Sync upstream 20250714 - #2
Closed
danielfbm wants to merge 30 commits into
Closed
Conversation
…er-go#1432) Bumps [golang.org/x/vuln](https://github.com/golang/vuln) from 1.0.1 to 1.1.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/golang/vuln/releases">golang.org/x/vuln's releases</a>.</em></p> <blockquote> <h2>v1.1.0</h2> <p>This release brings minor improvements to govulncheck inner workings and a few bug fixes (<a href="https://redirect.github.com/golang/go/issues/65590">#66139</a>, <a href="https://redirect.github.com/golang/go/issues/65590">#65590</a>).</p> <h2>Integration</h2> <p>Govulncheck JSON now also contains scan mode as part of the <a href="https://github.com/golang/vuln/blob/a7188c690e1dbf65a6b855e74618821c711ea516/internal/govulncheck/govulncheck.go#L49"><code>Config</code></a> message.</p> <p>Further, the <a href="https://github.com/golang/vuln/blob/a7188c690e1dbf65a6b855e74618821c711ea516/internal/govulncheck/govulncheck.go#L172"><code>Position</code></a> in trace frames now contains only paths relative to their enclosing module. This could potentially break some existing clients, hence the bump of the minor version.</p> <p>Note that this change is made to allow for easier preservation of privacy by the clients as now the file positions do not contain information about the local machine. This is also a portable solution. Clients can reconstruct full paths for their local machine by joining the <code>Position</code> relative paths with paths of the enclosing modules on the local machine.</p> <h2>v1.0.4</h2> <p>This release brings an improved overhaul of the govulncheck textual output. Findings at each detected level of precision (<code>symbol, package, or module</code>) are communicated in their own section.</p> <p>By default, only the section with the user-specified precision mode is shown followed by a summary of other sections. A detailed description with all of the sections can be obtained using a newly introduced <code>-show verbose</code> option.</p> <p>This release also brings improvements and fixes for error messages and binaries (<a href="https://redirect.github.com/golang/go/issues/59731">#59731</a>).</p> <h2>Integration</h2> <p>govulncheck (streaming) JSON now includes the code position of the vulnerable symbol. Where applicable, the <code>.Position</code> of the last entry of a finding's trace is the code location defining the <code>.Function</code>.</p> <h2>v1.0.3</h2> <p>The major feature brought by this release is govulncheck <code>-mode extract</code> option. It enables users to extract a blob abstraction of a binary whose size is typically much smaller than the binary itself. The blob can be passed to govulncheck for analysis with the <code>-mode binary</code> option. The users should not rely on the contents or the representation of the blob.</p> <p>This release also brings several bug fixes (<a href="https://redirect.github.com/golang/go/issues/65124">#65124</a>, <a href="https://redirect.github.com/golang/go/issues/65155">#65155</a>, and <a href="https://redirect.github.com/golang/go/issues/65130">#65130</a>).</p> <h2>v1.0.2</h2> <p>This release brings minor improvements to the govulncheck textual output and fixes for error messages (<a href="https://redirect.github.com/golang/go/issues/59623">#59623</a>, <a href="https://redirect.github.com/golang/go/issues/64681">#64681</a>), fixed version suggestion (<a href="https://redirect.github.com/golang/go/issues/62276">#62276</a>), documentation (e.g., <a href="https://redirect.github.com/golang/go/issues/60166">#60166</a>), and issues in dependencies (e.g., <a href="https://redirect.github.com/golang/go/issues/64112">#64112</a>).</p> <p>Support for analyzing stripped darwin binaries in govulncheck is added as well (<a href="https://redirect.github.com/golang/go/issues/61051">#61051</a>).</p> <h2>Integration</h2> <p>govulncheck (streaming) JSON now emits an OSV message for each vulnerability associated with user modules and its transitive dependencies, regardless of the module version.</p> <p>As usual, govulncheck emits a module-level Finding if a vulnerability for a module applies to the current module version.