2025-12-03 19:29:37 +00:00
|
|
|
module veza-backend-api
|
|
|
|
|
|
fix(deps): bump vulnerable modules to unblock govulncheck CI
Backend (Go) CI has been red for the entire v1.0.4 cleanup sprint (and
before it) because govulncheck reports 7 vulnerabilities in transitive
test-infrastructure deps, while the test suite itself passes cleanly.
Bump three direct dependencies to pull fixed versions of the affected
modules.
Direct bumps:
golang.org/x/image v0.36.0 → v0.38.0 (GO-2026-4815)
github.com/quic-go/quic-go v0.54.0 → v0.57.0 (GO-2025-4233)
github.com/testcontainers/testcontainers-go v0.33.0 → v0.42.0
github.com/testcontainers/testcontainers-go/modules/postgres
v0.33.0 → v0.42.0
Indirect / transitive side effects:
- containerd/containerd v1.7.18 is REMOVED from the dependency graph.
Newer testcontainers-go depends on containerd/errdefs + log +
platforms sub-packages only, which do not carry GO-2025-4108 /
GO-2025-4100 / GO-2025-3528.
- docker/docker v27.1.1 is REMOVED from the dependency graph for the
same reason — it was reached only via testcontainers-go, and the
new version no longer pulls the full Moby engine. This eliminates
GO-2026-4887 and GO-2026-4883 (the two vulns with no upstream fix)
WITHOUT needing a govulncheck allowlist/exclude wrapper.
- quic-go/qpack, x/crypto, x/net, x/sync, x/sys, x/text, x/tools and
a handful of otel-* modules bumped as a coherent set.
- Transitive opentelemetry bump (otel v1.24.0 → v1.41.0) is expected
since testcontainers-go v0.42 pulls a newer instrumentation.
All 7 vulnerabilities previously reported are now resolved:
GO-2026-4887 docker/docker — vuln module removed
GO-2026-4883 docker/docker — vuln module removed
GO-2026-4815 x/image — fixed in v0.38.0
GO-2025-4233 quic-go — fixed in v0.57.0
GO-2025-4108 containerd — vuln module removed
GO-2025-4100 containerd — vuln module removed
GO-2025-3528 containerd — vuln module removed
Verification (local):
go build ./... OK
go vet ./... OK
govulncheck ./... OK (no findings)
VEZA_SKIP_INTEGRATION=1 go test ./internal/... -short OK
No breaking API changes observed from the testcontainers-go v0.33 →
v0.42 bump (the project only uses GenericContainer, DockerContainer
.Terminate, and modules/postgres which are stable across these
versions). The shared Redis testcontainer helper in internal/testutils
and the hard-delete worker integration test from J4 still compile and
pass.
This commit enables the v1.0.4 tag to be cut on a green CI. No J7
(release) commit is part of this change — that ships separately.
Refs: AUDIT_REPORT.md §10 P5 (test infra hygiene), CI run 98
2026-04-15 12:38:48 +00:00
|
|
|
go 1.25.0
|
2025-12-03 19:29:37 +00:00
|
|
|
|
|
|
|
|
require (
|
fix(deps): bump vulnerable modules to unblock govulncheck CI
Backend (Go) CI has been red for the entire v1.0.4 cleanup sprint (and
before it) because govulncheck reports 7 vulnerabilities in transitive
test-infrastructure deps, while the test suite itself passes cleanly.
Bump three direct dependencies to pull fixed versions of the affected
modules.
Direct bumps:
golang.org/x/image v0.36.0 → v0.38.0 (GO-2026-4815)
github.com/quic-go/quic-go v0.54.0 → v0.57.0 (GO-2025-4233)
github.com/testcontainers/testcontainers-go v0.33.0 → v0.42.0
github.com/testcontainers/testcontainers-go/modules/postgres
v0.33.0 → v0.42.0
Indirect / transitive side effects:
- containerd/containerd v1.7.18 is REMOVED from the dependency graph.
Newer testcontainers-go depends on containerd/errdefs + log +
platforms sub-packages only, which do not carry GO-2025-4108 /
GO-2025-4100 / GO-2025-3528.
- docker/docker v27.1.1 is REMOVED from the dependency graph for the
same reason — it was reached only via testcontainers-go, and the
new version no longer pulls the full Moby engine. This eliminates
GO-2026-4887 and GO-2026-4883 (the two vulns with no upstream fix)
WITHOUT needing a govulncheck allowlist/exclude wrapper.
- quic-go/qpack, x/crypto, x/net, x/sync, x/sys, x/text, x/tools and
a handful of otel-* modules bumped as a coherent set.
- Transitive opentelemetry bump (otel v1.24.0 → v1.41.0) is expected
since testcontainers-go v0.42 pulls a newer instrumentation.
All 7 vulnerabilities previously reported are now resolved:
GO-2026-4887 docker/docker — vuln module removed
GO-2026-4883 docker/docker — vuln module removed
GO-2026-4815 x/image — fixed in v0.38.0
GO-2025-4233 quic-go — fixed in v0.57.0
GO-2025-4108 containerd — vuln module removed
GO-2025-4100 containerd — vuln module removed
GO-2025-3528 containerd — vuln module removed
Verification (local):
go build ./... OK
go vet ./... OK
govulncheck ./... OK (no findings)
VEZA_SKIP_INTEGRATION=1 go test ./internal/... -short OK
No breaking API changes observed from the testcontainers-go v0.33 →
v0.42 bump (the project only uses GenericContainer, DockerContainer
.Terminate, and modules/postgres which are stable across these
versions). The shared Redis testcontainer helper in internal/testutils
and the hard-delete worker integration test from J4 still compile and
pass.
This commit enables the v1.0.4 tag to be cut on a green CI. No J7
(release) commit is part of this change — that ships separately.
Refs: AUDIT_REPORT.md §10 P5 (test infra hygiene), CI run 98
2026-04-15 12:38:48 +00:00
|
|
|
github.com/BurntSushi/toml v1.6.0
|
2025-12-29 18:23:23 +00:00
|
|
|
github.com/DATA-DOG/go-sqlmock v1.5.2
|
2026-02-22 16:53:10 +00:00
|
|
|
github.com/SherClockHolmes/webpush-go v1.4.0
|
2025-12-28 11:19:34 +00:00
|
|
|
github.com/aws/aws-sdk-go-v2 v1.41.0
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/config v1.32.6
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/credentials v1.19.6
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.18
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/service/s3 v1.95.0
|
2026-02-22 16:53:10 +00:00
|
|
|
github.com/coder/websocket v1.8.14
|
2025-12-03 19:29:37 +00:00
|
|
|
github.com/dhowden/tag v0.0.0-20240417053706-3d75831295e8
|
|
|
|
|
github.com/disintegration/imaging v1.6.2
|
fix(deps): bump vulnerable modules to unblock govulncheck CI
Backend (Go) CI has been red for the entire v1.0.4 cleanup sprint (and
before it) because govulncheck reports 7 vulnerabilities in transitive
test-infrastructure deps, while the test suite itself passes cleanly.
Bump three direct dependencies to pull fixed versions of the affected
modules.
Direct bumps:
golang.org/x/image v0.36.0 → v0.38.0 (GO-2026-4815)
github.com/quic-go/quic-go v0.54.0 → v0.57.0 (GO-2025-4233)
github.com/testcontainers/testcontainers-go v0.33.0 → v0.42.0
github.com/testcontainers/testcontainers-go/modules/postgres
v0.33.0 → v0.42.0
Indirect / transitive side effects:
- containerd/containerd v1.7.18 is REMOVED from the dependency graph.
Newer testcontainers-go depends on containerd/errdefs + log +
platforms sub-packages only, which do not carry GO-2025-4108 /
GO-2025-4100 / GO-2025-3528.
- docker/docker v27.1.1 is REMOVED from the dependency graph for the
same reason — it was reached only via testcontainers-go, and the
new version no longer pulls the full Moby engine. This eliminates
GO-2026-4887 and GO-2026-4883 (the two vulns with no upstream fix)
WITHOUT needing a govulncheck allowlist/exclude wrapper.
- quic-go/qpack, x/crypto, x/net, x/sync, x/sys, x/text, x/tools and
a handful of otel-* modules bumped as a coherent set.
- Transitive opentelemetry bump (otel v1.24.0 → v1.41.0) is expected
since testcontainers-go v0.42 pulls a newer instrumentation.
All 7 vulnerabilities previously reported are now resolved:
GO-2026-4887 docker/docker — vuln module removed
GO-2026-4883 docker/docker — vuln module removed
GO-2026-4815 x/image — fixed in v0.38.0
GO-2025-4233 quic-go — fixed in v0.57.0
GO-2025-4108 containerd — vuln module removed
GO-2025-4100 containerd — vuln module removed
GO-2025-3528 containerd — vuln module removed
Verification (local):
go build ./... OK
go vet ./... OK
govulncheck ./... OK (no findings)
VEZA_SKIP_INTEGRATION=1 go test ./internal/... -short OK
No breaking API changes observed from the testcontainers-go v0.33 →
v0.42 bump (the project only uses GenericContainer, DockerContainer
.Terminate, and modules/postgres which are stable across these
versions). The shared Redis testcontainer helper in internal/testutils
and the hard-delete worker integration test from J4 still compile and
pass.
This commit enables the v1.0.4 tag to be cut on a green CI. No J7
(release) commit is part of this change — that ships separately.
Refs: AUDIT_REPORT.md §10 P5 (test infra hygiene), CI run 98
2026-04-15 12:38:48 +00:00
|
|
|
github.com/elastic/go-elasticsearch/v8 v8.11.0
|
2025-12-03 19:29:37 +00:00
|
|
|
github.com/fsnotify/fsnotify v1.9.0
|
2025-12-06 13:45:07 +00:00
|
|
|
github.com/getsentry/sentry-go v0.40.0
|
2026-02-11 20:31:00 +00:00
|
|
|
github.com/gin-gonic/gin v1.11.0
|
2026-02-22 16:53:10 +00:00
|
|
|
github.com/go-pdf/fpdf v0.9.0
|
2026-02-11 20:31:00 +00:00
|
|
|
github.com/go-playground/validator/v10 v10.27.0
|
2025-12-03 19:29:37 +00:00
|
|
|
github.com/golang-jwt/jwt/v5 v5.3.0
|
|
|
|
|
github.com/google/uuid v1.6.0
|
|
|
|
|
github.com/joho/godotenv v1.5.1
|
|
|
|
|
github.com/lib/pq v1.10.9
|
|
|
|
|
github.com/pquerna/otp v1.5.0
|
|
|
|
|
github.com/prometheus/client_golang v1.22.0
|
|
|
|
|
github.com/prometheus/client_model v0.6.2
|
2025-12-28 11:19:34 +00:00
|
|
|
github.com/prometheus/common v0.63.0
|
2025-12-03 19:29:37 +00:00
|
|
|
github.com/rabbitmq/amqp091-go v1.10.0
|
|
|
|
|
github.com/redis/go-redis/v9 v9.16.0
|
2025-12-16 16:23:49 +00:00
|
|
|
github.com/sony/gobreaker v1.0.0
|
2025-12-03 19:29:37 +00:00
|
|
|
github.com/stretchr/testify v1.11.1
|
2026-03-06 09:02:53 +00:00
|
|
|
github.com/stripe/stripe-go/v82 v82.5.1
|
2025-12-03 19:29:37 +00:00
|
|
|
github.com/swaggo/files v1.0.1
|
|
|
|
|
github.com/swaggo/gin-swagger v1.6.1
|
|
|
|
|
github.com/swaggo/swag v1.16.6
|
fix(deps): bump vulnerable modules to unblock govulncheck CI
Backend (Go) CI has been red for the entire v1.0.4 cleanup sprint (and
before it) because govulncheck reports 7 vulnerabilities in transitive
test-infrastructure deps, while the test suite itself passes cleanly.
