-
-
Notifications
You must be signed in to change notification settings - Fork 119
Upgrade dependencies #606
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Upgrade dependencies #606
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | CEB7Diff line number | Diff line change | ||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
@@ -4,20 +4,29 @@ go 1.20 | |||||||||||||||||||||
|
||||||||||||||||||||||
require ( | ||||||||||||||||||||||
github.com/dsnet/golib/memfile v1.0.0 | ||||||||||||||||||||||
github.com/pion/dtls/v3 v3.0.2 | ||||||||||||||||||||||
github.com/pion/dtls/v3 v3.0.6 | ||||||||||||||||||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 💡 Verification agent 🧩 Analysis chainVerify security vulnerabilities in updated dependencies. Please verify that the updated dependency versions don't contain known security vulnerabilities. Also applies to: 10-12, 17-17, 20-21 🌐 Web query:
💡 Result: Security Vulnerabilities in Specific Go Packages and Versions1. github.com/pion/dtls/v3 v3.0.6
Summary: No known, unpatched vulnerabilities in v3.0.6. 2. golang.org/x/net v0.35.0
Summary: v0.35.0 is affected by at least two publicly disclosed vulnerabilities. Upgrade is recommended. 3. golang.org/x/crypto v0.33.0
Summary: v0.33.0 is vulnerable to DoS attacks and should be upgraded. 4. golang.org/x/sys v0.30.0
Summary: No known vulnerabilities in v0.30.0 as of now. Summary Table
Recommendations
If your project is security sensitive, consider a full security review and always track dependency advisories for updates. Citations:
Address security vulnerabilities in Go dependencies The following versions in go.mod are affected by known CVEs and should be upgraded:
No action needed for:
Please bump these two dependencies in go.mod and verify there are no downstream breaking changes. 🤖 Prompt for AI Agents
|
||||||||||||||||||||||
github.com/stretchr/testify v1.9.0 | ||||||||||||||||||||||
go.uber.org/atomic v1.11.0 | ||||||||||||||||||||||
golang.org/x/exp v0.0.0-20240823005443-9b4947da3948 | ||||||||||||||||||||||
golang.org/x/net v0.28.0 | ||||||||||||||||||||||
golang.org/x/sync v0.8.0 | ||||||||||||||||||||||
golang.org/x/exp v0.0.0-20240904232852-e7e105dedf7e | ||||||||||||||||||||||
golang.org/x/net v0.35.0 | ||||||||||||||||||||||
golang.org/x/sync v0.11.0 | ||||||||||||||||||||||
) | ||||||||||||||||||||||
|
||||||||||||||||||||||
require ( | ||||||||||||||||||||||
github.com/davecgh/go-spew v1.1.1 // indirect | ||||||||||||||||||||||
github.com/pion/logging v0.2.2 // indirect | ||||||||||||||||||||||
github.com/pion/logging v0.2.3 // indirect | ||||||||||||||||||||||
github.com/pion/transport/v3 v3.0.7 // indirect | ||||||||||||||||||||||
github.com/pmezard/go-difflib v1.0.0 // indirect | ||||||||||||||||||||||
golang.org/x/crypto v0.26.0 // indirect | ||||||||||||||||||||||
golang.org/x/sys v0.24.0 // indirect | ||||||||||||||||||||||
golang.org/x/crypto v0.33.0 // indirect | ||||||||||||||||||||||
golang.org/x/sys v0.30.0 // indirect | ||||||||||||||||||||||
gopkg.in/yaml.v3 v3.0.1 // indirect | ||||||||||||||||||||||
) | ||||||||||||||||||||||
|
||||||||||||||||||||||
// pin versions to keep go1.20 support | ||||||||||||||||||||||
replace ( | ||||||||||||||||||||||
golang.org/x/crypto => golang.org/x/crypto v0.33.0 | ||||||||||||||||||||||
golang.org/x/exp => golang.org/x/exp v0.0.0-20240904232852-e7e105dedf7e | ||||||||||||||||||||||
golang.org/x/net => golang.org/x/net v0.35.0 | ||||||||||||||||||||||
golang.org/x/sync => golang.org/x/sync v0.11.0 | ||||||||||||||||||||||
golang.org/x/sys => golang.org/x/sys v0.30.0 | ||||||||||||||||||||||
) | ||||||||||||||||||||||
Comment on lines
+25
to
+32
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 💡 Verification agent 🧩 Analysis chainQuestion the necessity of the replace directive. The replace directive pins the exact same versions that are already specified in the Please verify if this replace directive is actually necessary by checking if any transitive dependencies pull in incompatible versions: 🏁 Script executed: #!/bin/bash
# Description: Check if replace directives are necessary by examining transitive dependencies
echo "Checking for version conflicts in transitive dependencies..."
# Check what versions would be selected without replace directives
go mod graph | grep -E "(golang.org/x/crypto|golang.org/x/exp|golang.org/x/net|golang.org/x/sync|golang.org/x/sys)" | head -20
echo -e "\nChecking go mod why for each replaced module..."
go mod why golang.org/x/crypto
go mod why golang.org/x/exp
go mod why golang.org/x/net
go mod why golang.org/x/sync
go mod why golang.org/x/sys Length of output: 2968 Drop redundant replace directives in go.mod All of the
If you still intend to proactively guard against future upgrades that might bump these beyond Go 1.20, consider documenting that goal instead of mirroring the current require versions here. 🤖 Prompt for AI Agents
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
💡 Verification agent
🧩 Analysis chain
Verify the action version and approve the upgrade.
The upgrade from golangci-lint-action@v6 to v8 is a good practice to stay current with the latest features and security updates.
🌐 Web query:
💡 Result:
The latest stable version of the
golangci/golangci-lint-action
GitHub Action is v6.2.0, released on May 28, 2025. (newreleases.io)This release introduces support for Linux ARM64 in public preview and updates the build tag syntax.
For detailed information on this release, you can refer to the release notes. (newreleases.io)
To use this version in your GitHub Actions workflow, specify it as follows:
Ensure that the
version
input matches the desired version ofgolangci-lint
you intend to use.Citations:
Invalid golangci-lint Action version
The workflow is currently using
golangci/golangci-lint-action@v8
, but no v8 release exists. The latest stable release is v6.2.0 (released May 28, 2025).Please update the workflow:
• File:
.github/workflows/golangci-lint.yml
Line: 28
Suggested change:
📝 Committable suggestion
🤖 Prompt for AI Agents