Bump github.com/jackpal/gateway from 1.0.7 to 1.1.1 #40

dependabot · 2025-06-05T05:21:10Z

Bumps github.com/jackpal/gateway from 1.0.7 to 1.1.1.

Release notes

Sourced from github.com/jackpal/gateway's releases.

v1.1.1

Filter out On-link gateways on Windows.

v1.1.0

Add func DiscoverGateways() ([]net.IP, error). This func returns an array of gateways that contains at least one gateway. Otherwise returns an error.

Update to go version 1.24.2

Update dependencies to latest versions. (There was an x/net security warning.)

v1.0.16

Update x/net dependency to v0.33.0

Full Changelog: jackpal/gateway@v1.0.15...v1.0.16

v1.0.15

Update dependencies to latest versions.

Full Changelog: jackpal/gateway@v1.0.14...v1.0.15

v1.0.14

What's Changed

Fix panic when interface not set in Solaris netstat -rn output by @sot-tech in jackpal/gateway#42

New Contributors

@sot-tech made their first contribution in jackpal/gateway#42

Full Changelog: jackpal/gateway@v1.0.13...v1.0.14

Fix compilation errors when cross-compiling to different OSs

Add tools/check-cross-compile.sh to check that the code compiles for various OSs.

Fix compilation errors exposed by tools/check-cross-compile.sh.

Commits

890214b Update to 1.1.1
c0adb0e Merge pull request #44 from threatmate/and-fix-on-link-gateways
4cae8ea Merge remote-tracking branch 'upstream/master' into and-fix-on-link-gateways
16813f8 Fix typo in readme.
44fa67e Update README.md, go.mod, go.sum
975307c Tweak naming of internal functions.
dd594e0 Merge pull request #43 from threatmate/multiple-gateways
25aafd7 Fix On-Link gateways by quietly ignoring them
2d3b46f Upgrade x/net dependency to 0.33.0
6c5beca Upgrade x/net dependency to 0.33.0
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Summary by Bito

This PR updates dependency management by upgrading the Go version and adjusting package dependencies. The main change upgrades github.com/jackpal/gateway from v1.0.7 to v1.1.1, while also adding github.com/pmezard/go-difflib and other dependency improvements. These changes enhance compatibility, security, and maintainability.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps [github.com/jackpal/gateway](https://github.com/jackpal/gateway) from 1.0.7 to 1.1.1. - [Release notes](https://github.com/jackpal/gateway/releases) - [Commits](jackpal/gateway@v1.0.7...v1.1.1) --- updated-dependencies: - dependency-name: github.com/jackpal/gateway dependency-version: 1.1.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>

