Skip to content

Update Dependencies & Go version #1104

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Apr 3, 2025
Merged

Conversation

EyalDelarea
Copy link
Contributor

@EyalDelarea EyalDelarea commented Mar 31, 2025

  • All tests passed. If this feature is not already covered by the tests, I added new tests.
  • All static analysis checks passed.
  • This pull request is on the dev branch.
  • I used gofmt for formatting the code before submitting the pull request.

📦 Dependency Upgrades

Upgraded several core dependencies for bug fixes, performance, and security:

  • go version: 1.22.9 → 1.23.7
  • github.com/ProtonMail/go-crypto: v1.1.5 → v1.1.6
  • github.com/forPelevin/gomoji: v1.2.0 → v1.3.0
  • github.com/go-git/go-git/v5: v5.13.2 → v5.14.0
  • github.com/golang-jwt/jwt/v4: v4.5.1 → v4.5.2
  • golang.org/x/* libraries updated across crypto, exp, net, sync, sys, term, and text.

Also, This PR introduces several improvements and maintenance updates across the codebase:

🔒 Security Tag Refinements

  • Replaced all existing // #nosec GXXX comments with // #nosec GXXX jfrog-ignore to follow JFrog's internal convention for tracking intentional static analysis suppressions.
  • This affects test token definitions, checksum handling, and TLS verification bypass comments.

🔐 TLS Hardening

  • Updated all tls.Config instances where InsecureSkipVerify is used to explicitly set MinVersion: tls.VersionTLS12, improving baseline transport security.

🧪 Test Code Cleanup

  • Removed usage of golang.org/x/exp/rand in test code and replaced it with crypto/rand, which is more appropriate and avoids the need for extra dependencies.
  • Removed unused constant nodeId from multipartupload_test.go.

These upgrades align with the latest Go ecosystem improvements and help ensure continued compatibility and security.

Will close:
#1101
#1096
#1092

@EyalDelarea EyalDelarea added safe to test Approve running integration tests on a pull request ignore for release Automatically generated release notes labels Mar 31, 2025
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Mar 31, 2025
@EyalDelarea EyalDelarea added the safe to test Approve running integration tests on a pull request label Mar 31, 2025
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Mar 31, 2025
@EyalDelarea EyalDelarea changed the title fix audit alerts Update Dependencies & Go version Mar 31, 2025
@EyalDelarea EyalDelarea added improvement Automatically generated release notes and removed ignore for release Automatically generated release notes labels Mar 31, 2025
@EyalDelarea EyalDelarea added the safe to test Approve running integration tests on a pull request label Apr 3, 2025
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Apr 3, 2025
Copy link
Contributor

github-actions bot commented Apr 3, 2025

👍 Frogbot scanned this pull request and did not find any new security issues.


@EyalDelarea EyalDelarea merged commit ec19507 into jfrog:dev Apr 3, 2025
24 checks passed
EyalDelarea added a commit to EyalDelarea/jfrog-client-go that referenced this pull request Apr 10, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
improvement Automatically generated release notes
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants