mirror of
https://github.com/GopeedLab/gopeed.git
synced 2026-11-09 10:00:27 +00:00
Silas MariuszandLevi
98879569f0
govulncheck (-tags nosqlite,web ./cmd/web/... and ./cmd/api/...) reports 40 reachable vulnerabilities in 10 modules on main. This update fixes 34 of them and keeps the go directive at 1.25.4, the version CI uses. - github.com/go-git/go-git/v5 v5.8.1 -> v5.19.2: GO-2024-2456, GO-2024-2466, GO-2025-3367, GO-2025-3368, GO-2026-4473, GO-2026-4909, GO-2026-4910, GO-2026-5074, GO-2026-5105, GO-2026-5336, GO-2026-5496, GO-2026-5693, GO-2026-6213, GO-2026-6214 - github.com/go-git/go-billy/v5 v5.4.1 -> v5.9.2: GO-2026-5490, GO-2026-5597 - golang.org/x/crypto v0.48.0 -> v0.55.0: GO-2026-5013, GO-2026-5015, GO-2026-5017, GO-2026-5018, GO-2026-5019, GO-2026-5020, GO-2026-5021 - golang.org/x/net v0.50.0 -> v0.58.0: GO-2026-4559, GO-2026-5026, GO-2026-5942 - golang.org/x/text v0.34.0 -> v0.41.0: GO-2026-5970 - github.com/imroc/req/v3 v3.52.2 -> v3.58.0, which brings github.com/quic-go/quic-go v0.51.0 -> v0.59.0 (GO-2025-4017) and github.com/refraction-networking/utls v1.6.7 -> v1.8.2 (GO-2025-3638, GO-2026-4509, GO-2026-4512). req v3.52.2 does not build against a quic-go with the fix. - github.com/pion/dtls/v3 v3.0.10 -> v3.1.4: GO-2026-6165 - github.com/pion/stun/v3 v3.1.1 -> v3.1.5: GO-2026-6163 - github.com/cloudflare/circl v1.6.1 -> v1.6.3: GO-2026-4550 The other module changes are what go mod tidy needs for these. Still open, because the fixed releases need Go 1.26: golang.org/x/net GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612 and GO-2026-6617 (fixed in v0.60.0), and golang.org/x/crypto GO-2026-6354 and GO-2026-6355 (fixed in v0.56.0). GO-2026-6610 affects every x/net before v0.60.0; govulncheck does not report it as reachable with v0.50.0, but does with v0.56.0 and v0.58.0. Co-authored-by: Levi <[email protected]>
172 lines
7.5 KiB
AMPL
172 lines
7.5 KiB
AMPL
module github.com/GopeedLab/gopeed
|
|
|
|
go 1.25.4
|
|
|
|
require (
|
|
codeberg.org/gruf/go-ffmpreg v0.6.23-0.20260827095416-df1836cb5be0
|
|
github.com/GopeedLab/webview_go v0.0.0-20260918010912-0d4c27bb7914
|
|
github.com/anacrolix/torrent v1.60.1-0.20251217073903-486bcbe758e0
|
|
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5
|
|
github.com/bodgit/sevenzip v1.6.1
|
|
github.com/dop251/goja v0.0.0-20260106131823-651366fbe6e3
|
|
github.com/dop251/goja_nodejs v0.0.0-20240728170619-29b559befffc
|
|
github.com/fclairamb/ftpserverlib v0.31.0
|
|
github.com/go-git/go-git/v5 v5.19.2
|
|
github.com/google/jsonschema-go v0.4.3
|
|
github.com/gorilla/handlers v1.5.1
|
|
github.com/gorilla/mux v1.8.0
|
|
github.com/imroc/req/v3 v3.58.0
|
|
github.com/jlaffaye/ftp v0.2.4
|
|
github.com/matoous/go-nanoid/v2 v2.0.0
|
|
github.com/mattn/go-ieproxy v0.0.12
|
|
github.com/mholt/archives v0.1.5
|
|
github.com/modelcontextprotocol/go-sdk v1.7.0
|
|
github.com/monkeyWie/goed2k v0.0.0-20260317100435-7a7575cf2447
|
|
github.com/pkg/errors v0.9.1
|
|
github.com/rs/dnscache v0.0.0-20230804202142-fc85eb664529
|
|
github.com/rs/zerolog v1.31.0
|
|
github.com/spf13/afero v1.15.0
|
|
github.com/tetratelabs/wazero v1.12.0
|
|
github.com/xiaoqidun/setft v0.0.0-20220310121541-be86327699ad
|
|
go.etcd.io/bbolt v1.4.3
|
|
golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