Bump three direct dependencies to pull fixed versions of the affected
modules.
Direct bumps:
golang.org/x/image v0.36.0 → v0.38.0 (GO-2026-4815)
github.com/quic-go/quic-go v0.54.0 → v0.57.0 (GO-2025-4233)
github.com/testcontainers/testcontainers-go v0.33.0 → v0.42.0
github.com/testcontainers/testcontainers-go/modules/postgres
v0.33.0 → v0.42.0
Indirect / transitive side effects:
- containerd/containerd v1.7.18 is REMOVED from the dependency graph.
Newer testcontainers-go depends on containerd/errdefs + log +
platforms sub-packages only, which do not carry GO-2025-4108 /
GO-2025-4100 / GO-2025-3528.
- docker/docker v27.1.1 is REMOVED from the dependency graph for the
same reason — it was reached only via testcontainers-go, and the
new version no longer pulls the full Moby engine. This eliminates
GO-2026-4887 and GO-2026-4883 (the two vulns with no upstream fix)
WITHOUT needing a govulncheck allowlist/exclude wrapper.
- quic-go/qpack, x/crypto, x/net, x/sync, x/sys, x/text, x/tools and
a handful of otel-* modules bumped as a coherent set.
- Transitive opentelemetry bump (otel v1.24.0 → v1.41.0) is expected
since testcontainers-go v0.42 pulls a newer instrumentation.
All 7 vulnerabilities previously reported are now resolved:
GO-2026-4887 docker/docker — vuln module removed
GO-2026-4883 docker/docker — vuln module removed
GO-2026-4815 x/image — fixed in v0.38.0
GO-2025-4233 quic-go — fixed in v0.57.0
GO-2025-4108 containerd — vuln module removed
GO-2025-4100 containerd — vuln module removed
GO-2025-3528 containerd — vuln module removed
Verification (local):
go build ./... OK
go vet ./... OK
govulncheck ./... OK (no findings)
VEZA_SKIP_INTEGRATION=1 go test ./internal/... -short OK
No breaking API changes observed from the testcontainers-go v0.33 →
v0.42 bump (the project only uses GenericContainer, DockerContainer
.Terminate, and modules/postgres which are stable across these
versions). The shared Redis testcontainer helper in internal/testutils
and the hard-delete worker integration test from J4 still compile and
pass.
This commit enables the v1.0.4 tag to be cut on a green CI. No J7
(release) commit is part of this change — that ships separately.
Refs: AUDIT_REPORT.md §10 P5 (test infra hygiene), CI run 98
2026-04-15 12:38:48 +00:00
|
|
|
github.com/testcontainers/testcontainers-go v0.42.0
|
|
|
|
|
github.com/testcontainers/testcontainers-go/modules/postgres v0.42.0
|
feat(observability): OTel SDK + collector + Tempo + 4 hot path spans (W2 Day 9)
Wires distributed tracing end-to-end. Backend exports OTLP/gRPC to a
collector, which tail-samples (errors + slow always, 10% rest) and
ships to Tempo. Grafana service-map dashboard pivots on the 4
instrumented hot paths.
- internal/tracing/otlp_exporter.go : InitOTLPTracer + Provider.Shutdown,
BatchSpanProcessor (5s/512 batch), ParentBased(TraceIDRatio) sampler,
W3C trace-context + baggage propagators. OTEL_SDK_DISABLED=true
short-circuits to a no-op. Failure to dial collector is non-fatal.
- cmd/api/main.go : init at boot, defer Shutdown(5s) on exit. appVersion
ldflag-overridable for resource attributes.
- 4 hot paths instrumented :
* handlers/auth.go::Login → "auth.login"
* core/track/track_upload_handler.go::InitiateChunkedUpload → "track.upload.initiate"
* core/marketplace/service.go::ProcessPaymentWebhook → "payment.webhook"
* handlers/search_handlers.go::Search → "search.query"
PII guarded — email masked, query content not recorded (length only).
- infra/ansible/roles/otel_collector : pin v0.116.1 contrib build,
systemd unit, tail-sampling config (errors + > 500ms always kept).
- infra/ansible/roles/tempo : pin v2.7.1 monolithic, local-disk backend
(S3 deferred to v1.1), 14d retention.
- infra/ansible/playbooks/observability.yml : provisions both Incus
containers + applies common baseline + roles in order.
- inventory/lab.yml : new groups observability, otel_collectors, tempo.
- config/grafana/dashboards/service-map.json : node graph + 4 hot-path
span tables + collector throughput/queue panels.
- docs/ENV_VARIABLES.md §30 : 4 OTEL_* env vars documented.
Acceptance criterion (Day 9) : login → span visible in Tempo UI. Lab
deployment to validate with `ansible-playbook -i inventory/lab.yml
playbooks/observability.yml` once roles/postgres_ha is up.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-27 23:15:11 +00:00
|
|
|
go.opentelemetry.io/otel v1.43.0
|
|
|
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0
|
|
|
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0
|
|
|
|
|
go.opentelemetry.io/otel/sdk v1.43.0
|
fix(deps): bump vulnerable modules to unblock govulncheck CI
Backend (Go) CI has been red for the entire v1.0.4 cleanup sprint (and
before it) because govulncheck reports 7 vulnerabilities in transitive
test-infrastructure deps, while the test suite itself passes cleanly.
Bump three direct dependencies to pull fixed versions of the affected
modules.
Direct bumps:
golang.org/x/image v0.36.0 → v0.38.0 (GO-2026-4815)
github.com/quic-go/quic-go v0.54.0 → v0.57.0 (GO-2025-4233)
github.com/testcontainers/testcontainers-go v0.33.0 → v0.42.0
github.com/testcontainers/testcontainers-go/modules/postgres
v0.33.0 → v0.42.0
Indirect / transitive side effects:
- containerd/containerd v1.7.18 is REMOVED from the dependency graph.
Newer testcontainers-go depends on containerd/errdefs + log +
platforms sub-packages only, which do not carry GO-2025-4108 /
GO-2025-4100 / GO-2025-3528.
- docker/docker v27.1.1 is REMOVED from the dependency graph for the
same reason — it was reached only via testcontainers-go, and the
new version no longer pulls the full Moby engine. This eliminates
GO-2026-4887 and GO-2026-4883 (the two vulns with no upstream fix)
WITHOUT needing a govulncheck allowlist/exclude wrapper.
- quic-go/qpack, x/crypto, x/net, x/sync, x/sys, x/text, x/tools and
a handful of otel-* modules bumped as a coherent set.
- Transitive opentelemetry bump (otel v1.24.0 → v1.41.0) is expected
since testcontainers-go v0.42 pulls a newer instrumentation.
All 7 vulnerabilities previously reported are now resolved:
GO-2026-4887 docker/docker — vuln module removed
GO-2026-4883 docker/docker — vuln module removed
GO-2026-4815 x/image — fixed in v0.38.0
GO-2025-4233 quic-go — fixed in v0.57.0
GO-2025-4108 containerd — vuln module removed
GO-2025-4100 containerd — vuln module removed
GO-2025-3528 containerd — vuln module removed
Verification (local):
go build ./... OK
go vet ./... OK
govulncheck ./... OK (no findings)
VEZA_SKIP_INTEGRATION=1 go test ./internal/... -short OK
No breaking API changes observed from the testcontainers-go v0.33 →
v0.42 bump (the project only uses GenericContainer, DockerContainer
.Terminate, and modules/postgres which are stable across these
versions). The shared Redis testcontainer helper in internal/testutils
and the hard-delete worker integration test from J4 still compile and
pass.
This commit enables the v1.0.4 tag to be cut on a green CI. No J7
(release) commit is part of this change — that ships separately.
Refs: AUDIT_REPORT.md §10 P5 (test infra hygiene), CI run 98
2026-04-15 12:38:48 +00:00
|
|
|
go.uber.org/goleak v1.3.0
|
2025-12-03 19:29:37 +00:00
|
|
|
go.uber.org/zap v1.27.0
|
feat(observability): OTel SDK + collector + Tempo + 4 hot path spans (W2 Day 9)
Wires distributed tracing end-to-end. Backend exports OTLP/gRPC to a
collector, which tail-samples (errors + slow always, 10% rest) and
ships to Tempo. Grafana service-map dashboard pivots on the 4
instrumented hot paths.
- internal/tracing/otlp_exporter.go : InitOTLPTracer + Provider.Shutdown,
BatchSpanProcessor (5s/512 batch), ParentBased(TraceIDRatio) sampler,
W3C trace-context + baggage propagators. OTEL_SDK_DISABLED=true
short-circuits to a no-op. Failure to dial collector is non-fatal.
- cmd/api/main.go : init at boot, defer Shutdown(5s) on exit. appVersion
ldflag-overridable for resource attributes.
- 4 hot paths instrumented :
* handlers/auth.go::Login → "auth.login"
* core/track/track_upload_handler.go::InitiateChunkedUpload → "track.upload.initiate"
* core/marketplace/service.go::ProcessPaymentWebhook → "payment.webhook"
* handlers/search_handlers.go::Search → "search.query"
PII guarded — email masked, query content not recorded (length only).
- infra/ansible/roles/otel_collector : pin v0.116.1 contrib build,
systemd unit, tail-sampling config (errors + > 500ms always kept).
- infra/ansible/roles/tempo : pin v2.7.1 monolithic, local-disk backend
(S3 deferred to v1.1), 14d retention.
- infra/ansible/playbooks/observability.yml : provisions both Incus
containers + applies common baseline + roles in order.
- inventory/lab.yml : new groups observability, otel_collectors, tempo.
- config/grafana/dashboards/service-map.json : node graph + 4 hot-path
span tables + collector throughput/queue panels.
- docs/ENV_VARIABLES.md §30 : 4 OTEL_* env vars documented.
Acceptance criterion (Day 9) : login → span visible in Tempo UI. Lab
deployment to validate with `ansible-playbook -i inventory/lab.yml
playbooks/observability.yml` once roles/postgres_ha is up.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-27 23:15:11 +00:00
|
|
|
golang.org/x/crypto v0.49.0
|
|
|
|
|
golang.org/x/oauth2 v0.35.0
|
2025-12-03 19:29:37 +00:00
|
|
|
golang.org/x/time v0.12.0
|
|
|
|
|
gopkg.in/natefinch/lumberjack.v2 v2.2.1
|
|
|
|
|
gorm.io/driver/postgres v1.6.0
|
|
|
|
|
gorm.io/driver/sqlite v1.6.0
|
|
|
|
|
gorm.io/gorm v1.30.0
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
require (
|
feat(observability): OTel SDK + collector + Tempo + 4 hot path spans (W2 Day 9)
Wires distributed tracing end-to-end. Backend exports OTLP/gRPC to a
collector, which tail-samples (errors + slow always, 10% rest) and
ships to Tempo. Grafana service-map dashboard pivots on the 4
instrumented hot paths.
