go
/
vulndb
зеркало из https://github.com/golang/vulndb.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность
vulndb/go.mod

89 строки
3.9 KiB
Modula-2
Исходник Постоянная ссылка Обычный вид История

all: initial commit
2021-03-16 22:02:37 +03:00
module golang.org/x/vulndb
go.mod: update golang.org/x dependencies Update golang.org/x dependencies to their latest tagged versions. Change-Id: I9bf3a763752d3d200ea2fb76141ae2c359f17155 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/611957 Reviewed-by: David Chase <drchase@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Auto-Submit: Gopher Robot <gobot@golang.org>
2024-09-09 18:52:17 +03:00
go 1.22.0
internal: delete This code is moved to x/vuln. Change-Id: Ide030bfcbf1bcaaed4a989e0f4b8c42c94fb0368 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/362495 Trust: Julie Qiu <julie@golang.org> Run-TryBot: Julie Qiu <julie@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Jonathan Amsterdam <jba@google.com>
2021-11-09 23:29:42 +03:00
checks.bash: replace all.bash all.bash is replaced with the checks.bash setup from x/vuln, so that tests run on TryBots. Change-Id: I49f2265343e9e962b8587eb9a733a52651466737 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/373156 Trust: Julie Qiu <julie@golang.org> Run-TryBot: Julie Qiu <julie@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Jonathan Amsterdam <jba@google.com>
2021-12-18 02:11:51 +03:00
require (
cmd/modinfo: a tool for getting module info Give this command-line tool a module path and it will print the number of importers for each package in the module. Change-Id: Ib93eb6bec1b7f049bda43c5f7f1b05a1281fb8e0 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/513499 Run-TryBot: Jonathan Amsterdam <jba@google.com> Reviewed-by: Tatiana Bradley <tatianabradley@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-07-27 00:24:52 +03:00
cloud.google.com/go/errorreporting v0.3.0
go.mod: update various dependencies to latest This is part of an effort to avoid potential problems with very stale versions. Change-Id: I2a1b40a344fdac1068aeb0eeed11dcdc6d5d7208 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/551455 Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-12-19 20:52:32 +03:00
cloud.google.com/go/firestore v1.14.0
cloud.google.com/go/secretmanager v1.11.4
go.mod, internal: update to latest version of event Update to a version of golang.org/x/exp/event that uses the latest OTel modules. Also provide a test for the Gemini AI client. Change-Id: I4705850d5953b9845e07842dcff63a01f13656f1 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/551435 Run-TryBot: Jonathan Amsterdam <jba@google.com> Reviewed-by: Tatiana Bradley <tatianabradley@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-12-19 21:10:31 +03:00
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.45.0
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/trace v1.21.0
github.com/GoogleCloudPlatform/opentelemetry-operations-go/propagator v0.45.0
checks.bash: replace all.bash all.bash is replaced with the checks.bash setup from x/vuln, so that tests run on TryBots. Change-Id: I49f2265343e9e962b8587eb9a733a52651466737 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/373156 Trust: Julie Qiu <julie@golang.org> Run-TryBot: Julie Qiu <julie@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Jonathan Amsterdam <jba@google.com>
2021-12-18 02:11:51 +03:00
github.com/client9/misspell v0.3.4
all: update go-git Change-Id: Ic67d1ba33076698b0762563d6fc482c9fe3609b3 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/560337 Reviewed-by: Tatiana Bradley <tatianabradley@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Roland Shoemaker <roland@golang.org>
2024-02-01 19:31:22 +03:00
github.com/go-git/go-billy/v5 v5.5.0
github.com/go-git/go-git/v5 v5.11.0
go.mod, internal: update to latest version of event Update to a version of golang.org/x/exp/event that uses the latest OTel modules. Also provide a test for the Gemini AI client. Change-Id: I4705850d5953b9845e07842dcff63a01f13656f1 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/551435 Run-TryBot: Jonathan Amsterdam <jba@google.com> Reviewed-by: Tatiana Bradley <tatianabradley@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-12-19 21:10:31 +03:00
github.com/google/generative-ai-go v0.5.0
go.mod: update various dependencies to latest This is part of an effort to avoid potential problems with very stale versions. Change-Id: I2a1b40a344fdac1068aeb0eeed11dcdc6d5d7208 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/551455 Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-12-19 20:52:32 +03:00
