Skip to content

build(deps): bump the dependencies group across 1 directory with 13 updates #234

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: master
Choose a base branch
from
Open

build(deps): bump the dependencies group across 1 directory with 13 updates #234

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
67 changes: 33 additions & 34 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,16 +1,16 @@
module github.com/ethpandaops/assertoor

go 1.25.7
go 1.26.0

@redpandabot redpandabot Bot Sep 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 go 1.26.0 directive vs pinned Go 1.25 toolchains

pressly/goose v3.28.0 declares go 1.26.0, forcing assertoor's go.mod directive up to 1.26.0, but every build path still pins Go 1.25: FROM golang:1.25 in Dockerfile/Dockerfile-local and go-version: 1.25.x in _shared-check.yaml (and 3x in _shared-build.yaml). The module can no longer be built by the pinned toolchains — it silently auto-downloads Go 1.26.0 at build time (failing outright offline or under GOTOOLCHAIN=local), so the Docker/CI pins should be raised to 1.26.x to match.


require (
github.com/donovanhide/eventsource v0.0.0-20210830082556-c59027999da0
github.com/dustin/go-humanize v1.0.1
github.com/ethereum/go-ethereum v1.17.4
github.com/ethereum/go-ethereum v1.17.5
github.com/ethpandaops/ethwallclock v0.4.0
github.com/ethpandaops/go-eth2-client v0.1.6
github.com/ethpandaops/service-authenticatoor v0.0.2
github.com/ethpandaops/spamoor v1.2.2
github.com/glebarez/go-sqlite v1.22.0
github.com/ethpandaops/go-eth2-client v0.1.7
github.com/ethpandaops/service-authenticatoor v0.0.3
github.com/ethpandaops/spamoor v1.2.3
github.com/glebarez/go-sqlite v1.23.0
github.com/golang-jwt/jwt/v5 v5.3.1
github.com/google/uuid v1.6.0
github.com/gorhill/cronexpr v0.0.0-20180427100037-88b0669f7d75
Expand All @@ -21,17 +21,17 @@ require (
github.com/jmoiron/sqlx v1.4.0
github.com/juliangruber/go-intersect v1.1.0
github.com/lib/pq v1.12.3
github.com/mashingan/smapping v0.1.19
github.com/pressly/goose/v3 v3.27.2
github.com/prometheus/client_golang v1.23.2
github.com/prometheus/client_model v0.6.2
github.com/prometheus/common v0.69.0
github.com/mashingan/smapping v0.1.20
github.com/pressly/goose/v3 v3.28.0
github.com/prometheus/client_golang v1.24.1
github.com/prometheus/client_model v0.6.3
github.com/prometheus/common v0.70.1
github.com/protolambda/zrnt v0.34.1
github.com/protolambda/ztyp v0.2.2
github.com/prysmaticlabs/go-bitfield v0.0.0-20240618144021-706c95b2dd15
github.com/rs/zerolog v1.35.1
github.com/santhosh-tekuri/jsonschema/v5 v5.3.1
github.com/sirupsen/logrus v1.9.4
github.com/sirupsen/logrus v1.10.2
github.com/spf13/cobra v1.10.2
github.com/spf13/pflag v1.0.10
github.com/swaggo/http-swagger v1.3.4
Expand All @@ -40,8 +40,8 @@ require (
github.com/urfave/negroni v1.0.0
github.com/wealdtech/go-eth2-types/v2 v2.8.2
github.com/wealdtech/go-eth2-util v1.8.2
golang.org/x/text v0.39.0
google.golang.org/protobuf v1.36.11
golang.org/x/text v0.41.0
google.golang.org/protobuf v1.36.12
gopkg.in/yaml.v2 v2.4.0
gopkg.in/yaml.v3 v3.0.1
)
Expand All @@ -55,20 +55,19 @@ require (
github.com/ProjectZKM/Ziren/crates/go-runtime/zkvm_runtime v0.0.0-20251001021608-1fe7b43fc4d6 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/bits-and-blooms/bitset v1.24.4 // indirect
github.com/casbin/govaluate v1.10.0 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect
github.com/consensys/gnark-crypto v0.20.1 // indirect
github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
github.com/crate-crypto/go-eth-kzg v1.5.0 // indirect
github.com/deckarep/golang-set/v2 v2.6.0 // indirect
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.3.0 // indirect
github.com/emicklei/dot v1.6.4 // indirect
github.com/ethereum/c-kzg-4844/v2 v2.1.6 // indirect
github.com/ethereum/c-kzg-4844/v2 v2.1.8 // indirect
github.com/ferranbt/fastssz v0.1.4 // indirect
github.com/fjl/geas v0.3.2 // indirect
github.com/fjl/jsonw v0.1.0 // indirect
github.com/fsnotify/fsnotify v1.9.0 // indirect
github.com/go-logr/logr v1.4.3 // indirect
github.com/go-logr/logr v1.4.4 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-ole/go-ole v1.3.0 // indirect
github.com/go-openapi/jsonpointer v0.21.1 // indirect
Expand All @@ -85,20 +84,20 @@ require (
github.com/klauspost/cpuid/v2 v2.3.0 // indirect
github.com/mailru/easyjson v0.9.0 // indirect
github.com/mattn/go-colorable v0.1.14 // indirect
github.com/mattn/go-isatty v0.0.21 // indirect
github.com/mattn/go-isatty v0.0.24 // indirect
github.com/mfridman/interpolate v0.0.2 // indirect
github.com/minio/sha256-simd v1.0.1 // indirect
github.com/mitchellh/mapstructure v1.5.0 // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/ncruces/go-strftime v1.0.0 // indirect
github.com/pk910/dynamic-ssz v1.3.2 // indirect
github.com/pk910/hashtree-bindings v0.2.2 // indirect
github.com/pk910/dynamic-ssz v1.3.3-0.20260812091520-ef568569f9c1 // indirect
github.com/pk910/hashtree-bindings v0.2.5 // indirect
github.com/pkg/errors v0.9.1 // indirect
github.com/prometheus/procfs v0.20.1 // indirect
github.com/prometheus/procfs v0.22.0 // indirect
github.com/protolambda/bls12-381-util v0.1.0 // indirect
github.com/r3labs/sse/v2 v2.10.0 // indirect
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
github.com/sethvargo/go-retry v0.3.0 // indirect
github.com/sethvargo/go-retry v0.4.0 // indirect
github.com/shirou/gopsutil v3.21.11+incompatible // indirect
github.com/supranational/blst v0.3.16 // indirect
github.com/swaggo/files v1.0.1 // indirect
Expand All @@ -108,20 +107,20 @@ require (
github.com/wealdtech/go-bytesutil v1.2.1 // indirect
github.com/yusufpapurcu/wmi v1.2.4 // indirect
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/otel v1.43.0 // indirect
go.opentelemetry.io/otel/metric v1.43.0 // indirect
go.opentelemetry.io/otel/trace v1.43.0 // indirect
go.opentelemetry.io/otel v1.46.0 // indirect
go.opentelemetry.io/otel/metric v1.46.0 // indirect
go.opentelemetry.io/otel/trace v1.46.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
golang.org/x/crypto v0.53.0 // indirect
golang.org/x/mod v0.37.0 // indirect
golang.org/x/net v0.56.0 // indirect
golang.org/x/sync v0.21.0 // indirect
golang.org/x/sys v0.46.0 // indirect
golang.org/x/crypto v0.55.0 // indirect

