3d1f127ad0
Backend (Go) CI has been red for the entire v1.0.4 cleanup sprint (and
before it) because govulncheck reports 7 vulnerabilities in transitive
test-infrastructure deps, while the test suite itself passes cleanly.
Bump three direct dependencies to pull fixed versions of the affected
modules.
Direct bumps:
golang.org/x/image v0.36.0 → v0.38.0 (GO-2026-4815)
github.com/quic-go/quic-go v0.54.0 → v0.57.0 (GO-2025-4233)
github.com/testcontainers/testcontainers-go v0.33.0 → v0.42.0
github.com/testcontainers/testcontainers-go/modules/postgres
v0.33.0 → v0.42.0
Indirect / transitive side effects:
- containerd/containerd v1.7.18 is REMOVED from the dependency graph.
Newer testcontainers-go depends on containerd/errdefs + log +
platforms sub-packages only, which do not carry GO-2025-4108 /
GO-2025-4100 / GO-2025-3528.
- docker/docker v27.1.1 is REMOVED from the dependency graph for the
same reason — it was reached only via testcontainers-go, and the
new version no longer pulls the full Moby engine. This eliminates
GO-2026-4887 and GO-2026-4883 (the two vulns with no upstream fix)
WITHOUT needing a govulncheck allowlist/exclude wrapper.
- quic-go/qpack, x/crypto, x/net, x/sync, x/sys, x/text, x/tools and
a handful of otel-* modules bumped as a coherent set.
- Transitive opentelemetry bump (otel v1.24.0 → v1.41.0) is expected
since testcontainers-go v0.42 pulls a newer instrumentation.
All 7 vulnerabilities previously reported are now resolved:
GO-2026-4887 docker/docker — vuln module removed
GO-2026-4883 docker/docker — vuln module removed
GO-2026-4815 x/image — fixed in v0.38.0
GO-2025-4233 quic-go — fixed in v0.57.0
GO-2025-4108 containerd — vuln module removed
GO-2025-4100 containerd — vuln module removed
GO-2025-3528 containerd — vuln module removed
Verification (local):
go build ./... OK
go vet ./... OK
govulncheck ./... OK (no findings)
VEZA_SKIP_INTEGRATION=1 go test ./internal/... -short OK
No breaking API changes observed from the testcontainers-go v0.33 →
v0.42 bump (the project only uses GenericContainer, DockerContainer
.Terminate, and modules/postgres which are stable across these
versions). The shared Redis testcontainer helper in internal/testutils
and the hard-delete worker integration test from J4 still compile and
pass.
This commit enables the v1.0.4 tag to be cut on a green CI. No J7
(release) commit is part of this change — that ships separately.
Refs: AUDIT_REPORT.md §10 P5 (test infra hygiene), CI run 98
168 lines
7.7 KiB
Modula-2
168 lines
7.7 KiB
Modula-2
module veza-backend-api
|
|
|
|
go 1.25.0
|
|
|
|
require (
|
|
github.com/BurntSushi/toml v1.6.0
|
|
github.com/DATA-DOG/go-sqlmock v1.5.2
|
|
github.com/SherClockHolmes/webpush-go v1.4.0
|
|
github.com/aws/aws-sdk-go-v2 v1.41.0
|
|
github.com/aws/aws-sdk-go-v2/config v1.32.6
|
|
github.com/aws/aws-sdk-go-v2/credentials v1.19.6
|
|
github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.18
|
|
github.com/aws/aws-sdk-go-v2/service/s3 v1.95.0
|
|
github.com/coder/websocket v1.8.14
|
|
github.com/dhowden/tag v0.0.0-20240417053706-3d75831295e8
|
|
github.com/disintegration/imaging v1.6.2
|
|
github.com/elastic/go-elasticsearch/v8 v8.11.0
|
|
github.com/fsnotify/fsnotify v1.9.0
|
|
github.com/getsentry/sentry-go v0.40.0
|
|
github.com/gin-gonic/gin v1.11.0
|
|
github.com/go-pdf/fpdf v0.9.0
|
|
github.com/go-playground/validator/v10 v10.27.0
|
|
github.com/golang-jwt/jwt/v5 v5.3.0
