From 44f54467c4fe5a416002b3991d7e0e879a6d80d8 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 27 Jul 2026 20:03:32 +0000 Subject: [PATCH] fix: resolve govulncheck findings Update dependencies and Go toolchain to address vulnerabilities reported by govulncheck: - google.golang.org/grpc v1.81.1 -> v1.82.1 (GO-2026-6061) - golang.org/x/text v0.37.0 -> v0.39.0 (GO-2026-5970) - Go toolchain 1.26.4 -> 1.26.5 (GO-2026-5856, crypto/tls) Bump go-version in CI workflows to 1.26.5 to match. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01EkHrsp8ys1SYoqqBLCCn6t --- .github/workflows/build.yml | 2 +- .github/workflows/ci-kotlin.yml | 2 +- .github/workflows/ci-python.yml | 2 +- .github/workflows/ci-typescript.yml | 2 +- .github/workflows/ci.yml | 4 ++-- go.mod | 10 +++++----- go.sum | 16 ++++++++-------- 7 files changed, 19 insertions(+), 19 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index db447977ab..0beb2869c3 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -12,7 +12,7 @@ jobs: - uses: actions/checkout@v7 - uses: actions/setup-go@v6 with: - go-version: '1.26.4' + go-version: '1.26.5' - name: install ./... run: go build ./... env: diff --git a/.github/workflows/ci-kotlin.yml b/.github/workflows/ci-kotlin.yml index 4efe07219c..f9b5a78327 100644 --- a/.github/workflows/ci-kotlin.yml +++ b/.github/workflows/ci-kotlin.yml @@ -19,7 +19,7 @@ jobs: - uses: actions/checkout@v7 - uses: actions/setup-go@v6 with: - go-version: '1.26.4' + go-version: '1.26.5' - name: install ./... run: go install ./... - uses: actions/checkout@v7 diff --git a/.github/workflows/ci-python.yml b/.github/workflows/ci-python.yml index 34e4ecc65c..1f471c5238 100644 --- a/.github/workflows/ci-python.yml +++ b/.github/workflows/ci-python.yml @@ -19,7 +19,7 @@ jobs: - uses: actions/checkout@v7 - uses: actions/setup-go@v6 with: - go-version: '1.26.4' + go-version: '1.26.5' - name: install ./... run: go install ./... - uses: actions/checkout@v7 diff --git a/.github/workflows/ci-typescript.yml b/.github/workflows/ci-typescript.yml index 2f7e84bba5..2e09006f9a 100644 --- a/.github/workflows/ci-typescript.yml +++ b/.github/workflows/ci-typescript.yml @@ -19,7 +19,7 @@ jobs: - uses: actions/checkout@v7 - uses: actions/setup-go@v6 with: - go-version: '1.26.4' + go-version: '1.26.5' - name: install ./... run: go install ./... - uses: actions/checkout@v7 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1496dbed0e..12b7957a87 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,7 +16,7 @@ jobs: - uses: actions/checkout@v7 - uses: actions/setup-go@v6 with: - go-version: '1.26.4' + go-version: '1.26.5' - run: go build ./... env: CGO_ENABLED: "0" @@ -28,7 +28,7 @@ jobs: - uses: actions/checkout@v7 - uses: actions/setup-go@v6 with: - go-version: '1.26.4' + go-version: '1.26.5' - name: install gotestsum run: go install gotest.tools/gotestsum@latest diff --git a/go.mod b/go.mod index c89cfa38f8..7c041d7ad5 100644 --- a/go.mod +++ b/go.mod @@ -2,7 +2,7 @@ module github.com/sqlc-dev/sqlc go 1.26.0 -toolchain go1.26.4 +toolchain go1.26.5 require ( github.com/antlr4-go/antlr/v4 v4.13.1 @@ -27,7 +27,7 @@ require ( github.com/wasilibs/go-pgquery v0.0.0-20250409022910-10ac41983c07 github.com/xeipuuv/gojsonschema v1.2.0 golang.org/x/sync v0.21.0 - google.golang.org/grpc v1.81.1 + google.golang.org/grpc v1.82.1 google.golang.org/protobuf v1.36.11 gopkg.in/yaml.v3 v3.0.1 ) @@ -50,7 +50,7 @@ require ( golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b // indirect golang.org/x/net v0.55.0 // indirect golang.org/x/sys v0.45.0 // indirect - golang.org/x/text v0.37.0 // indirect - google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171 // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect + golang.org/x/text v0.39.0 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect ) diff --git a/go.sum b/go.sum index 017fc2647b..06deab8bf0 100644 --- a/go.sum +++ b/go.sum @@ -112,16 +112,16 @@ golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM= golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY= golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc= -golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38= +golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus= +golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171 h1:tu/dtnW1o3wfaxCOjSLn5IRX4YDcJrtlpzYkhHhGaC4= -google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171/go.mod h1:M5krXqk4GhBKvB596udGL3UyjL4I1+cTbK0orROM9ng= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 h1:ggcbiqK8WWh6l1dnltU4BgWGIGo+EVYxCaAPih/zQXQ= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= -google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ= -google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I= +google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 h1:yQugLulqltosq0B/f8l4w9VryjV+N/5gcW0jQ3N8Qec= +google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478/go.mod h1:C6ADNqOxbgdUUeRTU+LCHDPB9ttAMCTff6auwCVa4uc= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 h1:RmoJA1ujG+/lRGNfUnOMfhCy5EipVMyvUE+KNbPbTlw= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE= +google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=