2025-07-27 16:26:10 +00:00
|
|
|
module code.forgejo.org/forgejo/runner
|
2022-04-27 17:45:53 +08:00
|
|
|
|
2025-05-02 16:12:37 +00:00
|
|
|
go 1.23.0
|
2024-12-04 10:12:38 +01:00
|
|
|
|
2025-07-09 08:09:38 +00:00
|
|
|
toolchain go1.23.11
|
2022-04-27 17:45:53 +08:00
|
|
|
|
|
|
|
require (
|
2025-07-03 16:55:53 +00:00
|
|
|
code.forgejo.org/forgejo/actions-proto v0.5.1
|
2025-01-09 00:02:03 +00:00
|
|
|
connectrpc.com/connect v1.18.1
|
2025-07-28 18:45:02 +02:00
|
|
|
github.com/Masterminds/semver v1.5.0
|
2025-03-25 07:27:50 +00:00
|
|
|
github.com/avast/retry-go/v4 v4.6.1
|
2025-07-28 18:45:02 +02:00
|
|
|
github.com/containerd/errdefs v0.3.0
|
|
|
|
github.com/creack/pty v1.1.24
|
|
|
|
github.com/distribution/reference v0.6.0
|
|
|
|
github.com/docker/cli v28.2.2+incompatible
|
2025-07-10 08:58:32 +00:00
|
|
|
github.com/docker/docker v28.3.2+incompatible
|
2025-07-28 18:45:02 +02:00
|
|
|
github.com/docker/go-connections v0.5.0
|
|
|
|
github.com/go-git/go-billy/v5 v5.6.1
|
|
|
|
github.com/go-git/go-git/v5 v5.13.1
|
|
|
|
github.com/gobwas/glob v0.2.3
|
2024-08-13 13:23:36 +00:00
|
|
|
github.com/google/uuid v1.6.0
|
2025-07-28 18:45:02 +02:00
|
|
|
github.com/imdario/mergo v0.3.16
|
2023-03-17 09:45:46 +08:00
|
|
|
github.com/joho/godotenv v1.5.1
|
2025-07-28 18:45:02 +02:00
|
|
|
github.com/julienschmidt/httprouter v1.3.0
|
|
|
|
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
|
2024-03-11 18:32:49 +07:00
|
|
|
github.com/mattn/go-isatty v0.0.20
|
2025-07-28 18:45:02 +02:00
|
|
|
github.com/moby/go-archive v0.1.0
|
|
|
|
github.com/moby/patternmatcher v0.6.0
|
|
|
|
github.com/opencontainers/image-spec v1.1.0
|
|
|
|
github.com/opencontainers/selinux v1.11.0
|
|
|
|
github.com/pkg/errors v0.9.1
|
|
|
|
github.com/rhysd/actionlint v1.6.27
|
2023-08-02 04:34:36 +00:00
|
|
|
github.com/sirupsen/logrus v1.9.3
|
2025-05-02 21:53:20 +00:00
|
|
|
github.com/spf13/cobra v1.9.1
|
2025-07-28 18:45:02 +02:00
|
|
|
github.com/spf13/pflag v1.0.6
|
2024-11-24 00:02:30 +00:00
|
|
|
github.com/stretchr/testify v1.10.0
|
2025-07-28 18:45:02 +02:00
|
|
|
github.com/timshannon/bolthold v0.0.0-20240314194003-30aac6950928
|
|
|
|
go.etcd.io/bbolt v1.3.10
|
2025-07-11 05:43:08 +00:00
|
|
|
golang.org/x/term v0.33.0
|
2025-06-07 09:07:52 +00:00
|
|
|
golang.org/x/time v0.12.0
|
2025-03-27 07:07:15 +00:00
|
|
|
google.golang.org/protobuf v1.36.6
|
2023-04-02 22:41:48 +08:00
|
|
|
gopkg.in/yaml.v3 v3.0.1
|
2025-05-02 13:48:30 +00:00
|
|
|
gotest.tools/v3 v3.5.2
|
2022-04-27 17:45:53 +08:00
|
|
|
)
|
|
|
|
|
|
|
|
require (
|
2023-08-02 04:34:36 +00:00
|
|
|
dario.cat/mergo v1.0.0 // indirect
|
2023-08-10 01:45:25 +00:00
|
|
|
github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
|
2025-05-14 08:16:27 +00:00
|
|
|
github.com/Microsoft/go-winio v0.6.2 // indirect
|
2025-01-10 11:01:56 +00:00
|
|
|
github.com/ProtonMail/go-crypto v1.1.3 // indirect
|
2025-06-14 09:34:54 +00:00
|
|
|
github.com/cloudflare/circl v1.6.1 // indirect
|
2025-06-14 14:54:20 +00:00
|
|
|
github.com/containerd/errdefs/pkg v0.3.0 // indirect
|
2024-08-23 10:54:10 +00:00
|
|
|
github.com/containerd/log v0.1.0 // indirect
|
2025-01-10 11:01:56 +00:00
|
|
|
github.com/cyphar/filepath-securejoin v0.3.6 // indirect
|
2023-04-04 21:32:04 +08:00
|
|
|
github.com/davecgh/go-spew v1.1.1 // indirect
|
2023-08-10 01:45:25 +00:00
|
|
|
github.com/docker/docker-credential-helpers v0.8.0 // indirect
|
2023-03-17 09:45:46 +08:00
|
|
|
github.com/docker/go-units v0.5.0 // indirect