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/vuln/commit/a7188c690e1dbf65a6b855e74618821c711ea516"><code>a7188c6</code></a> internal/openvex: add vex types</li> <li><a href="https://github.com/golang/vuln/commit/4b737a97851cc7a7f9b87cf5d123960d55e50006"><code>4b737a9</code></a> internal/sarif: compute relative paths for findings</li> <li><a href="https://github.com/golang/vuln/commit/7bf0c05f14670d9de8f2881314dd3e7dabb4a14c"><code>7bf0c05</code></a> internal/sarif: remove unused field</li> <li><a href="https://github.com/golang/vuln/commit/7b0e650379b05ed4e8106ef4874492f25ec05fe5"><code>7b0e650</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/vuln/commit/f1b1098b221539291c214e17e263e7d014a9761f"><code>f1b1098</code></a> internal/sarif,internal/scan,internal/traces: clean up tests</li> <li><a href="https://github.com/golang/vuln/commit/33791bcb641951845fcda445b39dd58c870b9330"><code>33791bc</code></a> internal/sarif: add region part of the physical location</li> <li><a href="https://github.com/golang/vuln/commit/d00c170d001daeff7d121991f4d994c1ad259b40"><code>d00c170</code></a> internal/sarif: add code flows</li> <li><a href="https://github.com/golang/vuln/commit/9fbf042ea52d082b8757c09220a2e259d6928239"><code>9fbf042</code></a> cmd/govulncheck: clean up test</li> <li><a href="https://github.com/golang/vuln/commit/efaa3cef72f7613a1c46ab7fd132de0dee77dcca"><code>efaa3ce</code></a> cmd/govulncheck: make test case config data</li> <li><a href="https://github.com/golang/vuln/commit/7838670b334c6ba85440789f2f3172612cc7154b"><code>7838670</code></a> cmd/govulncheck: add comment capability to fixups</li> <li>Additional commits viewable in <a href="https://github.com/golang/vuln/compare/v1.0.1...v1.1.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…1433) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This PR manually bumps setup-go to version 5 since the [dependabot PR](uber-go#1393) for it seems to be having issues w/ codecov token. CI runs on newer PRs somehow do not have this issue.
Fossa has been deprecated for Uber OSS repositories, remove the workflow accordingly.
Noticed that there were a handful of lint issues, all `errcheck` things. This PR: - Adds underscores to clarify error discarding - Updates the `make golangci-lint` target to use `./...`, as e.g. there are no `exp/*.go` files
Some packages set their value for WarnLevel to "warning". For easier integration add "warning" as accepted WarnLevel. Example for a package that is using "warning": https://github.com/sirupsen/logrus/blob/dd1b4c2e81afc5c255f216a722b012ed26be57df/logrus.go#L68 --------- Signed-off-by: Florian Lehner <florian.lehner@elastic.co>
…er-go#1440) Bumps [golang.org/x/vuln](https://github.com/golang/vuln) from 1.1.0 to 1.1.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/golang/vuln/releases">golang.org/x/vuln's releases</a>.</em></p> <blockquote> <h2>v1.1.1</h2> <p>This release brings some minor improvements to govulncheck textual output and performance optimizations for <code>package</code> and <code>module</code> scan modes.</p> <p>The major change brought by this release is the support for <a href="https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=sarif">SARIF</a> output format.</p> <h2>Integration</h2> <p>Govulncheck now supports <a href="https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=sarif">Static Analysis Results Interchange Format</a> (SARIF) output format via <code>-format sarif</code> flag option. Please see <a href="https://pkg.go.dev/golang.org/x/vuln@v1.1.1/internal/sarif">here</a> for more details on the actual encoding.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/vuln/commit/486fd2384a39a632a0e5b003e1840d49d1db7e86"><code>486fd23</code></a> all: remove unit tests for staticcheck, unparam, and spellcheck</li> <li><a href="https://github.com/golang/vuln/commit/6b0fd5601b4a69285e464ec05957800bf63e4d0e"><code>6b0fd56</code></a> internal/sarif,cmd/govulncheck: publicize sarif</li> <li><a href="https://github.com/golang/vuln/commit/7b455eea68df4fad0d78f08d7811f818426afc30"><code>7b455ee</code></a> internal/vulncheck: load source code for scan symbol mode only</li> <li><a href="https://github.com/golang/vuln/commit/7ed0faae83da959585ab1226aedda8b2e1eff849"><code>7ed0faa</code></a> all: update golang.org/x/tools</li> <li><a