fix(deps): update all by renovate[bot] · Pull Request #319 · moul/sshportal

renovate · 2022-02-09T03:15:30Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
actions/cache	action	patch	`v2.1.7` → `v2.1.8`
github.com/asaskevich/govalidator	require	digest	`f21760c` → `a9d515a`
github.com/dustin/go-humanize	require	patch	`v1.0.0` → `v1.0.1`
github.com/gliderlabs/ssh	require	patch	`v0.3.3` → `v0.3.8`
github.com/go-gormigrate/gormigrate/v2	require	minor	`v2.0.0` → `v2.1.6`
github.com/reiver/go-telnet	require	digest	`9ff0b2a` → `7da9ad7`
github.com/smartystreets/goconvey	require	minor	`v1.7.2` → `v1.8.1`
github.com/tailscale/depaware	require	digest	`720c4b4` → `835d31c`
github.com/urfave/cli	require	patch	`v1.22.5` → `v1.22.17`
golang	stage	minor	`1.18.0` → `1.26.4`
golang.org/x/crypto	require	minor	`v0.0.0-20220208050332-20e1d8d225ab` → `v0.53.0`
golang.org/x/tools	require	minor	`v0.1.10` → `v0.47.0`
golangci/golangci-lint	uses-with	minor	`v1.50.1` → `v1.64.8`
gorm.io/driver/mysql	require	minor	`v1.2.3` → `v1.6.0`
gorm.io/driver/postgres	require	minor	`v1.2.3` → `v1.6.0`
gorm.io/driver/sqlite	require	minor	`v1.2.6` → `v1.6.0`
gorm.io/gorm	require	minor	`v1.22.5` → `v1.31.2`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

actions/cache (actions/cache)

`v2.1.8`: Updating actions/core to version 1.10.0

Compare Source

The ::save-state and ::set-output are deprecated. The newer version of actions/core >1.10.0 uses the new syntax for save and set output. After this change, customers using actions/cache@v2 won't see deprecation warning message.

dustin/go-humanize (github.com/dustin/go-humanize)

`v1.0.1`

Compare Source

gliderlabs/ssh (github.com/gliderlabs/ssh)

`v0.3.8`

Compare Source

This bumps x/crypto to 0.31.0 to resolve CVE-2024-45337. The API has not changed, which means there are still a number of ways you could be vulnerable if your code improperly uses the PublicKeyHandler.

Note that this may result in a performance regression, as the PublicKeyHandler may be called multiple times for the same key. The last time it is called will be the key the user is actually using.

Note that if you are using Permissions to pass information about the public key out of the handler, you need to make sure you always overwrite all relevant stored map keys in order to avoid being vulnerable.

Full Changelog: gliderlabs/ssh@v0.3.7...v0.3.8

`v0.3.7`

Compare Source

What's Changed

feat: allow to set a server banner by @caarlos0 in #221
fix: remove ioutil deprecations by @aymanbagabas in #222
fix: bannerhandler by @gustavosbarreto in #227

New Contributors

@aymanbagabas made their first contribution in #222

Full Changelog: gliderlabs/ssh@v0.3.6...v0.3.7

go-gormigrate/gormigrate (github.com/go-gormigrate/gormigrate/v2)

`v2.1.6`

Compare Source

chore: bump go 1.25 => 1.26, update go deps
chore(ci): bump github actions
chore: bump db images for integration testing
- postgres: 18 => 19
- mariadb: 11 => 12
- mssql/server: 2022 => 2025

`v2.1.5`

Compare Source

feat: log in case of error when closing rows
chore(ci): add 1.25 to integration-test go matrix
chore(integration-test): bump go to 1.25
chore: bump go deps

`v2.1.4`

Compare Source

allow use of nil for options (by @ski7777 in #228)
Bump go deps

`v2.1.3`

Compare Source

Changed

Update dependencies

`v2.1.2`

Compare Source

Added

Fix LastInsertId error in postgres driver (by @oxyno-zeta)