|
2023-05-04 18:45:01 +08:00
|
|
|
github.com/emirpasic/gods v1.18.1 // indirect
|
2024-08-23 10:54:10 +00:00
|
|
|
github.com/fatih/color v1.16.0 // indirect
|
|
|
|
github.com/felixge/httpsnoop v1.0.4 // indirect
|
2023-06-16 06:07:48 +00:00
|
|
|
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
|
2025-05-14 08:16:27 +00:00
|
|
|
github.com/go-logr/logr v1.4.2 // indirect
|
2024-08-23 10:54:10 +00:00
|
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
Update github.com/go-viper/mapstructure/v2 (indirect) to v2.3.0 [SECURITY] (#622)
This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| [github.com/go-viper/mapstructure/v2](https://github.com/go-viper/mapstructure) | `v2.2.1` -> `v2.3.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
---
### mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data
[GHSA-fv92-fjc5-jj9h](https://github.com/advisories/GHSA-fv92-fjc5-jj9h)
<details>
<summary>More information</summary>
#### Details
##### Summary
Use of this library in a security-critical context may result in leaking sensitive information, if used to process sensitive fields.
##### Details
OpenBao (and presumably HashiCorp Vault) have surfaced error messages from `mapstructure` as follows:
https://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L43-L50
```go
_, _, err := d.getPrimitive(field, schema)
if err != nil {
return fmt.Errorf("error converting input for field %q: %w", field, err)
}
```
where this calls `mapstructure.WeakDecode(...)`: https://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L181-L193
```go
func (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bool, error) {
raw, ok := d.Raw[k]
if !ok {
return nil, false, nil
}
switch t := schema.Type; t {
case TypeBool:
var result bool
if err := mapstructure.WeakDecode(raw, &result); err != nil {
return nil, false, err
}
return result, true, nil
```
Notably, `WeakDecode(...)` eventually calls one of the decode helpers, which surfaces the original value:
https://github.com/go-viper/mapstructure/blob/1a66224d5e54d8757f63bd66339cf764c3292c21/mapstructure.go#L679-L686
https://github.com/go-viper/mapstructure/blob/1a66224d5e54d8757f63bd66339cf764c3292c21/mapstructure.go#L726-L730
https://github.com/go-viper/mapstructure/blob/1a66224d5e54d8757f63bd66339cf764c3292c21/mapstructure.go#L783-L787
& more.
##### PoC
To reproduce with OpenBao:
```
$ podman run -p 8300:8300 openbao/openbao:latest server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8300
```
and in a new tab:
```
$ BAO_TOKEN=root BAO_ADDR=http://localhost:8300 bao auth enable userpass
Success! Enabled userpass auth method at: userpass/
$ curl -X PUT -H "X-Vault-Request: true" -H "X-Vault-Token: root" -d '{"password":{"asdf":"my-sensitive-value"}}' "http://localhost:8300/v1/auth/userpass/users/adsf"
{"errors":["error converting input for field \"password\": '' expected type 'string', got unconvertible type 'map[string]interface {}', value: 'map[asdf:my-sensitive-value]'"]}
```
##### Impact
This is an information disclosure bug with little mitigation. See https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717 for a previous version. That version was fixed, but this is in the second part of that error message (starting at `'' expected a map, got 'string'` -- when the field type is `string` and a `map` is provided, we see the above information leak -- the previous example had a `map` type field with a `string` value provided).
This was rated 4.5 Medium by HashiCorp in the past iteration.
