-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathgo.mod
More file actions
97 lines (93 loc) · 4.59 KB
/
Copy pathgo.mod
File metadata and controls
97 lines (93 loc) · 4.59 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
module github.com/tracebloc/cli
// Minimum Go is what `go 1.26.0` says below — this used to claim
// "1.22" but the k8s.io/* v0.36.x deps dragged the floor up to 1.26
// (transitively via `go mod tidy`), and the stale comment misled
// Bugbot and humans alike. The lint config in .golangci.yml's `go:`
// key tracks this directive; bump both together when the minimum
// moves again.
go 1.26.0
// Pin the build toolchain to the latest 1.26.x patch so release binaries
// pick up stdlib security fixes (GO-2026-5856 needs go1.26.5; three more
// stdlib CVEs need go1.26.4). Bump this on each Go patch release.
//
// go1.26.6 clears four stdlib vulnerabilities govulncheck reports as CALLED
// from this module — not merely present in the dependency graph:
//
// GO-2026-6090 crypto/tls post-handshake message flood
// <- api.userAgentTransport.RoundTrip, submit.HTTPSubmitter.Submit
// GO-2026-5972 encoding/asn1 unbounded recursion depth
// <- submit.PortForwardJobsManager -> spdy.RoundTripperFor
// GO-2026-5026 net/http x/net/idna Punycode label handling
// <- api.userAgentTransport.RoundTrip, submit.HTTPSubmitter.Submit
// GO-2026-6218 net/url quadratic complexity in resolvePath
// <- submit.HTTPSubmitter.Submit, schema.NewV1Validator
//
// All four are fixed in go1.26.6 and none needs a code or dependency change,
// because every workflow resolves Go through `go-version-file: go.mod` — so
// this line is the whole fix for build.yml, golangci.yml, e2e.yml, mutation.yml,
// release.yml and chart-drift.yml at once.
//
// Found on the 2026-08-14 prod hop: `govulncheck` went red on the main tip and
// the promotion merged anyway, because it is NOT one of this repo's required
// status checks (backend#1972). Making it required is deliberately a SEPARATE
// change, and only after this reaches main — arming that gate first would block
// every promotion on a branch that is still on go1.26.5.
toolchain go1.26.6
require (
github.com/AlecAivazis/survey/v2 v2.3.7
github.com/fatih/color v1.19.0
github.com/santhosh-tekuri/jsonschema/v6 v6.0.3
github.com/schollz/progressbar/v3 v3.19.1
github.com/spf13/cobra v1.10.2
golang.org/x/sys v0.47.0
golang.org/x/term v0.45.0
golang.org/x/text v0.40.0
gopkg.in/yaml.v3 v3.0.1
k8s.io/api v0.36.3
k8s.io/apimachinery v0.36.3
k8s.io/client-go v0.36.3
)
require (
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
github.com/emicklei/go-restful/v3 v3.13.0 // indirect
github.com/fxamacker/cbor/v2 v2.9.0 // indirect
github.com/go-logr/logr v1.4.3 // indirect
github.com/go-openapi/jsonpointer v0.21.0 // indirect
github.com/go-openapi/jsonreference v0.20.2 // indirect
github.com/go-openapi/swag v0.23.0 // indirect
github.com/google/gnostic-models v0.7.0 // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
github.com/mailru/easyjson v0.7.7 // indirect
github.com/mattn/go-colorable v0.1.14 // indirect
github.com/mattn/go-isatty v0.0.22 // indirect
github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b // indirect
github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db // indirect
github.com/moby/spdystream v0.5.1 // indirect
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/rivo/uniseg v0.4.7 // indirect
github.com/spf13/pflag v1.0.9 // indirect
github.com/x448/float16 v0.8.4 // indirect
go.yaml.in/yaml/v2 v2.4.3 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect
golang.org/x/net v0.57.0 // indirect
golang.org/x/oauth2 v0.34.0 // indirect
golang.org/x/time v0.14.0 // indirect
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
k8s.io/klog/v2 v2.140.0 // indirect
k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect
k8s.io/streaming v0.36.3 // indirect
k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 // indirect
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
sigs.k8s.io/randfill v1.0.0 // indirect
sigs.k8s.io/structured-merge-diff/v6 v6.3.3 // indirect
sigs.k8s.io/yaml v1.6.0 // indirect
)