- internal/tracing/otlp_exporter.go : InitOTLPTracer + Provider.Shutdown,
BatchSpanProcessor (5s/512 batch), ParentBased(TraceIDRatio) sampler,
W3C trace-context + baggage propagators. OTEL_SDK_DISABLED=true
short-circuits to a no-op. Failure to dial collector is non-fatal.
- cmd/api/main.go : init at boot, defer Shutdown(5s) on exit. appVersion
ldflag-overridable for resource attributes.
- 4 hot paths instrumented :
* handlers/auth.go::Login → "auth.login"
* core/track/track_upload_handler.go::InitiateChunkedUpload → "track.upload.initiate"
* core/marketplace/service.go::ProcessPaymentWebhook → "payment.webhook"
* handlers/search_handlers.go::Search → "search.query"
PII guarded — email masked, query content not recorded (length only).
- infra/ansible/roles/otel_collector : pin v0.116.1 contrib build,
systemd unit, tail-sampling config (errors + > 500ms always kept).
- infra/ansible/roles/tempo : pin v2.7.1 monolithic, local-disk backend
(S3 deferred to v1.1), 14d retention.
- infra/ansible/playbooks/observability.yml : provisions both Incus
containers + applies common baseline + roles in order.
- inventory/lab.yml : new groups observability, otel_collectors, tempo.
- config/grafana/dashboards/service-map.json : node graph + 4 hot-path
span tables + collector throughput/queue panels.
- docs/ENV_VARIABLES.md §30 : 4 OTEL_* env vars documented.
Acceptance criterion (Day 9) : login → span visible in Tempo UI. Lab
deployment to validate with `ansible-playbook -i inventory/lab.yml
playbooks/observability.yml` once roles/postgres_ha is up.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-27 23:15:11 +00:00
|
|
|
cloud.google.com/go/compute/metadata v0.9.0 // indirect
|
fix(deps): bump vulnerable modules to unblock govulncheck CI
Backend (Go) CI has been red for the entire v1.0.4 cleanup sprint (and
before it) because govulncheck reports 7 vulnerabilities in transitive
test-infrastructure deps, while the test suite itself passes cleanly.
Bump three direct dependencies to pull fixed versions of the affected
modules.
Direct bumps:
golang.org/x/image v0.36.0 → v0.38.0 (GO-2026-4815)
github.com/quic-go/quic-go v0.54.0 → v0.57.0 (GO-2025-4233)
github.com/testcontainers/testcontainers-go v0.33.0 → v0.42.0
github.com/testcontainers/testcontainers-go/modules/postgres
v0.33.0 → v0.42.0
Indirect / transitive side effects:
- containerd/containerd v1.7.18 is REMOVED from the dependency graph.
Newer testcontainers-go depends on containerd/errdefs + log +
platforms sub-packages only, which do not carry GO-2025-4108 /
GO-2025-4100 / GO-2025-3528.
- docker/docker v27.1.1 is REMOVED from the dependency graph for the
same reason — it was reached only via testcontainers-go, and the
new version no longer pulls the full Moby engine. This eliminates
GO-2026-4887 and GO-2026-4883 (the two vulns with no upstream fix)
WITHOUT needing a govulncheck allowlist/exclude wrapper.
- quic-go/qpack, x/crypto, x/net, x/sync, x/sys, x/text, x/tools and
a handful of otel-* modules bumped as a coherent set.
- Transitive opentelemetry bump (otel v1.24.0 → v1.41.0) is expected
since testcontainers-go v0.42 pulls a newer instrumentation.
All 7 vulnerabilities previously reported are now resolved:
GO-2026-4887 docker/docker — vuln module removed
GO-2026-4883 docker/docker — vuln module removed
GO-2026-4815 x/image — fixed in v0.38.0
GO-2025-4233 quic-go — fixed in v0.57.0
GO-2025-4108 containerd — vuln module removed
GO-2025-4100 containerd — vuln module removed
GO-2025-3528 containerd — vuln module removed
Verification (local):
go build ./... OK
go vet ./... OK
govulncheck ./... OK (no findings)
VEZA_SKIP_INTEGRATION=1 go test ./internal/... -short OK
No breaking API changes observed from the testcontainers-go v0.33 →
v0.42 bump (the project only uses GenericContainer, DockerContainer
.Terminate, and modules/postgres which are stable across these
versions). The shared Redis testcontainer helper in internal/testutils
and the hard-delete worker integration test from J4 still compile and
pass.
This commit enables the v1.0.4 tag to be cut on a green CI. No J7
(release) commit is part of this change — that ships separately.
Refs: AUDIT_REPORT.md §10 P5 (test infra hygiene), CI run 98
2026-04-15 12:38:48 +00:00
|
|
|
dario.cat/mergo v1.0.2 // indirect
|
|
|
|
|
github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
|
2025-12-03 19:29:37 +00:00
|
|
|
github.com/KyleBanks/depth v1.2.1 // indirect
|
|
|
|
|
github.com/Microsoft/go-winio v0.6.2 // indirect
|
|
|
|
|
github.com/PuerkitoBio/purell v1.1.1 // indirect
|
|
|
|
|
github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect
|
2025-12-24 15:28:51 +00:00
|
|
|
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 // indirect
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.16 // indirect
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.16 // indirect
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.16 // indirect
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.16 // indirect
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 // indirect
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.7 // indirect
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.16 // indirect
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.16 // indirect
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/service/signin v1.0.4 // indirect
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/service/sso v1.30.8 // indirect
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.12 // indirect
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/service/sts v1.41.5 // indirect
|
|
|
|
|
github.com/aws/smithy-go v1.24.0 // indirect
|
2025-12-03 19:29:37 +00:00
|
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
2026-02-22 15:11:42 +00:00
|
|
|
github.com/boombuler/barcode v1.0.1 // indirect
|
2026-02-11 20:31:00 +00:00
|
|
|
github.com/bytedance/sonic v1.14.0 // indirect
|
|
|
|
|
github.com/bytedance/sonic/loader v0.3.0 // indirect
|
fix(deps): bump vulnerable modules to unblock govulncheck CI
Backend (Go) CI has been red for the entire v1.0.4 cleanup sprint (and
before it) because govulncheck reports 7 vulnerabilities in transitive
test-infrastructure deps, while the test suite itself passes cleanly.
Bump three direct dependencies to pull fixed versions of the affected
modules.
Direct bumps:
golang.org/x/image v0.36.0 → v0.38.0 (GO-2026-4815)
github.com/quic-go/quic-go v0.54.0 → v0.57.0 (GO-2025-4233)
github.com/testcontainers/testcontainers-go v0.33.0 → v0.42.0
github.com/testcontainers/testcontainers-go/modules/postgres
v0.33.0 → v0.42.0
Indirect / transitive side effects:
- containerd/containerd v1.7.18 is REMOVED from the dependency graph.
Newer testcontainers-go depends on containerd/errdefs + log +
platforms sub-packages only, which do not carry GO-2025-4108 /
GO-2025-4100 / GO-2025-3528.
- docker/docker v27.1.1 is REMOVED from the dependency graph for the
same reason — it was reached only via testcontainers-go, and the
new version no longer pulls the full Moby engine. This eliminates
GO-2026-4887 and GO-2026-4883 (the two vulns with no upstream fix)
WITHOUT needing a govulncheck allowlist/exclude wrapper.
- quic-go/qpack, x/crypto, x/net, x/sync, x/sys, x/text, x/tools and
a handful of otel-* modules bumped as a coherent set.
- Transitive opentelemetry bump (otel v1.24.0 → v1.41.0) is expected
since testcontainers-go v0.42 pulls a newer instrumentation.
All 7 vulnerabilities previously reported are now resolved:
GO-2026-4887 docker/docker — vuln module removed
GO-2026-4883 docker/docker — vuln module removed
GO-2026-4815 x/image — fixed in v0.38.0
GO-2025-4233 quic-go — fixed in v0.57.0
GO-2025-4108 containerd — vuln module removed
GO-2025-4100 containerd — vuln module removed
GO-2025-3528 containerd — vuln module removed
Verification (local):
go build ./... OK
go vet ./... OK
govulncheck ./... OK (no findings)
VEZA_SKIP_INTEGRATION=1 go test ./internal/... -short OK
No breaking API changes observed from the testcontainers-go v0.33 →
v0.42 bump (the project only uses GenericContainer, DockerContainer
.Terminate, and modules/postgres which are stable across these
versions). The shared Redis testcontainer helper in internal/testutils
and the hard-delete worker integration test from J4 still compile and
pass.
This commit enables the v1.0.4 tag to be cut on a green CI. No J7
(release) commit is part of this change — that ships separately.
Refs: AUDIT_REPORT.md §10 P5 (test infra hygiene), CI run 98
2026-04-15 12:38:48 +00:00
|
|
|
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
|
feat(observability): OTel SDK + collector + Tempo + 4 hot path spans (W2 Day 9)
Wires distributed tracing end-to-end. Backend exports OTLP/gRPC to a
collector, which tail-samples (errors + slow always, 10% rest) and
ships to Tempo. Grafana service-map dashboard pivots on the 4
instrumented hot paths.
- internal/tracing/otlp_exporter.go : InitOTLPTracer + Provider.Shutdown,
BatchSpanProcessor (5s/512 batch), ParentBased(TraceIDRatio) sampler,
W3C trace-context + baggage propagators. OTEL_SDK_DISABLED=true
short-circuits to a no-op. Failure to dial collector is non-fatal.
- cmd/api/main.go : init at boot, defer Shutdown(5s) on exit. appVersion
ldflag-overridable for resource attributes.
- 4 hot paths instrumented :
* handlers/auth.go::Login → "auth.login"
* core/track/track_upload_handler.go::InitiateChunkedUpload → "track.upload.initiate"
* core/marketplace/service.go::ProcessPaymentWebhook → "payment.webhook"
* handlers/search_handlers.go::Search → "search.query"
PII guarded — email masked, query content not recorded (length only).
- infra/ansible/roles/otel_collector : pin v0.116.1 contrib build,
systemd unit, tail-sampling config (errors + > 500ms always kept).
- infra/ansible/roles/tempo : pin v2.7.1 monolithic, local-disk backend
(S3 deferred to v1.1), 14d retention.
- infra/ansible/playbooks/observability.yml : provisions both Incus
containers + applies common baseline + roles in order.
- inventory/lab.yml : new groups observability, otel_collectors, tempo.
- config/grafana/dashboards/service-map.json : node graph + 4 hot-path
span tables + collector throughput/queue panels.
- docs/ENV_VARIABLES.md §30 : 4 OTEL_* env vars documented.
