Skip to content

Commit 564e8ff

Browse files
paskalpaskal
authored
Update go dependencies (#1972)
1 parent b451142 commit 564e8ff

File tree

241 files changed

+18663
-2951
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

241 files changed

+18663
-2951
lines changed

‎.github/workflows/ci-build.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,13 @@ jobs:
4141
- name: available platforms
4242
run: echo ${{ steps.buildx.outputs.platforms }}
4343

44+
- name: free disk space
45+
run: |
46+
sudo rm -rf /usr/share/dotnet
47+
sudo rm -rf /opt/ghc
48+
sudo rm -rf /usr/local/share/boost
49+
docker system prune -af
50+
4451
- name: build docker image without pushing (only outside master)
4552
if: ${{ github.ref != 'refs/heads/master' }}
4653
run: |

‎backend/app/notify/email.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ import (
1010

1111
log "github.com/go-pkgz/lgr"
1212
ntf "github.com/go-pkgz/notify"
13-
"github.com/go-pkgz/repeater"
13+
"github.com/go-pkgz/repeater/v2"
1414
"github.com/hashicorp/go-multierror"
1515

1616
"github.com/umputun/remark42/backend/app/templates"
@@ -161,7 +161,7 @@ func (e *Email) buildAndSendMessage(ctx context.Context, req Request, email stri
161161
return err
162162
}
163163

164-
return repeater.NewDefault(5, time.Millisecond*250).Do(
164+
return repeater.NewFixed(5, time.Millisecond*250).Do(
165165
ctx,
166166
func() error {
167167
return e.Email.Send(
@@ -196,7 +196,7 @@ func (e *Email) SendVerification(ctx context.Context, req VerificationRequest) e
196196
return err
197197
}
198198

199-
return repeater.NewDefault(5, time.Millisecond*250).Do(
199+
return repeater.NewFixed(5, time.Millisecond*250).Do(
200200
ctx,
201201
func() error {
202202
return e.Email.Send(

‎backend/app/rest/api/rest.go‎

Lines changed: 26 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,8 @@ import (
1515
"sync"
1616
"time"
1717

18-
"github.com/didip/tollbooth/v7"
19-
"github.com/didip/tollbooth_chi"
18+
"github.com/didip/tollbooth/v8"
19+
"github.com/didip/tollbooth/v8/limiter"
2020
"github.com/go-chi/chi/v5"
2121
"github.com/go-chi/chi/v5/middleware"
2222
"github.com/go-chi/cors"
@@ -234,14 +234,14 @@ func (s *Rest) routes() chi.Router {
234234

235235
router.Group(func(r chi.Router) {
236236
r.Use(middleware.Timeout(5 * time.Second))
237-
r.Use(logInfoWithBody, tollbooth_chi.LimitHandler(tollbooth.NewLimiter(2, nil)), middleware.NoCache)
237+
r.Use(logInfoWithBody, rateLimiter(2), middleware.NoCache)
238238
r.Use(validEmailAuth()) // reject suspicious email logins
239239
r.Mount("/auth", authHandler)
240240
})
241241

242242
router.Group(func(r chi.Router) {
243243
r.Use(middleware.Timeout(5 * time.Second))
244-
r.Use(tollbooth_chi.LimitHandler(tollbooth.NewLimiter(100, nil)))
244+
r.Use(rateLimiter(100))
245245
r.Mount("/avatar", avatarHandler)
246246
})
247247

@@ -251,14 +251,14 @@ func (s *Rest) routes() chi.Router {
251251
router.Route("/api/v1", func(rapi chi.Router) {
252252
rapi.Group(func(rava chi.Router) {
253253
rava.Use(middleware.Timeout(5 * time.Second))
254-
rava.Use(tollbooth_chi.LimitHandler(tollbooth.NewLimiter(100, nil)))
254+
rava.Use(rateLimiter(100))
255255
rava.Mount("/avatar", avatarHandler)
256256
})
257257

