Skip to content

Commit 03b0e91

Browse files
author
merge-queue-bot
committed
Merge PR #618: security: clear Dependabot alert #2 (critical wish SCP path traversal) + harden VS Code dev deps
2 parents f682d63 + 8b067b0 commit 03b0e91

8 files changed

Lines changed: 86 additions & 242 deletions

File tree

‎.github/copilot-instructions.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -229,9 +229,9 @@ row: "- [{title}](../docs/development/{filename})"
229229

230230
#### Build & Test Commands
231231

232-
Requires Go 1.25+. Dev tools (golangci-lint, vhs,
232+
Requires Go 1.25+. Dev tools (golangci-lint and
233233
gobco) build from `tools/go.mod`, which needs Go
234-
1.25.8+; `go.mod` itself must stay tool-free so
234+
1.25.8+; `go.mod` itself stays tool-free so
235235
`go install` consumers never inherit a dev tool's
236236
go floor.
237237

‎AGENTS.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -234,9 +234,9 @@ row: "- [{title}](docs/development/{filename})"
234234

235235
### Build & Test Commands
236236

237-
Requires Go 1.25+. Dev tools (golangci-lint, vhs,
237+
Requires Go 1.25+. Dev tools (golangci-lint and
238238
gobco) build from `tools/go.mod`, which needs Go
239-
1.25.8+; `go.mod` itself must stay tool-free so
239+
1.25.8+; `go.mod` itself stays tool-free so
240240
`go install` consumers never inherit a dev tool's
241241
go floor.
242242

‎CLAUDE.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -220,9 +220,9 @@ row: "- [{title}](docs/development/{filename})"
220220

221221
### Build & Test Commands
222222

223-
Requires Go 1.25+. Dev tools (golangci-lint, vhs,
223+
Requires Go 1.25+. Dev tools (golangci-lint and
224224
gobco) build from `tools/go.mod`, which needs Go
225-
1.25.8+; `go.mod` itself must stay tool-free so
225+
1.25.8+; `go.mod` itself stays tool-free so
226226
`go install` consumers never inherit a dev tool's
227227
go floor.
228228

‎docs/development/index.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,9 +35,9 @@ row: "- [{title}]({filename})"
3535

3636
## Build & Test Commands
3737

38-
Requires Go 1.25+. Dev tools (golangci-lint, vhs,
38+
Requires Go 1.25+. Dev tools (golangci-lint and
3939
gobco) build from `tools/go.mod`, which needs Go
40-
1.25.8+; `go.mod` itself must stay tool-free so
40+
1.25.8+; `go.mod` itself stays tool-free so
4141
`go install` consumers never inherit a dev tool's
4242
go floor.
4343

‎editors/vscode/bun.lock‎

Lines changed: 61 additions & 90 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎editors/vscode/package.json‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -210,5 +210,12 @@
210210
"mocha": "^11.7.6",
211211
"typescript": "^5.4.0",
212212
"vscode-uri": "^3.1.0"
213+
},
214+
"overrides": {
215+
"serialize-javascript": "^7.0.5",
216+
"diff": "^8.0.3",
217+
"qs": "^6.15.2",
218+
"fast-uri": "^3.1.2",
219+
"tmp": "^0.2.6"
213220
}
214221
}

‎tools/go.mod‎

Lines changed: 10 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,20 @@
11
module github.com/jeduden/mdsmith
22

3-
// Alternate modfile for dev tools only: golangci-lint, vhs, and
4-
// gobco are built from this graph via
3+
// Alternate modfile for dev tools only: golangci-lint and gobco are
4+
// built from this graph via
55
// `go tool -modfile=tools/go.mod <tool>`. Keeping them out of
6-
// go.mod keeps their dependency trees and go-version floors out of
7-
// the module graph that `go install m@version` and library
8-
// consumers resolve (vhs alone forces go >= 1.25.8 here, while the
9-
// real dependencies in go.mod top out at 1.25.0). Tidy with
6+
// go.mod keeps their large dependency trees out of the module graph
7+
// that `go install m@version` and library consumers resolve. The go
8+
// directive is held at 1.25.8 — above the 1.25.0 the linters need —
9+
// because the skill-eval job reads it via go-version-file to compile
10+
// a baseline worktree that demands 1.25.8 (see
11+
// .github/workflows/skill-eval.yml). Tidy with
1012
// `go mod tidy -modfile=tools/go.mod`; the require list is a
1113
// superset of go.mod because an alternate modfile still covers the
1214
// repository's own packages.
1315
go 1.25.8
1416

