mirror of
https://code.forgejo.org/forgejo/runner.git
synced 2025-06-27 16:35:58 +00:00
9d1817c718
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github.com/cloudflare/circl](https://github.com/cloudflare/circl) | indirect | minor | `v1.3.7` -> `v1.6.1` | --- ### CIRCL-Fourq: Missing and wrong validation can lead to incorrect results [GHSA-2x5j-vhc8-9cwm](https://github.com/advisories/GHSA-2x5j-vhc8-9cwm) / [GO-2025-3754](https://pkg.go.dev/vuln/GO-2025-3754) <details> <summary>More information</summary> #### Details ##### Impact The CIRCL implementation of FourQ fails to validate user-supplied low-order points during Diffie-Hellman key exchange, potentially allowing attackers to force the identity point and compromise session security. Moreover, there is an incorrect point validation in ScalarMult can lead to incorrect results in the isEqual function and if a point is on the curve. ##### Patches Version 1.6.1 (https://github.com/cloudflare/circl/tree/v1.6.1) mitigates the identified issues. We acknowledge Alon Livne (Botanica Software Labs) for the reported findings. #### Severity Low #### References - [https://github.com/cloudflare/circl/security/advisories/GHSA-2x5j-vhc8-9cwm](https://github.com/cloudflare/circl/security/advisories/GHSA-2x5j-vhc8-9cwm) - [https://github.com/cloudflare/circl](https://github.com/cloudflare/circl) - [https://github.com/cloudflare/circl/tree/v1.6.1](https://github.com/cloudflare/circl/tree/v1.6.1) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-2x5j-vhc8-9cwm) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### CIRCL-Fourq: Missing and wrong validation can lead to incorrect results in github.com/cloudflare/circl [GHSA-2x5j-vhc8-9cwm](https://github.com/advisories/GHSA-2x5j-vhc8-9cwm) / [GO-2025-3754](https://pkg.go.dev/vuln/GO-2025-3754) <details> <summary>More information</summary> #### Details CIRCL-Fourq: Missing and wrong validation can lead to incorrect results in github.com/cloudflare/circl #### Severity Unknown #### References - [https://github.com/cloudflare/circl/security/advisories/GHSA-2x5j-vhc8-9cwm](https://github.com/cloudflare/circl/security/advisories/GHSA-2x5j-vhc8-9cwm) - [https://github.com/cloudflare/circl/tree/v1.6.1](https://github.com/cloudflare/circl/tree/v1.6.1) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2025-3754) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Release Notes <details> <summary>cloudflare/circl (github.com/cloudflare/circl)</summary> ### [`v1.6.1`](https://github.com/cloudflare/circl/releases/tag/v1.6.1): CIRCL v1.6.1 [Compare Source](https://github.com/cloudflare/circl/compare/v1.6.0...v1.6.1) #### CIRCL v1.6.1 - Fixes some point checks on the FourQ curve. - Hybrid KEM fails on low-order points. ##### What's Changed - kem/hybrid: ensure X25519 hybrids fails with low order points by [@​Lekensteyn](https://github.com/Lekensteyn) in https://github.com/cloudflare/circl/pull/541 - .github: Use native ARM64 builders instead of QEMU by [@​Lekensteyn](https://github.com/Lekensteyn) in https://github.com/cloudflare/circl/pull/542 - Fixes several errors on twisted Edwards curves. by [@​armfazh](https://github.com/armfazh) in https://github.com/cloudflare/circl/pull/545 - Release v1.6.1 by [@​armfazh](https://github.com/armfazh) in https://github.com/cloudflare/circl/pull/546 **Full Changelog**: https://github.com/cloudflare/circl/compare/v1.6.0...v1.6.1 ### [`v1.6.0`](https://github.com/cloudflare/circl/releases/tag/v1.6.0): CIRCL v1.6.0 [Compare Source](https://github.com/cloudflare/circl/compare/v1.5.0...v1.6.0) #### CIRCL v1.6.0 ##### New! - [Prio3](https://github.com/cloudflare/circl/blob/main/vdaf/prio3) Verifiable Distributed Aggregation Function ([draft-irtf-cfrg-vdaf](https://datatracker.ietf.org/doc/draft-irtf-cfrg-vdaf/)). - [X-Wing](https://github.com/cloudflare/circl/blob/main/kem/xwing): general-purpose hybrid post-quantum KEM ([draft-connolly-cfrg-xwing-kem](https://datatracker.ietf.org/doc/draft-connolly-cfrg-xwing-kem/)) ##### What's Changed - Add OIDs to ML-DSA by [@​bwesterb](https://github.com/bwesterb) in