Acceptance criterion (Day 9) : login → span visible in Tempo UI. Lab
deployment to validate with `ansible-playbook -i inventory/lab.yml
playbooks/observability.yml` once roles/postgres_ha is up.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-27 23:15:11 +00:00
|
|
|
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
|
2025-12-03 19:29:37 +00:00
|
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
2026-02-11 20:31:00 +00:00
|
|
|
github.com/cloudwego/base64x v0.1.6 // indirect
|
fix(deps): bump vulnerable modules to unblock govulncheck CI
Backend (Go) CI has been red for the entire v1.0.4 cleanup sprint (and
before it) because govulncheck reports 7 vulnerabilities in transitive
test-infrastructure deps, while the test suite itself passes cleanly.
Bump three direct dependencies to pull fixed versions of the affected
modules.
Direct bumps:
golang.org/x/image v0.36.0 → v0.38.0 (GO-2026-4815)
github.com/quic-go/quic-go v0.54.0 → v0.57.0 (GO-2025-4233)
github.com/testcontainers/testcontainers-go v0.33.0 → v0.42.0
github.com/testcontainers/testcontainers-go/modules/postgres
v0.33.0 → v0.42.0
Indirect / transitive side effects:
- containerd/containerd v1.7.18 is REMOVED from the dependency graph.
Newer testcontainers-go depends on containerd/errdefs + log +
platforms sub-packages only, which do not carry GO-2025-4108 /
GO-2025-4100 / GO-2025-3528.
- docker/docker v27.1.1 is REMOVED from the dependency graph for the
same reason — it was reached only via testcontainers-go, and the
new version no longer pulls the full Moby engine. This eliminates
GO-2026-4887 and GO-2026-4883 (the two vulns with no upstream fix)
WITHOUT needing a govulncheck allowlist/exclude wrapper.
- quic-go/qpack, x/crypto, x/net, x/sync, x/sys, x/text, x/tools and
a handful of otel-* modules bumped as a coherent set.
- Transitive opentelemetry bump (otel v1.24.0 → v1.41.0) is expected
since testcontainers-go v0.42 pulls a newer instrumentation.
All 7 vulnerabilities previously reported are now resolved:
GO-2026-4887 docker/docker — vuln module removed
GO-2026-4883 docker/docker — vuln module removed
GO-2026-4815 x/image — fixed in v0.38.0
GO-2025-4233 quic-go — fixed in v0.57.0
GO-2025-4108 containerd — vuln module removed
GO-2025-4100 containerd — vuln module removed
GO-2025-3528 containerd — vuln module removed
Verification (local):
go build ./... OK
go vet ./... OK
govulncheck ./... OK (no findings)
VEZA_SKIP_INTEGRATION=1 go test ./internal/... -short OK
No breaking API changes observed from the testcontainers-go v0.33 →
v0.42 bump (the project only uses GenericContainer, DockerContainer
.Terminate, and modules/postgres which are stable across these
versions). The shared Redis testcontainer helper in internal/testutils
and the hard-delete worker integration test from J4 still compile and
pass.
This commit enables the v1.0.4 tag to be cut on a green CI. No J7
(release) commit is part of this change — that ships separately.
Refs: AUDIT_REPORT.md §10 P5 (test infra hygiene), CI run 98
2026-04-15 12:38:48 +00:00
|
|
|
github.com/containerd/errdefs v1.0.0 // indirect
|
|
|
|
|
github.com/containerd/errdefs/pkg v0.3.0 // indirect
|
2025-12-03 19:29:37 +00:00
|
|
|
github.com/containerd/log v0.1.0 // indirect
|
|
|
|
|
github.com/containerd/platforms v0.2.1 // indirect
|
fix(deps): bump vulnerable modules to unblock govulncheck CI
Backend (Go) CI has been red for the entire v1.0.4 cleanup sprint (and
before it) because govulncheck reports 7 vulnerabilities in transitive
test-infrastructure deps, while the test suite itself passes cleanly.
Bump three direct dependencies to pull fixed versions of the affected
modules.
Direct bumps:
golang.org/x/image v0.36.0 → v0.38.0 (GO-2026-4815)
github.com/quic-go/quic-go v0.54.0 → v0.57.0 (GO-2025-4233)
github.com/testcontainers/testcontainers-go v0.33.0 → v0.42.0
github.com/testcontainers/testcontainers-go/modules/postgres
v0.33.0 → v0.42.0
Indirect / transitive side effects:
- containerd/containerd v1.7.18 is REMOVED from the dependency graph.
Newer testcontainers-go depends on containerd/errdefs + log +
platforms sub-packages only, which do not carry GO-2025-4108 /
GO-2025-4100 / GO-2025-3528.
- docker/docker v27.1.1 is REMOVED from the dependency graph for the
same reason — it was reached only via testcontainers-go, and the
new version no longer pulls the full Moby engine. This eliminates
GO-2026-4887 and GO-2026-4883 (the two vulns with no upstream fix)
WITHOUT needing a govulncheck allowlist/exclude wrapper.
- quic-go/qpack, x/crypto, x/net, x/sync, x/sys, x/text, x/tools and
a handful of otel-* modules bumped as a coherent set.
- Transitive opentelemetry bump (otel v1.24.0 → v1.41.0) is expected
since testcontainers-go v0.42 pulls a newer instrumentation.
All 7 vulnerabilities previously reported are now resolved:
GO-2026-4887 docker/docker — vuln module removed
GO-2026-4883 docker/docker — vuln module removed
GO-2026-4815 x/image — fixed in v0.38.0
GO-2025-4233 quic-go — fixed in v0.57.0
GO-2025-4108 containerd — vuln module removed
GO-2025-4100 containerd — vuln module removed
GO-2025-3528 containerd — vuln module removed
Verification (local):
go build ./... OK
go vet ./... OK
govulncheck ./... OK (no findings)
VEZA_SKIP_INTEGRATION=1 go test ./internal/... -short OK
No breaking API changes observed from the testcontainers-go v0.33 →
v0.42 bump (the project only uses GenericContainer, DockerContainer
.Terminate, and modules/postgres which are stable across these
versions). The shared Redis testcontainer helper in internal/testutils
and the hard-delete worker integration test from J4 still compile and
pass.
This commit enables the v1.0.4 tag to be cut on a green CI. No J7
(release) commit is part of this change — that ships separately.
Refs: AUDIT_REPORT.md §10 P5 (test infra hygiene), CI run 98
2026-04-15 12:38:48 +00:00
|
|
|
github.com/cpuguy83/dockercfg v0.3.2 // indirect
|
2025-12-03 19:29:37 +00:00
|
|
|
github.com/davecgh/go-spew v1.1.1 // indirect
|
|
|
|
|
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
|
|
|
|
|
github.com/distribution/reference v0.6.0 // indirect
|
fix(deps): bump vulnerable modules to unblock govulncheck CI
Backend (Go) CI has been red for the entire v1.0.4 cleanup sprint (and
before it) because govulncheck reports 7 vulnerabilities in transitive
test-infrastructure deps, while the test suite itself passes cleanly.
Bump three direct dependencies to pull fixed versions of the affected
modules.
Direct bumps:
golang.org/x/image v0.36.0 → v0.38.0 (GO-2026-4815)
github.com/quic-go/quic-go v0.54.0 → v0.57.0 (GO-2025-4233)
github.com/testcontainers/testcontainers-go v0.33.0 → v0.42.0
github.com/testcontainers/testcontainers-go/modules/postgres
v0.33.0 → v0.42.0
Indirect / transitive side effects:
- containerd/containerd v1.7.18 is REMOVED from the dependency graph.
Newer testcontainers-go depends on containerd/errdefs + log +
platforms sub-packages only, which do not carry GO-2025-4108 /
GO-2025-4100 / GO-2025-3528.
- docker/docker v27.1.1 is REMOVED from the dependency graph for the
same reason — it was reached only via testcontainers-go, and the
new version no longer pulls the full Moby engine. This eliminates
GO-2026-4887 and GO-2026-4883 (the two vulns with no upstream fix)
WITHOUT needing a govulncheck allowlist/exclude wrapper.
- quic-go/qpack, x/crypto, x/net, x/sync, x/sys, x/text, x/tools and
a handful of otel-* modules bumped as a coherent set.
- Transitive opentelemetry bump (otel v1.24.0 → v1.41.0) is expected
since testcontainers-go v0.42 pulls a newer instrumentation.
All 7 vulnerabilities previously reported are now resolved:
GO-2026-4887 docker/docker — vuln module removed
GO-2026-4883 docker/docker — vuln module removed
GO-2026-4815 x/image — fixed in v0.38.0
GO-2025-4233 quic-go — fixed in v0.57.0
GO-2025-4108 containerd — vuln module removed
GO-2025-4100 containerd — vuln module removed
GO-2025-3528 containerd — vuln module removed
Verification (local):
go build ./... OK
go vet ./... OK
govulncheck ./... OK (no findings)
VEZA_SKIP_INTEGRATION=1 go test ./internal/... -short OK
No breaking API changes observed from the testcontainers-go v0.33 →
v0.42 bump (the project only uses GenericContainer, DockerContainer
.Terminate, and modules/postgres which are stable across these
versions). The shared Redis testcontainer helper in internal/testutils
and the hard-delete worker integration test from J4 still compile and
pass.
This commit enables the v1.0.4 tag to be cut on a green CI. No J7
(release) commit is part of this change — that ships separately.
Refs: AUDIT_REPORT.md §10 P5 (test infra hygiene), CI run 98
2026-04-15 12:38:48 +00:00
|
|
|
github.com/docker/go-connections v0.6.0 // indirect
|
2025-12-03 19:29:37 +00:00
|
|
|
github.com/docker/go-units v0.5.0 // indirect
|
fix(deps): bump vulnerable modules to unblock govulncheck CI
Backend (Go) CI has been red for the entire v1.0.4 cleanup sprint (and
before it) because govulncheck reports 7 vulnerabilities in transitive
test-infrastructure deps, while the test suite itself passes cleanly.
Bump three direct dependencies to pull fixed versions of the affected
modules.
Direct bumps:
golang.org/x/image v0.36.0 → v0.38.0 (GO-2026-4815)
github.com/quic-go/quic-go v0.54.0 → v0.57.0 (GO-2025-4233)
github.com/testcontainers/testcontainers-go v0.33.0 → v0.42.0
github.com/testcontainers/testcontainers-go/modules/postgres
v0.33.0 → v0.42.0
Indirect / transitive side effects:
- containerd/containerd v1.7.18 is REMOVED from the dependency graph.
Newer testcontainers-go depends on containerd/errdefs + log +
platforms sub-packages only, which do not carry GO-2025-4108 /
GO-2025-4100 / GO-2025-3528.
- docker/docker v27.1.1 is REMOVED from the dependency graph for the
same reason — it was reached only via testcontainers-go, and the
new version no longer pulls the full Moby engine. This eliminates
GO-2026-4887 and GO-2026-4883 (the two vulns with no upstream fix)
WITHOUT needing a govulncheck allowlist/exclude wrapper.
