Skip to content

Commit 39ce932

Browse files
neogopherneogopher
committed
chore(cve-fix): bump vulnerable dependencies
Direct dependencies bumped: - google.golang.org/grpc v1.74.2 -> v1.83.2 (CVE-2026-33186 and others) - golang.org/x/net v0.47.0 -> v0.58.0 (CVE-2026-39821 and others) - golang.org/x/crypto v0.40.0 -> v0.56.0 (multiple x/crypto/ssh CVEs) - gopkg.in/src-d/go-git.v4 v4.13.1 -> github.com/go-git/go-git/v5 v5.19.2 (CVE-2023-49569, Path Traversal; go-git.v4 has no available fix and is unmaintained, so this is a migration to the maintained v5 module, not a version bump) Indirect fixes reached by bumping k8s.io/api, k8s.io/apimachinery, k8s.io/cli-runtime, k8s.io/client-go, k8s.io/component-base, and k8s.io/kubectl in lockstep to v0.35.8: - github.com/moby/spdystream v0.4.0 -> v0.5.1
1 parent 8ff6260 commit 39ce932

1,098 files changed

Lines changed: 136585 additions & 88477 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎go.mod‎

Lines changed: 44 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,6 @@
11
module github.com/loft-sh/devspace
22

3-
go 1.25.0
4-
5-
toolchain go1.25.9
3+
go 1.26.0
64

75
require (
86
github.com/AlecAivazis/survey/v2 v2.3.2
@@ -20,7 +18,8 @@ require (
2018
github.com/evanphx/json-patch/v5 v5.1.0
2119
github.com/fujiwara/shapeio v1.0.0
2220
github.com/gertd/go-pluralize v0.2.0
23-
github.com/gliderlabs/ssh v0.3.5
21+
github.com/gliderlabs/ssh v0.3.8
22+
github.com/go-git/go-git/v5 v5.19.2
2423
github.com/go-resty/resty/v2 v2.17.2
2524
github.com/google/go-containerregistry v0.20.6
2625
github.com/google/uuid v1.6.0
@@ -51,36 +50,38 @@ require (
5150
github.com/spf13/cobra v1.10.0
5251
github.com/spf13/pflag v1.0.10
5352
github.com/vmware-labs/yaml-jsonpath v0.3.2
54-
golang.org/x/crypto v0.44.0
55-
golang.org/x/net v0.47.0
56-
golang.org/x/text v0.31.0
57-
google.golang.org/grpc v1.74.2
58-
google.golang.org/protobuf v1.36.8
53+
golang.org/x/crypto v0.56.0
54+
golang.org/x/net v0.58.0
55+
golang.org/x/text v0.41.0
56+
google.golang.org/grpc v1.83.2
57+
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af
5958
gopkg.in/natefinch/lumberjack.v2 v2.0.0
60-
gopkg.in/src-d/go-git.v4 v4.13.1
6159
gopkg.in/yaml.v3 v3.0.1
6260
gotest.tools v2.2.0+incompatible
63-
k8s.io/api v0.35.0
64-
k8s.io/apimachinery v0.35.0
65-
k8s.io/client-go v0.35.0
61+
k8s.io/api v0.35.8
62+
k8s.io/apimachinery v0.35.8
63+
k8s.io/client-go v0.35.8
6664
k8s.io/klog v1.0.0
6765
k8s.io/klog/v2 v2.130.1
68-
k8s.io/kubectl v0.35.0
66+
k8s.io/kubectl v0.35.8
6967
mvdan.cc/sh/v3 v3.5.1
7068
sigs.k8s.io/yaml v1.6.0
7169
)
7270

