlrUnhWCoFGxHAG8U2ljioxukquj7utPDgtQdTw=
110+
github.com/jackc/pgx/v5 v5.9.0 h1:T/dI+2TvmI2H8s/KH1/lXIbz1CUFk3gn5oTjr0/mBsE=
111+
github.com/jackc/pgx/v5 v5.9.0/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
112112
github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
113113
github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
114114
github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
@@ -253,27 +253,27 @@ go.opentelemetry.io/otel/trace v1.41.0/go.mod h1:U1NU4ULCoxeDKc09yCWdWe+3QoyweJc
253253
go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lIVU/I=
254254
go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
255255
go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
256-
golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
257-
golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
256+
golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
257+
golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
258258
golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
259-
golang.org/x/image v0.37.0 h1:ZiRjArKI8GwxZOoEtUfhrBtaCN+4b/7709dlT6SSnQA=
260-
golang.org/x/image v0.37.0/go.mod h1:/3f6vaXC+6CEanU4KJxbcUZyEePbyKbaLoDOe4ehFYY=
261-
golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
262-
golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
259+
golang.org/x/image v0.41.0 h1:8wS72eGJMJaBxK6okTzd4WaXumUlTVlb753MlsSvTCo=
260+
golang.org/x/image v0.41.0/go.mod h1:uIc348UZMSvS5Z65CVZ7iDPaNobNFEPeJ4kbqTOszmA=
261+
golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
262+
golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
263263
golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
264264
golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
265265
golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
266266
golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
267267
golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
268268
golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
269-
golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
270-
golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
271-
golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
272-
golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
269+
golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
270+
golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
271+
golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
272+
golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
273273
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
274274
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
275-
golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
276-
golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
275+
golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
276+
golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
277277
golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 h1:vVKdlvoWBphwdxWKrFZEuM0kGgGLxUOYcY4U/2Vjg44=
278278
golang.org/x/time v0.0.0-20220210224613-90d013bbcef8/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
279279
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

0 commit comments

Comments
 (0)