- quic-go/qpack, x/crypto, x/net, x/sync, x/sys, x/text, x/tools and
a handful of otel-* modules bumped as a coherent set.
- Transitive opentelemetry bump (otel v1.24.0 → v1.41.0) is expected
since testcontainers-go v0.42 pulls a newer instrumentation.
All 7 vulnerabilities previously reported are now resolved:
GO-2026-4887 docker/docker — vuln module removed
GO-2026-4883 docker/docker — vuln module removed
GO-2026-4815 x/image — fixed in v0.38.0
GO-2025-4233 quic-go — fixed in v0.57.0
GO-2025-4108 containerd — vuln module removed
GO-2025-4100 containerd — vuln module removed
GO-2025-3528 containerd — vuln module removed
Verification (local):
go build ./... OK
go vet ./... OK
govulncheck ./... OK (no findings)
VEZA_SKIP_INTEGRATION=1 go test ./internal/... -short OK
No breaking API changes observed from the testcontainers-go v0.33 →
v0.42 bump (the project only uses GenericContainer, DockerContainer
.Terminate, and modules/postgres which are stable across these
versions). The shared Redis testcontainer helper in internal/testutils
and the hard-delete worker integration test from J4 still compile and
pass.
This commit enables the v1.0.4 tag to be cut on a green CI. No J7
(release) commit is part of this change — that ships separately.
Refs: AUDIT_REPORT.md §10 P5 (test infra hygiene), CI run 98
2026-04-15 12:38:48 +00:00
|
|
|
github.com/ebitengine/purego v0.10.0 // indirect
|
2026-03-09 09:13:18 +00:00
|
|
|
github.com/elastic/elastic-transport-go/v8 v8.3.0 // indirect
|
2025-12-03 19:29:37 +00:00
|
|
|
github.com/felixge/httpsnoop v1.0.4 // indirect
|
2026-02-11 20:31:00 +00:00
|
|
|
github.com/gabriel-vasile/mimetype v1.4.8 // indirect
|
|
|
|
|
github.com/gin-contrib/sse v1.1.0 // indirect
|
fix(deps): bump vulnerable modules to unblock govulncheck CI
Backend (Go) CI has been red for the entire v1.0.4 cleanup sprint (and
before it) because govulncheck reports 7 vulnerabilities in transitive
test-infrastructure deps, while the test suite itself passes cleanly.
Bump three direct dependencies to pull fixed versions of the affected
modules.
Direct bumps:
golang.org/x/image v0.36.0 → v0.38.0 (GO-2026-4815)
github.com/quic-go/quic-go v0.54.0 → v0.57.0 (GO-2025-4233)
github.com/testcontainers/testcontainers-go v0.33.0 → v0.42.0
github.com/testcontainers/testcontainers-go/modules/postgres
v0.33.0 → v0.42.0
Indirect / transitive side effects:
- containerd/containerd v1.7.18 is REMOVED from the dependency graph.
Newer testcontainers-go depends on containerd/errdefs + log +
platforms sub-packages only, which do not carry GO-2025-4108 /
GO-2025-4100 / GO-2025-3528.
- docker/docker v27.1.1 is REMOVED from the dependency graph for the
same reason — it was reached only via testcontainers-go, and the
new version no longer pulls the full Moby engine. This eliminates
GO-2026-4887 and GO-2026-4883 (the two vulns with no upstream fix)
WITHOUT needing a govulncheck allowlist/exclude wrapper.
- quic-go/qpack, x/crypto, x/net, x/sync, x/sys, x/text, x/tools and
a handful of otel-* modules bumped as a coherent set.
- Transitive opentelemetry bump (otel v1.24.0 → v1.41.0) is expected
since testcontainers-go v0.42 pulls a newer instrumentation.
All 7 vulnerabilities previously reported are now resolved:
GO-2026-4887 docker/docker — vuln module removed
GO-2026-4883 docker/docker — vuln module removed
GO-2026-4815 x/image — fixed in v0.38.0
GO-2025-4233 quic-go — fixed in v0.57.0
GO-2025-4108 containerd — vuln module removed
GO-2025-4100 containerd — vuln module removed
GO-2025-3528 containerd — vuln module removed
Verification (local):
go build ./... OK
go vet ./... OK
govulncheck ./... OK (no findings)
VEZA_SKIP_INTEGRATION=1 go test ./internal/... -short OK
No breaking API changes observed from the testcontainers-go v0.33 →
v0.42 bump (the project only uses GenericContainer, DockerContainer
.Terminate, and modules/postgres which are stable across these
versions). The shared Redis testcontainer helper in internal/testutils
and the hard-delete worker integration test from J4 still compile and
pass.
This commit enables the v1.0.4 tag to be cut on a green CI. No J7
(release) commit is part of this change — that ships separately.
Refs: AUDIT_REPORT.md §10 P5 (test infra hygiene), CI run 98
2026-04-15 12:38:48 +00:00
|
|
|
github.com/go-logr/logr v1.4.3 // indirect
|
2025-12-03 19:29:37 +00:00
|
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
|
|
|
github.com/go-ole/go-ole v1.2.6 // indirect
|
2026-02-27 19:23:10 +00:00
|
|
|
github.com/go-openapi/jsonpointer v0.21.0 // indirect
|
2025-12-03 19:29:37 +00:00
|
|
|
github.com/go-openapi/jsonreference v0.19.6 // indirect
|
|
|
|
|
github.com/go-openapi/spec v0.20.4 // indirect
|
2026-02-27 19:23:10 +00:00
|
|
|
github.com/go-openapi/swag v0.23.0 // indirect
|
2025-12-03 19:29:37 +00:00
|
|
|
github.com/go-playground/locales v0.14.1 // indirect
|
|
|
|
|
github.com/go-playground/universal-translator v0.18.1 // indirect
|
|
|
|
|
github.com/goccy/go-json v0.10.2 // indirect
|
2026-02-11 20:31:00 +00:00
|
|
|
github.com/goccy/go-yaml v1.18.0 // indirect
|
feat(observability): OTel SDK + collector + Tempo + 4 hot path spans (W2 Day 9)
Wires distributed tracing end-to-end. Backend exports OTLP/gRPC to a
collector, which tail-samples (errors + slow always, 10% rest) and
ships to Tempo. Grafana service-map dashboard pivots on the 4
instrumented hot paths.
- internal/tracing/otlp_exporter.go : InitOTLPTracer + Provider.Shutdown,
BatchSpanProcessor (5s/512 batch), ParentBased(TraceIDRatio) sampler,
W3C trace-context + baggage propagators. OTEL_SDK_DISABLED=true
short-circuits to a no-op. Failure to dial collector is non-fatal.
- cmd/api/main.go : init at boot, defer Shutdown(5s) on exit. appVersion
ldflag-overridable for resource attributes.
- 4 hot paths instrumented :
* handlers/auth.go::Login → "auth.login"
* core/track/track_upload_handler.go::InitiateChunkedUpload → "track.upload.initiate"
* core/marketplace/service.go::ProcessPaymentWebhook → "payment.webhook"
* handlers/search_handlers.go::Search → "search.query"
PII guarded — email masked, query content not recorded (length only).
- infra/ansible/roles/otel_collector : pin v0.116.1 contrib build,
systemd unit, tail-sampling config (errors + > 500ms always kept).
- infra/ansible/roles/tempo : pin v2.7.1 monolithic, local-disk backend
(S3 deferred to v1.1), 14d retention.
- infra/ansible/playbooks/observability.yml : provisions both Incus
containers + applies common baseline + roles in order.
- inventory/lab.yml : new groups observability, otel_collectors, tempo.
- config/grafana/dashboards/service-map.json : node graph + 4 hot-path
span tables + collector throughput/queue panels.
- docs/ENV_VARIABLES.md §30 : 4 OTEL_* env vars documented.
Acceptance criterion (Day 9) : login → span visible in Tempo UI. Lab
deployment to validate with `ansible-playbook -i inventory/lab.yml
playbooks/observability.yml` once roles/postgres_ha is up.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-27 23:15:11 +00:00
|
|
|
github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
|
2025-12-03 19:29:37 +00:00
|
|
|
github.com/jackc/pgpassfile v1.0.0 // indirect
|
|
|
|
|
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
|
|
|
|
|
github.com/jackc/pgx/v5 v5.6.0 // indirect
|
|
|
|
|
github.com/jackc/puddle/v2 v2.2.2 // indirect
|
|
|
|
|
github.com/jinzhu/inflection v1.0.0 // indirect
|
|
|
|
|
github.com/jinzhu/now v1.1.5 // indirect
|
|
|
|
|
github.com/josharian/intern v1.0.0 // indirect
|
|
|
|
|
github.com/json-iterator/go v1.1.12 // indirect
|
fix(deps): bump vulnerable modules to unblock govulncheck CI
Backend (Go) CI has been red for the entire v1.0.4 cleanup sprint (and
before it) because govulncheck reports 7 vulnerabilities in transitive
test-infrastructure deps, while the test suite itself passes cleanly.
Bump three direct dependencies to pull fixed versions of the affected
modules.
Direct bumps:
golang.org/x/image v0.36.0 → v0.38.0 (GO-2026-4815)
github.com/quic-go/quic-go v0.54.0 → v0.57.0 (GO-2025-4233)
github.com/testcontainers/testcontainers-go v0.33.0 → v0.42.0
github.com/testcontainers/testcontainers-go/modules/postgres
v0.33.0 → v0.42.0
Indirect / transitive side effects:
- containerd/containerd v1.7.18 is REMOVED from the dependency graph.
Newer testcontainers-go depends on containerd/errdefs + log +
platforms sub-packages only, which do not carry GO-2025-4108 /
GO-2025-4100 / GO-2025-3528.
- docker/docker v27.1.1 is REMOVED from the dependency graph for the
same reason — it was reached only via testcontainers-go, and the
new version no longer pulls the full Moby engine. This eliminates
GO-2026-4887 and GO-2026-4883 (the two vulns with no upstream fix)
WITHOUT needing a govulncheck allowlist/exclude wrapper.
- quic-go/qpack, x/crypto, x/net, x/sync, x/sys, x/text, x/tools and
a handful of otel-* modules bumped as a coherent set.
- Transitive opentelemetry bump (otel v1.24.0 → v1.41.0) is expected
since testcontainers-go v0.42 pulls a newer instrumentation.
All 7 vulnerabilities previously reported are now resolved:
GO-2026-4887 docker/docker — vuln module removed
GO-2026-4883 docker/docker — vuln module removed
GO-2026-4815 x/image — fixed in v0.38.0
GO-2025-4233 quic-go — fixed in v0.57.0
GO-2025-4108 containerd — vuln module removed
GO-2025-4100 containerd — vuln module removed
GO-2025-3528 containerd — vuln module removed
Verification (local):
go build ./... OK
go vet ./... OK
govulncheck ./... OK (no findings)
VEZA_SKIP_INTEGRATION=1 go test ./internal/... -short OK
No breaking API changes observed from the testcontainers-go v0.33 →
v0.42 bump (the project only uses GenericContainer, DockerContainer
.Terminate, and modules/postgres which are stable across these
versions). The shared Redis testcontainer helper in internal/testutils
and the hard-delete worker integration test from J4 still compile and
pass.
