mirror of
https://gitea.com/gitea/runner.git
synced 2026-11-04 14:35:32 +00:00
Renovate Bot
e3607b576e
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.61.0` → `v0.62.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.61.0...refs/tags/v0.62.0) |  |  | --- ### Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net [CVE-2026-78661](https://nvd.nist.gov/vuln/detail/CVE-2026-78661) / [GO-2026-6860](https://pkg.go.dev/vuln/GO-2026-6860) <details> <summary>More information</summary> #### Details When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse. #### Severity Unknown #### References - [https://go.dev/cl/849365](https://go.dev/cl/849365) - [https://go.dev/issue/82224](https://go.dev/issue/82224) - [https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs](https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6860) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net [CVE-2026-97045](https://nvd.nist.gov/vuln/detail/CVE-2026-97045) / [GO-2026-6866](https://pkg.go.dev/vuln/GO-2026-6866) <details> <summary>More information</summary> #### Details In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text. #### Severity Unknown #### References - [https://go.dev/cl/855121](https://go.dev/cl/855121) - [https://go.dev/issue/82622](https://go.dev/issue/82622) - [https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs](https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6866) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODEuNyIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MS43IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1356 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: Renovate Bot <[email protected]>
66 lines
2.4 KiB
AMPL
66 lines
2.4 KiB
AMPL
module gitea.com/gitea/runner
|
|
|
|
go 1.27
|
|
|
|
toolchain go1.27.3
|
|
|
|
require (
|
|
connectrpc.com/connect/v2 v2.0.1
|
|
gitea.dev/actionslib v1.5.0
|
|
github.com/bmatcuk/doublestar/v4 v4.10.3
|
|
github.com/coder/websocket v1.8.15
|
|
github.com/containerd/errdefs v1.0.0
|
|
github.com/creack/pty v1.1.24
|
|
github.com/distribution/reference v0.6.0
|
|
github.com/docker/cli v29.9.2+incompatible
|
|
github.com/docker/go-connections v0.8.2
|
|
github.com/docker/go-units v0.5.0
|
|
github.com/joho/godotenv v1.5.1
|
|
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
|
|
github.com/moby/moby/api v1.56.1
|
|
github.com/moby/moby/client v0.6.2
|
|
github.com/moby/patternmatcher v0.6.1
|
|
github.com/opencontainers/image-spec v1.1.1
|
|
github.com/prometheus/client_golang v1.25.0
|
|
github.com/prometheus/client_model v0.6.3
|
|
github.com/spf13/cobra v1.10.2
|
|
github.com/spf13/pflag v1.0.10
|
|
github.com/stretchr/testify v1.12.1
|
|
go.etcd.io/bbolt v1.5.0
|
|
go.opentelemetry.io/otel v1.47.0
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0
|
|
go.opentelemetry.io/otel/sdk v1.47.0
|
|
go.opentelemetry.io/otel/trace v1.47.0
|
|
go.opentelemetry.io/proto/otlp v1.11.1
|
|
go.yaml.in/yaml/v4 v4.0.0-rc.6.0.20261013184558-04dd63131525
|
|
golang.org/x/net v0.62.0
|
|
golang.org/x/sync v0.24.0
|
|
golang.org/x/sys v0.49.0
|
|
golang.org/x/term v0.47.0
|
|
golang.org/x/text v0.43.0
|
|
google.golang.org/protobuf v1.36.12
|
|
)
|
|
|
|
require (
|
|
github.com/Microsoft/go-winio v0.6.2 // indirect
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/containerd/errdefs/pkg v0.3.0 // indirect
|
|
github.com/felixge/httpsnoop v1.1.0 // indirect
|
|
github.com/go-logr/logr v1.4.4 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/google/uuid v1.6.0 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/moby/docker-image-spec v1.3.1 // indirect
|
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
|
github.com/opencontainers/go-digest v1.0.0 // indirect
|
|
github.com/prometheus/common v0.72.0 // indirect
|
|
github.com/prometheus/procfs v0.22.0 // indirect
|
|
github.com/stretchr/objx v0.5.3 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 // indirect
|
|
go.opentelemetry.io/otel/log v1.47.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.47.0 // indirect
|
|
go.yaml.in/yaml/v3 v3.0.5 // indirect
|
|
)
|