From 28252bc072efc724e38c51d157ff8a66c66446ca Mon Sep 17 00:00:00 2001 From: Martin Hutchinson Date: Tue, 3 Nov 2026 09:52:23 +0000 Subject: [PATCH] build(deps): bump Go to 1.27.0 (toolchain go1.27.3), update deps, and add govulncheck action --- .github/workflows/go_test.yml | 2 +- .github/workflows/golangci-lint.yml | 2 +- .github/workflows/govulncheck.yml | 25 +++++++++++++++++++++++++ go.mod | 10 ++++++---- go.sum | 6 ++++++ 5 files changed, 39 insertions(+), 6 deletions(-) create mode 100644 .github/workflows/govulncheck.yml diff --git a/.github/workflows/go_test.yml b/.github/workflows/go_test.yml index 8e94dd58..fab5d85b 100644 --- a/.github/workflows/go_test.yml +++ b/.github/workflows/go_test.yml @@ -6,7 +6,7 @@ jobs: test: strategy: matrix: - go-version: [1.26.x, 1.27.x] + go-version: [1.27.x] os: [ubuntu-latest, macos-latest] runs-on: ${{ matrix.os }} steps: diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml index 1ed84c98..3c084e4f 100644 --- a/.github/workflows/golangci-lint.yml +++ b/.github/workflows/golangci-lint.yml @@ -23,5 +23,5 @@ jobs: - name: golangci-lint uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 with: - version: v2.13.2 + version: v2.15.0 args: --timeout=8m diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml new file mode 100644 index 00000000..e9c6ec9c --- /dev/null +++ b/.github/workflows/govulncheck.yml @@ -0,0 +1,25 @@ +name: govulncheck + +on: + push: + branches: + - main + pull_request: + branches: + - main + +permissions: + contents: read + +jobs: + govulncheck_job: + runs-on: ubuntu-latest + name: Run govulncheck + steps: + - id: govulncheck + uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # v1.1.0 + with: + go-version-file: go.mod + # Required to override the default 'stable' version and use go-version-file + go-version-input: '' + go-package: ./... diff --git a/go.mod b/go.mod index 4eff832c..00482ce7 100644 --- a/go.mod +++ b/go.mod @@ -1,10 +1,12 @@ module github.com/transparency-dev/incubator -go 1.26.0 +go 1.27.0 + +toolchain go1.27.3 require ( - filippo.io/sunlight v0.9.0 - filippo.io/torchwood v0.9.1-0.20260708154658-e0a6396dd50c + filippo.io/sunlight v0.10.2 + filippo.io/torchwood v0.10.1-0.20261024135344-1c05157b1fd2 github.com/cockroachdb/pebble v1.1.5 github.com/go-git/go-git/v5 v5.19.3 github.com/google/go-cmp v0.7.0 @@ -19,7 +21,7 @@ require ( go.opentelemetry.io/otel/sdk/metric v1.47.0 golang.org/x/crypto v0.58.0 golang.org/x/mod v0.42.0 - golang.org/x/net v0.60.0 + golang.org/x/net v0.62.0 golang.org/x/sync v0.24.0 k8s.io/klog/v2 v2.140.0 ) diff --git a/go.sum b/go.sum index 2e9fc501..a70b97fb 100644 --- a/go.sum +++ b/go.sum @@ -4,8 +4,12 @@ filippo.io/mldsa v0.0.0-20260711112038-ff3f469cee29 h1:11cJmDX5FvZu/znhVjfwxs9jZ filippo.io/mldsa v0.0.0-20260711112038-ff3f469cee29/go.mod h1:32qQ5yj3R24Eu03iWFWchdC3OB653wPvoepWejkefbY= filippo.io/sunlight v0.9.0 h1:YQnOlIjRuTsXzsXJdm+MMivu6OndV94iq/sMDASOn4k= filippo.io/sunlight v0.9.0/go.mod h1:o/a7PJt6Bw0bYhWnZDC8hHAUEQShVxUgsvltrHF/KoQ= +filippo.io/sunlight v0.10.2 h1:XKjgEIlDMRxMIDpEAvH7cSHx/PCPMO5IJUgcIb3bo/A= +filippo.io/sunlight v0.10.2/go.mod h1:jMYE8Fh4L94M9vkiX4N9Q3h5WLZMjKCxSCHq8gajzeM= filippo.io/torchwood v0.9.1-0.20260708154658-e0a6396dd50c h1:t259W9JzlCso86LB0V92ZmRJluFg1wEsiH4OonKAB5U= filippo.io/torchwood v0.9.1-0.20260708154658-e0a6396dd50c/go.mod h1:kKEN0olmFcNGfsPWT3M46wig9CUz7/vHIAENPh9pLXc= +filippo.io/torchwood v0.10.1-0.20261024135344-1c05157b1fd2 h1:jvnFpZovtSQykQNSPLtlEmP5SClXCWn+1zCHU8jz6cY= +filippo.io/torchwood v0.10.1-0.20261024135344-1c05157b1fd2/go.mod h1:hZt8lhTBBCK77TmuK+q0D7mNcnt2ovQkJs+zdonDRog= github.com/DataDog/zstd v1.4.5 h1:EndNeuB0l9syBZhut0wns3gV1hL8zX8LIu6ZiVHWLIQ= github.com/DataDog/zstd v1.4.5/go.mod h1:1jcaCB/ufaK+sKp1NBhlGmpz41jOoPQ35bpF36t7BBo= github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY= @@ -190,6 +194,8 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= +golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY= +golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=