Skip to content

Commit 68f7b91

Browse files
dangrondahldangrondahl
authored
fix: resolve Snyk violations, Go stdlib vulns, and broken list repos test (#767)
* fix: upgrade dependencies to resolve Snyk vulnerabilities - Bump go.opentelemetry.io/otel packages from v1.40.0 to v1.41.0 (fixes SNYK-GOLANG-GOOPENTELEMETRYIO* resource exhaustion via baggage headers) - Bump Go from 1.25.0 to 1.25.8 (fixes std/crypto/tls, std/crypto/x509, std/archive/tar, std/archive/zip, std/html/template, std/net/http vulnerabilities) * fix: renew expired Snyk ignore for x/crypto/ssh/agent vulnerability SNYK-GOLANG-GOLANGORGXCRYPTOSSHAGENT-12668891 still has no fix available (latest golang.org/x/crypto is v0.49.0). Extend the ignore expiry to 2026-10-08. * fix: bump Go to 1.25.9 for latest stdlib vulnerability fixes Snyk reported new std/crypto/tls, std/crypto/x509, std/archive/tar, and std/html/template vulnerabilities requiring Go 1.25.9. * fix: handle nil latest_activity in list repos output The API can return nil for the latest_activity field, which caused fmt.Sprintf to print %!s(<nil>). Display an empty string instead. Also relax the test regex to not require a specific activity string. * fix: use GOTOOLCHAIN=auto in Dockerfile for Go 1.25.9 Go 1.25.9 Docker image doesn't exist yet. Use golang:1.25 base image with GOTOOLCHAIN=auto so Go auto-downloads 1.25.9 at build time.
1 parent 05297c1 commit 68f7b91

6 files changed

Lines changed: 43 additions & 37 deletions

File tree

‎.snyk‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,9 @@ ignore:
1010
reason: Choosing to ignore this licence issue for now
1111
SNYK-GOLANG-GOLANGORGXCRYPTOSSHAGENT-12668891:
1212
- "*":
13-
reason: No fix available
14-
expires: 2025-11-17T05:18:46.481Z
15-
created: 2025-09-17T05:18:46.483Z
13+
reason: No fix available (latest golang.org/x/crypto v0.49.0 still affected)
14+
expires: 2026-10-08T00:00:00.000Z
15+
created: 2026-04-08T00:00:00.000Z
1616
patch: {}
1717
exclude:
1818
global:

‎Dockerfile‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ FROM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS builder
99

1010
RUN apk add --update --no-cache git bash make ca-certificates
1111

12+
ENV GOTOOLCHAIN=auto
13+
1214
WORKDIR /go/src/kosli
1315

1416
COPY . .

‎cmd/kosli/listRepos.go‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,11 @@ func printReposListAsTable(raw string, out io.Writer, page int) error {
105105
header := []string{"NAME", "URL", "PROVIDER", "LAST_ACTIVITY"}
106106
rows := []string{}
107107
for _, repo := range repos {
108-
row := fmt.Sprintf("%s\t%s\t%s\t%s", repo["name"], repo["url"], repo["provider"], repo["latest_activity"])
108+
latestActivity := ""
109+
if v := repo["latest_activity"]; v != nil {
110+
latestActivity = fmt.Sprintf("%s", v)
111+
}
112+
row := fmt.Sprintf("%s\t%s\t%s\t%s", repo["name"], repo["url"], repo["provider"], latestActivity)
109113
rows = append(rows, row)
110114
}
111115
tabFormattedPrint(out, header, rows)