https://github.com/cloudflare/circl/pull/519 - Adds Prio3 a set of verifiable distributed aggregation functions. by [@​armfazh](https://github.com/armfazh) in https://github.com/cloudflare/circl/pull/522 - Run semgrep cronjob only in upstream repository. by [@​armfazh](https://github.com/armfazh) in https://github.com/cloudflare/circl/pull/526 - X-Wing PQ/T hybrid by [@​bwesterb](https://github.com/bwesterb) in https://github.com/cloudflare/circl/pull/471 - ckem: move crypto/elliptic to crypto/ecdh by [@​MingLLuo](https://github.com/MingLLuo) in https://github.com/cloudflare/circl/pull/529 - hpke: Update HPKE code to use ecdh stdlib package. by [@​armfazh](https://github.com/armfazh) in https://github.com/cloudflare/circl/pull/530 - prio3: Adds polynomial multiplication using NTT by [@​armfazh](https://github.com/armfazh) in https://github.com/cloudflare/circl/pull/532 - Add Prio3 in readme. by [@​armfazh](https://github.com/armfazh) in https://github.com/cloudflare/circl/pull/527 ##### New Contributors - [@​MingLLuo](https://github.com/MingLLuo) made their first contribution in https://github.com/cloudflare/circl/pull/529 **Full Changelog**: https://github.com/cloudflare/circl/compare/v1.5.0...v1.6.0 ### [`v1.5.0`](https://github.com/cloudflare/circl/releases/tag/v1.5.0): CIRCL v1.5.0 [Compare Source](https://github.com/cloudflare/circl/compare/v1.4.0...v1.5.0) ### CIRCL v1.5.0 **New:** ML-DSA, Module-Lattice-based Digital Signature Algorithm. ##### What's Changed - kem: add X25519MLKEM768 TLS hybrid KEM by [@​bwesterb](https://github.com/bwesterb) in https://github.com/cloudflare/circl/pull/510 - Create semgrep.yml by [@​hrushikeshdeshpande](https://github.com/hrushikeshdeshpande) in https://github.com/cloudflare/circl/pull/514 - repo: Some fixes reported by CodeQL by [@​armfazh](https://github.com/armfazh) in https://github.com/cloudflare/circl/pull/515 - Add ML-DSA (FIPS204) by [@​bwesterb](https://github.com/bwesterb) in https://github.com/cloudflare/circl/pull/480 - sign/mldsa: Add test for ML-DSA signature verification. by [@​armfazh](https://github.com/armfazh) in https://github.com/cloudflare/circl/pull/517 - Release v1.5.0 by [@​armfazh](https://github.com/armfazh) in https://github.com/cloudflare/circl/pull/518 ##### New Contributors - [@​hrushikeshdeshpande](https://github.com/hrushikeshdeshpande) made their first contribution in https://github.com/cloudflare/circl/pull/514 **Full Changelog**: https://github.com/cloudflare/circl/compare/v1.4.0...v1.5.0 ### [`v1.4.0`](https://github.com/cloudflare/circl/releases/tag/v1.4.0): CIRCL v1.4.0 [Compare Source](https://github.com/cloudflare/circl/compare/v1.3.9...v1.4.0) ### CIRCL v1.4.0 ##### Changes New: ML-KEM compatible with FIPS-203. ##### Commit History - eddilithium3: fix typos by [@​bwesterb](https://github.com/bwesterb) in https://github.com/cloudflare/circl/pull/503 - Add ML-KEM (FIPS 203). by [@​bwesterb](https://github.com/bwesterb) in https://github.com/cloudflare/circl/pull/470 - Add ML-KEM decapsulation key check. by [@​bwesterb](https://github.com/bwesterb) in https://github.com/cloudflare/circl/pull/507 - Preparing for release v1.4.0 by [@​armfazh](https://github.com/armfazh) in https://github.com/cloudflare/circl/pull/508 **Full Changelog**: https://github.com/cloudflare/circl/compare/v1.3.9...v1.4.0 ### [`v1.3.9`](https://github.com/cloudflare/circl/releases/tag/v1.3.9): CIRCL v1.3.9 [Compare Source](https://github.com/cloudflare/circl/compare/v1.3.8...v1.3.9) #### CIRCL v1.3.9 ##### Changes: - Fix bug on BLS12381 decoding elements. ##### Commit History - dilithium: fix typo by [@​bwesterb](https://github.com/bwesterb) in https://github.com/cloudflare/circl/pull/498 - bls12381: Detects invalid prefix in G1 and G2 serialized elements by [@​armfazh](https://github.com/armfazh) in https://github.com/cloudflare/circl/pull/500 - Preparing CIRCL release v1.3.9 by [@​armfazh](https://github.com/armfazh) in https://github.com/cloudflare/circl/pull/501 **Full Changelog**: https://github.com/cloudflare/circl/compare/v1.3.8...v1.3.9 ### [`v1.3.8`](https://github.com/cloudflare/circl/releases/tag/v1.3.8): CIRCL v1.3.8 [Compare Source](https://github.com/cloudflare/circl/compare/v1.3.7...v1.3.8) ### CIRCL v1.3.8 #### New - BLS Signatures on top of BLS12-381. - Adopt faster squaring in pairings. - BlindRSA compliant with RFC9474. - (Verifiable) Secret Sharing compatible with the Group interface (elliptic curves). #### Notice - Update on cpabe/tkn20 ciphertexts, read more at https://github.com/cloudflare/circl/wiki/tkn20-Ciphertext-Format-(v1.3.8) ##### What's Changed - Implement Granger-Scott faster squaring in the cyclotomic subgroup. by [@​armfazh](https://github.com/armfazh) in https://github.com/cloudflare/circl/pull/449 - Updates avo and CIRCL's own dependency. by [@​armfazh](https://github.com/armfazh) in https://github.com/cloudflare/circl/pull/474 - Updating documentation for OPRF package. by [@​armfazh](https://github.com/armfazh) in https://github.com/cloudflare/circl/pull/475 - group: removes order method from group interface by [@​armfazh](https://github.com/armfazh) in https://github.com/cloudflare/circl/pull/356 - zk/dleq: Adding DLEQ proofs for Qn, the subgroup of squares in (Z/nZ)\* by [@​armfazh](https://github.com/armfazh) in https://github.com/cloudflare/circl/pull/451 - Reduce x/crypto and x/sys versions to match Go 1.21 by [@​Lekensteyn](https://github.com/Lekensteyn) in https://github.com/cloudflare/circl/pull/476 - Bump GitHub Actions versions and use Go 1.22 and 1.21 by [@​Lekensteyn](https://github.com/Lekensteyn) in https://github.com/cloudflare/circl/pull/477 - Adding rule for constant values by [@​armfazh](https://github.com/armfazh) in https://github.com/cloudflare/circl/pull/478 - Add BLS signatures over BLS12-381 by [@​armfazh](https://github.com/armfazh) in https://github.com/cloudflare/circl/pull/446 - group: Implements Shamir and Feldman secret sharing. by [@​armfazh](https://github.com/armfazh) in https://github.com/cloudflare/circl/pull/348 - blindrsa: add support for all variants of RFC9474 by [@​armfazh](https://github.com/armfazh) in https://github.com/cloudflare/circl/pull/479 - Explicitly installs Go with version before CodeQL analysis. by [@​armfazh](https://github.com/armfazh) in https://github.com/cloudflare/circl/pull/481 - Bumps golangci-lint action by [@​armfazh](https://github.com/armfazh) in https://github.com/cloudflare/circl/pull/485 - ecc/bls12381: Ensures pairing operations don't overwrite their input by [@​armfazh](https://github.com/armfazh) in https://github.com/cloudflare/circl/pull/494 - Align to the `purego` build tag, removing `noasm` build tag by [@​mattyclarkson](https://github.com/mattyclarkson) in https://github.com/cloudflare/circl/pull/492 - cpabe: Serializing ciphertext with 32-bit prefixes. by [@​armfazh](https://github.com/armfazh) in https://github.com/cloudflare/circl/pull/490 ##### New Contributors - [@​mattyclarkson](https://github.com/mattyclarkson) made their first contribution in https://github.com/cloudflare/circl/pull/492 **Full Changelog**: https://github.com/cloudflare/circl/compare/v1.3.7...v1.3.8 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MC40OC40IiwidXBkYXRlZEluVmVyIjoiNDAuNDguNCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==--> Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/605 Reviewed-by: earl-warren <earl-warren@noreply.code.forgejo.org> Co-authored-by: Renovate Bot <bot@kriese.eu> Co-committed-by: Renovate Bot <bot@kriese.eu>
104 lines
4.5 KiB
Modula-2
104 lines
4.5 KiB
Modula-2
module gitea.com/gitea/act_runner
|
|
|
|
go 1.23.0
|
|
|
|
toolchain go1.23.10
|
|
|
|
require (
|
|
code.gitea.io/actions-proto-go v0.4.1
|
|
code.gitea.io/gitea-vet v0.2.3
|
|
connectrpc.com/connect v1.18.1
|
|
github.com/avast/retry-go/v4 v4.6.1
|
|
github.com/docker/docker v25.0.10+incompatible
|
|
github.com/google/uuid v1.6.0
|
|
github.com/joho/godotenv v1.5.1
|
|
github.com/mattn/go-isatty v0.0.20
|
|
github.com/nektos/act v0.2.49
|
|
github.com/sirupsen/logrus v1.9.3
|
|
github.com/spf13/cobra v1.9.1
|
|
