Merge pull request #614 from USACE/issue488/vulnerabilities-goversion-pgx

Go version update with package updates.

Author: jeffsuperglide

api/Dockerfile

@@ -1,4 +1,10 @@
-FROM golang:1.26.3-alpine AS builder
+ARG GO_VERSION=1.26
+ARG GO_TAG=${GO_VERSION}-alpine
+
+# *~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~
+# builder
+# *~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~
+FROM golang:${GO_TAG} AS builder
 # Install Git
 RUN apk update && apk add --no-cache ca-certificates
 # Copy In Source Code
@@ -21,12 +27,12 @@ RUN GOOS=linux GOARCH=amd64 CGO_ENABLED=0 \
 FROM scratch
 COPY --from=builder /go/bin/cumulus-api /go/bin/cumulus-api
 COPY --from=builder /etc/ssl/certs/ca-certificates.crt \
-                    /etc/ssl/certs/ca-certificates.crt
+    /etc/ssl/certs/ca-certificates.crt
 # COPY --from=builder /etc_passwd /etc/passwd
 
 # Run as the new non-root by default
 # USER nobody
 
 VOLUME [ "/sql" ]
 
-ENTRYPOINT ["/go/bin/cumulus-api"]
+ENTRYPOINT ["/go/bin/cumulus-api"]

api/config/config.go

@@ -3,13 +3,14 @@ package config
 import (
 	"log"
 
-	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go-v2/aws"
 
 	"github.com/kelseyhightower/envconfig"
 )
 
 // Config holds application configuration variables
 type Config struct {
+	AwsConfig                    aws.Config
 	DBUser                       string
 	DBPass                       string
 	DBName                       string
@@ -34,18 +35,18 @@ type Config struct {
 	PgFeatureservUrl             string `envconfig:"PG_FEATURESERV_URL"`
 }
 
-func (cfg Config) AWSConfig() aws.Config {
+// func (cfg Config) AWSConfig() aws.Config {
 
-	a := aws.NewConfig().WithRegion(cfg.AWSS3Region)
+// 	a := aws.NewConfig().WithRegion(cfg.AWSS3Region)
 
-	// Used for "minio" during development
-	a.WithDisableSSL(cfg.AWSS3DisableSSL)
-	a.WithS3ForcePathStyle(cfg.AWSS3ForcePathStyle)
-	if cfg.AWSS3Endpoint != "" {
-		a.WithEndpoint(cfg.AWSS3Endpoint)
-	}
-	return *a
-}
+// 	// Used for "minio" during development
+// 	a.WithDisableSSL(cfg.AWSS3DisableSSL)
+// 	a.WithS3ForcePathStyle(cfg.AWSS3ForcePathStyle)
+// 	if cfg.AWSS3Endpoint != "" {
+// 		a.WithEndpoint(cfg.AWSS3Endpoint)
+// 	}
+// 	return *a
+// }
 
 // GetConfig returns environment variable config
 func GetConfig() (*Config, error) {

api/go.mod

@@ -1,72 +1,68 @@
 module github.com/USACE/cumulus-api/api
 
-go 1.26.3
+go 1.26.4
 
 require (
 	github.com/USACE/go-simple-asyncer v0.0.0-20201015223104-446ae10887a8
-	github.com/aws/aws-sdk-go v1.55.7
-	github.com/aws/aws-sdk-go-v2 v1.41.9
+	github.com/aws/aws-sdk-go-v2 v1.42.0
 	github.com/btcsuite/btcutil v1.0.2
-	github.com/georgysavva/scany v1.2.3
-	github.com/golang-jwt/jwt/v5 v5.2.2
+	github.com/georgysavva/scany/v2 v2.1.4
+	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/uuid v1.6.0
 	github.com/gosimple/slug v1.15.0
-	github.com/jackc/pgx/v4 v4.18.3
+	github.com/jackc/pgx/v5 v5.10.0
 	github.com/jmoiron/sqlx v1.4.0
 	github.com/kelseyhightower/envconfig v1.4.0
-	github.com/labstack/echo-contrib v0.17.4
-	github.com/labstack/echo-jwt/v4 v4.3.1
-	github.com/labstack/echo/v4 v4.13.3
-	golang.org/x/crypto v0.52.0
+	github.com/labstack/echo-contrib v0.50.1
+	github.com/labstack/echo-jwt/v4 v4.4.0
+	github.com/labstack/echo/v4 v4.15.2
+	golang.org/x/crypto v0.53.0
 	golang.org/x/net v0.55.0
 )
 
 require (
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.11 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.19 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.25 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.25 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.25 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.26 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.10 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.18 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.25 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.25 // indirect
-	github.com/aws/aws-sdk-go-v2/service/signin v1.1.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.30.19 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.36.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.42.3 // indirect
-	github.com/aws/smithy-go v1.26.0 // indirect
+	github.com/aws/aws-sdk-go v1.35.7 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.13 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.23 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.29 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.29 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.30 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.12 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.22 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.29 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.29 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signin v1.1.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.31.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.36.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.43.3 // indirect
+	github.com/aws/smithy-go v1.27.2 // indirect
+	github.com/jackc/puddle/v2 v2.2.2 // indirect
+	github.com/jmespath/go-jmespath v0.4.0 // indirect
+	github.com/streadway/amqp v1.0.0 // indirect
+	golang.org/x/sync v0.21.0 // indirect
 )
 
 require (
-	github.com/aws/aws-sdk-go-v2/config v1.32.20
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.102.2
+	github.com/aws/aws-sdk-go-v2/config v1.32.24
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.103.3
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/gosimple/unidecode v1.0.1 // indirect
-	github.com/jackc/chunkreader/v2 v2.0.1 // indirect
-	github.com/jackc/pgconn v1.14.3 // indirect
-	github.com/jackc/pgio v1.0.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
-	github.com/jackc/pgproto3/v2 v2.3.3 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
-	github.com/jackc/pgtype v1.14.4 // indirect
-	github.com/jackc/puddle v1.3.0 // indirect
-	github.com/jmespath/go-jmespath v0.4.0 // indirect
-	github.com/labstack/gommon v0.4.2 // indirect
-	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/labstack/gommon v0.5.0 // indirect
+	github.com/mattn/go-colorable v0.1.15 // indirect
+	github.com/mattn/go-isatty v0.0.22 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/prometheus/client_golang v1.22.0 // indirect
+	github.com/prometheus/client_golang v1.23.2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.63.0 // indirect
-	github.com/prometheus/procfs v0.16.1 // indirect
-	github.com/streadway/amqp v1.1.0 // indirect
+	github.com/prometheus/common v0.68.1 // indirect
+	github.com/prometheus/procfs v0.20.1 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/valyala/fasttemplate v1.2.2 // indirect
-	golang.org/x/sys v0.45.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
-	golang.org/x/time v0.11.0 // indirect
-	google.golang.org/protobuf v1.36.6 // indirect
+	golang.org/x/sys v0.46.0 // indirect
+	golang.org/x/text v0.38.0 // indirect
+	golang.org/x/time v0.15.0 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
 )