‎cmd/kosli/listRepos_test.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ func (suite *ListReposCommandTestSuite) TestListReposCmd() {
5757
{
5858
name: "02-listing repos works when there are no repos",
5959
cmd: fmt.Sprintf(`list repos %s`, suite.acmeOrgKosliArguments),
60-
goldenRegex: ".*\nkosli-dev/cli.*https://github.com/kosli-dev/cli.*github.*Trail Started at.*",
60+
goldenRegex: ".*\nkosli-dev/cli.*https://github.com/kosli-dev/cli.*github.*",
6161
},
6262
{
6363
name: "03-listing repos with --output json works when there are repos",
@@ -96,7 +96,7 @@ func (suite *ListReposCommandTestSuite) TestListReposCmd() {
9696
{
9797
name: "09-listing repos with --name filter works",
9898
cmd: fmt.Sprintf(`list repos --name kosli-dev/cli %s`, suite.acmeOrgKosliArguments),
99-
goldenRegex: ".*\nkosli-dev/cli.*https://github.com/kosli-dev/cli.*github.*Trail Started at.*",
99+
goldenRegex: ".*\nkosli-dev/cli.*https://github.com/kosli-dev/cli.*github.*",
100100
},
101101
{
102102
name: "10-listing repos with --name filter and --output json works",
@@ -106,7 +106,7 @@ func (suite *ListReposCommandTestSuite) TestListReposCmd() {
106106
{
107107
name: "11-listing repos with --provider filter works",
108108
cmd: fmt.Sprintf(`list repos --provider github %s`, suite.acmeOrgKosliArguments),
109-
goldenRegex: ".*\nkosli-dev/cli.*https://github.com/kosli-dev/cli.*github.*Trail Started at.*",
109+
goldenRegex: ".*\nkosli-dev/cli.*https://github.com/kosli-dev/cli.*github.*",
110110
},
111111
{
112112
name: "12-listing repos with non-matching --provider returns no repos message",

‎go.mod‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/kosli-dev/cli
22

3-
go 1.25.0
3+
go 1.25.9
44

55
require (
66
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0
@@ -131,7 +131,7 @@ require (
131131
github.com/google/uuid v1.6.0 // indirect
132132
github.com/gorilla/mux v1.8.1 // indirect
133133
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
134-
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7 // indirect
134+
github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
135135
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
136136
github.com/inconshreveable/mousetrap v1.1.0 // indirect
137137
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
@@ -199,12 +199,12 @@ require (
199199
github.com/yashtewari/glob-intersection v0.2.0 // indirect
200200
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
201201
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 // indirect
202-
go.opentelemetry.io/otel v1.40.0 // indirect
203-
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0 // indirect
204-
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.40.0 // indirect
205-
go.opentelemetry.io/otel/metric v1.40.0 // indirect
206-
go.opentelemetry.io/otel/sdk v1.40.0 // indirect
207-
go.opentelemetry.io/otel/trace v1.40.0 // indirect
202+
go.opentelemetry.io/otel v1.41.0 // indirect
203+
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.41.0 // indirect
204+
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.41.0 // indirect
205+
go.opentelemetry.io/otel/metric v1.41.0 // indirect
206+
go.opentelemetry.io/otel/sdk v1.41.0 // indirect
207+
go.opentelemetry.io/otel/trace v1.41.0 // indirect
208208
go.opentelemetry.io/proto/otlp v1.9.0 // indirect
209209
go.yaml.in/yaml/v2 v2.4.3 // indirect
210210
go.yaml.in/yaml/v3 v3.0.4 // indirect
@@ -217,8 +217,8 @@ require (
217217
golang.org/x/text v0.35.0 // indirect
218218
golang.org/x/time v0.15.0 // indirect
219219
golang.org/x/tools v0.42.0 // indirect
220-
google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 // indirect
221-
google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect
220+
google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57 // indirect
221+
google.golang.org/genproto/googleapis/rpc v0.0.0-20260209200024-4cfbd4190f57 // indirect
222222
google.golang.org/grpc v1.79.3 // indirect
223223
google.golang.org/protobuf v1.36.11 // indirect
224224
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect

‎go.sum‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -270,8 +270,8 @@ github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5T
270270
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674/go.mod h1:r4w70xmWCQKmi1ONH4KIaBptdivuRPyosB9RmPlGEwA=
271271
github.com/graph-gophers/graphql-go v1.9.0 h1:yu0ucKHLc5qGpRwLYKIWtr9bOoxovkWasuBrPQwlHls=
272272
github.com/graph-gophers/graphql-go v1.9.0/go.mod h1:23olKZ7duEvHlF/2ELEoSZaY1aNPfShjP782SOoNTyM=
273-
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7 h1:X+2YciYSxvMQK0UZ7sg45ZVabVZBeBuvMkmuI2V3Fak=
274-
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7/go.mod h1:lW34nIZuQ8UDPdkon5fmfp2l3+ZkQ2me/+oecHYLOII=
273+
github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 h1:HWRh5R2+9EifMyIHV7ZV+MIZqgz+PMpZ14Jynv3O2Zs=
274+
github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0/go.mod h1:JfhWUomR1baixubs02l85lZYYOm7LV6om4ceouMv45c=
275275
github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
276276
github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
277277
github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
@@ -510,22 +510,22 @@ go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ
510510
go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
511511
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 h1:7iP2uCb7sGddAr30RRS6xjKy7AZ2JtTOPA3oolgVSw8=
512512
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0/go.mod h1:c7hN3ddxs/z6q9xwvfLPk+UHlWRQyaeR1LdgfL/66l0=
513-
go.opentelemetry.io/otel v1.40.0 h1:oA5YeOcpRTXq6NN7frwmwFR0Cn3RhTVZvXsP4duvCms=
514-
go.opentelemetry.io/otel v1.40.0/go.mod h1:IMb+uXZUKkMXdPddhwAHm6UfOwJyh4ct1ybIlV14J0g=
515-
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0 h1:QKdN8ly8zEMrByybbQgv8cWBcdAarwmIPZ6FThrWXJs=
516-
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0/go.mod h1:bTdK1nhqF76qiPoCCdyFIV+N/sRHYXYCTQc+3VCi3MI=
517-
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.40.0 h1:DvJDOPmSWQHWywQS6lKL+pb8s3gBLOZUtw4N+mavW1I=
518-
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.40.0/go.mod h1:EtekO9DEJb4/jRyN4v4Qjc2yA7AtfCBuz2FynRUWTXs=
513+
go.opentelemetry.io/otel v1.41.0 h1:YlEwVsGAlCvczDILpUXpIpPSL/VPugt7zHThEMLce1c=
514+
go.opentelemetry.io/otel v1.41.0/go.mod h1:Yt4UwgEKeT05QbLwbyHXEwhnjxNO6D8L5PQP51/46dE=
515+
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.41.0 h1:ao6Oe+wSebTlQ1OEht7jlYTzQKE+pnx/iNywFvTbuuI=
516+
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.41.0/go.mod h1:u3T6vz0gh/NVzgDgiwkgLxpsSF6PaPmo2il0apGJbls=
517+
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.41.0 h1:mq/Qcf28TWz719lE3/hMB4KkyDuLJIvgJnFGcd0kEUI=
518+
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.41.0/go.mod h1:yk5LXEYhsL2htyDNJbEq7fWzNEigeEdV5xBF/Y+kAv0=
519519
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.40.0 h1:wVZXIWjQSeSmMoxF74LzAnpVQOAFDo3pPji9Y4SOFKc=
520520
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.40.0/go.mod h1:khvBS2IggMFNwZK/6lEeHg/W57h/IX6J4URh57fuI40=
521-
go.opentelemetry.io/otel/metric v1.40.0 h1:rcZe317KPftE2rstWIBitCdVp89A2HqjkxR3c11+p9g=
522-