Changed

Update dependencies

`v2.1.1`

Compare Source

Changed

Update dependencies

`v2.1.0`

Compare Source

Changed

Refactor plain sql mutation statements (create, insert, delete) into native gorm methods
Update dependencies

`v2.0.3`

Compare Source

Upgrade dependencies

`v2.0.2`

Compare Source

Upgrade dependencies

`v2.0.1`

Compare Source

Upgrade dependencies

smartystreets/goconvey (github.com/smartystreets/goconvey)

`v1.8.1`

Compare Source

`v1.8.0`: - Updating to Go 1.18

Compare Source

What's Changed

Automatically generate assertions.go by @riannucci in #650
Remove references to http://goconvey.co as malware squatters appear to have taken it by @mbsulliv in #673
upgrade deps, update to go 1.18 by @srabraham in #674
fix document about "go get" by @weishaopeng in #671
added main.goconvey by @xylophone21 in #663

New Contributors

@mbsulliv made their first contribution in #673
@srabraham made their first contribution in #674
@weishaopeng made their first contribution in #671
@xylophone21 made their first contribution in #663

Full Changelog: smartystreets/goconvey@v1.7.2...v1.8.0

urfave/cli (github.com/urfave/cli)

`v1.22.17`

Compare Source

What's Changed

Update dependencies in v1 series by @meatballhat in #2158

Full Changelog: urfave/cli@v1.22.16...v1.22.17

`v1.22.16`

Compare Source

What's Changed

Bump Go versions and reorder steps as with v2-maint by @meatballhat in #1887
Update dependencies in v1-maint by @meatballhat in #1979

Full Changelog: urfave/cli@v1.22.15...v1.22.16

`v1.22.15`

Compare Source

What's Changed

Bump dependencies, tested go versions, and actions steps for v1 by @meatballhat in #1886

Full Changelog: urfave/cli@v1.22.14...v1.22.15

`v1.22.14`

Compare Source

What's Changed

Update dependencies for v1 by @meatballhat in #1748

Full Changelog: urfave/cli@v1.22.13...v1.22.14

`v1.22.13`

Compare Source

What's Changed

Shift tested Go versions in v1-maint by @meatballhat in #1693
Update dependencies for v1-maint by @meatballhat in #1712

Full Changelog: urfave/cli@v1.22.12...v1.22.13

`v1.22.12`

Compare Source

What's Changed

Update many v1 things by @meatballhat in #1654

Full Changelog: urfave/cli@v1.22.11...v1.22.12

`v1.22.11`

Compare Source

What's Changed

Fix:(issue_1338) Fix behaviour of skip flag parsing if there are subc… by @dearchap in #1640
Doc:(issue_1195) Add integration testing example in docs by @dearchap in #1641
Fix:(issue_1142). Allow comma in altsrc flag names by @dearchap in #1645
Run CI on v1 series by @meatballhat in #1646

Full Changelog: urfave/cli@v1.22.10...v1.22.11

`v1.22.10`

Compare Source

What's Changed

Ignore dirs that are ignored in v2 by @meatballhat in #1428
Fix:(issue_1094) Dont execute Before/After during shell completions by @dearchap in #1459

Full Changelog: urfave/cli@v1.22.9...v1.22.10

`v1.22.9`

Compare Source

What's Changed

do fix CI by @kolyshkin in #1384
Add urfave_cli_no_docs build tag by @kolyshkin in #1383

Full Changelog: urfave/cli@v1.22.8...v1.22.9

`v1.22.8`

Compare Source

What's Changed

[v1] fix CI, add Go 1.17.x and 1.18.x by @kolyshkin in #1379

Full Changelog: urfave/cli@v1.22.7...v1.22.8

`v1.22.7`: Release 1.22.7

Compare Source

What's Changed

Don't call open("") backport by @kolyshkin in #1362

Full Changelog: urfave/cli@v1.22.6...v1.22.7

`v1.22.6`: Release 1.22.6

Compare Source

What's Changed

Ci config trimming by @meatballhat in #1355
Merging 1135 fix flag parsing by @thaJeztah via #1356

Full Changelog: urfave/cli@v1.22.5...v1.22.6

golangci/golangci-lint (golangci/golangci-lint)

`v1.64.8`

Compare Source

golangci-lint is a free and open-source project built by volunteers.

