egutierrez
a3ac58fb70
govulncheck reported 16 reachable vulnerabilities (re-audit finding N1, report 0006): 14 in github.com/nats-io/nats-server/v2@v2.10.22 -- the embedded NATS server, which is exposed to the internet in the chosen deployment -- and 2 in the Go standard library (GO-2026-5039 net/textproto, GO-2026-5037 crypto/x509). Changes: - go get github.com/nats-io/nats-server/v2@v2.11.15 (covers all 14 server CVEs; pulls nats.go v1.49.0, nkeys v0.4.15, jwt v2.8.1, klauspost/compress v1.18.4 and friends transitively). - go directive 1.25.0 -> 1.26.4 so the toolchain ships the two stdlib fixes. This is a go.mod/go.sum change justified purely by CVE remediation; it is the explicit exception to the "do not touch deps" rule for a CVE bump. Verification: - CGO_ENABLED=0 go build ./... && go vet ./... && go test -count=1 ./... -> green, including the 0003 multi-node cluster/JetStream e2e in pkg/embeddednats, so the server bump did not break the cluster or the durable plane. - govulncheck ./... -> "No vulnerabilities found" (0 reachable; the 13 that remain are in required-but-not-called modules). Refs: report 0006 N1, issue 0005a. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
41 lines
1.4 KiB
Modula-2
41 lines
1.4 KiB
Modula-2
module github.com/enmanuel/unibus
|
|
|
|
go 1.26.4
|
|
|
|
replace fn-registry => ../../../../
|
|
|
|
require (
|
|
fn-registry v0.0.0-00010101000000-000000000000
|
|
github.com/nats-io/nats-server/v2 v2.11.15
|
|
github.com/nats-io/nats.go v1.49.0
|
|
github.com/nats-io/nkeys v0.4.15
|
|
github.com/oklog/ulid/v2 v2.1.0
|
|
golang.org/x/time v0.15.0
|
|
modernc.org/sqlite v1.47.0
|
|
)
|
|
|
|
require (
|
|
github.com/antithesishq/antithesis-sdk-go v0.6.0-default-no-op // indirect
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/google/go-tpm v0.9.8 // indirect
|
|
github.com/google/uuid v1.6.0 // indirect
|
|
github.com/klauspost/compress v1.18.4 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/minio/highwayhash v1.0.4-0.20251030100505-070ab1a87a76 // indirect
|
|
github.com/nats-io/jwt/v2 v2.8.1 // indirect
|
|
github.com/nats-io/nuid v1.0.1 // indirect
|
|
github.com/ncruces/go-strftime v1.0.0 // indirect
|
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
|
golang.org/x/crypto v0.51.0 // indirect
|
|
golang.org/x/mobile v0.0.0-20260602190626-68735029466e // indirect
|
|
golang.org/x/mod v0.36.0 // indirect
|
|
golang.org/x/sync v0.20.0 // indirect
|
|
golang.org/x/sys v0.44.0 // indirect
|
|
golang.org/x/tools v0.45.0 // indirect
|
|
modernc.org/libc v1.70.0 // indirect
|
|
modernc.org/mathutil v1.7.1 // indirect
|
|
modernc.org/memory v1.11.0 // indirect
|
|
)
|
|
|
|
tool golang.org/x/mobile/cmd/gomobile
|