This commit enables the v1.0.4 tag to be cut on a green CI. No J7
(release) commit is part of this change — that ships separately.
Refs: AUDIT_REPORT.md §10 P5 (test infra hygiene), CI run 98
2026-04-15 12:38:48 +00:00
|
|
|
github.com/klauspost/compress v1.18.5 // indirect
|
2026-02-11 20:31:00 +00:00
|
|
|
github.com/klauspost/cpuid/v2 v2.3.0 // indirect
|
|
|
|
|
github.com/leodido/go-urn v1.4.0 // indirect
|
2025-12-03 19:29:37 +00:00
|
|
|
github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
|
fix(deps): bump vulnerable modules to unblock govulncheck CI
Backend (Go) CI has been red for the entire v1.0.4 cleanup sprint (and
before it) because govulncheck reports 7 vulnerabilities in transitive
test-infrastructure deps, while the test suite itself passes cleanly.
Bump three direct dependencies to pull fixed versions of the affected
modules.
Direct bumps:
golang.org/x/image v0.36.0 → v0.38.0 (GO-2026-4815)
github.com/quic-go/quic-go v0.54.0 → v0.57.0 (GO-2025-4233)
github.com/testcontainers/testcontainers-go v0.33.0 → v0.42.0
github.com/testcontainers/testcontainers-go/modules/postgres
v0.33.0 → v0.42.0
Indirect / transitive side effects:
- containerd/containerd v1.7.18 is REMOVED from the dependency graph.
Newer testcontainers-go depends on containerd/errdefs + log +
platforms sub-packages only, which do not carry GO-2025-4108 /
GO-2025-4100 / GO-2025-3528.
- docker/docker v27.1.1 is REMOVED from the dependency graph for the
same reason — it was reached only via testcontainers-go, and the
new version no longer pulls the full Moby engine. This eliminates
GO-2026-4887 and GO-2026-4883 (the two vulns with no upstream fix)
WITHOUT needing a govulncheck allowlist/exclude wrapper.
- quic-go/qpack, x/crypto, x/net, x/sync, x/sys, x/text, x/tools and
a handful of otel-* modules bumped as a coherent set.
- Transitive opentelemetry bump (otel v1.24.0 → v1.41.0) is expected
since testcontainers-go v0.42 pulls a newer instrumentation.
All 7 vulnerabilities previously reported are now resolved:
GO-2026-4887 docker/docker — vuln module removed
GO-2026-4883 docker/docker — vuln module removed
GO-2026-4815 x/image — fixed in v0.38.0
GO-2025-4233 quic-go — fixed in v0.57.0
GO-2025-4108 containerd — vuln module removed
GO-2025-4100 containerd — vuln module removed
GO-2025-3528 containerd — vuln module removed
Verification (local):
go build ./... OK
go vet ./... OK
govulncheck ./... OK (no findings)
VEZA_SKIP_INTEGRATION=1 go test ./internal/... -short OK
No breaking API changes observed from the testcontainers-go v0.33 →
v0.42 bump (the project only uses GenericContainer, DockerContainer
.Terminate, and modules/postgres which are stable across these
versions). The shared Redis testcontainer helper in internal/testutils
and the hard-delete worker integration test from J4 still compile and
pass.
This commit enables the v1.0.4 tag to be cut on a green CI. No J7
(release) commit is part of this change — that ships separately.
Refs: AUDIT_REPORT.md §10 P5 (test infra hygiene), CI run 98
2026-04-15 12:38:48 +00:00
|
|
|
github.com/magiconair/properties v1.8.10 // indirect
|
2026-02-27 19:23:10 +00:00
|
|
|
github.com/mailru/easyjson v0.7.7 // indirect
|
2026-02-11 20:31:00 +00:00
|
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
2025-12-03 19:29:37 +00:00
|
|
|
github.com/mattn/go-sqlite3 v1.14.22 // indirect
|
|
|
|
|
github.com/moby/docker-image-spec v1.3.1 // indirect
|
fix(deps): bump vulnerable modules to unblock govulncheck CI
Backend (Go) CI has been red for the entire v1.0.4 cleanup sprint (and
before it) because govulncheck reports 7 vulnerabilities in transitive
test-infrastructure deps, while the test suite itself passes cleanly.
Bump three direct dependencies to pull fixed versions of the affected
modules.
Direct bumps:
golang.org/x/image v0.36.0 → v0.38.0 (GO-2026-4815)
github.com/quic-go/quic-go v0.54.0 → v0.57.0 (GO-2025-4233)
github.com/testcontainers/testcontainers-go v0.33.0 → v0.42.0
github.com/testcontainers/testcontainers-go/modules/postgres
v0.33.0 → v0.42.0
Indirect / transitive side effects:
- containerd/containerd v1.7.18 is REMOVED from the dependency graph.
Newer testcontainers-go depends on containerd/errdefs + log +
platforms sub-packages only, which do not carry GO-2025-4108 /
GO-2025-4100 / GO-2025-3528.
- docker/docker v27.1.1 is REMOVED from the dependency graph for the
same reason — it was reached only via testcontainers-go, and the
new version no longer pulls the full Moby engine. This eliminates
GO-2026-4887 and GO-2026-4883 (the two vulns with no upstream fix)
WITHOUT needing a govulncheck allowlist/exclude wrapper.
- quic-go/qpack, x/crypto, x/net, x/sync, x/sys, x/text, x/tools and
a handful of otel-* modules bumped as a coherent set.
- Transitive opentelemetry bump (otel v1.24.0 → v1.41.0) is expected
since testcontainers-go v0.42 pulls a newer instrumentation.
All 7 vulnerabilities previously reported are now resolved:
GO-2026-4887 docker/docker — vuln module removed
GO-2026-4883 docker/docker — vuln module removed
GO-2026-4815 x/image — fixed in v0.38.0
GO-2025-4233 quic-go — fixed in v0.57.0
GO-2025-4108 containerd — vuln module removed
GO-2025-4100 containerd — vuln module removed
GO-2025-3528 containerd — vuln module removed
Verification (local):
go build ./... OK
go vet ./... OK
govulncheck ./... OK (no findings)
VEZA_SKIP_INTEGRATION=1 go test ./internal/... -short OK
No breaking API changes observed from the testcontainers-go v0.33 →
v0.42 bump (the project only uses GenericContainer, DockerContainer
.Terminate, and modules/postgres which are stable across these
versions). The shared Redis testcontainer helper in internal/testutils
and the hard-delete worker integration test from J4 still compile and
pass.
This commit enables the v1.0.4 tag to be cut on a green CI. No J7
(release) commit is part of this change — that ships separately.
Refs: AUDIT_REPORT.md §10 P5 (test infra hygiene), CI run 98
2026-04-15 12:38:48 +00:00
|
|
|
github.com/moby/go-archive v0.2.0 // indirect
|
|
|
|
|
github.com/moby/moby/api v1.54.1 // indirect
|
|
|
|
|
github.com/moby/moby/client v0.4.0 // indirect
|
|
|
|
|
github.com/moby/patternmatcher v0.6.1 // indirect
|
|
|
|
|
github.com/moby/sys/sequential v0.6.0 // indirect
|
|
|
|
|
github.com/moby/sys/user v0.4.0 // indirect
|
|
|
|
|
github.com/moby/sys/userns v0.1.0 // indirect
|
|
|
|
|
github.com/moby/term v0.5.2 // indirect
|
2025-12-03 19:29:37 +00:00
|
|
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
|
|
|
|
github.com/modern-go/reflect2 v1.0.2 // indirect
|
|
|
|
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
|
|
|
|
github.com/opencontainers/go-digest v1.0.0 // indirect
|
fix(deps): bump vulnerable modules to unblock govulncheck CI
Backend (Go) CI has been red for the entire v1.0.4 cleanup sprint (and
before it) because govulncheck reports 7 vulnerabilities in transitive
test-infrastructure deps, while the test suite itself passes cleanly.
Bump three direct dependencies to pull fixed versions of the affected
modules.
Direct bumps:
golang.org/x/image v0.36.0 → v0.38.0 (GO-2026-4815)
github.com/quic-go/quic-go v0.54.0 → v0.57.0 (GO-2025-4233)
github.com/testcontainers/testcontainers-go v0.33.0 → v0.42.0
github.com/testcontainers/testcontainers-go/modules/postgres
v0.33.0 → v0.42.0
Indirect / transitive side effects:
- containerd/containerd v1.7.18 is REMOVED from the dependency graph.
Newer testcontainers-go depends on containerd/errdefs + log +
platforms sub-packages only, which do not carry GO-2025-4108 /
GO-2025-4100 / GO-2025-3528.
- docker/docker v27.1.1 is REMOVED from the dependency graph for the
same reason — it was reached only via testcontainers-go, and the
new version no longer pulls the full Moby engine. This eliminates
GO-2026-4887 and GO-2026-4883 (the two vulns with no upstream fix)
WITHOUT needing a govulncheck allowlist/exclude wrapper.
- quic-go/qpack, x/crypto, x/net, x/sync, x/sys, x/text, x/tools and
a handful of otel-* modules bumped as a coherent set.
- Transitive opentelemetry bump (otel v1.24.0 → v1.41.0) is expected
since testcontainers-go v0.42 pulls a newer instrumentation.
All 7 vulnerabilities previously reported are now resolved:
GO-2026-4887 docker/docker — vuln module removed
GO-2026-4883 docker/docker — vuln module removed
GO-2026-4815 x/image — fixed in v0.38.0
GO-2025-4233 quic-go — fixed in v0.57.0
GO-2025-4108 containerd — vuln module removed
GO-2025-4100 containerd — vuln module removed
GO-2025-3528 containerd — vuln module removed
Verification (local):
go build ./... OK
go vet ./... OK
govulncheck ./... OK (no findings)
VEZA_SKIP_INTEGRATION=1 go test ./internal/... -short OK
No breaking API changes observed from the testcontainers-go v0.33 →
v0.42 bump (the project only uses GenericContainer, DockerContainer
.Terminate, and modules/postgres which are stable across these
versions). The shared Redis testcontainer helper in internal/testutils
and the hard-delete worker integration test from J4 still compile and
pass.
This commit enables the v1.0.4 tag to be cut on a green CI. No J7
(release) commit is part of this change — that ships separately.
Refs: AUDIT_REPORT.md §10 P5 (test infra hygiene), CI run 98
2026-04-15 12:38:48 +00:00
|
|
|
github.com/opencontainers/image-spec v1.1.1 // indirect
|
2026-02-11 20:31:00 +00:00
|
|
|
github.com/pelletier/go-toml/v2 v2.2.4 // indirect
|
2025-12-03 19:29:37 +00:00
|
|
|
github.com/pmezard/go-difflib v1.0.0 // indirect
|
fix(deps): bump vulnerable modules to unblock govulncheck CI
Backend (Go) CI has been red for the entire v1.0.4 cleanup sprint (and
before it) because govulncheck reports 7 vulnerabilities in transitive
test-infrastructure deps, while the test suite itself passes cleanly.
Bump three direct dependencies to pull fixed versions of the affected
modules.