href="https://github.com/golang/vuln/commit/122c809ebf2367fd3394cfcc7d9459ce708052c9"><code>122c809</code></a> internal/vulncheck: emit progress message instead of warning</li> <li><a href="https://github.com/golang/vuln/commit/d837ff86426137299700241b0997c011091800ff"><code>d837ff8</code></a> internal/scan: improve textual output for binary traces</li> <li><a href="https://github.com/golang/vuln/commit/4a8a6ffa0362e038bb7b9d56cc2fe09d0e4fd5ff"><code>4a8a6ff</code></a> internal/buildinfo: avoid panic on nil symbol for elf</li> <li><a href="https://github.com/golang/vuln/commit/052eac784b099e7cc1a3864eb927288b196f2000"><code>052eac7</code></a> internal/sarif: improve GOMODCACHE relative paths</li> <li><a href="https://github.com/golang/vuln/commit/93d3090660cdfbfe5dfa57dfc366438d35283648"><code>93d3090</code></a> internal/sarif: add version to module info for locations</li> <li><a href="https://github.com/golang/vuln/commit/0e39fee41378bbb3678d501b1b19193c0060f540"><code>0e39fee</code></a> internal/sarif: remove originalURIBaseIds</li> <li>Additional commits viewable in <a href="https://github.com/golang/vuln/compare/v1.1.0...v1.1.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
unmarshalText currently checks for almost all of the levels as the configured string values as well as their capitalized versions. But we call unmarshalText with bytes.ToLower() when we actually parse the levels, so we do not need to check for the capitalized versions separately since this is redundant. Previous version of this PR was trying to add "WARNING" as a check to this since that was recently added but the corresponding capitalized string wasn't checked, but @abhinav pointed out that we actually call this with ToLower, so it's better to remove the redundant checks.
…er-go#1445) Bumps [golang.org/x/vuln](https://github.com/golang/vuln) from 1.1.1 to 1.1.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/golang/vuln/releases">golang.org/x/vuln's releases</a>.</em></p> <blockquote> <h2>v1.1.2</h2> <p>This release brings the support for the VEX output format.</p> <h2>Integration</h2> <p>Govulncheck now supports <a href="https://github.com/openvex">OpenVex</a> output format via <code>-format openvex</code> flag option. Please see <a href="https://pkg.go.dev/golang.org/x/vuln@v1.1.2/internal/openvex">here</a> for more details on the actual encoding.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/vuln/commit/3740f5cb12a3f93b18dbe200c4bcb6256f8586e2"><code>3740f5c</code></a> internal/osv: add review status</li> <li><a href="https://github.com/golang/vuln/commit/29462d73a2bf15636e29dc1e570ea0caa38dd5d5"><code>29462d7</code></a> vulncheck: update documentation for vex</li> <li><a href="https://github.com/golang/vuln/commit/2736e1dc19ec039536007b7b7ab2cf1bd93052f6"><code>2736e1d</code></a> cmd/govulncheck/integration/stackrox-scanner: update expectations</li> <li><a href="https://github.com/golang/vuln/commit/65c6e2bf78af59b4e3eeb15616d10d2d93976c30"><code>65c6e2b</code></a> cmd/govulncheck/integration/k8s: update expectations</li> <li><a href="https://github.com/golang/vuln/commit/03e66a609a8e11ea10203ac2bb74977292163cf5"><code>03e66a6</code></a> internal/govulncheck: add more comments for emitted OSVs</li> <li><a href="https://github.com/golang/vuln/commit/f30059cfb245502cc453bb54905db2f0b77492ef"><code>f30059c</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/vuln/commit/84735a3ac315d2ef79d1f31d1298d6b8dc9a9a8d"><code>84735a3</code></a> internal/scan: increase telemetry counter for show flag</li> <li><a href="https://github.com/golang/vuln/commit/fb2a687c05601167d07f68c59e685fc7371bc176"><code>fb2a687</code></a> internal/scan: add format and scan level telemetry</li> <li><a href="https://github.com/golang/vuln/commit/f5e77b81ae7d803dfe37b80b919ebe9269cc0141"><code>f5e77b8</code></a> internal/cmd/govulncheck: remove unnecessary binary dependency</li> <li><a href="https://github.com/golang/vuln/commit/1201340bf0daba4b0f59a0118ecd04144ad1ffa6"><code>1201340</code></a> cmd/govulncheck/integration: update go in integration tests</li> <li>Additional commits viewable in <a href="https://github.com/golang/vuln/compare/v1.1.1...v1.1.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
codecov jobs have been failing recently.