github.com/google/go-cmp v0.6.0
all: upgrade to github.com/google/go-github/v41 The v1 version hasn't been updated since 2018. Upgrade to the latest version which is v41. Change-Id: I1e9ae4a525aba4350e2cb674167d55ba9746e022 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/376374 Trust: Julie Qiu <julie@golang.org> Run-TryBot: Julie Qiu <julie@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Jonathan Amsterdam <jba@google.com>
2022-01-07 19:17:54 +03:00
github.com/google/go-github/v41 v41.0.0
cmd/modinfo: a tool for getting module info Give this command-line tool a module path and it will print the number of importers for each package in the module. Change-Id: Ib93eb6bec1b7f049bda43c5f7f1b05a1281fb8e0 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/513499 Run-TryBot: Jonathan Amsterdam <jba@google.com> Reviewed-by: Tatiana Bradley <tatianabradley@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-07-27 00:24:52 +03:00
github.com/google/safehtml v0.1.0
internal/{observe,worker}: remove exp/event metrics Switch to an experimental metrics package of my own. Change-Id: I88cad487691787be5485b5773637e084317015ea Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/552655 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Tatiana Bradley <tatianabradley@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Run-TryBot: Jonathan Amsterdam <jba@google.com>
2023-12-24 17:53:25 +03:00
github.com/jba/metrics v0.1.1
github.com/jba/metrics/otel v0.1.1
go.mod: upgrade deps that were accidentally downgraded Due to merge issues, some dependencies were accidentally downgraded in a previous CL. Change-Id: I9d2deff5f582bca17f7008809bc4174ab8388b12 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/551438 Reviewed-by: Jonathan Amsterdam <jba@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-12-20 00:24:55 +03:00
github.com/jba/templatecheck v0.7.0
cmd/modinfo: a tool for getting module info Give this command-line tool a module path and it will print the number of importers for each package in the module. Change-Id: Ib93eb6bec1b7f049bda43c5f7f1b05a1281fb8e0 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/513499 Run-TryBot: Jonathan Amsterdam <jba@google.com> Reviewed-by: Tatiana Bradley <tatianabradley@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-07-27 00:24:52 +03:00
github.com/lib/pq v1.10.9
go.mod: upgrade deps that were accidentally downgraded Due to merge issues, some dependencies were accidentally downgraded in a previous CL. Change-Id: I9d2deff5f582bca17f7008809bc4174ab8388b12 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/551438 Reviewed-by: Jonathan Amsterdam <jba@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-12-20 00:24:55 +03:00
github.com/shurcooL/githubv4 v0.0.0-20231126234147-1cffa1f02456
go.mod, internal: update to latest version of event Update to a version of golang.org/x/exp/event that uses the latest OTel modules. Also provide a test for the Gemini AI client. Change-Id: I4705850d5953b9845e07842dcff63a01f13656f1 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/551435 Run-TryBot: Jonathan Amsterdam <jba@google.com> Reviewed-by: Tatiana Bradley <tatianabradley@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-12-19 21:10:31 +03:00
go.opentelemetry.io/otel v1.21.0
go.opentelemetry.io/otel/sdk v1.21.0
internal/observe, etc.: remove event tracing Use OpenTelemetry tracing directly instead of the exp/event package. This removes all dependence on exp/event's OpenTelemetry code. Change-Id: Id2846db3d2c35efea66244c314385b59ef605d9d Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/552656 Reviewed-by: Tatiana Bradley <tatianabradley@google.com> Run-TryBot: Jonathan Amsterdam <jba@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-12-24 18:37:44 +03:00
go.opentelemetry.io/otel/trace v1.21.0
internal/worker/log: use slog Use the log/slog package instead of golang.org/x/event. This removes x/event from the repo. Until Go 1.22 comes out, use golang.org/x/exp/slog, because we still test one version back (Go 1.20), and log/slog appeared in Go 1.21. Change-Id: Ia0f645069c778741ebb8c359161816a303a2175b Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/552675 TryBot-Result: Gopher Robot <gobot@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Run-TryBot: Jonathan Amsterdam <jba@google.com> Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
2023-12-24 21:34:14 +03:00
golang.org/x/exp v0.0.0-20240103183307-be819d1f06fc