#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N`
#### References
- [https://github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h](https://github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h)
- [https://github.com/go-viper/mapstructure](https://github.com/go-viper/mapstructure)
This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-fv92-fjc5-jj9h) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>
---
### Release Notes
<details>
<summary>go-viper/mapstructure (github.com/go-viper/mapstructure/v2)</summary>
### [`v2.3.0`](https://github.com/go-viper/mapstructure/releases/tag/v2.3.0)
[Compare Source](https://github.com/go-viper/mapstructure/compare/v2.2.1...v2.3.0)
#### What's Changed
- build(deps): bump actions/checkout from 4.1.7 to 4.2.0 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-viper/mapstructure/pull/46
- build(deps): bump golangci/golangci-lint-action from 6.1.0 to 6.1.1 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-viper/mapstructure/pull/47
- \[enhancement] Add check for `reflect.Value` in `ComposeDecodeHookFunc` by [@​mahadzaryab1](https://github.com/mahadzaryab1) in https://github.com/go-viper/mapstructure/pull/52
- build(deps): bump actions/setup-go from 5.0.2 to 5.1.0 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-viper/mapstructure/pull/51
- build(deps): bump actions/checkout from 4.2.0 to 4.2.2 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-viper/mapstructure/pull/50
- build(deps): bump actions/setup-go from 5.1.0 to 5.2.0 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-viper/mapstructure/pull/55
- build(deps): bump actions/setup-go from 5.2.0 to 5.3.0 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-viper/mapstructure/pull/58
- ci: add Go 1.24 to the test matrix by [@​sagikazarmark](https://github.com/sagikazarmark) in https://github.com/go-viper/mapstructure/pull/74
- build(deps): bump golangci/golangci-lint-action from 6.1.1 to 6.5.0 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-viper/mapstructure/pull/72
- build(deps): bump golangci/golangci-lint-action from 6.5.0 to 6.5.1 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-viper/mapstructure/pull/76
- build(deps): bump actions/setup-go from 5.3.0 to 5.4.0 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-viper/mapstructure/pull/78
- feat: add decode hook for netip.Prefix by [@​tklauser](https://github.com/tklauser) in https://github.com/go-viper/mapstructure/pull/85
- Updates by [@​sagikazarmark](https://github.com/sagikazarmark) in https://github.com/go-viper/mapstructure/pull/86
- build(deps): bump github/codeql-action from 2.13.4 to 3.28.15 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-viper/mapstructure/pull/87
- build(deps): bump actions/setup-go from 5.4.0 to 5.5.0 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-viper/mapstructure/pull/93
- build(deps): bump github/codeql-action from 3.28.15 to 3.28.17 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-viper/mapstructure/pull/92
- build(deps): bump github/codeql-action from 3.28.17 to 3.28.19 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-viper/mapstructure/pull/97
- build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-viper/mapstructure/pull/96
- Update README.md by [@​peczenyj](https://github.com/peczenyj) in https://github.com/go-viper/mapstructure/pull/90
- Add omitzero tag. by [@​Crystalix007](https://github.com/Crystalix007) in https://github.com/go-viper/mapstructure/pull/98
- Use error structs instead of duplicated strings by [@​m1k1o](https://github.com/m1k1o) in https://github.com/go-viper/mapstructure/pull/102
- build(deps): bump github/codeql-action from 3.28.19 to 3.29.0 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-viper/mapstructure/pull/101
- feat: add common error interface by [@​sagikazarmark](https://github.com/sagikazarmark) in https://github.com/go-viper/mapstructure/pull/105
- update linter by [@​sagikazarmark](https://github.com/sagikazarmark) in https://github.com/go-viper/mapstructure/pull/106
- Feature allow unset pointer by [@​rostislaved](https://github.com/rostislaved) in https://github.com/go-viper/mapstructure/pull/80
#### New Contributors
- [@​tklauser](https://github.com/tklauser) made their first contribution in https://github.com/go-viper/mapstructure/pull/85