Direct bumps:
golang.org/x/image v0.36.0 → v0.38.0 (GO-2026-4815)
github.com/quic-go/quic-go v0.54.0 → v0.57.0 (GO-2025-4233)
github.com/testcontainers/testcontainers-go v0.33.0 → v0.42.0
github.com/testcontainers/testcontainers-go/modules/postgres
v0.33.0 → v0.42.0
Indirect / transitive side effects:
- containerd/containerd v1.7.18 is REMOVED from the dependency graph.
Newer testcontainers-go depends on containerd/errdefs + log +
platforms sub-packages only, which do not carry GO-2025-4108 /
GO-2025-4100 / GO-2025-3528.
- docker/docker v27.1.1 is REMOVED from the dependency graph for the
same reason — it was reached only via testcontainers-go, and the
new version no longer pulls the full Moby engine. This eliminates
GO-2026-4887 and GO-2026-4883 (the two vulns with no upstream fix)
WITHOUT needing a govulncheck allowlist/exclude wrapper.
- quic-go/qpack, x/crypto, x/net, x/sync, x/sys, x/text, x/tools and
a handful of otel-* modules bumped as a coherent set.
- Transitive opentelemetry bump (otel v1.24.0 → v1.41.0) is expected
since testcontainers-go v0.42 pulls a newer instrumentation.
All 7 vulnerabilities previously reported are now resolved:
GO-2026-4887 docker/docker — vuln module removed
GO-2026-4883 docker/docker — vuln module removed
GO-2026-4815 x/image — fixed in v0.38.0
GO-2025-4233 quic-go — fixed in v0.57.0
GO-2025-4108 containerd — vuln module removed
GO-2025-4100 containerd — vuln module removed
GO-2025-3528 containerd — vuln module removed
Verification (local):
go build ./... OK
go vet ./... OK
govulncheck ./... OK (no findings)
VEZA_SKIP_INTEGRATION=1 go test ./internal/... -short OK
No breaking API changes observed from the testcontainers-go v0.33 →
v0.42 bump (the project only uses GenericContainer, DockerContainer
.Terminate, and modules/postgres which are stable across these
versions). The shared Redis testcontainer helper in internal/testutils
and the hard-delete worker integration test from J4 still compile and
pass.
This commit enables the v1.0.4 tag to be cut on a green CI. No J7
(release) commit is part of this change — that ships separately.
Refs: AUDIT_REPORT.md §10 P5 (test infra hygiene), CI run 98
2026-04-15 12:38:48 +00:00
|
|
|
github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
|
2025-12-03 19:29:37 +00:00
|
|
|
github.com/prometheus/procfs v0.16.1 // indirect
|
fix(deps): bump vulnerable modules to unblock govulncheck CI
Backend (Go) CI has been red for the entire v1.0.4 cleanup sprint (and
before it) because govulncheck reports 7 vulnerabilities in transitive
test-infrastructure deps, while the test suite itself passes cleanly.
Bump three direct dependencies to pull fixed versions of the affected
modules.
Direct bumps:
golang.org/x/image v0.36.0 → v0.38.0 (GO-2026-4815)
github.com/quic-go/quic-go v0.54.0 → v0.57.0 (GO-2025-4233)
github.com/testcontainers/testcontainers-go v0.33.0 → v0.42.0
github.com/testcontainers/testcontainers-go/modules/postgres
v0.33.0 → v0.42.0
Indirect / transitive side effects:
- containerd/containerd v1.7.18 is REMOVED from the dependency graph.
Newer testcontainers-go depends on containerd/errdefs + log +
platforms sub-packages only, which do not carry GO-2025-4108 /
GO-2025-4100 / GO-2025-3528.
- docker/docker v27.1.1 is REMOVED from the dependency graph for the
same reason — it was reached only via testcontainers-go, and the
new version no longer pulls the full Moby engine. This eliminates
GO-2026-4887 and GO-2026-4883 (the two vulns with no upstream fix)
WITHOUT needing a govulncheck allowlist/exclude wrapper.
- quic-go/qpack, x/crypto, x/net, x/sync, x/sys, x/text, x/tools and
a handful of otel-* modules bumped as a coherent set.
- Transitive opentelemetry bump (otel v1.24.0 → v1.41.0) is expected
since testcontainers-go v0.42 pulls a newer instrumentation.
All 7 vulnerabilities previously reported are now resolved:
GO-2026-4887 docker/docker — vuln module removed
GO-2026-4883 docker/docker — vuln module removed
GO-2026-4815 x/image — fixed in v0.38.0
GO-2025-4233 quic-go — fixed in v0.57.0
GO-2025-4108 containerd — vuln module removed
GO-2025-4100 containerd — vuln module removed
GO-2025-3528 containerd — vuln module removed
Verification (local):
go build ./... OK
go vet ./... OK
govulncheck ./... OK (no findings)
VEZA_SKIP_INTEGRATION=1 go test ./internal/... -short OK
No breaking API changes observed from the testcontainers-go v0.33 →
v0.42 bump (the project only uses GenericContainer, DockerContainer
.Terminate, and modules/postgres which are stable across these
versions). The shared Redis testcontainer helper in internal/testutils
and the hard-delete worker integration test from J4 still compile and
pass.
This commit enables the v1.0.4 tag to be cut on a green CI. No J7
(release) commit is part of this change — that ships separately.
Refs: AUDIT_REPORT.md §10 P5 (test infra hygiene), CI run 98
2026-04-15 12:38:48 +00:00
|
|
|
github.com/quic-go/qpack v0.6.0 // indirect
|
|
|
|
|
github.com/quic-go/quic-go v0.57.0 // indirect
|
|
|
|
|
github.com/shirou/gopsutil/v4 v4.26.3 // indirect
|
|
|
|
|
github.com/sirupsen/logrus v1.9.4 // indirect
|
|
|
|
|
github.com/stretchr/objx v0.5.3 // indirect
|
|
|
|
|
github.com/tklauser/go-sysconf v0.3.16 // indirect
|
|
|
|
|
github.com/tklauser/numcpus v0.11.0 // indirect
|
2025-12-03 19:29:37 +00:00
|
|
|
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
|
2026-02-11 20:31:00 +00:00
|
|
|
github.com/ugorji/go/codec v1.3.0 // indirect
|
fix(deps): bump vulnerable modules to unblock govulncheck CI
Backend (Go) CI has been red for the entire v1.0.4 cleanup sprint (and
before it) because govulncheck reports 7 vulnerabilities in transitive
test-infrastructure deps, while the test suite itself passes cleanly.
Bump three direct dependencies to pull fixed versions of the affected
modules.
Direct bumps:
golang.org/x/image v0.36.0 → v0.38.0 (GO-2026-4815)
github.com/quic-go/quic-go v0.54.0 → v0.57.0 (GO-2025-4233)
github.com/testcontainers/testcontainers-go v0.33.0 → v0.42.0
github.com/testcontainers/testcontainers-go/modules/postgres
v0.33.0 → v0.42.0
Indirect / transitive side effects:
- containerd/containerd v1.7.18 is REMOVED from the dependency graph.
Newer testcontainers-go depends on containerd/errdefs + log +
platforms sub-packages only, which do not carry GO-2025-4108 /
GO-2025-4100 / GO-2025-3528.
- docker/docker v27.1.1 is REMOVED from the dependency graph for the
same reason — it was reached only via testcontainers-go, and the
new version no longer pulls the full Moby engine. This eliminates
GO-2026-4887 and GO-2026-4883 (the two vulns with no upstream fix)
WITHOUT needing a govulncheck allowlist/exclude wrapper.
- quic-go/qpack, x/crypto, x/net, x/sync, x/sys, x/text, x/tools and
a handful of otel-* modules bumped as a coherent set.
- Transitive opentelemetry bump (otel v1.24.0 → v1.41.0) is expected
since testcontainers-go v0.42 pulls a newer instrumentation.
All 7 vulnerabilities previously reported are now resolved:
GO-2026-4887 docker/docker — vuln module removed
GO-2026-4883 docker/docker — vuln module removed
GO-2026-4815 x/image — fixed in v0.38.0
GO-2025-4233 quic-go — fixed in v0.57.0
GO-2025-4108 containerd — vuln module removed
GO-2025-4100 containerd — vuln module removed
GO-2025-3528 containerd — vuln module removed
Verification (local):
go build ./... OK
go vet ./... OK
govulncheck ./... OK (no findings)
VEZA_SKIP_INTEGRATION=1 go test ./internal/... -short OK
No breaking API changes observed from the testcontainers-go v0.33 →
v0.42 bump (the project only uses GenericContainer, DockerContainer
.Terminate, and modules/postgres which are stable across these
versions). The shared Redis testcontainer helper in internal/testutils
and the hard-delete worker integration test from J4 still compile and
pass.
This commit enables the v1.0.4 tag to be cut on a green CI. No J7
(release) commit is part of this change — that ships separately.
Refs: AUDIT_REPORT.md §10 P5 (test infra hygiene), CI run 98
2026-04-15 12:38:48 +00:00
|
|
|
github.com/yusufpapurcu/wmi v1.2.4 // indirect
|
|
|
|
|
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
|
|
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
|
feat(observability): OTel SDK + collector + Tempo + 4 hot path spans (W2 Day 9)
Wires distributed tracing end-to-end. Backend exports OTLP/gRPC to a
collector, which tail-samples (errors + slow always, 10% rest) and
ships to Tempo. Grafana service-map dashboard pivots on the 4
instrumented hot paths.
- internal/tracing/otlp_exporter.go : InitOTLPTracer + Provider.Shutdown,
BatchSpanProcessor (5s/512 batch), ParentBased(TraceIDRatio) sampler,
W3C trace-context + baggage propagators. OTEL_SDK_DISABLED=true
short-circuits to a no-op. Failure to dial collector is non-fatal.
- cmd/api/main.go : init at boot, defer Shutdown(5s) on exit. appVersion
ldflag-overridable for resource attributes.
- 4 hot paths instrumented :
* handlers/auth.go::Login → "auth.login"
* core/track/track_upload_handler.go::InitiateChunkedUpload → "track.upload.initiate"
* core/marketplace/service.go::ProcessPaymentWebhook → "payment.webhook"
* handlers/search_handlers.go::Search → "search.query"
PII guarded — email masked, query content not recorded (length only).
- infra/ansible/roles/otel_collector : pin v0.116.1 contrib build,
systemd unit, tail-sampling config (errors + > 500ms always kept).
- infra/ansible/roles/tempo : pin v2.7.1 monolithic, local-disk backend
(S3 deferred to v1.1), 14d retention.
- infra/ansible/playbooks/observability.yml : provisions both Incus
containers + applies common baseline + roles in order.
- inventory/lab.yml : new groups observability, otel_collectors, tempo.
- config/grafana/dashboards/service-map.json : node graph + 4 hot-path
span tables + collector throughput/queue panels.
- docs/ENV_VARIABLES.md §30 : 4 OTEL_* env vars documented.
