Skip to content

Commit 5b052ed

Browse files
rjtokenringrjtokenring
authored
Security fixes (#147)
* Lib upgrade * upgraded grpc * fixed dependency licenses * go upgrade * Updated license manually * Removing license
1 parent 8b24197 commit 5b052ed

File tree

138 files changed

+1730
-588
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

138 files changed

+1730
-588
lines changed

Diff for: ‎.github/workflows/check-dependencies-task.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ name: Check Dependencies
33

44
env:
55
# See: https://github.com/actions/setup-go/tree/v2#readme
6-
GO_VERSION: "1.17"
6+
GO_VERSION: "1.19"
77

88
# See: https://docs.github.com/en/actions/reference/events-that-trigger-workflows
99
on:

Diff for: ‎.github/workflows/test-go-task.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ name: Test Go
33

44
env:
55
# See: https://github.com/actions/setup-go/tree/v2#readme
6-
GO_VERSION: "1.17"
6+
GO_VERSION: "1.19"
77

88
# See: https://docs.github.com/en/free-pro-team@latest/actions/reference/events-that-trigger-workflows
99
on:

Diff for: ‎.licensed.yml

+3
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,9 @@ reviewed:
33
go:
44
- golang.org/x/crypto/curve25519/internal/field
55
- golang.org/x/crypto/internal/poly1305
6+
- golang.org/x/crypto/curve25519
7+
- google.golang.org/protobuf/encoding/protojson
8+
- google.golang.org/protobuf/internal/encoding/json
69

710
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies/AGPL-3.0/.licensed.yml
811
allowed:

Diff for: ‎.licenses/go/github.com/emirpasic/gods/containers.dep.yml

+3-4
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,12 @@
11
---
22
name: github.com/emirpasic/gods/containers
3-
version: v1.12.0
3+
version: v1.18.1
44
type: go
55
summary: Package containers provides core interfaces and functions for data structures.
66
homepage: https://pkg.go.dev/github.com/emirpasic/gods/containers
7-
# The code is licensed as BSD-2-Clause except for trees/avltree/avrtree.go and trees/avltree/iterator.go
87
license: bsd-2-clause
98
licenses:
10-
- sources: gods@v1.12.0/LICENSE
9+
- sources: gods@v1.18.1/LICENSE
1110
text: |
1211
Copyright (c) 2015, Emir Pasic
1312
All rights reserved.
@@ -50,7 +49,7 @@ licenses:
5049
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
5150
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
5251
OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
53-
- sources: gods@v1.12.0/README.md
52+
- sources: gods@v1.18.1/README.md
5453
text: This library is distributed under the BSD-style license found in the [LICENSE](https://github.com/emirpasic/gods/blob/master/LICENSE)
5554
file.
5655
notices: []

Diff for: ‎.licenses/go/github.com/emirpasic/gods/lists.dep.yml

+3-4
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,12 @@
11
---
22
name: github.com/emirpasic/gods/lists
3-
version: v1.12.0
3+
version: v1.18.1
44
type: go
55
summary: Package lists provides an abstract List interface.
66
homepage: https://pkg.go.dev/github.com/emirpasic/gods/lists
7-
# The code is licensed as BSD-2-Clause except for trees/avltree/avrtree.go and trees/avltree/iterator.go
87
license: bsd-2-clause
98
licenses:
10-
- sources: gods@v1.12.0/LICENSE
9+
- sources: gods@v1.18.1/LICENSE
1110
text: |
1211
Copyright (c) 2015, Emir Pasic
1312
All rights reserved.
@@ -50,7 +49,7 @@ licenses:
5049
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
5150
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
5251
OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
53-
- sources: gods@v1.12.0/README.md
52+
- sources: gods@v1.18.1/README.md
5453
text: This library is distributed under the BSD-style license found in the [LICENSE](https://github.com/emirpasic/gods/blob/master/LICENSE)
5554
file.
5655
notices: []

