Skip to content

Resolve dependency security alerts #358

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Resolve dependency security alerts #358

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a538d3a
Bump github.com/go-chi/chi/v5 from 5.2.4 to 5.4.0 in /cli
dependabot[bot] Oct 31, 2026
8120079
Regenerate notice metadata for chi update
Nov 4, 2026
c0ea525
Resolve dependency alerts and expand Dependabot coverage
Nov 4, 2026
df2b0a0
Retain existing Dependabot scope ahead of archival
Nov 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .notice-metadata.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
2552a3342cfa56d2e686501f7532fe24b302488755848f3bdc4cf8596887be4f cli/go.sum
b7647232c2ce866ce71738562ce67395f5b41c90d4051bf817dc8dd8a65d2e65 cli/go.sum
84eb410658549fcc9eeb7c33cd458c28d845ab174ef845fd47044625d5608769 server/ControlPlane/packages.lock.json
8a61e6fadd8f336d262161674d0ada617ba9e295047d097adddd4cab3e036f76 server/DataPlane/packages.lock.json
201d533615b833962d871e998a69367e6ec64aaa3871555054451f760a6bfd18 scripts/generate-notice.sh
4eba2aa3c634742cded43f32607109d4b5b899e67770e1cef8c480cca84f6152 NOTICE.txt
04304ebeb0025402ec1ef4c36ef62a125678d36f495369203f1b6689224e6e84 NOTICE.txt
630 changes: 414 additions & 216 deletions NOTICE.txt
View file
Open in desktop

Large diffs are not rendered by default.

14 changes: 6 additions & 8 deletions cli/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,16 +26,15 @@ require (
github.com/Masterminds/sprig/v3 v3.3.0
github.com/a8m/envsubst v1.4.3
github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883
github.com/containerd/errdefs v1.0.0
github.com/docker/cli v29.2.0+incompatible
github.com/docker/docker v28.5.2+incompatible
github.com/docker/go-connections v0.6.0
github.com/dustin/go-humanize v1.0.1
github.com/eiannone/keyboard v0.0.0-20220611211555-0d226195f203
github.com/erikgeiser/promptkit v0.9.0
github.com/fatih/color v1.18.0
github.com/fsnotify/fsnotify v1.9.0
github.com/getkin/kin-openapi v0.149.0
github.com/go-chi/chi/v5 v5.2.4
github.com/go-chi/chi/v5 v5.4.0
github.com/goccy/go-yaml v1.18.0
github.com/golang-jwt/jwt/v5 v5.3.0
github.com/google/uuid v1.6.0
Expand All @@ -45,6 +44,8 @@ require (
github.com/jackc/pgx/v5 v5.9.2
github.com/mattn/go-ieproxy v0.0.12
github.com/mittwald/go-helm-client v0.12.18
github.com/moby/moby/api v1.56.1
github.com/moby/moby/client v0.6.2
github.com/pkg/errors v0.9.1
github.com/psanford/memfs v0.0.0-20241019191636-4ef911798f9b
github.com/spf13/cobra v1.10.2
Expand All @@ -67,7 +68,7 @@ require (
require (
github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 // indirect
github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
github.com/Azure/go-ansiterm v0.0.0-20261006220739-8c912ac31dd4 // indirect
github.com/BurntSushi/toml v1.6.0 // indirect
github.com/MakeNowJust/heredoc v1.0.0 // indirect
github.com/Masterminds/goutils v1.1.1 // indirect
Expand All @@ -89,12 +90,12 @@ require (
github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd // indirect
github.com/charmbracelet/x/term v0.2.2 // indirect
github.com/containerd/containerd v1.7.36 // indirect
github.com/containerd/errdefs v1.0.0 // indirect
github.com/containerd/errdefs/pkg v0.3.0 // indirect
github.com/containerd/log v0.1.0 // indirect
github.com/containerd/platforms v0.2.1 // indirect
github.com/cyphar/filepath-securejoin v0.6.1 // indirect
github.com/distribution/reference v0.6.0 // indirect
github.com/docker/go-connections v0.8.2 // indirect
github.com/docker/go-units v0.5.0 // indirect
github.com/emicklei/go-restful/v3 v3.12.2 // indirect
github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
Expand Down Expand Up @@ -143,12 +144,10 @@ require (
github.com/mitchellh/reflectwalk v1.0.2 // indirect
github.com/moby/docker-image-spec v1.3.1 // indirect
github.com/moby/spdystream v0.5.1 // indirect
github.com/moby/sys/atomicwriter v0.1.0 // indirect
github.com/moby/term v0.5.2 // indirect
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
github.com/morikuni/aec v1.0.0 // indirect
github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
github.com/muesli/cancelreader v0.2.2 // indirect
github.com/muesli/reflow v0.3.0 // indirect
Expand Down Expand Up @@ -187,7 +186,6 @@ require (
google.golang.org/protobuf v1.36.11 // indirect
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
gotest.tools/v3 v3.4.0 // indirect
k8s.io/apiextensions-apiserver v0.35.1 // indirect
k8s.io/apiserver v0.35.1 // indirect
k8s.io/component-base v0.35.1 // indirect
Expand Down
54 changes: 16 additions & 38 deletions cli/go.sum
View file
Open in desktop

Large diffs are not rendered by default.

10 changes: 4 additions & 6 deletions cli/internal/cmd/run.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,8 +25,6 @@ import (

"github.com/alecthomas/units"
"github.com/docker/cli/cli/connhelper"
dockerimage "github.com/docker/docker/api/types/image"
dockerclient "github.com/docker/docker/client"
"github.com/dustin/go-humanize"
"github.com/google/uuid"
"github.com/hashicorp/go-cleanhttp"
Expand All @@ -36,6 +34,7 @@ import (
"github.com/microsoft/tyger/cli/internal/controlplane"
"github.com/microsoft/tyger/cli/internal/controlplane/model"
"github.com/microsoft/tyger/cli/internal/dataplane"
dockerclient "github.com/moby/moby/client"
"github.com/rs/zerolog/log"
"github.com/spf13/cobra"
"github.com/spf13/pflag"
Expand Down Expand Up @@ -1044,21 +1043,20 @@ func pullImages(ctx context.Context, newRun model.Run) error {
httpClient.Transport.(*http.Transport).DialContext = connhelper.Dialer

dockerClientOpt = []dockerclient.Opt{
dockerclient.WithAPIVersionNegotiation(),
dockerclient.WithHost(sshParams.URL().String()),
dockerclient.WithDialContext(connhelper.Dialer),
}
} else {
dockerClientOpt = []dockerclient.Opt{dockerclient.WithAPIVersionNegotiation(), dockerclient.FromEnv}
dockerClientOpt = []dockerclient.Opt{dockerclient.FromEnv}
}

dockerCli, err := dockerclient.NewClientWithOpts(dockerClientOpt...)
dockerCli, err := dockerclient.New(dockerClientOpt...)
if err != nil {
return fmt.Errorf("failed to create Docker client: %w", err)
}

for _, imageName := range imagesToPull {
out, err := dockerCli.ImagePull(context.Background(), imageName, dockerimage.PullOptions{})
out, err := dockerCli.ImagePull(context.Background(), imageName, dockerclient.ImagePullOptions{})
if err != nil {
return fmt.Errorf("failed to pull image %s: %w", imageName, err)
}
Expand Down
Loading
Loading