Skip to content

Commit 421be98

Browse files
liamfallonliamfallon
authored
Upgrade Porch to address vulnerabilities (kptdev#519)
* Upgrade cloudfare from v1.6.1 to v1.6.3 Signed-off-by: liamfallon <liam.fallon@est.tech> * Upgrade go-git as well Signed-off-by: liamfallon <liam.fallon@est.tech> * Fix test so that Git test repo is created and cleaned on each test iteration Signed-off-by: liamfallon <liam.fallon@est.tech> * Address copilot comments Signed-off-by: liamfallon <liam.fallon@est.tech> * Updated tests for new version of otel Signed-off-by: liamfallon <liam.fallon@est.tech> * Upgrade dependencies Signed-off-by: liamfallon <liam.fallon@est.tech> * Update some more dependencies Signed-off-by: liamfallon <liam.fallon@est.tech> * Addres copilot comment Signed-off-by: liamfallon <liam.fallon@est.tech> --------- Signed-off-by: liamfallon <liam.fallon@est.tech>
1 parent cc8230b commit 421be98

4 files changed

Lines changed: 191 additions & 196 deletions

File tree

‎go.mod‎

Lines changed: 42 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,14 @@ require (
88
cloud.google.com/go/iam v1.5.3
99
github.com/fergusstrange/embedded-postgres v1.32.0
1010
github.com/fsnotify/fsnotify v1.9.0
11-
github.com/go-git/go-billy/v5 v5.6.2
12-
github.com/go-git/go-git/v5 v5.16.5
11+
github.com/go-git/go-billy/v5 v5.8.0
12+
github.com/go-git/go-git/v5 v5.17.2
1313
github.com/golang/protobuf v1.5.4
1414
github.com/google/cel-go v0.26.1
1515
github.com/google/go-cmp v0.7.0
1616
github.com/google/go-containerregistry v0.20.6
1717
github.com/google/uuid v1.6.0
18-
github.com/jackc/pgx/v5 v5.7.6
18+
github.com/jackc/pgx/v5 v5.9.1
1919
github.com/kptdev/kpt v1.0.0-beta.61.1
2020
github.com/kptdev/krm-functions-catalog/functions/go/apply-replacements v0.1.5
2121
github.com/kptdev/krm-functions-catalog/functions/go/set-namespace v0.4.5
@@ -38,13 +38,13 @@ require (
3838
go.opentelemetry.io/otel/sdk v1.43.0
3939
go.opentelemetry.io/otel/sdk/metric v1.43.0
4040
go.opentelemetry.io/otel/trace v1.43.0
41-
go.opentelemetry.io/proto/otlp v1.9.0
41+
go.opentelemetry.io/proto/otlp v1.10.0
4242
golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546
43-
golang.org/x/oauth2 v0.34.0
43+
golang.org/x/oauth2 v0.36.0
4444
google.golang.org/api v0.254.0
4545
google.golang.org/genproto v0.0.0-20251103181224-f26f9409b101
46-
google.golang.org/grpc v1.79.3
47-
google.golang.org/protobuf v1.36.10
46+
google.golang.org/grpc v1.80.0
47+
google.golang.org/protobuf v1.36.11
4848
gopkg.in/yaml.v2 v2.4.0
4949
gopkg.in/yaml.v3 v3.0.1
5050
k8s.io/api v0.34.1
@@ -79,30 +79,29 @@ require (
7979
github.com/regclient/regclient v0.11.1 // indirect
8080
github.com/ulikunitz/xz v0.5.15 // indirect
8181
go.starlark.net v0.0.0-20251029211736-7849196f18cf // indirect
82-
golang.org/x/mod v0.30.0 // indirect
83-
golang.org/x/tools v0.39.0 // indirect
82+
golang.org/x/mod v0.34.0 // indirect
83+
golang.org/x/tools v0.43.0 // indirect
8484
sigs.k8s.io/kustomize/api v0.20.1 // indirect
8585
)
8686