258258
// open routes
259259
rapi.Group(func(ropen chi.Router) {
260260
ropen.Use(middleware.Timeout(30 * time.Second))
261-
ropen.Use(tollbooth_chi.LimitHandler(tollbooth.NewLimiter(s.openRouteLimiter, nil)))
261+
ropen.Use(rateLimiter(s.openRouteLimiter))
262262
ropen.Use(authMiddleware.Trace, middleware.NoCache, logInfoWithBody)
263263
ropen.Get("/config", s.configCtrl)
264264
ropen.Get("/find", s.pubRest.findCommentsCtrl)
@@ -281,7 +281,7 @@ func (s *Rest) routes() chi.Router {
281281
// open routes, cached
282282
rapi.Group(func(ropen chi.Router) {
283283
ropen.Use(middleware.Timeout(30 * time.Second))
284-
ropen.Use(tollbooth_chi.LimitHandler(tollbooth.NewLimiter(10, nil)))
284+
ropen.Use(rateLimiter(10))
285285
ropen.Use(authMiddleware.Trace, logInfoWithBody)
286286
ropen.Get("/picture/{user}/{id}", s.pubRest.loadPictureCtrl)
287287
ropen.Get("/qr/telegram", s.pubRest.telegramQrCtrl)
@@ -290,7 +290,7 @@ func (s *Rest) routes() chi.Router {
290290
// protected routes, require auth
291291
rapi.Group(func(rauth chi.Router) {
292292
rauth.Use(middleware.Timeout(30 * time.Second))
293-
rauth.Use(tollbooth_chi.LimitHandler(tollbooth.NewLimiter(10, nil)))
293+
rauth.Use(rateLimiter(10))
294294
rauth.Use(authMiddleware.Auth, matchSiteID, middleware.NoCache, logInfoWithBody)
295295
rauth.Get("/user", s.privRest.userInfoCtrl)
296296
rauth.Get("/userdata", s.privRest.userAllDataCtrl)
@@ -299,7 +299,7 @@ func (s *Rest) routes() chi.Router {
299299
// admin routes, require auth and admin users only
300300
rapi.Route("/admin", func(radmin chi.Router) {
301301
radmin.Use(middleware.Timeout(30 * time.Second))
302-
radmin.Use(tollbooth_chi.LimitHandler(tollbooth.NewLimiter(10, nil)))
302+
radmin.Use(rateLimiter(10))
303303
radmin.Use(authMiddleware.Auth, authMiddleware.AdminOnly, matchSiteID)
304304
radmin.Use(middleware.NoCache, logInfoWithBody)
305305

@@ -325,7 +325,7 @@ func (s *Rest) routes() chi.Router {
325325
// protected routes, throttled to 10/s by default, controlled by external UpdateLimiter param
326326
rapi.Group(func(rauth chi.Router) {
327327
rauth.Use(middleware.Timeout(10 * time.Second))
328-
rauth.Use(tollbooth_chi.LimitHandler(tollbooth.NewLimiter(s.updateLimiter(), nil)))
328+
rauth.Use(rateLimiter(s.updateLimiter()))
329329
rauth.Use(authMiddleware.Auth, matchSiteID, subscribersOnly(s.SubscribersOnly))
330330
rauth.Use(middleware.NoCache, logInfoWithBody)
331331