Diff for: ‎.licenses/go/github.com/emirpasic/gods/lists/arraylist.dep.yml

+3-4
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,12 @@
11
---
22
name: github.com/emirpasic/gods/lists/arraylist
3-
version: v1.12.0
3+
version: v1.18.1
44
type: go
55
summary: Package arraylist implements the array list.
66
homepage: https://pkg.go.dev/github.com/emirpasic/gods/lists/arraylist
7-
# The code is licensed as BSD-2-Clause except for trees/avltree/avrtree.go and trees/avltree/iterator.go
87
license: bsd-2-clause
98
licenses:
10-
- sources: gods@v1.12.0/LICENSE
9+
- sources: gods@v1.18.1/LICENSE
1110
text: |
1211
Copyright (c) 2015, Emir Pasic
1312
All rights reserved.
@@ -50,7 +49,7 @@ licenses:
5049
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
5150
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
5251
OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
53-
- sources: gods@v1.12.0/README.md
52+
- sources: gods@v1.18.1/README.md
5453
text: This library is distributed under the BSD-style license found in the [LICENSE](https://github.com/emirpasic/gods/blob/master/LICENSE)
5554
file.
5655
notices: []

Diff for: ‎.licenses/go/github.com/emirpasic/gods/trees.dep.yml

+3-4
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,12 @@
11
---
22
name: github.com/emirpasic/gods/trees
3-
version: v1.12.0
3+
version: v1.18.1
44
type: go
55
summary: Package trees provides an abstract Tree interface.
66
homepage: https://pkg.go.dev/github.com/emirpasic/gods/trees
7-
# The code is licensed as BSD-2-Clause except for trees/avltree/avrtree.go and trees/avltree/iterator.go
87
license: bsd-2-clause
98
licenses:
10-
- sources: gods@v1.12.0/LICENSE
9+
- sources: gods@v1.18.1/LICENSE
1110
text: |
1211
Copyright (c) 2015, Emir Pasic
1312
All rights reserved.
@@ -50,7 +49,7 @@ licenses:
5049
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
5150
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
5251
OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
53-
- sources: gods@v1.12.0/README.md
52+
- sources: gods@v1.18.1/README.md
5453
text: This library is distributed under the BSD-style license found in the [LICENSE](https://github.com/emirpasic/gods/blob/master/LICENSE)
5554
file.
5655
notices: []

Diff for: ‎.licenses/go/github.com/emirpasic/gods/trees/binaryheap.dep.yml

+3-4
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,12 @@
11
---
22
name: github.com/emirpasic/gods/trees/binaryheap
3-
version: v1.12.0
3+
version: v1.18.1
44
type: go
55
summary: Package binaryheap implements a binary heap backed by array list.
66
homepage: https://pkg.go.dev/github.com/emirpasic/gods/trees/binaryheap
7-
# The code is licensed as BSD-2-Clause except for trees/avltree/avrtree.go and trees/avltree/iterator.go
87
license: bsd-2-clause
98
licenses:
10-
- sources: gods@v1.12.0/LICENSE
9+
- sources: gods@v1.18.1/LICENSE
1110
text: |
1211
Copyright (c) 2015, Emir Pasic
1312
All rights reserved.
@@ -50,7 +49,7 @@ licenses:
5049
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
5150
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
5251
OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
53-
- sources: gods@v1.12.0/README.md
52+
- sources: gods@v1.18.1/README.md
5453
text: This library is distributed under the BSD-style license found in the [LICENSE](https://github.com/emirpasic/gods/blob/master/LICENSE)
5554
file.
5655
notices: []

Diff for: ‎.licenses/go/github.com/emirpasic/gods/utils.dep.yml

+3-4
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,12 @@
11
---
22
name: github.com/emirpasic/gods/utils
3-
version: v1.12.0
3+
version: v1.18.1
44
type: go
55
summary: Package utils provides common utility functions.
66
homepage: https://pkg.go.dev/github.com/emirpasic/gods/utils
7-
# The code is licensed as BSD-2-Clause except for trees/avltree/avrtree.go and trees/avltree/iterator.go
87
license: bsd-2-clause
98
licenses:
10-
- sources: gods@v1.12.0/LICENSE
9+
- sources: gods@v1.18.1/LICENSE
1110
text: |
1211
Copyright (c) 2015, Emir Pasic
1312
All rights reserved.
@@ -50,7 +49,7 @@ licenses:
5049
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
5150
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
5251
OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
53-
- sources: gods@v1.12.0/README.md
52+
- sources: gods@v1.18.1/README.md
5453
text: This library is distributed under the BSD-style license found in the [LICENSE](https://github.com/emirpasic/gods/blob/master/LICENSE)
5554
file.
5655
notices: []