The error we're seeing with verbose true is
```
debug - 2024-06-12 19:18:58,188 -- Starting create commit process --- {"commit_sha": "60547051d2c7a282f81ee9c7cb4c2547c0640e40", "parent_sha": null, "pr": "1435", "branch": "dependabot/github_actions/golangci/golangci-lint-action-6", "slug": "uber-go/zap", "token": null, "service": "github", "enterprise_url": null}
Error: Codecov token not found. Please provide Codecov token with -t flag.
Warning: Codecov: Failed to properly create commit: The process '/home/runner/work/_actions/codecov/codecov-action/v4/dist/codecov' failed with exit code 1
```
ref:
https://github.com/uber-go/zap/actions/runs/9488445442/job/26147390272#step:6:58
From the docs there are multiple valid ways to specify the coverage
upload token https://github.com/codecov/codecov-action
Since we're using the environment variable approach and we're still
getting an error that the token is not provided, let's try the with
token option.
…1435) Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 5 to 6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/golangci/golangci-lint-action/releases">golangci/golangci-lint-action's releases</a>.</em></p> <blockquote> <h2>v6.0.0</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <p>This version removes <code>annotations</code> option (because it was useless), and removes the default output format (<code>github-actions</code>). The annotations are still produced but with another approach.</p> <h3>Changes</h3> <ul> <li>feat: rewrite format handling by <a href="https://github.com/ldez"><code>@ldez</code></a> in <a href="https://redirect.github.com/golangci/golangci-lint-action/pull/1038">golangci/golangci-lint-action#1038</a></li> </ul> <h3>Dependencies</h3> <ul> <li>build(deps-dev): bump <code>@typescript-eslint/eslint-plugin</code> from 7.7.1 to 7.8.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/golangci/golangci-lint-action/pull/1034">golangci/golangci-lint-action#1034</a></li> <li>build(deps): bump <code>@types/node</code> from 20.12.7 to 20.12.8 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/golangci/golangci-lint-action/pull/1036">golangci/golangci-lint-action#1036</a></li> <li>build(deps-dev): bump <code>@typescript-eslint/parser</code> from 7.7.1 to 7.8.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/golangci/golangci-lint-action/pull/1035">golangci/golangci-lint-action#1035</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/golangci/golangci-lint-action/compare/v5.3.0...v6.0.0">https://github.com/golangci/golangci-lint-action/compare/v5.3.0...v6.0.0</a></p> <h2>v5.3.0</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <h3>Changes</h3> <ul> <li>feat: uses 2 dots compare syntax for push diff by <a href="https://github.com/ldez"><code>@ldez</code></a> in <a href="https://redirect.github.com/golangci/golangci-lint-action/pull/1030">golangci/golangci-lint-action#1030</a></li> <li>feat: add option to control cache invalidation interval by <a href="https://github.com/ldez"><code>@ldez</code></a> in <a href="https://redirect.github.com/golangci/golangci-lint-action/pull/1031">golangci/golangci-lint-action#1031</a></li> <li>feat: use OS and working-directory as cache key by <a href="https://github.com/ldez"><code>@ldez</code></a> in <a href="https://redirect.github.com/golangci/golangci-lint-action/pull/1032">golangci/golangci-lint-action#1032</a></li> <li>feat: improve log about pwd/cwd by <a href="https://github.com/ldez"><code>@ldez</code></a> in <a href="https://redirect.github.com/golangci/golangci-lint-action/pull/1033">golangci/golangci-lint-action#1033</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/golangci/golangci-lint-action/compare/v5.2.0...v5.3.0">https://github.com/golangci/golangci-lint-action/compare/v5.2.0...v5.3.0</a></p> <h2>v5.2.0</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <h3>Changes</h3> <ul> <li><a href="https://github.com/golangci/golangci-lint-action/commit/aebff4bd9cd0198ff4f020915c27258a9edc4c01">feat: add an option to enable/disable annotations</a> by <a href="https://github.com/ldez"><code>@ldez</code></a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/golangci/golangci-lint-action/compare/v5.1.0...v5.2.0">https://github.com/golangci/golangci-lint-action/compare/v5.1.0...v5.2.0</a></p> <h2>v5.1.0</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <h3>Changes</h3> <ul> <li>feat: support for <code>pull</code> and <code>merge_group</code> events with the option <code>only-new-issues</code> by <a href="https://github.com/ldez"><code>@ldez</code></a> in <a href="https://redirect.github.com/golangci/golangci-lint-action/pull/1029">golangci/golangci-lint-action#1029</a></li> </ul> <h3>Dependencies</h3> <ul> <li>build(deps-dev): bump <code>@typescript-eslint/parser</code> from 7.7.0 to 7.7.