go.mod: update golang.org/x dependencies Update golang.org/x dependencies to their latest tagged versions. Change-Id: I80d0c92d357e47868d3e8f6506220fff3ab4d9df Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/626479 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: David Chase <drchase@google.com> Auto-Submit: Gopher Robot <gobot@golang.org>
2024-11-08 20:26:18 +03:00
golang.org/x/mod v0.22.0
golang.org/x/oauth2 v0.24.0
golang.org/x/sync v0.9.0
golang.org/x/time v0.8.0
golang.org/x/tools v0.27.0
go.mod: upgrade deps that were accidentally downgraded Due to merge issues, some dependencies were accidentally downgraded in a previous CL. Change-Id: I9d2deff5f582bca17f7008809bc4174ab8388b12 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/551438 Reviewed-by: Jonathan Amsterdam <jba@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-12-20 00:24:55 +03:00
google.golang.org/api v0.154.0
google.golang.org/grpc v1.60.1
go.mod: update gopkg.in/yaml.v3 Upgrade to non-vulerable version. Also update tests because the behavior of yaml has slightly changed with how whitespace is handled. Change-Id: Ie6088046da9cd79ee6ad6e5aefb03fdc65cd707b Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/499655 Auto-Submit: Julie Qiu <julieqiu@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Julie Qiu <julieqiu@google.com> Reviewed-by: Tatiana Bradley <tatianabradley@google.com> Run-TryBot: Julie Qiu <julieqiu@google.com>
2023-05-31 19:46:54 +03:00
gopkg.in/yaml.v3 v3.0.1
go.mod: upgrade deps that were accidentally downgraded Due to merge issues, some dependencies were accidentally downgraded in a previous CL. Change-Id: I9d2deff5f582bca17f7008809bc4174ab8388b12 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/551438 Reviewed-by: Jonathan Amsterdam <jba@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-12-20 00:24:55 +03:00
honnef.co/go/tools v0.4.6
mvdan.cc/unparam v0.0.0-20230917202934-3ee2d22f45fb
checks.bash: replace all.bash all.bash is replaced with the checks.bash setup from x/vuln, so that tests run on TryBots. Change-Id: I49f2265343e9e962b8587eb9a733a52651466737 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/373156 Trust: Julie Qiu <julie@golang.org> Run-TryBot: Julie Qiu <julie@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Jonathan Amsterdam <jba@google.com>
2021-12-18 02:11:51 +03:00
)
internal: delete This code is moved to x/vuln. Change-Id: Ide030bfcbf1bcaaed4a989e0f4b8c42c94fb0368 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/362495 Trust: Julie Qiu <julie@golang.org> Run-TryBot: Julie Qiu <julie@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Jonathan Amsterdam <jba@google.com>
2021-11-09 23:29:42 +03:00
require (
go.mod, internal: update to latest version of event Update to a version of golang.org/x/exp/event that uses the latest OTel modules. Also provide a test for the Gemini AI client. Change-Id: I4705850d5953b9845e07842dcff63a01f13656f1 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/551435 Run-TryBot: Jonathan Amsterdam <jba@google.com> Reviewed-by: Tatiana Bradley <tatianabradley@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-12-19 21:10:31 +03:00
cloud.google.com/go v0.111.0 // indirect
cloud.google.com/go/ai v0.3.0 // indirect
go.mod: update golang.org/x dependencies Update golang.org/x dependencies to their latest tagged versions. Change-Id: Ic95042a609445c1422de6ea9e11b89116adb4877 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/583598 Auto-Submit: Gopher Robot <gobot@golang.org> Reviewed-by: Than McIntosh <thanm@google.com> Reviewed-by: Cherry Mui <cherryyz@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2024-05-06 20:52:31 +03:00
cloud.google.com/go/compute/metadata v0.3.0 // indirect
go.mod, internal: update to latest version of event Update to a version of golang.org/x/exp/event that uses the latest OTel modules. Also provide a test for the Gemini AI client. Change-Id: I4705850d5953b9845e07842dcff63a01f13656f1 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/551435 Run-TryBot: Jonathan Amsterdam <jba@google.com> Reviewed-by: Tatiana Bradley <tatianabradley@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-12-19 21:10:31 +03:00
cloud.google.com/go/iam v1.1.5 // indirect
cloud.google.com/go/longrunning v0.5.4 // indirect
cloud.google.com/go/monitoring v1.16.3 // indirect
cloud.google.com/go/trace v1.10.4 // indirect
all: update go-git Change-Id: Ic67d1ba33076698b0762563d6fc482c9fe3609b3 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/560337 Reviewed-by: Tatiana Bradley <tatianabradley@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Roland Shoemaker <roland@golang.org>