Diff for: ‎.licenses/go/github.com/golang/protobuf/jsonpb.dep.yml

+41
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
---
2+
name: github.com/golang/protobuf/jsonpb
3+
version: v1.5.3
4+
type: go
5+
summary: Package jsonpb provides functionality to marshal and unmarshal between a
6+
protocol buffer message and JSON.
7+
homepage: https://pkg.go.dev/github.com/golang/protobuf/jsonpb
8+
license: bsd-3-clause
9+
licenses:
10+
- sources: [email protected]/LICENSE
11+
text: |+
12+
Copyright 2010 The Go Authors. All rights reserved.
13+
14+
Redistribution and use in source and binary forms, with or without
15+
modification, are permitted provided that the following conditions are
16+
met:
17+
18+
* Redistributions of source code must retain the above copyright
19+
notice, this list of conditions and the following disclaimer.
20+
* Redistributions in binary form must reproduce the above
21+
copyright notice, this list of conditions and the following disclaimer
22+
in the documentation and/or other materials provided with the
23+
distribution.
24+
* Neither the name of Google Inc. nor the names of its
25+
contributors may be used to endorse or promote products derived from
26+
this software without specific prior written permission.
27+
28+
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
29+
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
30+
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
31+
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
32+
OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
33+
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
34+
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
35+
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
36+
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
37+
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
38+
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
39+
40+
notices: []
41+
...

Diff for: ‎.licenses/go/github.com/golang/protobuf/proto.dep.yml

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
---
22
name: github.com/golang/protobuf/proto
3-
version: v1.5.2
3+
version: v1.5.3
44
type: go
55
summary: Package proto provides functionality for handling protocol buffer messages.
66
homepage: https://pkg.go.dev/github.com/golang/protobuf/proto
77
license: bsd-3-clause
88
licenses:
9-
- sources: [email protected].2/LICENSE
9+
- sources: [email protected].3/LICENSE
1010
text: |+
1111
Copyright 2010 The Go Authors. All rights reserved.
1212
@@ -37,3 +37,4 @@ licenses:
3737
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
3838
3939
notices: []
40+
...

Diff for: ‎.licenses/go/github.com/golang/protobuf/ptypes.dep.yml

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
---
22
name: github.com/golang/protobuf/ptypes
3-
version: v1.5.2
3+
version: v1.5.3
44
type: go
55
summary: Package ptypes provides functionality for interacting with well-known types.
66
homepage: https://pkg.go.dev/github.com/golang/protobuf/ptypes
77
license: bsd-3-clause
88
licenses:
9-
- sources: [email protected].2/LICENSE
9+
- sources: [email protected].3/LICENSE
1010
text: |+
1111
Copyright 2010 The Go Authors. All rights reserved.
1212
@@ -37,3 +37,4 @@ licenses:
3737
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
3838
3939
notices: []
40+
...

Diff for: ‎.licenses/go/github.com/golang/protobuf/ptypes/any.dep.yml

+4-3
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
---
22
name: github.com/golang/protobuf/ptypes/any
3-
version: v1.5.2
3+
version: v1.5.3
44
type: go
5-
summary:
5+
summary:
66
homepage: https://pkg.go.dev/github.com/golang/protobuf/ptypes/any
77
license: bsd-3-clause
88
licenses:
9-
- sources: [email protected].2/LICENSE
9+
- sources: [email protected].3/LICENSE
1010
text: |+
1111
Copyright 2010 The Go Authors. All rights reserved.
1212
@@ -37,3 +37,4 @@ licenses:
3737
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
3838
3939
notices: []
40+
...

Diff for: ‎.licenses/go/github.com/golang/protobuf/ptypes/duration.dep.yml

+4-3
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
---
22
name: github.com/golang/protobuf/ptypes/duration
3-
version: v1.5.2
3+
version: v1.5.3
44
type: go
5-
summary:
5+
summary:
66
homepage: https://pkg.go.dev/github.com/golang/protobuf/ptypes/duration
77
license: bsd-3-clause
88
licenses:
9-
- sources: [email protected].2/LICENSE
9+
- sources: [email protected].3/LICENSE
1010
text: |+
1111
Copyright 2010 The Go Authors. All rights reserved.
1212
@@ -37,3 +37,4 @@ licenses:
3737
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
3838
3939
notices: []
40+
...