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/golangci/golangci-lint-action/pull/1027">golangci/golangci-lint-action#1027</a></li> <li>build(deps-dev): bump <code>@typescript-eslint/eslint-plugin</code> from 7.7.0 to 7.7.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/golangci/golangci-lint-action/pull/1028">golangci/golangci-lint-action#1028</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golangci/golangci-lint-action/commit/a4f60bb28d35aeee14e6880718e0c85ff1882e64"><code>a4f60bb</code></a> fix: use 3-dots syntax for diff on push (<a href="https://redirect.github.com/golangci/golangci-lint-action/issues/1040">#1040</a>)</li> <li><a href="https://github.com/golangci/golangci-lint-action/commit/5815a4b9176ef5d9477ec687e3e7f68f04e1a3fc"><code>5815a4b</code></a> doc: improve readme</li> <li><a href="https://github.com/golangci/golangci-lint-action/commit/23faadfdeb23a6f9e511beaba149bb123b5b145a"><code>23faadf</code></a> doc: improve readme</li> <li><a href="https://github.com/golangci/golangci-lint-action/commit/b556f25b3c7399b6dad72f47062098ff1b36e060"><code>b556f25</code></a> doc: improve readme</li> <li><a href="https://github.com/golangci/golangci-lint-action/commit/789f114c52eaee9275c87b15fc90e449e56d1b0a"><code>789f114</code></a> feat: rewrite format handling (<a href="https://redirect.github.com/golangci/golangci-lint-action/issues/1038">#1038</a>)</li> <li><a href="https://github.com/golangci/golangci-lint-action/commit/d36b91c2948e1d383efc1388208baed5ac9b8e0d"><code>d36b91c</code></a> build(deps-dev): bump <code>@typescript-eslint/parser</code> from 7.7.1 to 7.8.0 (<a href="https://redirect.github.com/golangci/golangci-lint-action/issues/1035">#1035</a>)</li> <li><a href="https://github.com/golangci/golangci-lint-action/commit/a9eb1153485e197079024eb082ecd007e94b286b"><code>a9eb115</code></a> build(deps): bump <code>@types/node</code> from 20.12.7 to 20.12.8 (<a href="https://redirect.github.com/golangci/golangci-lint-action/issues/1036">#1036</a>)</li> <li><a href="https://github.com/golangci/golangci-lint-action/commit/bd4fa7c9002facfc2cebdefb1a94ba57d2e87851"><code>bd4fa7c</code></a> build(deps-dev): bump <code>@typescript-eslint/eslint-plugin</code> from 7.7.1 to 7.8.0 (#...</li> <li>See full diff in <a href="https://github.com/golangci/golangci-lint-action/compare/v5...v6">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…1452) This is useful for assertions on logs in a particular named path, currently this is only possible through calls to Filter but it is more verbose. Added a FilterLoggerName function that plays nicely with the other filters: zapLogs.FilterLoggerName("my.logger").FilterMessage("hello") --------- Signed-off-by: Mauri de Souza Meneguzzo <mauri870@gmail.com> Co-authored-by: Sung Yoon Whang <sungyoonwhang@gmail.com>
…er-go#1453) Bumps [golang.org/x/vuln](https://github.com/golang/vuln) from 1.1.2 to 1.1.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/golang/vuln/releases">golang.org/x/vuln's releases</a>.</em></p> <blockquote> <h2>v1.1.3</h2> <p>This release brings a few bug fixes (<a href="https://redirect.github.com/golang/go/issues/68034">#68034</a>, <a href="https://redirect.github.com/golang/go/issues/68256">#68256</a>, and <a href="https://redirect.github.com/golang/go/issues/68338">#68338</a>) and an increased support for analyzing Go binaries. Binaries built with Go versions prior to go1.18 are now checked, but only for standard library vulnerabilities.