|
|
github.com/google/uuid v1.6.0
|
|
github.com/joho/godotenv v1.5.1
|
|
github.com/lib/pq v1.10.9
|
|
github.com/pquerna/otp v1.5.0
|
|
github.com/prometheus/client_golang v1.22.0
|
|
github.com/prometheus/client_model v0.6.2
|
|
github.com/prometheus/common v0.63.0
|
|
github.com/rabbitmq/amqp091-go v1.10.0
|
|
github.com/redis/go-redis/v9 v9.16.0
|
|
github.com/sony/gobreaker v1.0.0
|
|
github.com/stretchr/testify v1.11.1
|
|
github.com/stripe/stripe-go/v82 v82.5.1
|
|
github.com/swaggo/files v1.0.1
|
|
github.com/swaggo/gin-swagger v1.6.1
|
|
github.com/swaggo/swag v1.16.6
|
|
github.com/testcontainers/testcontainers-go v0.42.0
|
|
github.com/testcontainers/testcontainers-go/modules/postgres v0.42.0
|
|
go.uber.org/goleak v1.3.0
|
|
go.uber.org/zap v1.27.0
|
|
golang.org/x/crypto v0.48.0
|
|
golang.org/x/oauth2 v0.30.0
|
|
golang.org/x/time v0.12.0
|
|
gopkg.in/natefinch/lumberjack.v2 v2.2.1
|
|
gorm.io/driver/postgres v1.6.0
|
|
gorm.io/driver/sqlite v1.6.0
|
|
gorm.io/gorm v1.30.0
|
|
)
|
|
|
|
require (
|
|
cloud.google.com/go/compute/metadata v0.3.0 // indirect
|
|
dario.cat/mergo v1.0.2 // indirect
|
|
github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
|
|
github.com/KyleBanks/depth v1.2.1 // indirect
|
|
github.com/Microsoft/go-winio v0.6.2 // indirect
|
|
github.com/PuerkitoBio/purell v1.1.1 // indirect
|
|
github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect
|
|
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.16 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.16 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.16 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.16 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.7 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.16 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.16 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/signin v1.0.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sso v1.30.8 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.12 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sts v1.41.5 // indirect
|
|
github.com/aws/smithy-go v1.24.0 // indirect
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/boombuler/barcode v1.0.1 // indirect
|
|
github.com/bytedance/sonic v1.14.0 // indirect
|
|
github.com/bytedance/sonic/loader v0.3.0 // indirect
|
|
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/cloudwego/base64x v0.1.6 // indirect
|
|
github.com/containerd/errdefs v1.0.0 // indirect
|
|
github.com/containerd/errdefs/pkg v0.3.0 // indirect
|
|
github.com/containerd/log v0.1.0 // indirect
|
|
github.com/containerd/platforms v0.2.1 // indirect
|
|
github.com/cpuguy83/dockercfg v0.3.2 // indirect
|
|
github.com/davecgh/go-spew v1.1.1 // indirect
|
|
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
|
|
github.com/distribution/reference v0.6.0 // indirect
|
|
github.com/docker/go-connections v0.6.0 // indirect
|
|
github.com/docker/go-units v0.5.0 // indirect
|
|
github.com/ebitengine/purego v0.10.0 // indirect
|
|
github.com/elastic/elastic-transport-go/v8 v8.3.0 // indirect
|
|
github.com/felixge/httpsnoop v1.0.4 // indirect
|
|
github.com/gabriel-vasile/mimetype v1.4.8 // indirect
|
|
github.com/gin-contrib/sse v1.1.0 // indirect
|
|
github.com/go-logr/logr v1.4.3 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/go-ole/go-ole v1.2.6 // indirect
|
|