Diff for: ‎.licenses/go/github.com/golang/protobuf/ptypes/timestamp.dep.yml

+4-3
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
---
22
name: github.com/golang/protobuf/ptypes/timestamp
3-
version: v1.5.2
3+
version: v1.5.3
44
type: go
5-
summary:
5+
summary:
66
homepage: https://pkg.go.dev/github.com/golang/protobuf/ptypes/timestamp
77
license: bsd-3-clause
88
licenses:
9-
- sources: [email protected].2/LICENSE
9+
- sources: [email protected].3/LICENSE
1010
text: |+
1111
Copyright 2010 The Go Authors. All rights reserved.
1212
@@ -37,3 +37,4 @@ licenses:
3737
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
3838
3939
notices: []
40+
...

Diff for: ‎.licenses/go/github.com/kevinburke/ssh_config.dep.yml

+4-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
name: github.com/kevinburke/ssh_config
3-
version: v1.1.0
3+
version: v1.2.0
44
type: go
55
summary: Package ssh_config provides tools for manipulating SSH config files.
66
homepage: https://pkg.go.dev/github.com/kevinburke/ssh_config
@@ -60,9 +60,12 @@ licenses:
6060
notices:
6161
- sources: AUTHORS.txt
6262
text: |-
63+
Carlos A Becker <[email protected]>
64+
Dustin Spicuzza <[email protected]>
6365
Eugene Terentev <[email protected]>
6466
Kevin Burke <[email protected]>
6567
Mark Nevill <[email protected]>
68+
Scott Lessans <[email protected]>
6669
Sergey Lukjanov <[email protected]>
6770
Wayne Ashley Berry <[email protected]>
6871
santosh653 <[email protected]>

Diff for: ‎.licenses/go/github.com/sergi/go-diff/diffmatchpatch.dep.yml

+3-5
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,13 @@
11
---
22
name: github.com/sergi/go-diff/diffmatchpatch
3-
version: v1.2.0
3+
version: v1.3.1
44
type: go
55
summary: Package diffmatchpatch offers robust algorithms to perform the operations
66
required for synchronizing plain text.
77
homepage: https://pkg.go.dev/github.com/sergi/go-diff/diffmatchpatch
8-
# Apache-2.0 subsumes MIT
9-
# https://www.gnu.org/licenses/license-compatibility.html#combining
108
license: apache-2.0
119
licenses:
12-
- sources: go-diff@v1.2.0/LICENSE
10+
- sources: go-diff@v1.3.1/LICENSE
1311
text: |+
1412
Copyright (c) 2012-2016 The go-diff Authors. All rights reserved.
1513
@@ -31,7 +29,7 @@ licenses:
3129
FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
3230
DEALINGS IN THE SOFTWARE.
3331
34-
- sources: go-diff@v1.2.0/APACHE-LICENSE-2.0
32+
- sources: go-diff@v1.3.1/APACHE-LICENSE-2.0
3533
text: |2
3634
3735
Apache License

Diff for: ‎.licenses/go/github.com/sirupsen/logrus.dep.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
name: github.com/sirupsen/logrus
3-
version: v1.8.1
3+
version: v1.9.0
44
type: go
55
summary: Package logrus is a structured logger for Go, completely API compatible with
66
the standard library logger.

Diff for: ‎.licenses/go/github.com/xanzy/ssh-agent.dep.yml

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
---
22
name: github.com/xanzy/ssh-agent
3-
version: v0.3.1
3+
version: v0.3.3
44
type: go
5-
summary:
5+
summary:
66
homepage: https://pkg.go.dev/github.com/xanzy/ssh-agent
77
license: apache-2.0
88
licenses:
@@ -216,3 +216,4 @@ licenses:
216216
Version 2.0 (the "License"); you may not use this file except in compliance with
217217
the License. You may obtain a copy of the License at <http://www.apache.org/licenses/LICENSE-2.0>
218218
notices: []
219+
...

0 commit comments

Comments
 (0)