2024-02-01 19:31:22 +03:00
dario.cat/mergo v1.0.0 // indirect
internal/ghsarepo: ignore withdrawn GHSAs The GHSA repo client now ignores withdrawn GHSAs. (This CL pulls in a newer version of osv-scanner to get access to the Withdrawn field.) Change-Id: I160408ea3a69aa4c2cc3af03f8f90bb89512626d Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/551439 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com>
2023-12-20 01:12:53 +03:00
github.com/BurntSushi/toml v1.3.2 // indirect
go.mod, internal: update to latest version of event Update to a version of golang.org/x/exp/event that uses the latest OTel modules. Also provide a test for the Gemini AI client. Change-Id: I4705850d5953b9845e07842dcff63a01f13656f1 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/551435 Run-TryBot: Jonathan Amsterdam <jba@google.com> Reviewed-by: Tatiana Bradley <tatianabradley@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-12-19 21:10:31 +03:00
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.45.0 // indirect
all: update go-git Change-Id: Ic67d1ba33076698b0762563d6fc482c9fe3609b3 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/560337 Reviewed-by: Tatiana Bradley <tatianabradley@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Roland Shoemaker <roland@golang.org>
2024-02-01 19:31:22 +03:00
github.com/Microsoft/go-winio v0.6.1 // indirect
github.com/ProtonMail/go-crypto v1.0.0 // indirect
github.com/cloudflare/circl v1.3.7 // indirect
github.com/cyphar/filepath-securejoin v0.2.4 // indirect
internal/ghsarepo: add a client for the GHSA Git repo This change adds a client to read from the GHSA Git repo at https://github.com/github/advisory-database. This will allow us to read GHSAs in OSV format instead of the SecurityAdvisory format output by the GraphQL API. Change-Id: I791eb090b9fd6ec05a64703e84f63421d36bb154 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/503876 Run-TryBot: Tatiana Bradley <tatianabradley@google.com> Reviewed-by: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-06-13 21:51:51 +03:00
github.com/emirpasic/gods v1.18.1 // indirect
go.mod: upgrade deps that were accidentally downgraded Due to merge issues, some dependencies were accidentally downgraded in a previous CL. Change-Id: I9d2deff5f582bca17f7008809bc4174ab8388b12 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/551438 Reviewed-by: Jonathan Amsterdam <jba@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-12-20 00:24:55 +03:00
github.com/felixge/httpsnoop v1.0.4 // indirect
internal/ghsarepo: add a client for the GHSA Git repo This change adds a client to read from the GHSA Git repo at https://github.com/github/advisory-database. This will allow us to read GHSAs in OSV format instead of the SecurityAdvisory format output by the GraphQL API. Change-Id: I791eb090b9fd6ec05a64703e84f63421d36bb154 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/503876 Run-TryBot: Tatiana Bradley <tatianabradley@google.com> Reviewed-by: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-06-13 21:51:51 +03:00
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
go.mod, internal: update to latest version of event Update to a version of golang.org/x/exp/event that uses the latest OTel modules. Also provide a test for the Gemini AI client. Change-Id: I4705850d5953b9845e07842dcff63a01f13656f1 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/551435 Run-TryBot: Jonathan Amsterdam <jba@google.com> Reviewed-by: Tatiana Bradley <tatianabradley@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-12-19 21:10:31 +03:00
github.com/go-logr/logr v1.3.0 // indirect
go.mod: update golang.org/x/exp Update the exp repo to the latest version. This will give us the new event metrics code, which we will then use for worker metrics. Also, add the -compat=1.17 flag to go mod tidy; otherwise it complains about maintaining 1.16 compatibility, which we don't care about. Change-Id: I5abb1aecb8b9d6b424223ea00680ea98bd29e4da Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/386696 Trust: Jonathan Amsterdam <jba@google.com> Run-TryBot: Jonathan Amsterdam <jba@google.com> Reviewed-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2022-02-18 19:33:30 +03:00
github.com/go-logr/stdr v1.2.2 // indirect
