Repository navigation
Bump dependencies to fix security alerts - #240
Merged
Merged
Conversation
wu-sheng
force-pushed
the
bump/security-deps-2026-11-02
branch
from
November 2, 2026 17:06
1f4fbfa to
ac9f310
Compare
- golang.org/x/net v0.60.0 -> v0.62.0 (GO-2026-6860, GO-2026-6866), with golang.org/x/crypto v0.58.0, x/sync v0.24.0, x/sys v0.49.0, x/term v0.47.0 and x/text v0.43.0 by minimum version selection. - dist/LICENSE regenerated with license-eye (d38fe05); only the version lines change. CHANGES.md updated. GitHub Actions: actions/checkout v3/v4 -> v7, actions/setup-go v4/v5 -> v7, actions/upload-artifact v4 -> v7, in the workflows and in the actions/setup composite action. infra-e2e: apache/skywalking-infra-e2e cf589b4 -> 56ac8be in the three e2e jobs. Its verifier now requires every entry of a `contains` block to match a distinct actual item (infra-e2e #137, #143). The basic case's dependency-instance expectation listed a CLIENT detect point the instance relation never reports (the OAP returns only SERVER); the old verifier accepted the partial match. The expected file now lists SERVER only.
wu-sheng
force-pushed
the
bump/security-deps-2026-11-02
branch
from
November 3, 2026 00:36
ac9f310 to
b2324ce
Compare
mrproliu
approved these changes
Nov 3, 2026
mrproliu
approved these changes
Nov 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bump golang.org/x/net in swctl past the versions OSV flags, regenerate
dist/LICENSE, and move CI to current GitHub Actions majors and skywalking-infra-e2e.Dependencies
go.modgo.modgo.modgo.modgovulncheck on master lists both x/net advisories in a required module but not reachable from swctl code. CHANGES.md: one line under a new 0.16.0 Bug Fixes section (0.15.0 is released).
GitHub Actions
actions/setupcomposite action this repository publishesinfra-e2e
apache/skywalking-infra-e2e
cf589b4->56ac8be(current main, CI green) in the three e2e jobs. The action sets up Go 1.26 itself to builde2e.The newer verifier requires every entry of a
containsblock to match a distinct actual item (apache/skywalking-infra-e2e#137, #143); the old one accepted a partial match.test/cases/basic/expected/dependency-instance.ymlexpected the consumer -> provider instance call to carry both SERVER and CLIENT detect points, but the OAP reports only SERVER for it, so the case failed on 56ac8be. The expectation now lists SERVER only. Checked locally withe2e verifybuilt at 56ac8be against the actual output from the failed run: the new file passes and the old one fails the same way CI did.License
dist/LICENSEregenerated withlicense-eye dependency resolveat the Makefile's pin (d38fe05); only the x/* version lines change. The same run on master produced no diff, so there was no earlier drift.dist/licensesis unchanged.Verified locally (Go 1.27.1)
go build ./...: passgo test ./...: pass (11 packages)make license-header: passmake lint(golangci-lint is not installed here), the e2e jobsLeft out on purpose
openpgpis unmaintained) has no fixed version; govulncheck finds it unreachable.