github.com/stretchr/testify v1.10.0
|
|
golang.org/x/term v0.32.0
|
|
golang.org/x/time v0.12.0
|
|
google.golang.org/protobuf v1.36.6
|
|
gopkg.in/yaml.v3 v3.0.1
|
|
gotest.tools/v3 v3.5.2
|
|
)
|
|
|
|
require (
|
|
dario.cat/mergo v1.0.0 // indirect
|
|
github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
|
|
github.com/Masterminds/semver v1.5.0 // indirect
|
|
github.com/Microsoft/go-winio v0.6.2 // indirect
|
|
github.com/ProtonMail/go-crypto v1.1.3 // indirect
|
|
github.com/cloudflare/circl v1.6.1 // indirect
|
|
github.com/containerd/containerd v1.7.27 // indirect
|
|
github.com/containerd/log v0.1.0 // indirect
|
|
github.com/creack/pty v1.1.24 // indirect
|
|
github.com/cyphar/filepath-securejoin v0.3.6 // indirect
|
|
github.com/davecgh/go-spew v1.1.1 // indirect
|
|
github.com/distribution/reference v0.6.0 // indirect
|
|
github.com/docker/cli v25.0.7+incompatible // indirect
|
|
github.com/docker/docker-credential-helpers v0.8.0 // indirect
|
|
github.com/docker/go-connections v0.5.0 // indirect
|
|
github.com/docker/go-units v0.5.0 // indirect
|
|
github.com/emirpasic/gods v1.18.1 // indirect
|
|
github.com/fatih/color v1.16.0 // indirect
|
|
github.com/felixge/httpsnoop v1.0.4 // indirect
|
|
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
|
|
github.com/go-git/go-billy/v5 v5.6.1 // indirect
|
|
github.com/go-git/go-git/v5 v5.13.1 // indirect
|
|
github.com/go-logr/logr v1.4.2 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/gobwas/glob v0.2.3 // indirect
|
|
github.com/gogo/protobuf v1.3.2 // indirect
|
|
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
|
|
github.com/google/go-cmp v0.6.0 // indirect
|
|
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
|
|
github.com/imdario/mergo v0.3.16 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
|
|
github.com/julienschmidt/httprouter v1.3.0 // indirect
|
|
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
|
|
github.com/kevinburke/ssh_config v1.2.0 // indirect
|
|
github.com/klauspost/compress v1.17.4 // indirect
|
|
github.com/mattn/go-colorable v0.1.13 // indirect
|
|
github.com/mattn/go-runewidth v0.0.15 // indirect
|
|
github.com/mitchellh/mapstructure v1.5.0 // indirect
|
|
github.com/moby/buildkit v0.13.2 // indirect
|
|
github.com/moby/patternmatcher v0.6.0 // indirect
|
|
github.com/moby/sys/sequential v0.5.0 // indirect
|
|
github.com/moby/sys/user v0.3.0 // indirect
|
|
github.com/moby/sys/userns v0.1.0 // indirect
|
|
github.com/opencontainers/go-digest v1.0.0 // indirect
|
|
github.com/opencontainers/image-spec v1.1.0 // indirect
|
|
github.com/opencontainers/selinux v1.11.0 // indirect
|
|
github.com/pjbgf/sha1cd v0.3.0 // indirect
|
|
github.com/pkg/errors v0.9.1 // indirect
|
|
github.com/pmezard/go-difflib v1.0.0 // indirect
|
|
github.com/rhysd/actionlint v1.6.27 // indirect
|
|
github.com/rivo/uniseg v0.4.7 // indirect
|
|
github.com/robfig/cron/v3 v3.0.1 // indirect
|
|
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
|
|
github.com/skeema/knownhosts v1.3.0 // indirect
|
|
github.com/spf13/pflag v1.0.6 // indirect
|
|
github.com/stretchr/objx v0.5.2 // indirect
|
|
github.com/timshannon/bolthold v0.0.0-20240314194003-30aac6950928 // indirect
|
|
github.com/xanzy/ssh-agent v0.3.3 // indirect
|
|
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
|
|
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
|
|
github.com/xeipuuv/gojsonschema v1.2.0 // indirect
|
|
go.etcd.io/bbolt v1.3.10 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 // indirect
|
|
go.opentelemetry.io/otel v1.21.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.21.0 // indirect
|
|
go.opentelemetry.io/otel/trace v1.21.0 // indirect
|
|
golang.org/x/crypto v0.36.0 // indirect
|
|
golang.org/x/net v0.38.0 // indirect
|
|
golang.org/x/sync v0.12.0 // indirect
|
|
golang.org/x/sys v0.33.0 // indirect
|
|
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
|
|
gopkg.in/warnings.v0 v0.1.2 // indirect
|
|
gopkg.in/yaml.v2 v2.4.0 // indirect
|
|
)
|
|
|
|
replace github.com/nektos/act => code.forgejo.org/forgejo/act v1.26.0
|