1517
tool (
16-
github.com/charmbracelet/vhs
1718
github.com/golangci/golangci-lint/v2/cmd/golangci-lint
1819
github.com/rillig/gobco
1920
)
@@ -54,20 +55,16 @@ require (
5455
github.com/Masterminds/semver/v3 v3.4.0 // indirect
5556
github.com/MirrexOne/unqueryvet v1.4.0 // indirect
5657
github.com/OpenPeeDeeP/depguard/v2 v2.2.1 // indirect
57-
github.com/agnivade/levenshtein v1.2.1 // indirect
5858
github.com/alecthomas/chroma/v2 v2.21.1 // indirect
5959
github.com/alecthomas/go-check-sumtype v0.3.1 // indirect
6060
github.com/alexkohler/nakedret/v2 v2.0.6 // indirect
6161
github.com/alexkohler/prealloc v1.0.1 // indirect
6262
github.com/alfatraining/structtag v1.0.0 // indirect
6363
github.com/alingse/asasalint v0.0.11 // indirect
6464
github.com/alingse/nilnesserr v0.2.0 // indirect
65-
github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect
6665
github.com/ashanbrown/forbidigo/v2 v2.3.0 // indirect
6766
github.com/ashanbrown/makezero/v2 v2.1.0 // indirect
68-
github.com/atotto/clipboard v0.1.4 // indirect
6967
github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
70-
github.com/aymerick/douceur v0.2.0 // indirect
7168
github.com/beorn7/perks v1.0.1 // indirect
7269
github.com/bkielbasa/cyclop v1.2.3 // indirect
7370
github.com/blizzy78/varnamelen v0.8.0 // indirect
@@ -77,37 +74,23 @@ require (
7774
github.com/breml/errchkjson v0.4.1 // indirect
7875
github.com/butuzov/ireturn v0.4.0 // indirect
7976
github.com/butuzov/mirror v1.3.0 // indirect
80-
github.com/caarlos0/env/v11 v11.4.0 // indirect
8177
github.com/catenacyber/perfsprint v0.10.1 // indirect
8278
github.com/ccojocar/zxcvbn-go v1.0.4 // indirect
8379
github.com/cespare/xxhash/v2 v2.3.0 // indirect
8480
github.com/charithe/durationcheck v0.0.11 // indirect
85-
github.com/charmbracelet/bubbletea v1.3.4 // indirect
8681
github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc // indirect
87-
github.com/charmbracelet/glamour v1.0.0 // indirect
88-
github.com/charmbracelet/keygen v0.5.4 // indirect
8982
github.com/charmbracelet/lipgloss v1.1.1-0.20250404203927-76690c660834 // indirect
90-
github.com/charmbracelet/log v0.4.1 // indirect
91-
github.com/charmbracelet/ssh v0.0.0-20250128164007-98fd5ae11894 // indirect
92-
github.com/charmbracelet/vhs v0.11.0 // indirect
93-
github.com/charmbracelet/wish v1.4.7 // indirect
9483
github.com/charmbracelet/x/ansi v0.10.2 // indirect
9584
github.com/charmbracelet/x/cellbuf v0.0.13 // indirect
96-
github.com/charmbracelet/x/conpty v0.1.0 // indirect
97-
github.com/charmbracelet/x/errors v0.0.0-20240904165849-e8e43e13f84b // indirect
98-
github.com/charmbracelet/x/exp/slice v0.0.0-20250327172914-2fdc97757edf // indirect
9985
github.com/charmbracelet/x/term v0.2.1 // indirect
100-
github.com/charmbracelet/x/termios v0.1.0 // indirect
10186
github.com/ckaznocha/intrange v0.3.1 // indirect
10287
github.com/clipperhouse/uax29/v2 v2.2.0 // indirect
103-
github.com/creack/pty v1.1.24 // indirect
10488
github.com/curioswitch/go-reassign v0.3.0 // indirect
10589
github.com/daixiang0/gci v0.13.7 // indirect
10690
github.com/dave/dst v0.27.3 // indirect
10791
github.com/davecgh/go-spew v1.1.1 // indirect
10892
github.com/denis-tingaikin/go-header v0.5.0 // indirect
10993
github.com/dlclark/regexp2 v1.11.5 // indirect
110-
github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
11194
github.com/ettle/strcase v0.2.0 // indirect
11295
github.com/fatih/color v1.18.0 // indirect
11396
github.com/fatih/structtag v1.2.0 // indirect
@@ -116,8 +99,6 @@ require (
11699
github.com/fzipp/gocyclo v0.6.0 // indirect
117100
github.com/ghostiam/protogetter v0.3.18 // indirect
118101
github.com/go-critic/go-critic v0.14.3 // indirect
119-
github.com/go-logfmt/logfmt v0.6.0 // indirect
120-
github.com/go-rod/rod v0.116.2 // indirect