go.opentelemetry.io/otel/metric v1.40.0/go.mod h1:ib/crwQH7N3r5kfiBZQbwrTge743UDc7DTFVZrrXnqc=
523-
go.opentelemetry.io/otel/sdk v1.40.0 h1:KHW/jUzgo6wsPh9At46+h4upjtccTmuZCFAc9OJ71f8=
524-
go.opentelemetry.io/otel/sdk v1.40.0/go.mod h1:Ph7EFdYvxq72Y8Li9q8KebuYUr2KoeyHx0DRMKrYBUE=
525-
go.opentelemetry.io/otel/sdk/metric v1.40.0 h1:mtmdVqgQkeRxHgRv4qhyJduP3fYJRMX4AtAlbuWdCYw=
526-
go.opentelemetry.io/otel/sdk/metric v1.40.0/go.mod h1:4Z2bGMf0KSK3uRjlczMOeMhKU2rhUqdWNoKcYrtcBPg=
527-
go.opentelemetry.io/otel/trace v1.40.0 h1:WA4etStDttCSYuhwvEa8OP8I5EWu24lkOzp+ZYblVjw=
528-
go.opentelemetry.io/otel/trace v1.40.0/go.mod h1:zeAhriXecNGP/s2SEG3+Y8X9ujcJOTqQ5RgdEJcawiA=
521+
go.opentelemetry.io/otel/metric v1.41.0 h1:rFnDcs4gRzBcsO9tS8LCpgR0dxg4aaxWlJxCno7JlTQ=
522+
go.opentelemetry.io/otel/metric v1.41.0/go.mod h1:xPvCwd9pU0VN8tPZYzDZV/BMj9CM9vs00GuBjeKhJps=
523+
go.opentelemetry.io/otel/sdk v1.41.0 h1:YPIEXKmiAwkGl3Gu1huk1aYWwtpRLeskpV+wPisxBp8=
524+
go.opentelemetry.io/otel/sdk v1.41.0/go.mod h1:ahFdU0G5y8IxglBf0QBJXgSe7agzjE4GiTJ6HT9ud90=
525+
go.opentelemetry.io/otel/sdk/metric v1.41.0 h1:siZQIYBAUd1rlIWQT2uCxWJxcCO7q3TriaMlf08rXw8=
526+
go.opentelemetry.io/otel/sdk/metric v1.41.0/go.mod h1:HNBuSvT7ROaGtGI50ArdRLUnvRTRGniSUZbxiWxSO8Y=
527+
go.opentelemetry.io/otel/trace v1.41.0 h1:Vbk2co6bhj8L59ZJ6/xFTskY+tGAbOnCtQGVVa9TIN0=
528+
go.opentelemetry.io/otel/trace v1.41.0/go.mod h1:U1NU4ULCoxeDKc09yCWdWe+3QoyweJcISEVa1RBzOis=
529529
go.opentelemetry.io/proto/otlp v1.9.0 h1:l706jCMITVouPOqEnii2fIAuO3IVGBRPV5ICjceRb/A=
530530
go.opentelemetry.io/proto/otlp v1.9.0/go.mod h1:xE+Cx5E/eEHw+ISFkwPLwCZefwVjY+pqKg1qcK03+/4=
531531
go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
@@ -605,10 +605,10 @@ golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8T
605605
gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
606606
gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
607607
google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
608-
google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 h1:merA0rdPeUV3YIIfHHcH4qBkiQAc1nfCKSI7lB4cV2M=
609-
google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409/go.mod h1:fl8J1IvUjCilwZzQowmw2b7HQB2eAuYBabMXzWurF+I=
610-
google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 h1:H86B94AW+VfJWDqFeEbBPhEtHzJwJfTbgE2lZa54ZAQ=
611-
google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ=
608+
google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57 h1:JLQynH/LBHfCTSbDWl+py8C+Rg/k1OVH3xfcaiANuF0=
609+
google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57/go.mod h1:kSJwQxqmFXeo79zOmbrALdflXQeAYcUbgS7PbpMknCY=
610+
google.golang.org/genproto/googleapis/rpc v0.0.0-20260209200024-4cfbd4190f57 h1:mWPCjDEyshlQYzBpMNHaEof6UX1PmHcaUODUywQ0uac=
611+
google.golang.org/genproto/googleapis/rpc v0.0.0-20260209200024-4cfbd4190f57/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ=
612612
google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=
613613
google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
614614
google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=

0 commit comments

Comments
 (0)