basepeak-ai/tui
Watch
6
0
Fork
You've already forked tui
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(deps): update Go to 1.26.9 and vulnerable deps #1

Merged
thklein merged 3 commits from fix/deps-security into main 2026-10-18 10:24:20 +00:00
Conversation 0 Commits 3 Files changed 4 +25 -25
thklein commented 2026-10-18 08:48:12 +00:00
Owner
Copy link
  • Raise the go directive from 1.25.3 to 1.26.9 (latest go1.26 patch release)
  • golang.org/x/net v0.24.0 → v0.61.0 (fix requires ≥ v0.60.0)
  • github.com/yuin/goldmark v1.5.4 → v1.7.17 (fix requires ≥ v1.7.17; kept on the 1.7 line for glamour v0.7.0 compatibility)
  • github.com/microcosm-cc/bluemonday v1.0.25 → v1.0.27 (v1.0.25 is retracted)
  • Indirect: x/sys v0.49.0, x/term v0.47.0, x/text v0.43.0, gorilla/css v1.0.1
  • fix(run): go vet failed on fmt.Printf(opt.LoadMessage) (non-constant format string); use fmt.Print, which also avoids mangling messages that contain %
  • style: gofmt import order left over from the module path rename

git.basepeak.dev/basepeak-ai/go-gptscript is intentionally left unchanged.

govulncheck

Reachable
Before (go 1.25.3) 25 (golang.org/x/net, github.com/yuin/goldmark, Go stdlib)
After (go 1.26.9) 0 (No vulnerabilities found)

Verification (local, go1.26.9)

go mod tidy, go build ./..., go vet ./..., go test ./... all pass.

This repository has no CI workflow (no .forgejo/workflows or .github/workflows), so there are no CI checks on this PR; the results above are from a local run.

Note for consumers: modules requiring this version will need go >= 1.26.9 (gptscript is currently on go 1.26.3 and will be raised when it picks this up).

- Raise the `go` directive from `1.25.3` to `1.26.9` (latest go1.26 patch release) - `golang.org/x/net` v0.24.0 → v0.61.0 (fix requires ≥ v0.60.0) - `github.com/yuin/goldmark` v1.5.4 → v1.7.17 (fix requires ≥ v1.7.17; kept on the 1.7 line for glamour v0.7.0 compatibility) - `github.com/microcosm-cc/bluemonday` v1.0.25 → v1.0.27 (v1.0.25 is retracted) - Indirect: x/sys v0.49.0, x/term v0.47.0, x/text v0.43.0, gorilla/css v1.0.1 - `fix(run)`: `go vet` failed on `fmt.Printf(opt.LoadMessage)` (non-constant format string); use `fmt.Print`, which also avoids mangling messages that contain `%` - `style`: gofmt import order left over from the module path rename `git.basepeak.dev/basepeak-ai/go-gptscript` is intentionally left unchanged. ## govulncheck | | Reachable | |---|---| | Before (go 1.25.3) | 25 (golang.org/x/net, github.com/yuin/goldmark, Go stdlib) | | After (go 1.26.9) | 0 (No vulnerabilities found) | ## Verification (local, go1.26.9) `go mod tidy`, `go build ./...`, `go vet ./...`, `go test ./...` all pass. This repository has no CI workflow (no `.forgejo/workflows` or `.github/workflows`), so there are no CI checks on this PR; the results above are from a local run. Note for consumers: modules requiring this version will need `go >= 1.26.9` (gptscript is currently on `go 1.26.3` and will be raised when it picks this up).
thklein deleted branch fix/deps-security 2026-10-18 10:24:20 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
basepeak-ai/tui!1
No description provided.