121102
github.com/go-toolsmith/astcast v1.1.0 // indirect
122103
github.com/go-toolsmith/astcopy v1.1.0 // indirect
123104
github.com/go-toolsmith/astequal v1.2.0 // indirect
@@ -144,7 +125,6 @@ require (
144125
github.com/golangci/unconvert v0.0.0-20250410112200-a129a6e6413e // indirect
145126
github.com/google/go-cmp v0.7.0 // indirect
146127
github.com/gordonklaus/ineffassign v0.2.0 // indirect
147-
github.com/gorilla/css v1.0.1 // indirect
148128
github.com/gostaticanalysis/analysisutil v0.7.1 // indirect
149129
github.com/gostaticanalysis/comment v1.5.0 // indirect
150130
github.com/gostaticanalysis/forcetypeassert v0.2.0 // indirect
@@ -179,23 +159,14 @@ require (
179159
github.com/maratori/testableexamples v1.0.1 // indirect
180160
github.com/maratori/testpackage v1.1.2 // indirect
181161
github.com/matoous/godox v1.1.0 // indirect
162+
github.com/matryer/is v1.4.1 // indirect
182163
github.com/mattn/go-colorable v0.1.14 // indirect
183164
github.com/mattn/go-isatty v0.0.20 // indirect
184-
github.com/mattn/go-localereader v0.0.1 // indirect
185165
github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
186166
github.com/mgechev/revive v1.13.0 // indirect
187-
github.com/microcosm-cc/bluemonday v1.0.27 // indirect
188167
github.com/mitchellh/go-homedir v1.1.0 // indirect
189168
github.com/mitchellh/mapstructure v1.5.0 // indirect
190169
github.com/moricho/tparallel v0.3.2 // indirect
191-
github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
192-
github.com/muesli/cancelreader v0.2.2 // indirect
193-
github.com/muesli/go-app-paths v0.2.2 // indirect
194-
github.com/muesli/mango v0.2.0 // indirect
195-
github.com/muesli/mango-cobra v1.3.0 // indirect
196-
github.com/muesli/mango-pflag v0.1.0 // indirect
197-
github.com/muesli/reflow v0.3.0 // indirect
198-
github.com/muesli/roff v0.1.0 // indirect
199170
github.com/muesli/termenv v0.16.0 // indirect
200171
github.com/nakabonne/nestif v0.3.1 // indirect
201172
github.com/nishanths/exhaustive v0.12.0 // indirect
@@ -223,6 +194,7 @@ require (
223194
github.com/sashamelentyev/interfacebloat v1.1.0 // indirect
224195
github.com/sashamelentyev/usestdlibvars v1.29.0 // indirect
225196
github.com/securego/gosec/v2 v2.22.11 // indirect
197+
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
226198
github.com/sirupsen/logrus v1.9.3 // indirect
227199
github.com/sivchari/containedctx v1.0.3 // indirect
228200
github.com/sonatard/noctx v0.4.0 // indirect
@@ -251,13 +223,6 @@ require (
251223
github.com/yagipy/maintidx v1.0.0 // indirect
252224
github.com/yeya24/promlinter v0.3.0 // indirect
253225
github.com/ykadowak/zerologlint v0.1.5 // indirect
254-
github.com/ysmood/fetchup v0.2.3 // indirect
255-
github.com/ysmood/goob v0.4.0 // indirect
256-
github.com/ysmood/got v0.40.0 // indirect
257-
github.com/ysmood/gson v0.7.3 // indirect
258-
github.com/ysmood/leakless v0.9.0 // indirect
259-
github.com/yuin/goldmark v1.7.13 // indirect
260-
github.com/yuin/goldmark-emoji v1.0.6 // indirect
261226
gitlab.com/bosi/decorder v0.4.2 // indirect
262227
go-simpler.org/musttag v0.14.0 // indirect
263228
go-simpler.org/sloglint v0.11.1 // indirect
@@ -267,11 +232,8 @@ require (
267232
go.uber.org/multierr v1.10.0 // indirect
268233
go.uber.org/zap v1.27.0 // indirect
269234
go.yaml.in/yaml/v3 v3.0.4 // indirect
270-
golang.org/x/crypto v0.49.0 // indirect
271-
golang.org/x/exp v0.0.0-20240909161429-701f63a606c0 // indirect
272235
golang.org/x/exp/typeparams v0.0.0-20251023183803-a4bb9ffd2546 // indirect
273236
golang.org/x/sync v0.20.0 // indirect
274-
golang.org/x/term v0.41.0 // indirect
275237
golang.org/x/text v0.35.0 // indirect
276238
google.golang.org/protobuf v1.36.8 // indirect
277239
gopkg.in/ini.v1 v1.67.0 // indirect

0 commit comments

Comments
 (0)