internal/worker: add tracing Add support for OpenTelemetry tracing of certain important functions, using the event package. We don't have a burning need for traces, but they are nice to have, and this was an important exercise for validating the approach of the event package. Change-Id: I37d1f56f06f425f3b1eb885877a0d2f5ac85a098 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/380440 Trust: Jonathan Amsterdam <jba@google.com> Run-TryBot: Jonathan Amsterdam <jba@google.com> Reviewed-by: Julie Qiu <julie@golang.org>
2022-01-08 23:53:43 +03:00
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
cmd/modinfo: a tool for getting module info Give this command-line tool a module path and it will print the number of importers for each package in the module. Change-Id: Ib93eb6bec1b7f049bda43c5f7f1b05a1281fb8e0 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/513499 Run-TryBot: Jonathan Amsterdam <jba@google.com> Reviewed-by: Tatiana Bradley <tatianabradley@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-07-27 00:24:52 +03:00
github.com/golang/protobuf v1.5.3 // indirect
cmd,internal: add tools and worker code golang.org/x/vuln/srv is moved to this repository. Originally, the motivation for creating x/vuln was to split the YAML reports and Go code into two separate repositories. However, this resulted in a few issues: 1. The structure of the YAML reports is tightly coupled with the structs in internal/report, and changing one without the other would result in errors when linting the reports. 2. The vlint package itself needed to be exported, even though the only consumer was the test in x/vulndb. 3. The deploy/build.yaml script depends on cmd/gendb@latest, so updating that command could easily break the script (for example, submitting CL 373004 without changing the reference in deploy/build.yaml). Additionally, the original location of this code was x/vuln, which contained two types of packages. (1) Packages meant for consumption by other clients (for example, x/vuln/client), and (2) Internal packages that were only meant for use to spin up the worker. The internal packages resulted in many dependencies since they pulled in GCP, which we don't want clients of the vulncheck library to have to pull in. This problem was originally solved by creating a nested module inside x/vuln, but nicer separation that would also solve the issues above is the following: * x/vuln: contains Go code meant to be imported by others * x/vulndb: contains internal code only used to maintain the vulndb For golang/go#50247 Change-Id: I74a7b7f9b8fc5b0ad48a45fc3156f93c08aa9955 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/373495 Trust: Julie Qiu <julie@golang.org> Reviewed-by: Jonathan Amsterdam <jba@google.com>
2021-12-21 00:26:47 +03:00
github.com/google/go-querystring v1.1.0 // indirect
go.mod: update various dependencies to latest This is part of an effort to avoid potential problems with very stale versions. Change-Id: I2a1b40a344fdac1068aeb0eeed11dcdc6d5d7208 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/551455 Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-12-19 20:52:32 +03:00
github.com/google/s2a-go v0.1.7 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
github.com/googleapis/gax-go/v2 v2.12.0 // indirect
cmd,internal: add tools and worker code golang.org/x/vuln/srv is moved to this repository. Originally, the motivation for creating x/vuln was to split the YAML reports and Go code into two separate repositories. However, this resulted in a few issues: 1. The structure of the YAML reports is tightly coupled with the structs in internal/report, and changing one without the other would result in errors when linting the reports. 2. The vlint package itself needed to be exported, even though the only consumer was the test in x/vulndb. 3. The deploy/build.yaml script depends on cmd/gendb@latest, so updating that command could easily break the script (for example, submitting CL 373004 without changing the reference in deploy/build.yaml). Additionally, the original location of this code was x/vuln, which contained two types of packages. (1) Packages meant for consumption by other clients (for example, x/vuln/client), and (2) Internal packages that were only meant for use to spin up the worker. The internal packages resulted in many dependencies since they pulled in GCP, which we don't want clients of the vulncheck library to have to pull in. This problem was originally solved by creating a nested module inside x/vuln, but nicer separation that would also solve the issues above is the following: * x/vuln: contains Go code meant to be imported by others * x/vulndb: contains internal code only used to maintain the vulndb For golang/go#50247 Change-Id: I74a7b7f9b8fc5b0ad48a45fc3156f93c08aa9955 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/373495 Trust: Julie Qiu <julie@golang.org> Reviewed-by: Jonathan Amsterdam <jba@google.com>