If you value it, consider supporting us, the maintainers and linter authors.

We appreciate it! ❤️

For key updates, see the changelog.

Changelog

8b37f14 fix: check version of the configuration (#5564)

`v1.64.7`

Compare Source

golangci-lint is a free and open-source project built by volunteers.

If you value it, consider supporting us, the maintainers and linter authors.

We appreciate it! ❤️

For key updates, see the changelog.

Changelog

94946f3 build(deps): bump github.com/OpenPeeDeeP/depguard/v2 from 2.2.0 to 2.2.1 (#5509)
132365e build(deps): bump github.com/golangci/dupl from 3e9179a to f665c8d (#5512)
bddd1bc build(deps): bump github.com/securego/gosec/v2 from 2.22.1 to 2.22.2 (#5515)
624fb4e build(deps): bump golang.org/x/mod from 0.23.0 to 0.24.0 (#5507)
8cffdb7 build(deps): bump golang.org/x/oauth2 from 0.27.0 to 0.28.0 in /scripts/gen_github_action_config in the scripts group (#5521)
7a3f3d7 build(deps): bump golang.org/x/tools from 0.30.0 to 0.31.0 (#5508)
c13fd5b build(deps): bump honnef.co/go/tools from 0.6.0 to 0.6.1 (#5510)

`v1.64.6`

Compare Source

golangci-lint is a free and open-source project built by volunteers.

If you value it, consider supporting us, the maintainers and linter authors.

We appreciate it! ❤️

For key updates, see the changelog.

Changelog

3d28c57 Require type for oneOf mutual exclusion (#5426)
84ab753 build(deps): bump 4d63.com/gocheckcompilerdirectives from 1.2.1 to 1.3.0 (#5485)
9fddfc4 build(deps): bump github.com/4meepo/tagalign from 1.4.1 to 1.4.2 (#5430)
404916a build(deps): bump github.com/GaijinEntertainment/go-exhaustruct/v3 from 3.3.0 to 3.3.1 (#5467)
3b6b9da build(deps): bump github.com/catenacyber/perfsprint from 0.8.1 to 0.8.2 (#5441)
336b21b build(deps): bump github.com/kisielk/errcheck from 1.8.0 to 1.9.0 (#5447)
baad5bb build(deps): bump github.com/kkHAIKE/contextcheck from 1.1.5 to 1.1.6 (#5482)
9e832c9 build(deps): bump github.com/ldez/exptostd from 0.4.1 to 0.4.2 (#5456)
f2c6303 build(deps): bump github.com/mgechev/revive from 1.6.1 to 1.7.0 (#5422)
9a2423a build(deps): bump github.com/nunnatsa/ginkgolinter from 0.19.0 to 0.19.1 (#5435)
140d96e build(deps): bump github.com/rogpeppe/go-internal from 1.13.1 to 1.14.0 (#5469)
3eecab1 build(deps): bump github.com/rogpeppe/go-internal from 1.14.0 to 1.14.1 (#5476)
d574f35 build(deps): bump github.com/shirou/gopsutil/v4 from 4.25.1 to 4.25.2 (#5486)
1a6b95b build(deps): bump github.com/spf13/cobra from 1.8.1 to 1.9.0 (#5421)
69ed661 build(deps): bump github.com/spf13/cobra from 1.9.0 to 1.9.1 (#5429)
5e17a57 build(deps): bump github.com/tdakkota/asciicheck from 0.4.0 to 0.4.1 (#5418)
2c1d661 build(deps): bump github.com/tetafro/godot from 1.4.20 to 1.5.0 (#5420)
414f446 build(deps): bump golang.org/x/oauth2 from 0.26.0 to 0.27.0 in /scripts/gen_github_action_config in the scripts group (#5471)
042d640 build(deps): bump golangci/golangci-lint-action from 6.3.2 to 6.5.0 in the github-actions group (#5419)
d4f4d16 build(deps): bump google.golang.org/protobuf from 1.36.4 to 1.36.5 in /pkg/golinters/protogetter/testdata in the linter-testdata group across 1 directory (#5484)
f69da39 fix: use commit hash when version is v0.0.0 (#5479)
53d58e8 govet: skip fieldalignment test on 32bit platforms (#5463)

`v1.64.5`

Compare Source

golangci-lint is a free and open-source project built by volunteers.

