From 5feea37d26d0c34122a807a63326020830a5a1fa Mon Sep 17 00:00:00 2001 From: lxtan Date: Sun, 8 Nov 2026 14:35:38 +0800 Subject: [PATCH] fix(deps): bump Go toolchain to 1.27.3 and patch vulnerable modules `govulncheck` on Linux flagged reachable standard-library and module vulnerabilities, which made every open dependabot PR fail the "Check known vulnerabilities" step. - `go` directive 1.26.6 -> 1.27.3 (GO-2026-6809 and GO-2026-6603/6605/ 6607/6608/6609/6610/6611/6612/6613/6617 in the standard library) - github.com/andybalholm/brotli v1.0.6 -> v1.2.7 (GO-2026-6888) - github.com/klauspost/compress v1.17.4 -> v1.20.2 (GO-2026-6865) - golang.org/x/net v0.59.0 -> v0.60.0 (GO-2026-6603/6611/6612/6613) - reformat internal/ja3proxy/traffic/io.go for the Go 1.27 formatter, which the CI `gofmt` check now enforces Validation: - `gofmt -l .` clean - `go build -trimpath ./...` - `go vet ./...` - `go test -count=1 ./...` (all packages pass) - `govulncheck ./...` reports 0 reachable vulnerabilities --- go.mod | 8 ++++---- go.sum | 14 ++++++++------ internal/ja3proxy/traffic/io.go | 16 ++++++++-------- 3 files changed, 20 insertions(+), 18 deletions(-) diff --git a/go.mod b/go.mod index b3044f1..56abce0 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/lylemi/ja3proxy -go 1.26.6 +go 1.27.3 require ( github.com/charmbracelet/bubbles v1.0.0 @@ -8,11 +8,11 @@ require ( github.com/charmbracelet/lipgloss v1.1.0 github.com/cloudflare/cfssl v1.6.5 github.com/refraction-networking/utls v1.8.2 - golang.org/x/net v0.59.0 + golang.org/x/net v0.60.0 ) require ( - github.com/andybalholm/brotli v1.0.6 // indirect + github.com/andybalholm/brotli v1.2.7 // indirect github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect github.com/charmbracelet/colorprofile v0.4.1 // indirect github.com/charmbracelet/x/ansi v0.11.6 // indirect @@ -25,7 +25,7 @@ require ( github.com/go-logr/logr v1.2.4 // indirect github.com/google/certificate-transparency-go v1.1.7 // indirect github.com/jmoiron/sqlx v1.3.5 // indirect - github.com/klauspost/compress v1.17.4 // indirect + github.com/klauspost/compress v1.20.2 // indirect github.com/lucasb-eyer/go-colorful v1.3.0 // indirect github.com/mattn/go-isatty v0.0.20 // indirect github.com/mattn/go-localereader v0.0.1 // indirect diff --git a/go.sum b/go.sum index 0f59862..fc2198e 100644 --- a/go.sum +++ b/go.sum @@ -1,5 +1,5 @@ -github.com/andybalholm/brotli v1.0.6 h1:Yf9fFpf49Zrxb9NlQaluyE92/+X7UVHlhMNJN2sxfOI= -github.com/andybalholm/brotli v1.0.6/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig= +github.com/andybalholm/brotli v1.2.7 h1:UgafRPGMam5ySHfRkhthMqOFA6IFoeF3D7mWIDLjG5A= +github.com/andybalholm/brotli v1.2.7/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY= github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k= github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8= github.com/aymanbagabas/go-udiff v0.3.1 h1:LV+qyBQ2pqe0u42ZsUEtPiCaUoqgA9gYRDs3vj1nolY= @@ -45,8 +45,8 @@ github.com/google/go-github v17.0.0+incompatible/go.mod h1:zLgOLi98H3fifZn+44m+u github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck= github.com/jmoiron/sqlx v1.3.5 h1:vFFPA71p1o5gAeqtEAwLU4dnX2napprKtHr7PYIcN3g= github.com/jmoiron/sqlx v1.3.5/go.mod h1:nRVWtLre0KfCLJvgxzCsLVMogSvQ1zNJtpYr2Ccp0mQ= -github.com/klauspost/compress v1.17.4 h1:Ej5ixsIri7BrIjBkRZLTo6ghwrEtHFk7ijlczPW4fZ4= -github.com/klauspost/compress v1.17.4/go.mod h1:/dCuZOvVtNoHsyb+cuJD3itjs3NbnF6KH9zAO4BDxPM= +github.com/klauspost/compress v1.20.2 h1:v5tiZvm1KGLyg5d5oXdXe3lsSPrbEUiKoXGia//I7Qo= +github.com/klauspost/compress v1.20.2/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI= github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ= github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ= github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI= @@ -99,6 +99,8 @@ github.com/weppos/publicsuffix-go v0.30.0/go.mod h1:kBi8zwYnR0zrbm8RcuN1o9Fzgpnn github.com/weppos/publicsuffix-go/publicsuffix/generator v0.0.0-20220927085643-dc0d00c92642/go.mod h1:GHfoeIdZLdZmLjMlzBftbTDntahTttUMWjxZwQJhULE= github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no= github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM= +github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU= +github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E= github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= github.com/zmap/rc2 v0.0.0-20131011165748-24b9757f5521/go.mod h1:3YZ9o3WnatTIZhuOtot4IcUfzoKVjUHqu6WALIyI0nE= github.com/zmap/rc2 v0.0.0-20190804163417-abaa70531248/go.mod h1:3YZ9o3WnatTIZhuOtot4IcUfzoKVjUHqu6WALIyI0nE= @@ -134,8 +136,8 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc= -golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues= -golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= diff --git a/internal/ja3proxy/traffic/io.go b/internal/ja3proxy/traffic/io.go index 4239a92..af131f5 100644 --- a/internal/ja3proxy/traffic/io.go +++ b/internal/ja3proxy/traffic/io.go @@ -28,14 +28,14 @@ func wrapTrafficTunnel(session *TrafficSessionHandle, destConn net.Conn, clientC return destConn, clientConn } return &trafficReadConn{ - Conn: destConn, - session: session, - direction: trafficDirectionDownload, - }, &trafficReadConn{ - Conn: clientConn, - session: session, - direction: trafficDirectionUpload, - } + Conn: destConn, + session: session, + direction: trafficDirectionDownload, + }, &trafficReadConn{ + Conn: clientConn, + session: session, + direction: trafficDirectionUpload, + } } func WrapTunnel(session *TrafficSessionHandle, destConn net.Conn, clientConn net.Conn) (net.Conn, net.Conn) {