github.com/go-openapi/jsonpointer v0.21.0 // indirect
|
|
github.com/go-openapi/jsonreference v0.19.6 // indirect
|
|
github.com/go-openapi/spec v0.20.4 // indirect
|
|
github.com/go-openapi/swag v0.23.0 // indirect
|
|
github.com/go-playground/locales v0.14.1 // indirect
|
|
github.com/go-playground/universal-translator v0.18.1 // indirect
|
|
github.com/goccy/go-json v0.10.2 // indirect
|
|
github.com/goccy/go-yaml v1.18.0 // indirect
|
|
github.com/jackc/pgpassfile v1.0.0 // indirect
|
|
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
|
|
github.com/jackc/pgx/v5 v5.6.0 // indirect
|
|
github.com/jackc/puddle/v2 v2.2.2 // indirect
|
|
github.com/jinzhu/inflection v1.0.0 // indirect
|
|
github.com/jinzhu/now v1.1.5 // indirect
|
|
github.com/josharian/intern v1.0.0 // indirect
|
|
github.com/json-iterator/go v1.1.12 // indirect
|
|
github.com/klauspost/compress v1.18.5 // indirect
|
|
github.com/klauspost/cpuid/v2 v2.3.0 // indirect
|
|
github.com/leodido/go-urn v1.4.0 // indirect
|
|
github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
|
|
github.com/magiconair/properties v1.8.10 // indirect
|
|
github.com/mailru/easyjson v0.7.7 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/mattn/go-sqlite3 v1.14.22 // indirect
|
|
github.com/moby/docker-image-spec v1.3.1 // indirect
|
|
github.com/moby/go-archive v0.2.0 // indirect
|
|
github.com/moby/moby/api v1.54.1 // indirect
|
|
github.com/moby/moby/client v0.4.0 // indirect
|
|
github.com/moby/patternmatcher v0.6.1 // indirect
|
|
github.com/moby/sys/sequential v0.6.0 // indirect
|
|
github.com/moby/sys/user v0.4.0 // indirect
|
|
github.com/moby/sys/userns v0.1.0 // indirect
|
|
github.com/moby/term v0.5.2 // indirect
|
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
|
github.com/modern-go/reflect2 v1.0.2 // indirect
|
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
|
github.com/opencontainers/go-digest v1.0.0 // indirect
|
|
github.com/opencontainers/image-spec v1.1.1 // indirect
|
|
github.com/pelletier/go-toml/v2 v2.2.4 // indirect
|
|
github.com/pmezard/go-difflib v1.0.0 // indirect
|
|
github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
|
|
github.com/prometheus/procfs v0.16.1 // indirect
|
|
github.com/quic-go/qpack v0.6.0 // indirect
|
|
github.com/quic-go/quic-go v0.57.0 // indirect
|
|
github.com/shirou/gopsutil/v4 v4.26.3 // indirect
|
|
github.com/sirupsen/logrus v1.9.4 // indirect
|
|
github.com/stretchr/objx v0.5.3 // indirect
|
|
github.com/tklauser/go-sysconf v0.3.16 // indirect
|
|
github.com/tklauser/numcpus v0.11.0 // indirect
|
|
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
|
|
github.com/ugorji/go/codec v1.3.0 // indirect
|
|
github.com/yusufpapurcu/wmi v1.2.4 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
|
|
go.opentelemetry.io/otel v1.41.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.41.0 // indirect
|
|
go.opentelemetry.io/otel/trace v1.41.0 // indirect
|
|
go.uber.org/multierr v1.10.0 // indirect
|
|
golang.org/x/arch v0.20.0 // indirect
|
|
golang.org/x/image v0.38.0 // indirect
|
|
golang.org/x/mod v0.33.0 // indirect
|
|
golang.org/x/net v0.50.0 // indirect
|
|
golang.org/x/sync v0.20.0 // indirect
|
|
golang.org/x/sys v0.42.0 // indirect
|
|
golang.org/x/text v0.35.0 // indirect
|
|
golang.org/x/tools v0.42.0 // indirect
|
|
google.golang.org/protobuf v1.36.9 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
)
|