basepeak-ai/gptscript
Watch
6
0
Fork
You've already forked gptscript
 0
Code Issues 1 Pull requests 1 Projects Releases 3 Packages Wiki Activity Actions 5

fix(deps): bump modules to clear known vulns #21

Merged
thklein merged 1 commit from fix/deps-vulns into main 2026-10-18 10:24:22 +00:00
Conversation 1 Commits 1 Files changed 7 +130 -135
thklein commented 2026-10-18 08:57:45 +00:00
Owner
Copy link

Summary

Clears every vulnerability that govulncheck reports as reachable, before the repo is made public.

  • go directive 1.26.3 -> 1.26.9 (latest go1.26 patch). CI setup-go pinned to 1.26.9; release.yaml already uses go-version-file: go.mod.
  • Security bumps: golang.org/x/net v0.52.0 -> v0.61.0, golang.org/x/crypto v0.49.0 -> v0.58.0, go-git/go-git/v5 v5.16.3 -> v5.19.3, go-git/go-billy/v5 v5.6.2 -> v5.9.2, yuin/goldmark v1.7.13 -> v1.8.6, cloudflare/circl v1.6.1 -> v1.6.5, klauspost/compress v1.18.2 -> v1.20.3.
  • getkin/kin-openapi v0.132.0 -> v0.151.0. Its advisories were not reachable, but it was the only open item left. It needed one code change: Schema.ExclusiveMin/ExclusiveMax are now an ExclusiveBound type. pkg/loader/openapi.go reads the OpenAPI 3.0 boolean through IsTrue(), so 3.0 behaviour is the same as before, and it now also maps the 3.1 numeric form.
  • Low-risk patch/minor bumps of direct deps: docker/cli, fatih/color, autogold, mcp go-sdk 1.8.0, rs/cors, samber/lo, logrus, cobra, pflag, testify, gjson, x/sync, x/term, gotest.tools.
  • Not bumped: the basepeak-ai/* modules (handled in sibling PRs), docker-credential-helpers (v0 minor), html2text, tiktoken-go-loader.

govulncheck (~/go/bin/govulncheck ./..., built with go1.26)

Before (main @ 77d3fcb, go1.26.3):

Your code is affected by 46 vulnerabilities from 6 modules and the Go standard library.
This scan also found 14 vulnerabilities in packages you import and 13
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.

(x/net 11, x/crypto 9, go-git 10, go-billy 2, goldmark 1, circl 1, stdlib 18)

After (go1.26.9):

Your code is affected by 0 vulnerabilities.
This scan also found 0 vulnerabilities in packages you import and 1
vulnerability in modules you require, but your code doesn't appear to call these
vulnerabilities.

The one left is GO-2026-5932 in golang.org/x/crypto@v0.58.0. No fixed version exists yet ("Fixed in: N/A").