If you value it, consider supporting us, the maintainers and linter authors.

We appreciate it! ❤️

For key updates, see the changelog.

Changelog

a43c84c build(deps): bump github.com/gostaticanalysis/forcetypeassert from 0.1.0 to 0.2.0 (#5409)
4be8bf8 build(deps): bump github.com/securego/gosec/v2 from 2.22.0 to 2.22.1 (#5410)
e352220 build(deps): bump github.com/tdakkota/asciicheck from 0.3.0 to 0.4.0 (#5411)
0a603e4 fix: add missing new-from-merge-base flag (#5412)

`v1.64.4`

Compare Source

golangci-lint is a free and open-source project built by volunteers.

If you value it, consider supporting us, the maintainers and linter authors.

We appreciate it! ❤️

For key updates, see the changelog.

Changelog

04aec4f gci: fix section parsing (#5407)

`v1.64.3`

Compare Source

golangci-lint is a free and open-source project built by volunteers.

If you value it, consider supporting us, the maintainers and linter authors.

We appreciate it! ❤️

For key updates, see the changelog.

Changelog

b8920dd build(deps): bump github.com/go-critic/go-critic from 0.11.5 to 0.12.0 (#5400)
1a0b85b build(deps): bump github.com/mgechev/revive from 1.6.0 to 1.6.1 (#5399)
750e1ab build(deps): bump github.com/nunnatsa/ginkgolinter from 0.18.4 to 0.19.0 (#5404)
08ae805 gci: fix standard packages list for go1.24 (#5402)

`v1.64.2`

Compare Source

golangci-lint is a free and open-source project built by volunteers.

If you value it, consider supporting us, the maintainers and linter authors.

We appreciate it! ❤️

For key updates, see the changelog.