2021-12-21 00:26:47 +03:00
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
internal/ghsarepo: add a client for the GHSA Git repo This change adds a client to read from the GHSA Git repo at https://github.com/github/advisory-database. This will allow us to read GHSAs in OSV format instead of the SecurityAdvisory format output by the GraphQL API. Change-Id: I791eb090b9fd6ec05a64703e84f63421d36bb154 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/503876 Run-TryBot: Tatiana Bradley <tatianabradley@google.com> Reviewed-by: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-06-13 21:51:51 +03:00
github.com/kevinburke/ssh_config v1.2.0 // indirect
github.com/pjbgf/sha1cd v0.3.0 // indirect
all: update go-git Change-Id: Ic67d1ba33076698b0762563d6fc482c9fe3609b3 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/560337 Reviewed-by: Tatiana Bradley <tatianabradley@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Roland Shoemaker <roland@golang.org>
2024-02-01 19:31:22 +03:00
github.com/sergi/go-diff v1.3.1 // indirect
internal/ghsa: a package for getting GitHub security advisories Change-Id: Ie8448aa59d09534fc3cde570590b5f9a609ae93e Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/383894 Trust: Jonathan Amsterdam <jba@google.com> Run-TryBot: Jonathan Amsterdam <jba@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Trust: Damien Neil <dneil@google.com>
2022-02-08 01:51:23 +03:00
github.com/shurcooL/graphql v0.0.0-20200928012149-18c5c3165e3a // indirect
all: update go-git Change-Id: Ic67d1ba33076698b0762563d6fc482c9fe3609b3 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/560337 Reviewed-by: Tatiana Bradley <tatianabradley@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Roland Shoemaker <roland@golang.org>
2024-02-01 19:31:22 +03:00
github.com/skeema/knownhosts v1.2.1 // indirect
internal/ghsarepo: add a client for the GHSA Git repo This change adds a client to read from the GHSA Git repo at https://github.com/github/advisory-database. This will allow us to read GHSAs in OSV format instead of the SecurityAdvisory format output by the GraphQL API. Change-Id: I791eb090b9fd6ec05a64703e84f63421d36bb154 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/503876 Run-TryBot: Tatiana Bradley <tatianabradley@google.com> Reviewed-by: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-06-13 21:51:51 +03:00
github.com/xanzy/ssh-agent v0.3.3 // indirect
cmd/modinfo: a tool for getting module info Give this command-line tool a module path and it will print the number of importers for each package in the module. Change-Id: Ib93eb6bec1b7f049bda43c5f7f1b05a1281fb8e0 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/513499 Run-TryBot: Jonathan Amsterdam <jba@google.com> Reviewed-by: Tatiana Bradley <tatianabradley@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-07-27 00:24:52 +03:00
go.opencensus.io v0.24.0 // indirect
go.mod: upgrade deps that were accidentally downgraded Due to merge issues, some dependencies were accidentally downgraded in a previous CL. Change-Id: I9d2deff5f582bca17f7008809bc4174ab8388b12 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/551438 Reviewed-by: Jonathan Amsterdam <jba@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-12-20 00:24:55 +03:00
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.46.1 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 // indirect
go.mod, internal: update to latest version of event Update to a version of golang.org/x/exp/event that uses the latest OTel modules. Also provide a test for the Gemini AI client. Change-Id: I4705850d5953b9845e07842dcff63a01f13656f1 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/551435 Run-TryBot: Jonathan Amsterdam <jba@google.com> Reviewed-by: Tatiana Bradley <tatianabradley@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-12-19 21:10:31 +03:00
go.opentelemetry.io/otel/metric v1.21.0 // indirect
internal/{observe,worker}: remove exp/event metrics Switch to an experimental metrics package of my own. Change-Id: I88cad487691787be5485b5773637e084317015ea Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/552655 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Tatiana Bradley <tatianabradley@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Run-TryBot: Jonathan Amsterdam <jba@google.com>
2023-12-24 17:53:25 +03:00
go.opentelemetry.io/otel/sdk/metric v1.21.0 // indirect