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/vuln/commit/4ea4418106cea3bb2c9aa098527c924e9e1fbbb4"><code>4ea4418</code></a> internal/openvex: update handler test</li> <li><a href="https://github.com/golang/vuln/commit/de0a0adbc1d357501a7f291978a9f8b87d15eb5a"><code>de0a0ad</code></a> LICENSE: update per Google Legal</li> <li><a href="https://github.com/golang/vuln/commit/1884dfae5d94f200377663e5be082dbe1d96b979"><code>1884dfa</code></a> internal/vulncheck: add warning message for ancient binaries</li> <li><a href="https://github.com/golang/vuln/commit/d9ad5223849a23e412d4a6ac1f61ecfc94cab0d8"><code>d9ad522</code></a> all: remove build restrictions requiring go1.18</li> <li><a href="https://github.com/golang/vuln/commit/44e45eaefb4e945ace34bc19e9a29cdb1b143966"><code>44e45ea</code></a> cmd/govulncheck: clarify unsafe/reflection limitations</li> <li><a href="https://github.com/golang/vuln/commit/601dd9b53b1c3d43f3065ea3b24d6a5fca69b1e1"><code>601dd9b</code></a> cmd/govulncheck: update docs for old Go binaries</li> <li><a href="https://github.com/golang/vuln/commit/0f7005f3db72ac2c67d870609932dd49954db764"><code>0f7005f</code></a> internal/openvex: omit vulns with no findings</li> <li><a href="https://github.com/golang/vuln/commit/f94421b20479af8851aa9ecc80a1142ad6f63c93"><code>f94421b</code></a> cmd/govulncheck/integration: adjust k8s expectations</li> <li><a href="https://github.com/golang/vuln/commit/684f5c9fa70708a9f79c33c09e16ce0bd25446d5"><code>684f5c9</code></a> all: remove skipIfShort</li> <li><a href="https://github.com/golang/vuln/commit/d52dedc621a782b20cbbf420a6e0358e80322300"><code>d52dedc</code></a> all: remove unnecessary test lines for staticcheck</li> <li>Additional commits viewable in <a href="https://github.com/golang/vuln/compare/v1.1.2...v1.1.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Sung Yoon Whang <sungyoon@uber.com>
The current message is misleading. It states the opposite of what the assertion is checking for.
Allows fields to be used to construct `ObjectMarshaler`s that can then be used with other functions like `func Objects`. Link to issue: uber-go#1458 --------- Co-authored-by: Abhinav Gupta <mail@abhinavg.net>
Signed-off-by: cuishuang <imcusg@gmail.com>
With the release of Go 1.23, CI should run against Go 1.22 and 1.23 Signed-off-by: junya koyama <arukiidou@yahoo.co.jp>
Updates the CHANGELOG of exp to prepare for a new release based on changes made to this directory since the last release. I think I got all user-facing changes, but feel free to tweak.
…-go#1477) Adds a unit test and a fuzz test to demonstrate that the AtomicLevel handler is not vulnerable to XSS. I ran the fuzz test on my computer for 10 minutes on my laptop with no cases where `<...>` was present in the response body. ``` ... fuzz: elapsed: 9m57s, execs: 43145040 (95839/sec), new interesting: 442 (total: 445) fuzz: elapsed: 10m0s, execs: 43396113 (83690/sec), new interesting: 442 (total: 445) ``` Refs uber-go#1476
The dependabot PR uber-go#1376 fails to bump grpc due to conflict with go1.16 (ref: uber-go#1473). Bump go version by one so go mod tidy is happy in the test package with the grpc upgrade.
Just as the title says. Signed-off-by: Ryan Leung <rleungx@gmail.com>
niliness -> nilness
It is possible to call zap.Object with nil or nil interface This will cause panic in zap bringing down the app using it The standard way of handling this is via nilField - compare all the constructors on pointers. As interfaces are similar to pointers - lets handle this case the same way Add tests in zapcore for equality on zap.Object(nil) Show ReflectType does not panic on nils Add test that zap.Object(nil) works Update benchmarks and use such a field to show performance and allocation are not affected excessively Refs uber-go#1500 Signed-off-by: Alexander Shopov <ash@kambanaria.org>
Author
|
This pull request has been automatically closed due to inactivity (no updates for 66 days). If you believe this PR should remain open, please:
The branch will be automatically deleted after 90 days of total inactivity unless it matches a protected pattern. Protected branch patterns: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
16 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.