- [@​peczenyj](https://github.com/peczenyj) made their first contribution in https://github.com/go-viper/mapstructure/pull/90
- [@​Crystalix007](https://github.com/Crystalix007) made their first contribution in https://github.com/go-viper/mapstructure/pull/98
- [@​rostislaved](https://github.com/rostislaved) made their first contribution in https://github.com/go-viper/mapstructure/pull/80
**Full Changelog**: https://github.com/go-viper/mapstructure/compare/v2.2.1...v2.3.0
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xLjQiLCJ1cGRhdGVkSW5WZXIiOiI0MS4xLjQiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->
Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/622
Reviewed-by: earl-warren <earl-warren@noreply.code.forgejo.org>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
2025-06-29 07:35:20 +00:00
|
|
|
github.com/go-viper/mapstructure/v2 v2.3.0 // indirect
|
2022-04-27 17:45:53 +08:00
|
|
|
github.com/gogo/protobuf v1.3.2 // indirect
|
2023-06-16 06:07:48 +00:00
|
|
|
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
|
2025-06-14 14:54:20 +00:00
|
|
|
github.com/google/go-cmp v0.7.0 // indirect
|
2022-11-22 15:34:13 +08:00
|
|
|
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
|
2023-05-04 18:45:01 +08:00
|
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
2022-04-27 17:45:53 +08:00
|
|
|
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
|
2022-08-12 14:59:58 +08:00
|
|
|
github.com/kevinburke/ssh_config v1.2.0 // indirect
|
2025-06-14 14:54:20 +00:00
|
|
|
github.com/klauspost/compress v1.18.0 // indirect
|
2022-09-25 18:54:00 +08:00
|
|
|
github.com/mattn/go-colorable v0.1.13 // indirect
|
2023-08-10 01:45:25 +00:00
|
|
|
github.com/mattn/go-runewidth v0.0.15 // indirect
|
2025-06-14 14:54:20 +00:00
|
|
|
github.com/moby/docker-image-spec v1.3.1 // indirect
|
2025-07-28 18:45:02 +02:00
|
|
|
github.com/moby/sys/atomicwriter v0.1.0 // indirect
|
2025-06-14 14:54:20 +00:00
|
|
|
github.com/moby/sys/sequential v0.6.0 // indirect
|
|
|
|
github.com/moby/sys/user v0.4.0 // indirect
|
2025-05-14 08:16:27 +00:00
|
|
|
github.com/moby/sys/userns v0.1.0 // indirect
|
2025-07-26 14:43:36 +00:00
|
|
|
github.com/moby/term v0.5.0 // indirect
|
|
|
|
github.com/morikuni/aec v1.0.0 // indirect
|
2022-04-27 17:45:53 +08:00
|
|
|
github.com/opencontainers/go-digest v1.0.0 // indirect
|
2023-05-04 18:45:01 +08:00
|
|
|
github.com/pjbgf/sha1cd v0.3.0 // indirect
|
2023-04-04 21:32:04 +08:00
|
|
|
github.com/pmezard/go-difflib v1.0.0 // indirect
|
2024-08-23 10:54:10 +00:00
|
|
|
github.com/rivo/uniseg v0.4.7 // indirect
|
2023-11-07 20:19:08 +01:00
|
|
|
github.com/robfig/cron/v3 v3.0.1 // indirect
|
2025-01-10 11:01:56 +00:00
|
|
|
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
|
|
|
|
github.com/skeema/knownhosts v1.3.0 // indirect
|
2024-08-13 13:23:35 +00:00
|
|
|
github.com/stretchr/objx v0.5.2 // indirect
|
2023-05-04 18:45:01 +08:00
|
|
|
github.com/xanzy/ssh-agent v0.3.3 // indirect
|
2023-08-10 01:45:25 +00:00
|
|
|
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
|
2022-11-22 15:34:13 +08:00
|
|
|
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
|
2023-03-17 09:45:46 +08:00
|
|
|
github.com/xeipuuv/gojsonschema v1.2.0 // indirect
|
2025-06-14 14:54:20 +00:00
|
|
|
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
|
2024-08-23 10:54:10 +00:00
|
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 // indirect
|
2025-06-14 14:54:20 +00:00
|
|
|
go.opentelemetry.io/otel v1.36.0 // indirect
|
2025-07-26 14:43:36 +00:00
|
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.21.0 // indirect
|
2025-06-14 14:54:20 +00:00
|
|
|
go.opentelemetry.io/otel/metric v1.36.0 // indirect
|
2025-07-26 14:43:36 +00:00
|
|
|
go.opentelemetry.io/otel/sdk v1.21.0 // indirect
|
2025-06-14 14:54:20 +00:00
|
|
|
go.opentelemetry.io/otel/trace v1.36.0 // indirect
|
2025-05-14 07:06:23 +00:00
|
|
|
golang.org/x/crypto v0.36.0 // indirect
|
|
|
|
golang.org/x/net v0.38.0 // indirect
|
2025-05-14 08:16:27 +00:00
|
|
|
golang.org/x/sync v0.12.0 // indirect
|
2025-07-11 05:43:08 +00:00
|
|
|
golang.org/x/sys v0.34.0 // indirect
|
2025-07-28 18:45:02 +02:00
|
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20231120223509-83a465c0220f // indirect
|
2022-04-27 17:45:53 +08:00
|
|
|
gopkg.in/warnings.v0 v0.1.2 // indirect
|
|
|
|
)
|