From 0cd0514cfa938002ab0aba5c875147d778463ea7 Mon Sep 17 00:00:00 2001 From: Pedro Gomes Date: Sat, 22 Aug 2026 17:35:20 +0100 Subject: [PATCH] fix(deps): clear the go-git advisories blocking every PR, and pin the toolchain MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit govulncheck has been failing on every open pull request since GO-2026-6213 and GO-2026-6214 were published — both in go-git v6.0.0-alpha.4, both reachable from cmd/inforge/stack.go:217 where ephemeralWorkspace calls auto.NewLocalWorkspace, which reaches dotgit ref handling and worktree checkout. main's last CI run predates the advisories, so main looks green while nothing can merge: Dependabot #286 fails bulwark and therefore PR Gate, and so does everything else open. go-git is an indirect dependency via Pulumi's Automation API, so the bump is explicit: alpha.4 -> alpha.5, which carries go-billy to alpha.2 and x/net to v0.57.0. Build and the full suite pass on it. The toolchain pin is here rather than in a tidy-up of its own because it is the same failure in a different form. go.mod asked for 1.25.11 while five workflow steps pinned 1.26.6, and govulncheck reports against whichever Go actually builds — five of the vulnerabilities it finds locally are standard library issues fixed in 1.26.6, invisible in CI only because CI happens to pin the newer one. Dependabot updates neither number, so the two drift silently and the gap is a security question rather than a tidiness one. Stating it once in go.mod lets every workflow read it through setup-go's go-version-file, which the CI migration then depends on: without a toolchain line, go-version-file resolves to 1.25.11 and would quietly downgrade CI. Verified with bulwark v2.0.0: gosec, govulncheck and semgrep all pass, "no vulnerabilities found". --- go.mod | 13 ++++++++++--- go.sum | 12 ++++++------ 2 files changed, 16 insertions(+), 9 deletions(-) diff --git a/go.mod b/go.mod index 74aee7a..aac61c1 100644 --- a/go.mod +++ b/go.mod @@ -2,6 +2,13 @@ module github.com/wardnet/inforge go 1.25.11 +// Stated once, here. Workflows read it through setup-go's go-version-file +// instead of each restating a version: CI pinned 1.26.6 in five places while +// this file asked only for 1.25.11, and Dependabot updates neither, so the two +// drifted silently. govulncheck reports against whichever Go actually builds, +// which is what makes the drift a security question rather than a tidiness one. +toolchain go1.26.6 + require ( filippo.io/age v1.3.1 github.com/aws/aws-sdk-go-v2 v1.42.1 @@ -70,8 +77,8 @@ require ( github.com/fatih/color v1.19.0 // indirect github.com/fsnotify/fsnotify v1.6.0 // indirect github.com/go-git/gcfg/v2 v2.0.2 // indirect - github.com/go-git/go-billy/v6 v6.0.0-alpha.1 // indirect - github.com/go-git/go-git/v6 v6.0.0-alpha.4 // indirect + github.com/go-git/go-billy/v6 v6.0.0-alpha.2 // indirect + github.com/go-git/go-git/v6 v6.0.0-alpha.5 // indirect github.com/go-logr/logr v1.4.3 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/gogo/protobuf v1.3.2 // indirect @@ -139,7 +146,7 @@ require ( go.uber.org/atomic v1.11.0 // indirect go.uber.org/multierr v1.11.0 // indirect golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect - golang.org/x/net v0.56.0 // indirect + golang.org/x/net v0.57.0 // indirect golang.org/x/sys v0.47.0 // indirect golang.org/x/text v0.40.0 // indirect golang.org/x/tools v0.47.0 // indirect diff --git a/go.sum b/go.sum index 94dab73..199fe18 100644 --- a/go.sum +++ b/go.sum @@ -120,12 +120,12 @@ github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c= github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU= github.com/go-git/gcfg/v2 v2.0.2 h1:MY5SIIfTGGEMhdA7d7JePuVVxtKL7Hp+ApGDJAJ7dpo= github.com/go-git/gcfg/v2 v2.0.2/go.mod h1:/lv2NsxvhepuMrldsFilrgct6pxzpGdSRC13ydTLSLs= -github.com/go-git/go-billy/v6 v6.0.0-alpha.1 h1:xVjAR4oUvrKy7/Xuw/lLlV3gkxR3KO2H8W+MamuVVsQ= -github.com/go-git/go-billy/v6 v6.0.0-alpha.1/go.mod h1:eaCUpHbedW7//EwcYmUDfJe2N6sJC9O12AT0OTqJR1E= +github.com/go-git/go-billy/v6 v6.0.0-alpha.2 h1:1Sv5WemXL8CxKrAx1gioJ+uHNb2bZJhiQLfwSZ4Et8c= +github.com/go-git/go-billy/v6 v6.0.0-alpha.2/go.mod h1:r/bsv9i/iDyyEU8/Z6mjC+YraOVwie1ddfUqBCElKXQ= github.com/go-git/go-git-fixtures/v6 v6.0.0-alpha.1 h1:gmqi2jvsreu0s8JMLylYDFq4sbjHwwlhktMw0DUg3mA= github.com/go-git/go-git-fixtures/v6 v6.0.0-alpha.1/go.mod h1:ECf1MqJlBdYpKggBrOXjo/0EnvRZx6D++I86UYjPgAQ= -github.com/go-git/go-git/v6 v6.0.0-alpha.4 h1:aDTc2UGanmaE7FkGLSlBEB9nohMnQ+RKXcfq/D+esDQ= -github.com/go-git/go-git/v6 v6.0.0-alpha.4/go.mod h1:4ODa/G7hPWrh4Y+7lmt59Ij3zW38IEfvRoAZxLYYBhc= +github.com/go-git/go-git/v6 v6.0.0-alpha.5 h1:sE+OlkHgYWNMVmN1s9sR7uyFgsWLtxcNWse/vBYKxRE= +github.com/go-git/go-git/v6 v6.0.0-alpha.5/go.mod h1:3IjhiZnM+uBmUrOGSeqrJpsmi4Vd0H2NZO/uK2a7d0s= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= @@ -351,8 +351,8 @@ golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLL golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200421231249-e086a090c8fd/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= -golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o= -golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec= +golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= +golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=