7371
require (
74-
cloud.google.com/go/compute/metadata v0.7.0 // indirect
72+
cloud.google.com/go/compute/metadata v0.9.0 // indirect
73+
dario.cat/mergo v1.0.0 // indirect
7574
github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
7675
github.com/MakeNowJust/heredoc v1.0.0 // indirect
7776
github.com/Masterminds/semver/v3 v3.4.0 // indirect
7877
github.com/Microsoft/go-winio v0.6.2 // indirect
78+
github.com/ProtonMail/go-crypto v1.1.6 // indirect
7979
github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect
8080
github.com/beorn7/perks v1.0.1 // indirect
8181
github.com/blang/semver/v4 v4.0.0 // indirect
8282
github.com/cespare/xxhash/v2 v2.3.0 // indirect
8383
github.com/chai2010/gettext-go v1.0.2 // indirect
84+
github.com/cloudflare/circl v1.6.3 // indirect
8485
github.com/containerd/console v1.0.3 // indirect
8586
github.com/containerd/containerd v1.6.18 // indirect
8687
github.com/containerd/continuity v0.3.0 // indirect
@@ -90,6 +91,7 @@ require (
9091
github.com/containerd/stargz-snapshotter/estargz v0.16.3 // indirect
9192
github.com/containerd/typeurl v1.0.2 // indirect
9293
github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
94+
github.com/cyphar/filepath-securejoin v0.6.1 // indirect
9395
github.com/davecgh/go-spew v1.1.1 // indirect
9496
github.com/distribution/distribution/v3 v3.0.0-20210316161203-a01c71e2477e // indirect
9597
github.com/docker/distribution v2.8.3+incompatible // indirect
@@ -98,11 +100,13 @@ require (
98100
github.com/docker/go-units v0.5.0 // indirect
99101
github.com/dprotaso/go-yit v0.0.0-20191028211022-135eb7262960 // indirect
100102
github.com/emicklei/go-restful/v3 v3.12.2 // indirect
101-
github.com/emirpasic/gods v1.12.0 // indirect
103+
github.com/emirpasic/gods v1.18.1 // indirect
102104
github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f // indirect
103105
github.com/felixge/httpsnoop v1.0.4 // indirect
104106
github.com/fxamacker/cbor/v2 v2.9.0 // indirect
105107
github.com/go-errors/errors v1.4.2 // indirect
108+
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
109+
github.com/go-git/go-billy/v5 v5.9.0 // indirect
106110
github.com/go-logr/logr v1.4.3 // indirect
107111
github.com/go-logr/stdr v1.2.2 // indirect
108112
github.com/go-openapi/jsonpointer v0.21.0 // indirect
@@ -112,6 +116,7 @@ require (
112116
github.com/gofrs/flock v0.8.1 // indirect
113117
github.com/gogo/googleapis v1.4.1 // indirect
114118
github.com/gogo/protobuf v1.3.2 // indirect
119+
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
115120
github.com/golang/protobuf v1.5.4 // indirect
116121
github.com/google/btree v1.1.3 // indirect
117122
github.com/google/gnostic-models v0.7.0 // indirect
@@ -131,10 +136,12 @@ require (
131136
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
132137
github.com/josharian/intern v1.0.0 // indirect
133138
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
134-
github.com/kevinburke/ssh_config v0.0.0-20190725054713-01f96b0aa0cd // indirect
139+
github.com/kevinburke/ssh_config v1.2.0 // indirect
135140
github.com/klauspost/compress v1.18.0 // indirect
141+
github.com/klauspost/cpuid/v2 v2.3.0 // indirect
136142
github.com/klauspost/pgzip v1.2.6 // indirect
137143
github.com/kr/fs v0.1.0 // indirect
144+
github.com/kr/pty v1.1.8 // indirect
138145
github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
139146
github.com/mailru/easyjson v0.7.7 // indirect
140147
github.com/mattn/go-colorable v0.1.13 // indirect
@@ -145,7 +152,7 @@ require (
145152
github.com/mitchellh/mapstructure v1.4.3 // indirect
146153
github.com/moby/docker-image-spec v1.3.1 // indirect
147154
github.com/moby/go-archive v0.1.0 // indirect
148-
github.com/moby/spdystream v0.5.0 // indirect
155+
github.com/moby/spdystream v0.5.1 // indirect
149156
github.com/moby/sys/atomicwriter v0.1.0 // indirect
150157
github.com/moby/sys/capability v0.4.0 // indirect
151158
github.com/moby/sys/mountinfo v0.7.2 // indirect
