jcoffey-dev
b7f99b49f2
GHSA-2v4p-qf9q-27wj is a panic in gRPC-Go's xDS routing interceptor: a request arriving with neither `:authority` nor `Host` indexes an empty slice, the per-RPC goroutine does not recover, and the process dies. High, and nine alerts, because nine go.mod files pin the same version -- eight directly, terraform indirectly. Nothing here was reachable. The interceptor is installed by `xds.NewGRPCServer`, which this repo never calls: the one production server is `grpc.NewServer(grpc.Creds(...))` in ingest/internal/grpcserver and the only other is a plain one in a searchclient test. That is also why security-scan has been green throughout -- govulncheck reports on reachability and found nothing on 1.83.1, while Dependabot reports on version ranges and found nine. Both were right. Taken anyway: it is a patch release, and the next advisory in this dependency may well land somewhere we do reach. `go mod tidy` carried the indirect requirements grpc 1.83.2 asks for -- x/net, x/text, x/sys and friends. No CI job builds or tests Go here, so all nine modules were built locally and api, ingest and enterprise tested with -count=1, since a cached pass would not have exercised the new version. The dependabot.yml is the other half. There was no config, so nothing opened a PR against any of this. Go majors stay out of the group, being import path changes rather than bumps.
63 lines
2.8 KiB
AMPL
63 lines
2.8 KiB
AMPL
module github.com/cairnobs/cairnobs/terraform
|
|
|
|
go 1.25.8
|
|
|
|
require (
|
|
github.com/hashicorp/terraform-plugin-framework v1.19.0
|
|
github.com/hashicorp/terraform-plugin-go v0.31.0
|
|
github.com/hashicorp/terraform-plugin-testing v1.16.0
|
|
)
|
|
|
|
require (
|
|
github.com/ProtonMail/go-crypto v1.4.1 // indirect
|
|
github.com/agext/levenshtein v1.2.3 // indirect
|
|
github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
|
|
github.com/cloudflare/circl v1.6.3 // indirect
|
|
github.com/fatih/color v1.18.0 // indirect
|
|
github.com/golang/protobuf v1.5.4 // indirect
|
|
github.com/google/go-cmp v0.7.0 // indirect
|
|
github.com/hashicorp/errwrap v1.1.0 // indirect
|
|
github.com/hashicorp/go-checkpoint v0.5.0 // indirect
|
|
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
|
|
github.com/hashicorp/go-cty v1.5.0 // indirect
|
|
github.com/hashicorp/go-hclog v1.6.3 // indirect
|
|
github.com/hashicorp/go-multierror v1.1.1 // indirect
|
|
github.com/hashicorp/go-plugin v1.7.0 // indirect
|
|
github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
|
|
github.com/hashicorp/go-uuid v1.0.3 // indirect
|
|
github.com/hashicorp/go-version v1.9.0 // indirect
|
|
github.com/hashicorp/hc-install v0.9.4 // indirect
|
|
github.com/hashicorp/hcl/v2 v2.24.0 // indirect
|
|
github.com/hashicorp/logutils v1.0.0 // indirect
|
|
github.com/hashicorp/terraform-exec v0.25.1 // indirect
|
|
github.com/hashicorp/terraform-json v0.27.2 // indirect
|
|
github.com/hashicorp/terraform-plugin-log v0.11.0 // indirect
|
|
github.com/hashicorp/terraform-plugin-sdk/v2 v2.40.0 // indirect
|
|
github.com/hashicorp/terraform-registry-address v0.4.0 // indirect
|
|
github.com/hashicorp/terraform-svchost v0.2.1 // indirect
|
|
github.com/hashicorp/yamux v0.1.2 // indirect
|
|
github.com/mattn/go-colorable v0.1.14 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/mitchellh/copystructure v1.2.0 // indirect
|
|
github.com/mitchellh/go-testing-interface v1.14.1 // indirect
|
|
github.com/mitchellh/go-wordwrap v1.0.1 // indirect
|
|
github.com/mitchellh/mapstructure v1.5.0 // indirect
|
|
github.com/mitchellh/reflectwalk v1.0.2 // indirect
|
|
github.com/oklog/run v1.2.0 // indirect
|
|
github.com/vmihailenco/msgpack v4.0.4+incompatible // indirect
|
|
github.com/vmihailenco/msgpack/v5 v5.4.1 // indirect
|
|
github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
|
|
github.com/zclconf/go-cty v1.18.1 // indirect
|
|
golang.org/x/crypto v0.55.0 // indirect
|
|
golang.org/x/mod v0.38.0 // indirect
|
|
golang.org/x/net v0.58.0 // indirect
|
|
golang.org/x/sync v0.22.0 // indirect
|
|
golang.org/x/sys v0.47.0 // indirect
|
|
golang.org/x/text v0.41.0 // indirect
|
|
golang.org/x/tools v0.48.0 // indirect
|
|
google.golang.org/appengine v1.6.8 // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
|
|
google.golang.org/grpc v1.83.2 // indirect
|
|
google.golang.org/protobuf v1.36.11 // indirect
|
|
)
|