Skip to content

Commit c015643

Browse files
zhaohuabingzhaohuabing
authored
deps: bump dependencies flagged by OSV scan (#9575)
Bump dependencies with available fixed versions flagged by the OSV scanner across the tools and example modules and the npm lockfiles. Go (tools/go.mod, indirect): - golang.org/x/net 0.55.0 -> 0.57.0 (GO-2026-5942) - golang.org/x/text 0.37.0 -> 0.40.0 (GO-2026-5970) - google.golang.org/grpc 1.79.3 -> 1.82.1 (GHSA-hrxh-6v49-42gf) - oras.land/oras-go/v2 2.6.0 -> 2.6.1 (GHSA-8xwf-rjm4-xvhv, GHSA-jxpm-75mh-9fp7, GHSA-vh4v-2xq2-g5cg, GHSA-xf85-363p-868w) Go (examples/{envoy-ext-auth,grpc-ext-proc,simple-extension-server}, indirect): - golang.org/x/net 0.55.0 -> 0.57.0 (GO-2026-5942) - golang.org/x/text 0.37.0/0.38.0 -> 0.40.0 (GO-2026-5970) npm (transitive, lockfile only): - postcss 8.5.10 -> 8.5.22 (GHSA-6g55-p6wh-862q, site) - tar 7.5.16 -> 7.5.21 (GHSA-23hp-3jrh-7fpw, +3, site) - brace-expansion 5.0.6 -> 5.0.8 (GHSA-3jxr-9vmj-r5cp, tools) Versions in tools/ and examples/ are aligned with the already-patched root and test modules to avoid version skew. Advisories without an upstream fix are not addressed here: golang.org/x/crypto (GO-2026-5932), oras.land/oras-go/v2 (GHSA-fxhp-mv3v-67qp), github.com/containerd/containerd (GO-2026-5064, -5338, -5622), and adm-zip (GHSA-xcpc-8h2w-3j85; fixed in 0.6.0 but hugo-extended still pins ^0.5.17). Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io>
1 parent 55ae848 commit c015643

10 files changed

Lines changed: 90 additions & 90 deletions

File tree

‎examples/envoy-ext-auth/go.mod‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ require (
1414
github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 // indirect
1515
github.com/envoyproxy/protoc-gen-validate v1.3.3 // indirect
1616
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
17-
golang.org/x/net v0.55.0 // indirect
18-
golang.org/x/sys v0.45.0 // indirect
19-
golang.org/x/text v0.37.0 // indirect
17+
golang.org/x/net v0.57.0 // indirect
18+
golang.org/x/sys v0.47.0 // indirect
19+
golang.org/x/text v0.40.0 // indirect
2020
)

‎examples/envoy-ext-auth/go.sum‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -30,12 +30,12 @@ go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfC
3030
go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
3131
go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
3232
go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
33-
golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
34-
golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
35-
golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
36-
golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
37-
golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
38-
golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
33+
golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
34+
golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
35+
golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
36+
golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
37+
golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
38+
golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
3939
gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
4040
gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
4141
google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 h1:RmoJA1ujG+/lRGNfUnOMfhCy5EipVMyvUE+KNbPbTlw=

‎examples/grpc-ext-proc/go.mod‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ require (
1212
github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 // indirect
1313
github.com/envoyproxy/protoc-gen-validate v1.3.3 // indirect
1414
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
15-
golang.org/x/net v0.55.0 // indirect
16-
golang.org/x/sys v0.45.0 // indirect
17-
golang.org/x/text v0.37.0 // indirect
15+
golang.org/x/net v0.57.0 // indirect
16+
golang.org/x/sys v0.47.0 // indirect
17+
golang.org/x/text v0.40.0 // indirect
1818
google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
1919
)

‎examples/grpc-ext-proc/go.sum‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -30,12 +30,12 @@ go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfC
3030
go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
3131
go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
3232
go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
33-
golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
34-
golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
35-
golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
36-
golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
37-
golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
38-
golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
33+
golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
34+
golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
35+
golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
36+
golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
37+
golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
38+
golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
3939
gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
4040
gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
4141
google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 h1:RmoJA1ujG+/lRGNfUnOMfhCy5EipVMyvUE+KNbPbTlw=