Changelog

07019ee build(deps): bump honnef.co/go/tools from 0.5.1 to 0.6.0 (#5391)
474fdaf go1.24 support (#5224)
e21ee9a build(deps): bump github.com/ldez/exptostd from 0.4.0 to 0.4.1 (#5390)
8e1d5f4 build(deps): bump golang.org/x/tools from 0.29.0 to 0.30.0 (#5389)
23eafd5 build(deps): bump github.com/catenacyber/perfsprint from 0.8.0 to 0.8.1 (#5386)
71445ee build(deps): bump go-simpler.org/sloglint from 0.7.2 to 0.9.0 (#5384)
9ce9097 build(deps): bump 4d63.com/gochecknoglobals from 0.2.1 to 0.2.2 (#5380)
1200be2 build(deps): bump github.com/catenacyber/perfsprint from 0.7.1 to 0.8.0 (#5382)
2b24c4e build(deps): bump golang.org/x/sys from 0.29.0 to 0.30.0 (#5376)
fbc663d build(deps): bump golang.org/x/mod from 0.22.0 to 0.23.0 (#5375)
0284fa9 tenv: deprecation (#5373)
a2ef9ee build(deps): bump github.com/polyfloyd/go-errorlint from 1.7.0 to 1.7.1 (#5368)
a7da404 build(deps): bump github.com/spf13/pflag from 1.0.5 to 1.0.6 (#5367)
72a1b33 build(deps): bump github.com/shirou/gopsutil/v4 from 4.24.12 to 4.25.1 (#5366)
10c03d7 feat: use run.relative-path-mode for output format paths (#5363)
fc94060 build(deps): bump the linter-testdata group across 2 directories with 4 updates (#5365)
192e98b feat: add new issues.new-from-merge-base option (#5362)
980a911 fix: sanitize severities by output format (#5359)
4b05170 build(deps): bump github.com/matoous/godox from 0.0.0-20230222163458-006bad1f9d26 to 1.1.0 (#5355)
98c110b feat: new linter exclusions system (#5339)
d1e9da0 fix: fallback on unknown severities for code climate (#5350)
2637593 build(deps): bump github.com/mgechev/revive from 1.5.1 to 1.6.0 (#5346)
23641e3 build(deps): bump github.com/golangci/revgrep from 0.6.1 to 0.7.0 (#5337)
a10bfc5 build(deps): bump github.com/golangci/revgrep from 0.6.0 to 0.6.1 (#5336)
2084a50 build(deps): bump github.com/Crocmagnon/fatcontext from 0.6.0 to 0.7.1 (#5335)
ac95a23 build(deps): bump github.com/ldez/exptostd from 0.3.1 to 0.4.0 (#5330)
20e4b1e build(deps): bump github.com/Crocmagnon/fatcontext from 0.5.3 to 0.6.0 (#5332)
29eaf2d build(deps): bump github.com/ldez/gomoddirectives from 0.6.0 to 0.6.1 (#5329)
5a7c7e6 fix: spancheck default StartSpanMatchersSlice values (#5324)
019bde5 build(deps): bump github.com/golangci/revgrep from 0.5.3 to 0.6.0 (#5319)
2502d20 build(deps): bump github.com/mattn/go-colorable from 0.1.13 to 0.1.14 (#5318)
8f187ff build(deps): bump github.com/securego/gosec/v2 from 2.21.4 to 2.22.0 (#5311)
e24c18c build(deps): bump github.com/karamaru-alpha/copyloopvar from 1.1.0 to 1.2.1 (#5307)
ace35f0 fix: avoid panic with plugin without description (#5312)
09489d5 build(deps): bump github.com/uudashr/iface from 1.3.0 to 1.3.1 (#5308)
c07dc97 build(deps): bump github.com/ghostiam/protogetter from 0.3.8 to 0.3.9 (#5306)
555fb5c build(deps): bump github.com/alingse/nilnesserr from 0.1.1 to 0.1.2 (#5305)
b7fd295 build(deps): bump golang.org/x/tools from 0.28.0 to 0.29.0 (#5309)
b747025 build(deps): bump github.com/ldez/grignotin from 0.7.0 to 0.8.0 (#5295)
d516da9 build(deps): bump golang.org/x/sys from 0.28.0 to 0.29.0 (#5293)

`v1.63.4`

Compare Source

golangci-lint is a free and open-source project built by volunteers.

If you value it, consider supporting us, the maintainers and linter authors.

We appreciate it! ❤️

For key updates, see the changelog.

Changelog

c114969 fix: filter Go filenames (#5291)

`v1.63.3`

Compare Source

golangci-lint is a free and open-source project built by volunteers.

If you value it, consider supporting us, the maintainers and linter authors.

We appreciate it! ❤️

For key updates, see the changelog.

Changelog

bb896aa build(deps): bump github.com/ldez/exptostd from 0.3.0 to 0.3.1 (#5283)
e7a1c9f build(deps): bump github.com/ldez/usetesting from 0.4.1 to 0.4.2 (#5282)
472b9b9 build(deps): bump github.com/shirou/gopsutil/v4 from 4.24.11 to 4.24.12 (#5281)
e1b7346 fix: invalid from position (#5287)
8e4b0c3 goheader: skip issues with invalid positions (#5286)

`v1.63.2`

Compare Source

golangci-lint is a free and open-source project built by volunteers.

If you value it, consider supporting us, the maintainers and linter authors.

We appreciate it! ❤️

For key updates, see the changelog.

Changelog

15412b3 fix: invalid position when missing EOL (#5279)

`v1.63.1`

Compare Source

golangci-lint is a free and open-source project built by volunteers.

If you value it, consider supporting us, the maintainers and linter authors.

We appreciate it! ❤️

For key updates, see the changelog.

Changelog

afa0e27 fix: filter files (#5272)
ffb15ca gci: fix cgo (#5274)

`v1.63.0`

Compare Source

golangci-lint is a free and open-source project built by volunteers.