bito-code-review · 2025-06-05T05:21:25Z

Code Review Agent Run #1d3465

Actionable Suggestions - 0

Additional Suggestions - 1

go.mod - 1
- Redundant dependency declaration in go.mod · Line 136-137

Security Concerns - 10

Vulnerability 1
- Dependency Name: golang.org/x/oauth2
- Dependency Version: None
- Vulnerability Name: GO-2025-3488
- Vulnerability Description: An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.
- Fixed in Version: v0.27.0
- Code Suggestion:
  @@ -1,1 +1,1 @@ - golang.org/x/oauth2 vX.Y.Z + golang.org/x/oauth2 v0.27.0
Vulnerability 2
- Dependency Name: stdlib
- Dependency Version: None
- Vulnerability Name: GO-2025-3373
- Vulnerability Description: A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain.
- Fixed in Version: v1.23.5
- Code Suggestion:
  @@ -1,1 +1,1 @@ - go X.Y.Z + go 1.23.5
Vulnerability 3
- Dependency Name: stdlib
- Dependency Version: None
- Vulnerability Name: GO-2025-3420
- Vulnerability Description: The HTTP client drops sensitive headers after following a cross-domain redirect but incorrectly restores them for subsequent same-domain redirects.
- Fixed in Version: v1.23.5
- Code Suggestion:
  @@ -1,1 +1,1 @@ - go X.Y.Z + go 1.23.5
Vulnerability 4
- Dependency Name: stdlib
- Dependency Version: None
- Vulnerability Name: GO-2025-3447
- Vulnerability Description: Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture.
- Fixed in Version: v1.23.6
- Code Suggestion:
  @@ -1,1 +1,1 @@ - go X.Y.Z + go 1.23.6
Vulnerability 5
- Dependency Name: stdlib
- Dependency Version: None
- Vulnerability Name: GO-2025-3563
- Vulnerability Description: The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines, potentially allowing request smuggling.
- Fixed in Version: v1.23.8
- Code Suggestion:
  @@ -1,1 +1,1 @@ - go X.Y.Z + go 1.23.8
Vulnerability 6
- Dependency Name: golang.org/x/net
- Dependency Version: None
- Vulnerability Name: GO-2024-2687
- Vulnerability Description: An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames.
- Fixed in Version: v0.23.0
- Code Suggestion:
  @@ -1,1 +1,1 @@ - golang.org/x/net vX.Y.Z + golang.org/x/net v0.23.0
Vulnerability 7
- Dependency Name: golang.org/x/net
- Dependency Version: None
- Vulnerability Name: GO-2024-3333
- Vulnerability Description: An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing.
- Fixed in Version: v0.33.0
- Code Suggestion:
  @@ -1,1 +1,1 @@ - golang.org/x/net vX.Y.Z + golang.org/x/net v0.33.0
Vulnerability 8
- Dependency Name: golang.org/x/net
- Dependency Version: None
- Vulnerability Name: GO-2025-3503
- Vulnerability Description: Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component.
- Fixed in Version: v0.36.0
- Code Suggestion:
  @@ -1,1 +1,1 @@ - golang.org/x/net vX.Y.Z + golang.org/x/net v0.36.0
Vulnerability 9
- Dependency Name: golang.org/x/net
- Dependency Version: None
- Vulnerability Name: GO-2025-3595
- Vulnerability Description: The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing.
- Fixed in Version: v0.38.0
- Code Suggestion:
  @@ -1,1 +1,1 @@ - golang.org/x/net vX.Y.Z + golang.org/x/net v0.38.0
Vulnerability 10
- Dependency Name: google.golang.org/protobuf
- Dependency Version: None
- Vulnerability Name: GO-2024-2611
- Vulnerability Description: The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON.
- Fixed in Version: v1.33.0
- Code Suggestion:
  @@ -1,1 +1,1 @@ - google.golang.org/protobuf vX.Y.Z + google.golang.org/protobuf v1.33.0

Review Details

Files reviewed - 1 · Commit Range: 3f435a8..3f435a8
- go.mod
Files skipped - 1
- go.sum - Reason: Filter setting
Tools
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful
- SNYK (Security Vulnerability) - ✔︎ Successful
- GOVULNCHECK (Security Vulnerability) - ✔︎ Successful
- OWASP (Security Vulnerability) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers a full AI review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Default Agent You can customize the agent settings here or contact your Bito workspace admin at [email protected].

Documentation & Help

AI Code Review powered by

bito-code-review · 2025-06-05T05:24:11Z

Changelist by Bito

This pull request implements the following key changes.

Key Change	Files Impacted
Other Improvements - Dependency and Version Update	- `go.mod` - Updated Go version to 1.24.2, bumped github.com/jackpal/gateway to v1.1.1, added github.com/pmezard/go-difflib, replaced outdated testing dependencies with updated versions, and upgraded golang.org/x/net from v0.10.0 to v0.38.0.

dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jun 5, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump github.com/jackpal/gateway from 1.0.7 to 1.1.1 #40

Bump github.com/jackpal/gateway from 1.0.7 to 1.1.1 #40

Uh oh!

dependabot bot commented on behalf of github Jun 5, 2025 •

edited

Loading

Uh oh!

bito-code-review bot commented Jun 5, 2025 •

edited

Loading

Code Review Agent Run #1d3465

Uh oh!

bito-code-review bot commented Jun 5, 2025

Changelist by Bito

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Bump github.com/jackpal/gateway from 1.0.7 to 1.1.1 #40

Are you sure you want to change the base?

Bump github.com/jackpal/gateway from 1.0.7 to 1.1.1 #40

Uh oh!

Conversation

dependabot bot commented on behalf of github Jun 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.1.1

v1.1.0

v1.0.16

v1.0.15

v1.0.14

What's Changed

New Contributors

Fix compilation errors when cross-compiling to different OSs

Summary by Bito

Uh oh!

bito-code-review bot commented Jun 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #1d3465

Uh oh!

bito-code-review bot commented Jun 5, 2025

Changelist by Bito

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot bot commented on behalf of github Jun 5, 2025 •

edited

Loading

bito-code-review bot commented Jun 5, 2025 •

edited

Loading