go.mod: update golang.org/x dependencies Update golang.org/x dependencies to their latest tagged versions. Change-Id: I80d0c92d357e47868d3e8f6506220fff3ab4d9df Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/626479 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: David Chase <drchase@google.com> Auto-Submit: Gopher Robot <gobot@golang.org>
2024-11-08 20:26:18 +03:00
golang.org/x/crypto v0.29.0 // indirect
cmd/modinfo: a tool for getting module info Give this command-line tool a module path and it will print the number of importers for each package in the module. Change-Id: Ib93eb6bec1b7f049bda43c5f7f1b05a1281fb8e0 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/513499 Run-TryBot: Jonathan Amsterdam <jba@google.com> Reviewed-by: Tatiana Bradley <tatianabradley@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-07-27 00:24:52 +03:00
golang.org/x/exp/typeparams v0.0.0-20221208152030-732eee02a75a // indirect
go.mod: update golang.org/x dependencies Update golang.org/x dependencies to their latest tagged versions. Change-Id: I80d0c92d357e47868d3e8f6506220fff3ab4d9df Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/626479 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: David Chase <drchase@google.com> Auto-Submit: Gopher Robot <gobot@golang.org>
2024-11-08 20:26:18 +03:00
golang.org/x/net v0.31.0 // indirect
golang.org/x/sys v0.27.0 // indirect
golang.org/x/text v0.20.0 // indirect
go.mod, internal: update to latest version of event Update to a version of golang.org/x/exp/event that uses the latest OTel modules. Also provide a test for the Gemini AI client. Change-Id: I4705850d5953b9845e07842dcff63a01f13656f1 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/551435 Run-TryBot: Jonathan Amsterdam <jba@google.com> Reviewed-by: Tatiana Bradley <tatianabradley@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-12-19 21:10:31 +03:00
google.golang.org/genproto v0.0.0-20231120223509-83a465c0220f // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20231211222908-989df2bf70f3 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20231211222908-989df2bf70f3 // indirect
all: fix lints Fix small issues like unused symbols, unchecked errors etc. Bump dependency on protobuf, which has a vulnerability. Change-Id: I10385ff41302d1446c35af43ae72219fc9687150 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/601376 Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2024-07-12 23:10:40 +03:00
google.golang.org/protobuf v1.33.0 // indirect
cmd,internal: add tools and worker code golang.org/x/vuln/srv is moved to this repository. Originally, the motivation for creating x/vuln was to split the YAML reports and Go code into two separate repositories. However, this resulted in a few issues: 1. The structure of the YAML reports is tightly coupled with the structs in internal/report, and changing one without the other would result in errors when linting the reports. 2. The vlint package itself needed to be exported, even though the only consumer was the test in x/vulndb. 3. The deploy/build.yaml script depends on cmd/gendb@latest, so updating that command could easily break the script (for example, submitting CL 373004 without changing the reference in deploy/build.yaml). Additionally, the original location of this code was x/vuln, which contained two types of packages. (1) Packages meant for consumption by other clients (for example, x/vuln/client), and (2) Internal packages that were only meant for use to spin up the worker. The internal packages resulted in many dependencies since they pulled in GCP, which we don't want clients of the vulncheck library to have to pull in. This problem was originally solved by creating a nested module inside x/vuln, but nicer separation that would also solve the issues above is the following: * x/vuln: contains Go code meant to be imported by others * x/vulndb: contains internal code only used to maintain the vulndb For golang/go#50247 Change-Id: I74a7b7f9b8fc5b0ad48a45fc3156f93c08aa9955 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/373495 Trust: Julie Qiu <julie@golang.org> Reviewed-by: Jonathan Amsterdam <jba@google.com>
2021-12-21 00:26:47 +03:00
gopkg.in/warnings.v0 v0.1.2 // indirect
internal: delete This code is moved to x/vuln. Change-Id: Ide030bfcbf1bcaaed4a989e0f4b8c42c94fb0368 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/362495 Trust: Julie Qiu <julie@golang.org> Run-TryBot: Julie Qiu <julie@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Jonathan Amsterdam <jba@google.com>
2021-11-09 23:29:42 +03:00
)