If you value it, consider supporting us, the maintainers and linter authors.

We appreciate it! ❤️

For key updates, see the changelog.

Changelog

0640d3f Add UseTesting linter (#5170)
aa0450c Add exptostd linter (#5259)
1467bc0 Add nilnesserr linter (#5240)
6a20504 build(deps): bump github.com/shirou/gopsutil to v4.24.10 (#5167)
a6c26ee build(deps): bump github.com/4meepo/tagalign from 1.3.4 to 1.4.1 (#5255)
e85310c build(deps): bump github.com/Antonboom/nilnil from 1.0.0 to 1.0.1 (#5233)
c751e5c build(deps): bump github.com/alecthomas/go-check-sumtype from 0.2.0 to 0.3.1 (#5230)
c882e89 build(deps): bump github.com/ashanbrown/makezero from 1.1.1 to 1.2.0 (#5181)
acfb3be build(deps): bump github.com/bombsimon/wsl/v4 from 4.4.1 to 4.5.0 (#5262)
321e03f build(deps): bump github.com/butuzov/ireturn from 0.3.0 to 0.3.1 (#5188)
72bbc45 build(deps): bump github.com/butuzov/mirror from 1.2.0 to 1.3.0 (#5178)
06ffc05 build(deps): bump github.com/ckaznocha/intrange from 0.2.1 to 0.3.0 (#5203)
a92ccc7 build(deps): bump github.com/curioswitch/go-reassign from 0.2.0 to 0.3.0 (#5176)
043275f build(deps): bump github.com/go-xmlfmt/xmlfmt from 1.1.2 to 1.1.3 (#5177)
c8cf7a4 build(deps): bump github.com/jjti/go-spancheck from 0.6.2 to 0.6.4 (#5174)
dafd655 build(deps): bump github.com/julz/importas from 0.1.0 to b26b8fc (#5219)
b322a16 build(deps): bump github.com/julz/importas from 0.1.1-0.20241016092914-b26b8fc96f8a to 0.2.0 (#5256)
d40b6da build(deps): bump github.com/ldez/gomoddirectives from 0.2.4 to 0.4.2 (#5175)
794a340 build(deps): bump github.com/ldez/gomoddirectives from 0.4.2 to 0.5.0 (#5187)
67825fe build(deps): bump github.com/ldez/gomoddirectives from 0.5.0 to 0.6.0 (#5196)
0c6bccb build(deps): bump github.com/ldez/grignotin from 0.6.0 to 0.7.0 (#5248)
d74f1ae build(deps): bump github.com/ldez/tagliatelle from 0.5.0 to 0.6.0 (#5164)
59f05b5 build(deps): bump github.com/ldez/tagliatelle from 0.6.0 to 0.7.1 (#5204)
9686758 build(deps): bump github.com/ldez/usetesting from 0.2.0 to 0.2.1 (#5189)
fc650e4 build(deps): bump github.com/ldez/usetesting from 0.2.1 to 0.2.2 (#5198)
cf4c529 build(deps): bump github.com/ldez/usetesting from 0.2.2 to 0.3.0 ([#5261](ht

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

semgrep-app · 2023-06-06T22:58:58Z

GHSA-232p-vwff-86mp

-	github.com/dustin/go-humanize v1.0.0
-	github.com/gliderlabs/ssh v0.3.3
-	github.com/go-gormigrate/gormigrate/v2 v2.0.0
+	github.com/dustin/go-humanize v1.0.1


Risk: github.com/docker/docker versions >= 23.0.0 before 23.0.3, >= 1.12.0 before 20.10.24 are vulnerable to Unprotected Alternate Channel / Not Failing Securely ('Failing Open'). Affected configurations silently accept cleartext VXLAN datagrams, enabling attackers to inject arbitrary Ethernet frames into the encrypted network. This can result in denial of service attacks or further escalations,

Fix: Upgrade this library to at least version 20.10.24 at sshportal/go.mod:7.

Reference(s): GHSA-232p-vwff-86mp, CVE-2023-28840
_{Ignore this finding from ssc-6c040726-d493-4854-b380-987107b4c1bb.}

socket-security · 2025-08-14T04:43:50Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability
golang.org/x/crypto@v0.0.0-20220208050332-20e1d8d225ab ⏵ v0.53.0	⁺¹	⁺⁷⁵
golang.org/x/tools@v0.1.10 ⏵ v0.47.0	⁺³
github.com/asaskevich/govalidator@v0.0.0-20210307081110-f21760c49a8d ⏵ v0.0.0-20230301143203-a9d515a09cc2
gorm.io/gorm@v1.22.5 ⏵ v1.31.2	^-7
github.com/urfave/cli@v1.22.5 ⏵ v1.22.17	⁺¹
github.com/smartystreets/goconvey@v1.7.2 ⏵ v1.8.1	⁺¹
github.com/gliderlabs/ssh@v0.3.3 ⏵ v0.3.8	⁺¹
github.com/tailscale/depaware@v0.0.0-20210622194025-720c4b409502 ⏵ v0.0.0-20260426051615-835d31c2ca68
github.com/reiver/go-telnet@v0.0.0-20180421082511-9ff0b2ab096e ⏵ v0.0.0-20250617105250-7da9ad70a2b2
github.com/go-gormigrate/gormigrate/v2@v2.0.0 ⏵ v2.1.6	⁺¹
github.com/dustin/go-humanize@v1.0.0 ⏵ v1.0.1	⁺¹
gorm.io/driver/mysql@v1.2.3 ⏵ v1.6.0
gorm.io/driver/postgres@v1.2.3 ⏵ v1.6.0
gorm.io/driver/sqlite@v1.2.6 ⏵ v1.6.0

View full report

socket-security · 2026-04-14T17:31:28Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Critical CVE: pgx contains memory-safety vulnerability in golang `github.com/jackc/pgx/v5` CVE: GHSA-xgrm-4fwx-7qm8 pgx contains memory-safety vulnerability (CRITICAL) Affected versions: < 5.9.0 Patched version: 5.9.0 From: `?` → `golang/gorm.io/driver/postgres@v1.6.0` → `golang/github.com/jackc/pgx/v5@v5.6.0` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/github.com/jackc/pgx/v5@v5.6.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: Memory-safety vulnerability in golang `github.com/jackc/pgx/v5`. CVE: GHSA-9jj7-4m8r-rfcm Memory-safety vulnerability in github.com/jackc/pgx/v5. (CRITICAL) Affected versions: < 5.9.0 Patched version: 5.9.0 From: `?` → `golang/gorm.io/driver/postgres@v1.6.0` → `golang/github.com/jackc/pgx/v5@v5.6.0` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/github.com/jackc/pgx/v5@v5.6.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: golang `golang.org/x/tools` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: go.mod → `golang/golang.org/x/tools@v0.47.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/golang.org/x/tools@v0.47.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

auto-add-label Bot added the bug label Feb 9, 2022

trafico-bot Bot added the 🔍 Ready for Review Pull Request is not reviewed yet label Feb 9, 2022

renovate Bot changed the title ~~fix(deps): update golang.org/x/crypto commit hash to bba287d~~ fix(deps): update golang.org/x/crypto commit hash to dad3315 Feb 9, 2022

renovate Bot force-pushed the renovate/all branch from a2e84cb to ec65ef0 Compare February 9, 2022 16:49

renovate Bot changed the title ~~fix(deps): update golang.org/x/crypto commit hash to dad3315~~ fix(deps): update golang.org/x/crypto commit hash to db63837 Feb 9, 2022

renovate Bot force-pushed the renovate/all branch from ec65ef0 to f7075e8 Compare February 9, 2022 20:18

renovate Bot changed the title ~~fix(deps): update golang.org/x/crypto commit hash to db63837~~ fix(deps): update golang.org/x/crypto commit hash to f4118a5 Feb 10, 2022

renovate Bot force-pushed the renovate/all branch from f7075e8 to 7a49373 Compare February 10, 2022 16:47