‎examples/simple-extension-server/go.mod‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,9 @@ require (
1717
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
1818
github.com/russross/blackfriday/v2 v2.1.0 // indirect
1919
github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect
20-
golang.org/x/net v0.55.0 // indirect
21-
golang.org/x/sys v0.46.0 // indirect
22-
golang.org/x/text v0.38.0 // indirect
20+
golang.org/x/net v0.57.0 // indirect
21+
golang.org/x/sys v0.47.0 // indirect
22+
golang.org/x/text v0.40.0 // indirect
2323
google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
2424
google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
2525
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect

‎examples/simple-extension-server/go.sum‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -42,12 +42,12 @@ go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRk
4242
go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
4343
go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
4444
go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
45-
golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
46-
golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
47-
golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
48-
golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
49-
golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
50-
golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
45+
golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
46+
golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
47+
golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
48+
golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
49+
golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
50+
golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
5151
gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
5252
gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
5353
google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa h1:Kjn0N0tCrDgiAFW+lGO4JZ3ck44CehvJQMAwj9QF0G8=

‎site/package-lock.json‎

Lines changed: 10 additions & 10 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎tools/go.mod‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -341,29 +341,29 @@ require (
341341
go.lsp.dev/uri v0.3.0 // indirect
342342
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
343343
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect
344-
go.opentelemetry.io/otel v1.42.0 // indirect
345-
go.opentelemetry.io/otel/metric v1.42.0 // indirect
346-
go.opentelemetry.io/otel/trace v1.42.0 // indirect
344+
go.opentelemetry.io/otel v1.43.0 // indirect
345+
go.opentelemetry.io/otel/metric v1.43.0 // indirect
346+
go.opentelemetry.io/otel/trace v1.43.0 // indirect
347347
go.uber.org/multierr v1.11.0 // indirect
348348
go.uber.org/zap v1.27.1 // indirect
349349
go.yaml.in/yaml/v2 v2.4.3 // indirect
350350
go.yaml.in/yaml/v3 v3.0.4 // indirect
351-
golang.org/x/crypto v0.52.0 // indirect
351+
golang.org/x/crypto v0.54.0 // indirect
352352
golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90 // indirect
353353
golang.org/x/exp/typeparams v0.0.0-20260209203927-2842357ff358 // indirect
354-
golang.org/x/mod v0.35.0 // indirect
355-
golang.org/x/net v0.55.0 // indirect
354+
golang.org/x/mod v0.37.0 // indirect
355+
golang.org/x/net v0.57.0 // indirect
356356
golang.org/x/oauth2 v0.36.0 // indirect
357357
golang.org/x/perf v0.0.0-20260409210113-8e83ce0f7b1c // indirect
358-
golang.org/x/sync v0.20.0 // indirect
359-
golang.org/x/sys v0.45.0 // indirect
360-
golang.org/x/term v0.43.0 // indirect
361-
golang.org/x/text v0.37.0 // indirect
358+
golang.org/x/sync v0.22.0 // indirect
359+
golang.org/x/sys v0.47.0 // indirect
360+
golang.org/x/term v0.45.0 // indirect
361+
golang.org/x/text v0.40.0 // indirect
362362
golang.org/x/time v0.14.0 // indirect
363-
golang.org/x/tools v0.44.0 // indirect
364-
google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7 // indirect
365-
google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7 // indirect
366-
google.golang.org/grpc v1.79.3 // indirect
363+
golang.org/x/tools v0.47.0 // indirect
364+
google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 // indirect
365+
google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
366+
google.golang.org/grpc v1.82.1 // indirect
367367
google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1 // indirect
368368
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
369369
gopkg.in/alecthomas/kingpin.v2 v2.2.6 // indirect
@@ -390,7 +390,7 @@ require (
390390
mvdan.cc/gofumpt v0.9.2 // indirect
391391
mvdan.cc/unparam v0.0.0-20251027182757-5beb8c8f8f15 // indirect
392392
mvdan.cc/xurls/v2 v2.6.0 // indirect
393-
oras.land/oras-go/v2 v2.6.0 // indirect
393+
oras.land/oras-go/v2 v2.6.1 // indirect
394394
pluginrpc.com/pluginrpc v0.5.0 // indirect
395395
sigs.k8s.io/controller-runtime/tools/setup-envtest v0.0.0-20260405152528-6210f847b2c1 // indirect
396396
sigs.k8s.io/controller-tools v0.20.1 // indirect

0 commit comments

Comments
 (0)