|
|
)
|
|
|
|
require (
|
|
github.com/cyphar/filepath-securejoin v0.6.1 // indirect
|
|
github.com/google/go-querystring v1.1.0 // indirect
|
|
github.com/onsi/gomega v1.36.3 // indirect
|
|
)
|
|
|
|
require (
|
|
github.com/STARRY-S/zip v0.2.3 // indirect
|
|
github.com/anacrolix/btree v0.1.1 // indirect
|
|
github.com/anacrolix/missinggo/v2 v2.10.0 // indirect
|
|
github.com/andybalholm/brotli v1.2.0 // indirect
|
|
github.com/bodgit/plumbing v1.3.0 // indirect
|
|
github.com/bodgit/windows v1.0.1 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 // indirect
|
|
github.com/felixge/fgprof v0.9.5 // indirect
|
|
github.com/google/go-cmp v0.7.0 // indirect
|
|
github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
|
|
github.com/icholy/digest v1.1.0 // indirect
|
|
github.com/klauspost/compress v1.18.2 // indirect
|
|
github.com/klauspost/pgzip v1.2.6 // indirect
|
|
github.com/mikelolasagasti/xz v1.0.1 // indirect
|
|
github.com/minio/minlz v1.0.1 // indirect
|
|
github.com/nwaples/rardecode/v2 v2.2.0 // indirect
|
|
github.com/pierrec/lz4/v4 v4.1.22 // indirect
|
|
github.com/pion/transport/v4 v4.0.2 // indirect
|
|
github.com/quic-go/qpack v0.6.0 // indirect
|
|
github.com/quic-go/quic-go v0.59.0 // indirect
|
|
github.com/refraction-networking/utls v1.8.2 // indirect
|
|
github.com/segmentio/asm v1.1.3 // indirect
|
|
github.com/segmentio/encoding v0.5.4 // indirect
|
|
github.com/sorairolake/lzip-go v0.3.8 // indirect
|
|
github.com/ulikunitz/xz v0.5.15 // indirect
|
|
github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
|
go4.org v0.0.0-20230225012048-214862532bf5 // indirect
|
|
golang.org/x/oauth2 v0.35.0 // indirect
|
|
golang.org/x/sync v0.22.0 // indirect
|
|
)
|
|
|
|
require (
|
|
dario.cat/mergo v1.0.0 // indirect
|
|
github.com/Microsoft/go-winio v0.6.2
|
|
github.com/ProtonMail/go-crypto v1.1.6 // indirect
|
|
github.com/RoaringBitmap/roaring v1.9.4
|
|
github.com/alecthomas/atomic v0.1.0-alpha2 // indirect
|
|
github.com/anacrolix/chansync v0.7.0 // indirect
|
|
github.com/anacrolix/dht/v2 v2.23.0 // indirect
|
|
github.com/anacrolix/envpprof v1.5.0 // indirect
|
|
github.com/anacrolix/generics v0.2.0
|
|
github.com/anacrolix/go-libutp v1.3.2 // indirect
|
|
github.com/anacrolix/log v0.17.1-0.20251118025802-918f1157b7bb // indirect
|
|
github.com/anacrolix/missinggo v1.3.0 // indirect
|
|
github.com/anacrolix/missinggo/perf v1.0.0 // indirect
|
|
github.com/anacrolix/mmsg v1.1.1 // indirect
|
|
github.com/anacrolix/multiless v0.4.0 // indirect
|
|
github.com/anacrolix/stm v0.5.0 // indirect
|
|
github.com/anacrolix/sync v0.6.0 // indirect
|
|
github.com/anacrolix/upnp v0.1.4 // indirect
|
|
github.com/anacrolix/utp v0.2.0 // indirect
|
|
github.com/bahlo/generic-list-go v0.2.0 // indirect
|
|
github.com/benbjohnson/immutable v0.4.3 // indirect
|
|
github.com/bits-and-blooms/bitset v1.24.4 // indirect
|
|
github.com/bradfitz/iter v0.0.0-20191230175014-e8f45d346db8 // indirect
|
|
github.com/cespare/xxhash v1.1.0 // indirect
|
|
github.com/cloudflare/circl v1.6.3 // indirect
|
|
github.com/davecgh/go-spew v1.1.1 // indirect
|
|
github.com/dlclark/regexp2 v1.11.5 // indirect
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/edsrzf/mmap-go v1.2.0 // indirect