@@ -345,7 +345,7 @@ func (s *Rest) routes() chi.Router {
345345
// protected routes, anonymous rejected
346346
rapi.Group(func(rauth chi.Router) {
347347
rauth.Use(middleware.Timeout(10 * time.Second))
348-
rauth.Use(tollbooth_chi.LimitHandler(tollbooth.NewLimiter(s.updateLimiter(), nil)))
348+
rauth.Use(rateLimiter(s.updateLimiter()))
349349
rauth.Use(authMiddleware.Auth, rejectAnonUser, matchSiteID)
350350
rauth.Use(logger.New(logger.Log(log.Default()), logger.Prefix("[DEBUG]"), logger.IPfn(ipFn)).Handler)
351351
rauth.Post("/picture", s.privRest.savePictureCtrl)
@@ -355,7 +355,7 @@ func (s *Rest) routes() chi.Router {
355355
// open routes on root level
356356
router.Group(func(rroot chi.Router) {
357357
rroot.Use(middleware.Timeout(10 * time.Second))
358-
rroot.Use(tollbooth_chi.LimitHandler(tollbooth.NewLimiter(50, nil)))
358+
rroot.Use(rateLimiter(50))
359359
rroot.Get("/robots.txt", s.pubRest.robotsCtrl)
360360
rroot.Get("/email/unsubscribe.html", s.privRest.emailUnsubscribeCtrl)
361361
rroot.Post("/email/unsubscribe.html", s.privRest.emailUnsubscribeCtrl)
@@ -491,7 +491,7 @@ func addFileServer(r chi.Router, embedFS embed.FS, webRoot, version string) {
491491
webFS = http.StripPrefix("/web", webFS)
492492
r.Get("/web", http.RedirectHandler("/web/", http.StatusMovedPermanently).ServeHTTP)
493493

494-
r.With(tollbooth_chi.LimitHandler(tollbooth.NewLimiter(20, nil)),
494+
r.With(rateLimiter(20),
495495
middleware.Timeout(10*time.Second),
496496
cacheControl(time.Hour, version),
497497
).Get("/web/*", func(w http.ResponseWriter, r *http.Request) {
@@ -728,3 +728,16 @@ func parseError(err error, defaultCode int) (code int) {
728728

729729
return code
730730
}
731+
732+
// rateLimiter creates a rate limiting middleware with proper IP lookup configuration.
733+
// tollbooth v8 requires explicit IP lookup method to be set.
734+
// uses RemoteAddr which is set by chi's middleware.RealIP to the real client IP
735+
// from X-Forwarded-For, X-Real-IP, or True-Client-IP headers.
736+
func rateLimiter(maxReq float64) func(http.Handler) http.Handler {
737+
lmt := tollbooth.NewLimiter(maxReq, nil)
738+
lmt.SetIPLookup(limiter.IPLookup{
739+
Name: "RemoteAddr",
740+
IndexFromRight: 0,
741+
})
742+
return tollbooth.HTTPMiddleware(lmt)
743+
}

‎backend/app/rest/proxy/image.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ import (
1212

1313
"github.com/PuerkitoBio/goquery"
1414
log "github.com/go-pkgz/lgr"
15-
"github.com/go-pkgz/repeater"
15+
"github.com/go-pkgz/repeater/v2"
1616

1717
"github.com/umputun/remark42/backend/app/rest"
1818
"github.com/umputun/remark42/backend/app/store/image"
@@ -151,7 +151,7 @@ func (p Image) downloadImage(ctx context.Context, imgURL string) ([]byte, error)
151151
client := http.Client{Timeout: 30 * time.Second}
152152
defer client.CloseIdleConnections()
153153
var resp *http.Response
154-
err := repeater.NewDefault(5, time.Second).Do(ctx, func() error {
154+
err := repeater.NewFixed(5, time.Second).Do(ctx, func() error {
155155
var e error
156156
req, e := http.NewRequest("GET", imgURL, http.NoBody)
157157
if e != nil {

