From b2324cee5362e95fa3eca76fb99c50e5b0526e79 Mon Sep 17 00:00:00 2001 From: Wu Sheng Date: Tue, 3 Nov 2026 08:36:28 +0800 Subject: [PATCH] Bump dependencies to fix security alerts - golang.org/x/net v0.60.0 -> v0.62.0 (GO-2026-6860, GO-2026-6866), with golang.org/x/crypto v0.58.0, x/sync v0.24.0, x/sys v0.49.0, x/term v0.47.0 and x/text v0.43.0 by minimum version selection. - dist/LICENSE regenerated with license-eye (d38fe05); only the version lines change. CHANGES.md updated. GitHub Actions: actions/checkout v3/v4 -> v7, actions/setup-go v4/v5 -> v7, actions/upload-artifact v4 -> v7, in the workflows and in the actions/setup composite action. infra-e2e: apache/skywalking-infra-e2e cf589b4 -> 56ac8be in the three e2e jobs. Its verifier now requires every entry of a `contains` block to match a distinct actual item (infra-e2e #137, #143). The basic case's dependency-instance expectation listed a CLIENT detect point the instance relation never reports (the OAP returns only SERVER); the old verifier accepted the partial match. The expected file now lists SERVER only. --- .github/workflows/CI.yaml | 32 +++++++++---------- .github/workflows/publish-docker.yaml | 4 +-- CHANGES.md | 7 ++++ actions/setup/action.yaml | 4 +-- dist/LICENSE | 12 +++---- go.mod | 12 +++---- go.sum | 28 ++++++++-------- .../basic/expected/dependency-instance.yml | 1 - 8 files changed, 53 insertions(+), 47 deletions(-) diff --git a/.github/workflows/CI.yaml b/.github/workflows/CI.yaml index a7b61934..a3e72c85 100644 --- a/.github/workflows/CI.yaml +++ b/.github/workflows/CI.yaml @@ -42,7 +42,7 @@ jobs: if: github.repository == 'apache/skywalking-cli' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Check License Header uses: apache/skywalking-eyes@5dfa68f93380a5e57259faaf95088b7f133b5778 @@ -50,7 +50,7 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Setup Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v7 with: go-version: "1.26" @@ -62,9 +62,9 @@ jobs: runs-on: ubuntu-latest if: github.repository == 'apache/skywalking-cli' steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Set up Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v7 with: go-version: "1.26" @@ -74,7 +74,7 @@ jobs: - name: Lint run: make lint - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 if: failure() with: name: check-diff @@ -95,9 +95,9 @@ jobs: runs-on: ubuntu-latest if: github.repository == 'apache/skywalking-cli' steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Set up Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v7 with: go-version: "1.26" @@ -105,7 +105,7 @@ jobs: run: make install DESTDIR=/usr/local/bin - name: Test commands - uses: apache/skywalking-infra-e2e@cf589b4a0b9f8e6f436f78e9cfd94a1ee5494180 + uses: apache/skywalking-infra-e2e@56ac8befeb5f910f2dc9339e65d07cd18953f90e with: e2e-file: test/cases/basic/test.yaml @@ -115,9 +115,9 @@ jobs: runs-on: ubuntu-latest if: github.repository == 'apache/skywalking-cli' steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Set up Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v7 with: go-version: "1.26" @@ -125,7 +125,7 @@ jobs: run: make install DESTDIR=/usr/local/bin - name: Test admin commands - uses: apache/skywalking-infra-e2e@cf589b4a0b9f8e6f436f78e9cfd94a1ee5494180 + uses: apache/skywalking-infra-e2e@56ac8befeb5f910f2dc9339e65d07cd18953f90e with: e2e-file: test/cases/admin/test.yaml @@ -135,9 +135,9 @@ jobs: runs-on: ubuntu-latest if: github.repository == 'apache/skywalking-cli' steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Set up Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v7 with: go-version: "1.26" @@ -145,7 +145,7 @@ jobs: run: make install DESTDIR=/usr/local/bin - name: Test OAL live debugging - uses: apache/skywalking-infra-e2e@cf589b4a0b9f8e6f436f78e9cfd94a1ee5494180 + uses: apache/skywalking-infra-e2e@56ac8befeb5f910f2dc9339e65d07cd18953f90e with: e2e-file: test/cases/live-debugging/test.yaml @@ -155,9 +155,9 @@ jobs: runs-on: ubuntu-latest if: github.repository == 'apache/skywalking-cli' steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: setup go - uses: actions/setup-go@v5 + uses: actions/setup-go@v7 with: go-version: "1.26" diff --git a/.github/workflows/publish-docker.yaml b/.github/workflows/publish-docker.yaml index 326651d1..7b34d9bd 100644 --- a/.github/workflows/publish-docker.yaml +++ b/.github/workflows/publish-docker.yaml @@ -37,11 +37,11 @@ jobs: VERSION: ${{ github.sha }} APP_NAME: skywalking-cli steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v7 with: submodules: true - name: Set up Go - uses: actions/setup-go@v4 + uses: actions/setup-go@v7 with: go-version: "1.26" # Plain `docker login` instead of docker/login-action: the ASF allow-list diff --git a/CHANGES.md b/CHANGES.md index f7085a2c..7788bfe4 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -2,6 +2,13 @@ Changes by Version ================== Release Notes. +0.16.0 +------------------ + +### Bug Fixes + +* Upgrade `golang.org/x/net` to v0.62.0 (with `golang.org/x/crypto` v0.58.0, `golang.org/x/text` v0.43.0 and `golang.org/x/sys` v0.49.0) to fix GO-2026-6860 and GO-2026-6866. + 0.15.0 ------------------ diff --git a/actions/setup/action.yaml b/actions/setup/action.yaml