@redpandabot redpandabot Bot Sep 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 x/crypto v0.55.0 lands with known unpatched CVEs

OSV reports GO-2026-6354 (CVE-2026-78662) and GO-2026-6355 (CVE-2026-56855) — ssh channel DoS, both fixed only in x/crypto v0.56.0 — plus GO-2026-5932 (openpgp advisory) for the new version v0.55.0 this PR selects. v0.56.0 was published 2026-09-02, so the group bump should target it rather than 0.55.0 and leave the module on a known-vulnerable x/crypto.

golang.org/x/mod v0.38.0 // indirect
golang.org/x/net v0.58.0 // indirect
golang.org/x/sync v0.22.0 // indirect
golang.org/x/sys v0.47.0 // indirect
golang.org/x/time v0.15.0 // indirect
golang.org/x/tools v0.47.0 // indirect
golang.org/x/tools v0.48.0 // indirect
gopkg.in/cenkalti/backoff.v1 v1.1.0 // indirect
modernc.org/libc v1.73.4 // indirect
modernc.org/libc v1.75.6 // indirect
modernc.org/mathutil v1.7.1 // indirect
modernc.org/memory v1.11.0 // indirect
modernc.org/sqlite v1.53.0 // indirect
modernc.org/memory v1.12.1 // indirect
modernc.org/sqlite v1.57.0 // indirect
)
Loading
Loading