|
|
github.com/emirpasic/gods v1.18.1 // indirect
|
|
github.com/felixge/httpsnoop v1.0.1 // indirect
|
|
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
|
|
github.com/go-git/go-billy/v5 v5.9.2 // indirect
|
|
github.com/go-llsqlite/adapter v0.2.0 // indirect
|
|
github.com/go-llsqlite/crawshaw v0.6.0 // indirect
|
|
github.com/go-logr/logr v1.4.3 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/go-sourcemap/sourcemap v2.1.4+incompatible // indirect
|
|
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
|
|
github.com/google/btree v1.1.3 // indirect
|
|
github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 // indirect
|
|
github.com/google/uuid v1.6.0 // indirect
|
|
github.com/gorilla/websocket v1.5.3 // indirect
|
|
github.com/huandu/xstrings v1.5.0 // indirect
|
|
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
|
|
github.com/kevinburke/ssh_config v1.2.0 // indirect
|
|
github.com/klauspost/cpuid/v2 v2.3.0 // indirect
|
|
github.com/mattn/go-colorable v0.1.13 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/minio/sha256-simd v1.0.1 // indirect
|
|
github.com/mr-tron/base58 v1.2.0 // indirect
|
|
github.com/mschoch/smat v0.2.0 // indirect
|
|
github.com/multiformats/go-multihash v0.2.3 // indirect
|
|
github.com/multiformats/go-varint v0.1.0 // indirect
|
|
github.com/ncruces/go-strftime v1.0.0 // indirect
|
|
github.com/pion/datachannel v1.6.0 // indirect
|
|
github.com/pion/dtls/v3 v3.1.4 // indirect
|
|
github.com/pion/ice/v4 v4.2.0 // indirect
|
|
github.com/pion/interceptor v0.1.42 // indirect
|
|
github.com/pion/logging v0.2.4 // indirect
|
|
github.com/pion/mdns/v2 v2.1.0 // indirect
|
|
github.com/pion/randutil v0.1.0 // indirect
|
|
github.com/pion/rtcp v1.2.16 // indirect
|
|
github.com/pion/rtp v1.10.0 // indirect
|
|
github.com/pion/sctp v1.9.1 // indirect
|
|
github.com/pion/sdp/v3 v3.0.17 // indirect
|
|
github.com/pion/srtp/v3 v3.0.10 // indirect
|
|
github.com/pion/stun/v3 v3.1.5 // indirect
|
|
github.com/pion/turn/v4 v4.1.4 // indirect
|
|
github.com/pion/webrtc/v4 v4.2.2-0.20260109001657-a5962f314db7 // indirect
|
|
github.com/pjbgf/sha1cd v0.6.0 // indirect
|
|
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c
|
|
github.com/protolambda/ctxlock v0.1.0 // indirect
|
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
|
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
|
|
github.com/skeema/knownhosts v1.3.1 // indirect
|
|
github.com/spaolacci/murmur3 v1.1.0 // indirect
|
|
github.com/tidwall/btree v1.8.1 // indirect
|
|
github.com/wlynxg/anet v0.0.5 // indirect
|
|
github.com/xanzy/ssh-agent v0.3.3 // indirect
|
|
go.opentelemetry.io/otel v1.39.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.39.0 // indirect
|
|
go.opentelemetry.io/otel/trace v1.39.0 // indirect
|
|
golang.org/x/crypto v0.55.0 // indirect
|
|
golang.org/x/net v0.58.0
|
|
golang.org/x/sys v0.47.0 // indirect
|
|
golang.org/x/text v0.41.0
|
|
golang.org/x/time v0.15.0
|
|
gopkg.in/warnings.v0 v0.1.2 // indirect
|
|
lukechampine.com/blake3 v1.4.1 // indirect
|
|
modernc.org/libc v1.67.4 // indirect
|
|
modernc.org/mathutil v1.7.1 // indirect
|
|
modernc.org/memory v1.11.0 // indirect
|
|
modernc.org/sqlite v1.43.0 // indirect
|
|
zombiezen.com/go/sqlite v1.4.2 // indirect
|
|
)
|