index 851df182..c9a73c93 100644 --- a/actions/setup/action.yaml +++ b/actions/setup/action.yaml @@ -34,13 +34,13 @@ runs: using: "composite" steps: - name: Set up Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v7 with: go-version: 1.24 cache-dependency-path: ${{ github.action_path }}/go.sum - name: Checkout if: inputs.version != '' - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: repository: apache/skywalking-cli ref: ${{ inputs.version }} diff --git a/dist/LICENSE b/dist/LICENSE index 732db2dc..a8a4be0e 100644 --- a/dist/LICENSE +++ b/dist/LICENSE @@ -254,13 +254,13 @@ The text of each license is also included at licenses/license-[project].txt. github.com/google/uuid v1.6.0 BSD-3-Clause github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 BSD-3-Clause github.com/spf13/pflag v1.0.6 BSD-3-Clause - golang.org/x/crypto v0.57.0 BSD-3-Clause - golang.org/x/net v0.60.0 BSD-3-Clause + golang.org/x/crypto v0.58.0 BSD-3-Clause + golang.org/x/net v0.62.0 BSD-3-Clause golang.org/x/oauth2 v0.36.0 BSD-3-Clause - golang.org/x/sync v0.23.0 BSD-3-Clause - golang.org/x/sys v0.48.0 BSD-3-Clause - golang.org/x/term v0.46.0 BSD-3-Clause - golang.org/x/text v0.42.0 BSD-3-Clause + golang.org/x/sync v0.24.0 BSD-3-Clause + golang.org/x/sys v0.49.0 BSD-3-Clause + golang.org/x/term v0.47.0 BSD-3-Clause + golang.org/x/text v0.43.0 BSD-3-Clause golang.org/x/time v0.11.0 BSD-3-Clause google.golang.org/protobuf v1.36.11 BSD-3-Clause gopkg.in/evanphx/json-patch.v4 v4.12.0 BSD-3-Clause diff --git a/go.mod b/go.mod index 4743bc1c..515e7b1f 100644 --- a/go.mod +++ b/go.mod @@ -13,7 +13,7 @@ require ( github.com/sirupsen/logrus v1.9.3 github.com/spf13/viper v1.7.0 github.com/urfave/cli/v2 v2.3.0 - golang.org/x/text v0.42.0 + golang.org/x/text v0.43.0 google.golang.org/grpc v1.84.0 gopkg.in/yaml.v2 v2.4.0 k8s.io/apimachinery v0.33.1 @@ -74,12 +74,12 @@ require ( github.com/spf13/pflag v1.0.6 // indirect github.com/subosito/gotenv v1.2.0 // indirect github.com/x448/float16 v0.8.4 // indirect - golang.org/x/crypto v0.57.0 // indirect - golang.org/x/net v0.60.0 // indirect + golang.org/x/crypto v0.58.0 // indirect + golang.org/x/net v0.62.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect - golang.org/x/sync v0.23.0 // indirect - golang.org/x/sys v0.48.0 // indirect - golang.org/x/term v0.46.0 // indirect + golang.org/x/sync v0.24.0 // indirect + golang.org/x/sys v0.49.0 // indirect + golang.org/x/term v0.47.0 // indirect golang.org/x/time v0.11.0 // indirect gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 // indirect diff --git a/go.sum b/go.sum index 0cd9e3c2..c411f32b 100644 --- a/go.sum +++ b/go.sum @@ -338,8 +338,8 @@ golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8U golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= -golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= -golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= +golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54= +golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8= @@ -376,8 +376,8 @@ golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= -golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= -golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= +golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY= +golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= @@ -390,8 +390,8 @@ golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJ golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= -golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= +golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA= +golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= @@ -408,16 +408,16 @@ golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20190626150813-e07cf5db2756/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= -golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= -golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE= -golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc= +golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA= +golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM= +golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI= -golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= +golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc= +golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0= @@ -442,8 +442,8 @@ golang.org/x/tools v0.0.0-20191112195655-aa38f8e97acc/go.mod h1:b+2E5dAYhXwXZwtn golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= -golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI= -golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo= +golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI= +golang.org/x/tools v0.51.0/go.mod h1:9eEncMayCV6zRMGhR5eZEC2iBx98qWcF1HZ9Z7wJOoA= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= diff --git a/test/cases/basic/expected/dependency-instance.yml b/test/cases/basic/expected/dependency-instance.yml index 33dd2795..0990d1fc 100644 --- a/test/cases/basic/expected/dependency-instance.yml +++ b/test/cases/basic/expected/dependency-instance.yml @@ -38,7 +38,6 @@ calls: detectpoints: {{- contains .detectpoints }} - SERVER - - CLIENT {{- end }} {{- end }} debuggingtrace: null