8787
require (
88-
github.com/grafana/regexp v0.0.0-20240518133315-a468a5bfb3bc // indirect
89-
github.com/prometheus/otlptranslator v0.0.2 // indirect
90-
go.opentelemetry.io/contrib/propagators/aws v1.38.0 // indirect
91-
go.opentelemetry.io/contrib/propagators/b3 v1.38.0 // indirect
92-
go.opentelemetry.io/contrib/propagators/jaeger v1.38.0 // indirect
93-
go.opentelemetry.io/contrib/propagators/ot v1.38.0 // indirect
94-
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.14.0 // indirect
95-
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.14.0 // indirect
96-
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.38.0 // indirect
97-
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.38.0 // indirect
98-
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0 // indirect
99-
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.38.0 // indirect
100-
go.opentelemetry.io/otel/exporters/prometheus v0.60.0 // indirect
101-
go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.14.0 // indirect
102-
go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.38.0 // indirect
103-
go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.38.0 // indirect
104-
go.opentelemetry.io/otel/log v0.14.0 // indirect
105-
go.opentelemetry.io/otel/sdk/log v0.14.0 // indirect
88+
github.com/prometheus/otlptranslator v1.0.0 // indirect
89+
go.opentelemetry.io/contrib/propagators/aws v1.43.0 // indirect
90+
go.opentelemetry.io/contrib/propagators/b3 v1.43.0 // indirect
91+
go.opentelemetry.io/contrib/propagators/jaeger v1.43.0 // indirect
92+
go.opentelemetry.io/contrib/propagators/ot v1.43.0 // indirect
93+
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0 // indirect
94+
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.19.0 // indirect
95+
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0 // indirect
96+
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 // indirect
97+
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 // indirect
98+
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 // indirect
99+
go.opentelemetry.io/otel/exporters/prometheus v0.65.0 // indirect
100+
go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.19.0 // indirect
101+
go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.43.0 // indirect
102+
go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.43.0 // indirect
103+
go.opentelemetry.io/otel/log v0.19.0 // indirect
104+
go.opentelemetry.io/otel/sdk/log v0.19.0 // indirect
106105
)
107106

108107
require (
@@ -125,13 +124,13 @@ require (
125124
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
126125
github.com/cespare/xxhash/v2 v2.3.0 // indirect
127126
github.com/chai2010/gettext-go v1.0.3 // indirect
128-
github.com/cloudflare/circl v1.6.1 // indirect
127+
github.com/cloudflare/circl v1.6.3 // indirect
129128
github.com/containerd/stargz-snapshotter/estargz v0.18.0 // indirect
130129
github.com/coreos/go-semver v0.3.1 // indirect
131130
github.com/coreos/go-systemd/v22 v22.6.0 // indirect
132131
github.com/cyphar/filepath-securejoin v0.6.0 // indirect
133132
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
134-
github.com/docker/cli v28.5.1+incompatible // indirect
133+
github.com/docker/cli v29.4.0+incompatible // indirect
135134
github.com/docker/distribution v2.8.3+incompatible // indirect
136135
github.com/docker/docker-credential-helpers v0.9.4 // indirect
137136
github.com/dustmop/soup v1.1.2-0.20190516214245-38228baa104e // indirect
@@ -171,7 +170,7 @@ require (
171170
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
172171
github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
173172
github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
174-
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.3 // indirect
173+
github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
175174
github.com/inconshreveable/mousetrap v1.1.0 // indirect
176175
github.com/jackc/pgpassfile v1.0.0 // indirect
177176
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
@@ -202,8 +201,8 @@ require (
202201
github.com/pjbgf/sha1cd v0.5.0 // indirect
203202
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
204203
github.com/prometheus/client_model v0.6.2 // indirect
205-
github.com/prometheus/common v0.67.2 // indirect
206-
github.com/prometheus/procfs v0.19.2 // indirect
204+
github.com/prometheus/common v0.67.5 // indirect
205+
github.com/prometheus/procfs v0.20.1 // indirect
207206
github.com/russross/blackfriday/v2 v2.1.0 // indirect
208207
github.com/sergi/go-diff v1.4.0 // indirect
209208
github.com/sirupsen/logrus v1.9.3 // indirect
@@ -220,22 +219,22 @@ require (
220219
go.etcd.io/etcd/client/v3 v3.6.5 // indirect
221220
go.mongodb.org/mongo-driver v1.17.6 // indirect
222221
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
223-
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 // indirect
222+
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect
224223
go.opentelemetry.io/otel/metric v1.43.0 // indirect
225224
go.uber.org/multierr v1.11.0 // indirect
226225
go.uber.org/zap v1.27.0 // indirect
227-
go.yaml.in/yaml/v2 v2.4.3 // indirect
226+
go.yaml.in/yaml/v2 v2.4.4 // indirect
228227
go.yaml.in/yaml/v3 v3.0.4 // indirect
229-
golang.org/x/crypto v0.46.0 // indirect
230-
golang.org/x/net v0.48.0 // indirect
231-
golang.org/x/sync v0.19.0 // indirect
232-
golang.org/x/sys v0.42.0 // indirect
233-
golang.org/x/term v0.38.0 // indirect
234-
golang.org/x/text v0.32.0 // indirect
235-
golang.org/x/time v0.14.0 // indirect
228+
golang.org/x/crypto v0.49.0 // indirect
229+
golang.org/x/net v0.52.0 // indirect
230+
golang.org/x/sync v0.20.0 // indirect
231+
golang.org/x/sys v0.43.0 // indirect
232+
golang.org/x/term v0.42.0 // indirect
233+
golang.org/x/text v0.36.0 // indirect
234+
golang.org/x/time v0.15.0 // indirect
236235
gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
237-
google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect
238-
google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
236+
google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
237+
google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect
239238
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
240239
gopkg.in/inf.v0 v0.9.1 // indirect
241240
gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect

0 commit comments

Comments
 (0)