Acceptance criterion (Day 9) : login → span visible in Tempo UI. Lab
deployment to validate with `ansible-playbook -i inventory/lab.yml
playbooks/observability.yml` once roles/postgres_ha is up.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-27 23:15:11 +00:00
|
|
|
go.opentelemetry.io/otel/metric v1.43.0 // indirect
|
|
|
|
|
go.opentelemetry.io/otel/trace v1.43.0 // indirect
|
|
|
|
|
go.opentelemetry.io/proto/otlp v1.10.0 // indirect
|
2025-12-03 19:29:37 +00:00
|
|
|
go.uber.org/multierr v1.10.0 // indirect
|
2026-02-11 20:31:00 +00:00
|
|
|
golang.org/x/arch v0.20.0 // indirect
|
fix(deps): bump vulnerable modules to unblock govulncheck CI
Backend (Go) CI has been red for the entire v1.0.4 cleanup sprint (and
before it) because govulncheck reports 7 vulnerabilities in transitive
test-infrastructure deps, while the test suite itself passes cleanly.
Bump three direct dependencies to pull fixed versions of the affected
modules.
Direct bumps:
golang.org/x/image v0.36.0 → v0.38.0 (GO-2026-4815)
github.com/quic-go/quic-go v0.54.0 → v0.57.0 (GO-2025-4233)
github.com/testcontainers/testcontainers-go v0.33.0 → v0.42.0
github.com/testcontainers/testcontainers-go/modules/postgres
v0.33.0 → v0.42.0
Indirect / transitive side effects:
- containerd/containerd v1.7.18 is REMOVED from the dependency graph.
Newer testcontainers-go depends on containerd/errdefs + log +
platforms sub-packages only, which do not carry GO-2025-4108 /
GO-2025-4100 / GO-2025-3528.
- docker/docker v27.1.1 is REMOVED from the dependency graph for the
same reason — it was reached only via testcontainers-go, and the
new version no longer pulls the full Moby engine. This eliminates
GO-2026-4887 and GO-2026-4883 (the two vulns with no upstream fix)
WITHOUT needing a govulncheck allowlist/exclude wrapper.
- quic-go/qpack, x/crypto, x/net, x/sync, x/sys, x/text, x/tools and
a handful of otel-* modules bumped as a coherent set.
- Transitive opentelemetry bump (otel v1.24.0 → v1.41.0) is expected
since testcontainers-go v0.42 pulls a newer instrumentation.
All 7 vulnerabilities previously reported are now resolved:
GO-2026-4887 docker/docker — vuln module removed
GO-2026-4883 docker/docker — vuln module removed
GO-2026-4815 x/image — fixed in v0.38.0
GO-2025-4233 quic-go — fixed in v0.57.0
GO-2025-4108 containerd — vuln module removed
GO-2025-4100 containerd — vuln module removed
GO-2025-3528 containerd — vuln module removed
Verification (local):
go build ./... OK
go vet ./... OK
govulncheck ./... OK (no findings)
VEZA_SKIP_INTEGRATION=1 go test ./internal/... -short OK
No breaking API changes observed from the testcontainers-go v0.33 →
v0.42 bump (the project only uses GenericContainer, DockerContainer
.Terminate, and modules/postgres which are stable across these
versions). The shared Redis testcontainer helper in internal/testutils
and the hard-delete worker integration test from J4 still compile and
pass.
This commit enables the v1.0.4 tag to be cut on a green CI. No J7
(release) commit is part of this change — that ships separately.
Refs: AUDIT_REPORT.md §10 P5 (test infra hygiene), CI run 98
2026-04-15 12:38:48 +00:00
|
|
|
golang.org/x/image v0.38.0 // indirect
|
|
|
|
|
golang.org/x/mod v0.33.0 // indirect
|
feat(observability): OTel SDK + collector + Tempo + 4 hot path spans (W2 Day 9)
Wires distributed tracing end-to-end. Backend exports OTLP/gRPC to a
collector, which tail-samples (errors + slow always, 10% rest) and
ships to Tempo. Grafana service-map dashboard pivots on the 4
instrumented hot paths.
- internal/tracing/otlp_exporter.go : InitOTLPTracer + Provider.Shutdown,
BatchSpanProcessor (5s/512 batch), ParentBased(TraceIDRatio) sampler,
W3C trace-context + baggage propagators. OTEL_SDK_DISABLED=true
short-circuits to a no-op. Failure to dial collector is non-fatal.
- cmd/api/main.go : init at boot, defer Shutdown(5s) on exit. appVersion
ldflag-overridable for resource attributes.
- 4 hot paths instrumented :
* handlers/auth.go::Login → "auth.login"
* core/track/track_upload_handler.go::InitiateChunkedUpload → "track.upload.initiate"
* core/marketplace/service.go::ProcessPaymentWebhook → "payment.webhook"
* handlers/search_handlers.go::Search → "search.query"
PII guarded — email masked, query content not recorded (length only).
- infra/ansible/roles/otel_collector : pin v0.116.1 contrib build,
systemd unit, tail-sampling config (errors + > 500ms always kept).
- infra/ansible/roles/tempo : pin v2.7.1 monolithic, local-disk backend
(S3 deferred to v1.1), 14d retention.
- infra/ansible/playbooks/observability.yml : provisions both Incus
containers + applies common baseline + roles in order.
- inventory/lab.yml : new groups observability, otel_collectors, tempo.
- config/grafana/dashboards/service-map.json : node graph + 4 hot-path
span tables + collector throughput/queue panels.
- docs/ENV_VARIABLES.md §30 : 4 OTEL_* env vars documented.
Acceptance criterion (Day 9) : login → span visible in Tempo UI. Lab
deployment to validate with `ansible-playbook -i inventory/lab.yml
playbooks/observability.yml` once roles/postgres_ha is up.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-27 23:15:11 +00:00
|
|
|
golang.org/x/net v0.52.0 // indirect
|
fix(deps): bump vulnerable modules to unblock govulncheck CI
Backend (Go) CI has been red for the entire v1.0.4 cleanup sprint (and
before it) because govulncheck reports 7 vulnerabilities in transitive
test-infrastructure deps, while the test suite itself passes cleanly.
Bump three direct dependencies to pull fixed versions of the affected
modules.
Direct bumps:
golang.org/x/image v0.36.0 → v0.38.0 (GO-2026-4815)
github.com/quic-go/quic-go v0.54.0 → v0.57.0 (GO-2025-4233)
github.com/testcontainers/testcontainers-go v0.33.0 → v0.42.0
github.com/testcontainers/testcontainers-go/modules/postgres
v0.33.0 → v0.42.0
Indirect / transitive side effects:
- containerd/containerd v1.7.18 is REMOVED from the dependency graph.
Newer testcontainers-go depends on containerd/errdefs + log +
platforms sub-packages only, which do not carry GO-2025-4108 /
GO-2025-4100 / GO-2025-3528.
- docker/docker v27.1.1 is REMOVED from the dependency graph for the
same reason — it was reached only via testcontainers-go, and the
new version no longer pulls the full Moby engine. This eliminates
GO-2026-4887 and GO-2026-4883 (the two vulns with no upstream fix)
WITHOUT needing a govulncheck allowlist/exclude wrapper.
- quic-go/qpack, x/crypto, x/net, x/sync, x/sys, x/text, x/tools and
a handful of otel-* modules bumped as a coherent set.
- Transitive opentelemetry bump (otel v1.24.0 → v1.41.0) is expected
since testcontainers-go v0.42 pulls a newer instrumentation.
All 7 vulnerabilities previously reported are now resolved:
GO-2026-4887 docker/docker — vuln module removed
GO-2026-4883 docker/docker — vuln module removed
GO-2026-4815 x/image — fixed in v0.38.0
GO-2025-4233 quic-go — fixed in v0.57.0
GO-2025-4108 containerd — vuln module removed
GO-2025-4100 containerd — vuln module removed
GO-2025-3528 containerd — vuln module removed
Verification (local):
go build ./... OK
go vet ./... OK
govulncheck ./... OK (no findings)
VEZA_SKIP_INTEGRATION=1 go test ./internal/... -short OK
No breaking API changes observed from the testcontainers-go v0.33 →
v0.42 bump (the project only uses GenericContainer, DockerContainer
.Terminate, and modules/postgres which are stable across these
versions). The shared Redis testcontainer helper in internal/testutils
and the hard-delete worker integration test from J4 still compile and
pass.
This commit enables the v1.0.4 tag to be cut on a green CI. No J7
(release) commit is part of this change — that ships separately.
Refs: AUDIT_REPORT.md §10 P5 (test infra hygiene), CI run 98
2026-04-15 12:38:48 +00:00
|
|
|
golang.org/x/sync v0.20.0 // indirect
|
|
|
|
|
golang.org/x/sys v0.42.0 // indirect
|
|
|
|
|
golang.org/x/text v0.35.0 // indirect
|
|
|
|
|
golang.org/x/tools v0.42.0 // indirect
|
feat(observability): OTel SDK + collector + Tempo + 4 hot path spans (W2 Day 9)
Wires distributed tracing end-to-end. Backend exports OTLP/gRPC to a
collector, which tail-samples (errors + slow always, 10% rest) and
ships to Tempo. Grafana service-map dashboard pivots on the 4
instrumented hot paths.
- internal/tracing/otlp_exporter.go : InitOTLPTracer + Provider.Shutdown,
BatchSpanProcessor (5s/512 batch), ParentBased(TraceIDRatio) sampler,
W3C trace-context + baggage propagators. OTEL_SDK_DISABLED=true
short-circuits to a no-op. Failure to dial collector is non-fatal.
- cmd/api/main.go : init at boot, defer Shutdown(5s) on exit. appVersion
ldflag-overridable for resource attributes.
- 4 hot paths instrumented :
* handlers/auth.go::Login → "auth.login"
* core/track/track_upload_handler.go::InitiateChunkedUpload → "track.upload.initiate"
* core/marketplace/service.go::ProcessPaymentWebhook → "payment.webhook"
* handlers/search_handlers.go::Search → "search.query"
PII guarded — email masked, query content not recorded (length only).
- infra/ansible/roles/otel_collector : pin v0.116.1 contrib build,
systemd unit, tail-sampling config (errors + > 500ms always kept).
- infra/ansible/roles/tempo : pin v2.7.1 monolithic, local-disk backend
(S3 deferred to v1.1), 14d retention.
- infra/ansible/playbooks/observability.yml : provisions both Incus
containers + applies common baseline + roles in order.
- inventory/lab.yml : new groups observability, otel_collectors, tempo.
- config/grafana/dashboards/service-map.json : node graph + 4 hot-path
span tables + collector throughput/queue panels.
- docs/ENV_VARIABLES.md §30 : 4 OTEL_* env vars documented.
Acceptance criterion (Day 9) : login → span visible in Tempo UI. Lab
deployment to validate with `ansible-playbook -i inventory/lab.yml
playbooks/observability.yml` once roles/postgres_ha is up.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-27 23:15:11 +00:00
|
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
|
|
|
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect
|
|
|
|
|
google.golang.org/grpc v1.80.0 // indirect
|
|
|
|
|
google.golang.org/protobuf v1.36.11 // indirect
|
2025-12-03 19:29:37 +00:00
|
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
|
|
|
)
|