Verification

  • go mod tidy, go build ./... and go vet ./... pass. make gen-docs produces no diff.
  • golangci-lint run: 32 issues, the same count and categories as main (29 pre-existing gofmt import-order issues, 1 govet, 2 staticcheck). Nothing new.
  • go test ./... fails in the same tests on main and on this branch:
    • pkg/loader/github: TestLoad, TestLoad_GithubEnterprise (they expect raw.githubusercontent URLs)
    • pkg/tests: TestMCPLoad times out after 10m; TestCredentialExpirationEnv, TestGPTScriptCredential, TestStackedCredentialContexts also fail
    • integration: needs a built binary or LLM keys
## Summary Clears every vulnerability that `govulncheck` reports as reachable, before the repo is made public. - `go` directive `1.26.3` -> `1.26.9` (latest go1.26 patch). CI `setup-go` pinned to `1.26.9`; `release.yaml` already uses `go-version-file: go.mod`. - Security bumps: `golang.org/x/net` v0.52.0 -> v0.61.0, `golang.org/x/crypto` v0.49.0 -> v0.58.0, `go-git/go-git/v5` v5.16.3 -> v5.19.3, `go-git/go-billy/v5` v5.6.2 -> v5.9.2, `yuin/goldmark` v1.7.13 -> v1.8.6, `cloudflare/circl` v1.6.1 -> v1.6.5, `klauspost/compress` v1.18.2 -> v1.20.3. - `getkin/kin-openapi` v0.132.0 -> v0.151.0. Its advisories were not reachable, but it was the only open item left. It needed one code change: `Schema.ExclusiveMin/ExclusiveMax` are now an `ExclusiveBound` type. `pkg/loader/openapi.go` reads the OpenAPI 3.0 boolean through `IsTrue()`, so 3.0 behaviour is the same as before, and it now also maps the 3.1 numeric form. - Low-risk patch/minor bumps of direct deps: docker/cli, fatih/color, autogold, mcp go-sdk 1.8.0, rs/cors, samber/lo, logrus, cobra, pflag, testify, gjson, x/sync, x/term, gotest.tools. - Not bumped: the `basepeak-ai/*` modules (handled in sibling PRs), `docker-credential-helpers` (v0 minor), `html2text`, `tiktoken-go-loader`. ## govulncheck (`~/go/bin/govulncheck ./...`, built with go1.26) Before (main @ 77d3fcb, go1.26.3): ``` Your code is affected by 46 vulnerabilities from 6 modules and the Go standard library. This scan also found 14 vulnerabilities in packages you import and 13 vulnerabilities in modules you require, but your code doesn't appear to call these vulnerabilities. ``` (x/net 11, x/crypto 9, go-git 10, go-billy 2, goldmark 1, circl 1, stdlib 18) After (go1.26.9): ``` Your code is affected by 0 vulnerabilities. This scan also found 0 vulnerabilities in packages you import and 1 vulnerability in modules you require, but your code doesn't appear to call these vulnerabilities. ``` The one left is GO-2026-5932 in `golang.org/x/crypto@v0.58.0`. No fixed version exists yet ("Fixed in: N/A"). ## Verification - `go mod tidy`, `go build ./...` and `go vet ./...` pass. `make gen-docs` produces no diff. - `golangci-lint run`: 32 issues, the same count and categories as main (29 pre-existing gofmt import-order issues, 1 govet, 2 staticcheck). Nothing new. - `go test ./...` fails in the same tests on main and on this branch: - `pkg/loader/github`: `TestLoad`, `TestLoad_GithubEnterprise` (they expect raw.githubusercontent URLs) - `pkg/tests`: `TestMCPLoad` times out after 10m; `TestCredentialExpirationEnv`, `TestGPTScriptCredential`, `TestStackedCredentialContexts` also fail - `integration`: needs a built binary or LLM keys
fix(deps): bump modules to clear known vulns
Some checks failed
integration / integration (windows-latest) (pull_request) Waiting to run
Details
test / test (windows-latest) (pull_request) Waiting to run
Details
smoke / check-label (pull_request_target) Failing after 2s
Details
smoke / gpt-4o-2024-08-06 (pull_request_target) Has been skipped
Details
smoke / gpt-4o-mini-2024-07-18 (pull_request_target) Has been skipped
Details
smoke / claude-3-7-sonnet-20250219 (pull_request_target) Has been skipped
Details
Validate docs build / validate-docs (pull_request) Failing after 10s
Details
integration / integration (ubuntu-22.04) (pull_request) Failing after 12s
Details
test / test (ubuntu-22.04) (pull_request) Failing after 13s
Details
caf7bca819
 
govulncheck reported 46 reachable vulnerabilities in golang.org/x/net,
golang.org/x/crypto, go-git, go-billy, goldmark, circl and the Go
standard library. Bump those modules and move the go directive and CI
toolchains to go1.26.9.

Also take low-risk patch/minor bumps of direct dependencies, plus
kin-openapi (unreachable advisories) and klauspost/compress. kin-openapi
changed exclusiveMinimum/exclusiveMaximum to an ExclusiveBound type, so
the OpenAPI loader now reads the 3.0 boolean via IsTrue() and also maps
the 3.1 numeric form.
thklein commented 2026-10-18 09:11:06 +00:00
Author
Owner
Copy link

CI check: every failing job fails the same way on main @ 77d3fcb (runs #318/#320/#321) and on the earlier PR #20 (#314-#317), so they are pre-existing. test/integration (ubuntu) fail because go mod download cannot read private git.basepeak.dev modules (could not read Username). validate-docs fails because the DinD volume mount leaves /docs/package.json missing. smoke/check-label fails in jq (Cannot index string with string "name") and the smoke model jobs are skipped. The windows-latest jobs stay pending because there is no runner. Locally with go1.26.9: build, vet, gen-docs and lint are unchanged from main, and unit-test failures match main (see the PR description).

CI check: every failing job fails the same way on main @ 77d3fcb (runs #318/#320/#321) and on the earlier PR #20 (#314-#317), so they are pre-existing. test/integration (ubuntu) fail because `go mod download` cannot read private git.basepeak.dev modules (`could not read Username`). validate-docs fails because the DinD volume mount leaves `/docs/package.json` missing. smoke/check-label fails in jq (`Cannot index string with string "name"`) and the smoke model jobs are skipped. The windows-latest jobs stay pending because there is no runner. Locally with go1.26.9: build, vet, gen-docs and lint are unchanged from main, and unit-test failures match main (see the PR description).
thklein deleted branch fix/deps-vulns 2026-10-18 10:24:22 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
area/engine

   
clarity/clear

   
enhancement

   
security

   
size/M
No labels
area/engine
clarity/clear
enhancement
security
size/M
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
basepeak-ai/gptscript!21
No description provided.