renovate Bot changed the title ~~fix(deps): update golang.org/x/crypto commit hash to f4118a5~~ chore(deps): update all docker tags Feb 11, 2022

renovate Bot force-pushed the renovate/all branch from 7a49373 to 92eef3a Compare February 11, 2022 00:51

auto-add-label Bot added dependencies and removed bug labels Feb 11, 2022

renovate Bot changed the title ~~chore(deps): update all docker tags~~ chore(deps): update golang docker tag to v1.17.7 Feb 13, 2022

renovate Bot changed the title ~~chore(deps): update golang docker tag to v1.17.7~~ chore(deps): update all docker tags Feb 13, 2022

renovate Bot force-pushed the renovate/all branch from 92eef3a to 1222172 Compare February 13, 2022 20:11

renovate Bot changed the title ~~chore(deps): update all docker tags~~ chore(deps): update all Feb 14, 2022

renovate Bot force-pushed the renovate/all branch 4 times, most recently from cb00655 to f43cfe7 Compare February 19, 2022 17:17

renovate Bot force-pushed the renovate/all branch 3 times, most recently from 41f4efb to f1cf282 Compare March 8, 2022 00:36

renovate Bot force-pushed the renovate/all branch 6 times, most recently from 7c324a8 to e684342 Compare March 18, 2022 13:55

renovate Bot force-pushed the renovate/all branch from e684342 to 52e0917 Compare March 21, 2022 18:32

renovate Bot changed the title ~~chore(deps): update all~~ fix(deps): update all Apr 21, 2022

renovate Bot force-pushed the renovate/all branch from a6777f4 to 6b682e0 Compare April 21, 2022 22:16

auto-add-label Bot added bug and removed dependencies labels Apr 21, 2022

renovate Bot force-pushed the renovate/all branch 5 times, most recently from b57a58c to af6d109 Compare April 28, 2022 13:21

renovate Bot force-pushed the renovate/all branch 5 times, most recently from a1bdb10 to 72b1efe Compare May 11, 2022 20:44

renovate Bot force-pushed the renovate/all branch 5 times, most recently from 3a73794 to 5bcea1f Compare May 18, 2022 06:15

renovate Bot force-pushed the renovate/all branch 3 times, most recently from a9e11be to 9bab928 Compare May 28, 2022 17:09

renovate Bot force-pushed the renovate/all branch 2 times, most recently from 7aac983 to a02dae4 Compare June 2, 2022 00:55

renovate Bot force-pushed the renovate/all branch 2 times, most recently from 119e774 to 6c3c508 Compare June 8, 2022 16:31

semgrep-app Bot reviewed Jun 6, 2023

View reviewed changes

fix(deps): update all

8cfa0f5

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps): update all#319

fix(deps): update all#319
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/all

renovate Bot commented Feb 9, 2022 •

edited

Loading

Uh oh!

semgrep-app Bot Jun 6, 2023 •

edited

Loading

Uh oh!

socket-security Bot commented Aug 14, 2025 •

edited

Loading

Uh oh!

socket-security Bot commented Apr 14, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Feb 9, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v2.1.8: Updating actions/core to version 1.10.0

What's Changed

New Contributors

Changed

Added

Changed

Changed

Changed

v1.8.0: - Updating to Go 1.18

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

v1.22.7: Release 1.22.7

What's Changed

v1.22.6: Release 1.22.6

What's Changed

Changelog

Changelog

Changelog

Changelog

Changelog

Changelog

Changelog

Changelog

Changelog

Changelog

Changelog

Changelog

Configuration

Uh oh!

semgrep-app Bot Jun 6, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

socket-security Bot commented Aug 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Feb 9, 2022 •

edited

Loading

`v2.1.8`: Updating actions/core to version 1.10.0

`v1.8.0`: - Updating to Go 1.18

`v1.22.7`: Release 1.22.7

`v1.22.6`: Release 1.22.6

semgrep-app Bot Jun 6, 2023 •

edited

Loading

socket-security Bot commented Aug 14, 2025 •

edited

Loading

socket-security Bot commented Apr 14, 2026 •

edited

Loading