@@ -165,13 +172,14 @@ require (
165172
github.com/opencontainers/runtime-spec v1.2.1 // indirect
166173
github.com/otiai10/mint v1.6.3 // indirect
167174
github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
175+
github.com/pjbgf/sha1cd v0.6.0 // indirect
168176
github.com/prometheus/client_golang v1.23.2 // indirect
169177
github.com/prometheus/client_model v0.6.2 // indirect
170178
github.com/prometheus/common v0.66.1 // indirect
171179
github.com/prometheus/procfs v0.16.1 // indirect
172180
github.com/russross/blackfriday/v2 v2.1.0 // indirect
173-
github.com/sergi/go-diff v1.2.0 // indirect
174-
github.com/src-d/gcfg v1.4.0 // indirect
181+
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
182+
github.com/skeema/knownhosts v1.3.1 // indirect
175183
github.com/syncthing/notify v0.0.0-20250528144937-c7027d4f7465 // indirect
176184
github.com/tcnksm/go-gitconfig v0.1.2 // indirect
177185
github.com/tonistiigi/fsutil v0.0.0-20230105215944-fb433841cbfa // indirect
@@ -180,38 +188,37 @@ require (
180188
github.com/ulikunitz/xz v0.5.15 // indirect
181189
github.com/vbatts/tar-split v0.12.1 // indirect
182190
github.com/x448/float16 v0.8.4 // indirect
183-
github.com/xanzy/ssh-agent v0.2.1 // indirect
191+
github.com/xanzy/ssh-agent v0.3.3 // indirect
184192
github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // indirect
185193
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
186194
github.com/xeipuuv/gojsonschema v1.2.0 // indirect
187195
github.com/xlab/treeprint v1.2.0 // indirect
188-
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
196+
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
189197
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.29.0 // indirect
190198
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
191-
go.opentelemetry.io/otel v1.36.0 // indirect
199+
go.opentelemetry.io/otel v1.44.0 // indirect
192200
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 // indirect
193-
go.opentelemetry.io/otel/metric v1.36.0 // indirect
194-
go.opentelemetry.io/otel/sdk v1.36.0 // indirect
195-
go.opentelemetry.io/otel/trace v1.36.0 // indirect
201+
go.opentelemetry.io/otel/metric v1.44.0 // indirect
202+
go.opentelemetry.io/otel/sdk v1.44.0 // indirect
203+
go.opentelemetry.io/otel/trace v1.44.0 // indirect
196204
go.opentelemetry.io/proto/otlp v1.5.0 // indirect
197205
go.yaml.in/yaml/v2 v2.4.3 // indirect
198206
go.yaml.in/yaml/v3 v3.0.4 // indirect
199-
golang.org/x/mod v0.29.0 // indirect
200-
golang.org/x/oauth2 v0.30.0 // indirect
201-
golang.org/x/sync v0.18.0 // indirect
202-
golang.org/x/sys v0.38.0 // indirect
203-
golang.org/x/term v0.37.0 // indirect
207+
golang.org/x/mod v0.38.0 // indirect
208+
golang.org/x/oauth2 v0.36.0 // indirect
209+
golang.org/x/sync v0.22.0 // indirect
210+
golang.org/x/sys v0.47.0 // indirect
211+
golang.org/x/term v0.45.0 // indirect
204212
golang.org/x/time v0.12.0 // indirect
205-
golang.org/x/tools v0.38.0 // indirect
206-
google.golang.org/genproto/googleapis/api v0.0.0-20250528174236-200df99c418a // indirect
207-
google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a // indirect
213+
golang.org/x/tools v0.48.0 // indirect
214+
google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
215+
google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
208216
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
209217
gopkg.in/inf.v0 v0.9.1 // indirect
210-
gopkg.in/src-d/go-billy.v4 v4.3.2 // indirect
211218
gopkg.in/warnings.v0 v0.1.2 // indirect
212219
gopkg.in/yaml.v2 v2.4.0 // indirect
213-
k8s.io/cli-runtime v0.35.0 // indirect
214-
k8s.io/component-base v0.35.0 // indirect
220+
k8s.io/cli-runtime v0.35.8 // indirect
221+
k8s.io/component-base v0.35.8 // indirect
215222
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
216223
k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect
217224
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect

0 commit comments

Comments
 (0)