‎backend/go.mod‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -6,16 +6,15 @@ require (
66
github.com/Depado/bfchroma/v2 v2.0.0
77
github.com/PuerkitoBio/goquery v1.11.0
88
github.com/alecthomas/chroma/v2 v2.20.0
9-
github.com/didip/tollbooth/v7 v7.0.2
10-
github.com/didip/tollbooth_chi v0.0.0-20220719025231-d662a7f6928f
9+
github.com/didip/tollbooth/v8 v8.0.1
1110
github.com/go-chi/chi/v5 v5.2.3
1211
github.com/go-chi/cors v1.2.2
13-
github.com/go-pkgz/auth/v2 v2.0.1-0.20250415030422-4f9f2c5e3b0d
12+
github.com/go-pkgz/auth/v2 v2.1.0
1413
github.com/go-pkgz/jrpc v0.4.0
1514
github.com/go-pkgz/lcw/v2 v2.0.0
1615
github.com/go-pkgz/lgr v0.12.1
17-
github.com/go-pkgz/notify v1.2.0
18-
github.com/go-pkgz/repeater v1.2.0
16+
github.com/go-pkgz/notify v1.3.0
17+
github.com/go-pkgz/repeater/v2 v2.2.0
1918
github.com/go-pkgz/rest v1.20.4
2019
github.com/go-pkgz/syncs v1.3.2
2120
github.com/golang-jwt/jwt/v5 v5.3.0
@@ -37,35 +36,36 @@ require (
3736
)
3837

3938
require (
40-
cloud.google.com/go/compute/metadata v0.6.0 // indirect
39+
cloud.google.com/go/compute/metadata v0.9.0 // indirect
4140
github.com/andybalholm/cascadia v1.3.3 // indirect
4241
github.com/aymerick/douceur v0.2.0 // indirect
4342
github.com/cespare/xxhash/v2 v2.3.0 // indirect
4443
github.com/davecgh/go-spew v1.1.1 // indirect
4544
github.com/dghubble/oauth1 v0.7.3 // indirect
4645
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
4746
github.com/dlclark/regexp2 v1.11.5 // indirect
48-
github.com/go-oauth2/oauth2/v4 v4.5.3 // indirect
49-
github.com/go-pkgz/email v0.5.0 // indirect
50-
github.com/go-pkgz/expirable-cache/v3 v3.0.0 // indirect
47+
github.com/go-oauth2/oauth2/v4 v4.5.4 // indirect
48+
github.com/go-pkgz/email v0.6.0 // indirect
49+
github.com/go-pkgz/expirable-cache/v3 v3.1.0 // indirect
50+
github.com/go-pkgz/repeater v1.2.0 // indirect
5151
github.com/go-pkgz/routegroup v1.6.0 // indirect
5252
github.com/golang/snappy v1.0.0 // indirect
5353
github.com/gorilla/css v1.0.1 // indirect
5454
github.com/gorilla/websocket v1.5.3 // indirect
5555
github.com/hashicorp/errwrap v1.1.0 // indirect
5656
github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
57-
github.com/klauspost/compress v1.18.0 // indirect
57+
github.com/klauspost/compress v1.18.2 // indirect
5858
github.com/montanaflynn/stats v0.7.1 // indirect
5959
github.com/pmezard/go-difflib v1.0.0 // indirect
60-
github.com/redis/go-redis/v9 v9.7.3 // indirect
60+
github.com/redis/go-redis/v9 v9.17.2 // indirect
6161
github.com/rrivera/identicon v0.0.0-20240116195454-d5ba35832c0d // indirect
62-
github.com/slack-go/slack v0.15.0 // indirect
62+
github.com/slack-go/slack v0.17.3 // indirect
6363
github.com/xdg-go/pbkdf2 v1.0.0 // indirect
64-
github.com/xdg-go/scram v1.1.2 // indirect
64+
github.com/xdg-go/scram v1.2.0 // indirect
6565
github.com/xdg-go/stringprep v1.0.4 // indirect
6666
github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
67-
go.mongodb.org/mongo-driver v1.17.3 // indirect
68-
golang.org/x/oauth2 v0.29.0 // indirect
67+
go.mongodb.org/mongo-driver v1.17.6 // indirect
68+
golang.org/x/oauth2 v0.33.0 // indirect
6969
golang.org/x/sync v0.18.0 // indirect
7070
golang.org/x/sys v0.38.0 // indirect
7171
golang.org/x/text v0.31.0 // indirect

0 commit comments

Comments
 (0)