e084bf70f7Clears all 7 govulncheck findings flagged on ci.yml run #151: - golang.org/x/net v0.54.0 → v0.55.0 - GO-2026-5026 idna ASCII Punycode rejection (package-level) - GO-2026-5025..5030 x/net/html parser issues (module-level) - github.com/buger/jsonparser v1.1.1 → v1.1.2 (direct require to override the transitive pin from mark3labs/mcp-go → invopop/jsonschema → wk8/go-ordered-map/v2) - GO-2026-4514 DoS in jsonparser None of these were symbol-reachable from forgejo-mcp code (default govulncheck exits 0). Bumped anyway for hygiene; future runs will not regress to reachable as new code paths land. Local verification: govulncheck -show verbose ./... reports "No vulnerabilities found" at all tiers. go test ./... and make build pass. Refs forgejo-mcp-p1p.
48 lines
1.9 KiB
Modula-2
48 lines
1.9 KiB
Modula-2
module codeberg.org/goern/forgejo-mcp/v2
|
|
|
|
go 1.25.0
|
|
|
|
require (
|
|
codeberg.org/mvdkleijn/forgejo-sdk/forgejo/v3 v3.0.0
|
|
github.com/mark3labs/mcp-go v0.44.0
|
|
go.uber.org/zap v1.27.1
|
|
)
|
|
|
|
require (
|
|
github.com/42wim/httpsig v1.2.3 // indirect
|
|
github.com/bahlo/generic-list-go v0.2.0 // indirect
|
|
github.com/buger/jsonparser v1.1.2 // indirect
|
|
github.com/davidmz/go-pageant v1.0.2 // indirect
|
|
github.com/go-fed/httpsig v1.1.0 // indirect
|
|
github.com/go-openapi/errors v0.22.6 // indirect
|
|
github.com/go-openapi/strfmt v0.25.0 // indirect
|
|
github.com/go-openapi/swag v0.25.4 // indirect
|
|
github.com/go-openapi/swag/cmdutils v0.25.4 // indirect
|
|
github.com/go-openapi/swag/conv v0.25.4 // indirect
|
|
github.com/go-openapi/swag/fileutils v0.25.4 // indirect
|
|
github.com/go-openapi/swag/jsonname v0.25.4 // indirect
|
|
github.com/go-openapi/swag/jsonutils v0.25.4 // indirect
|
|
github.com/go-openapi/swag/loading v0.25.4 // indirect
|
|
github.com/go-openapi/swag/mangling v0.25.4 // indirect
|
|
github.com/go-openapi/swag/netutils v0.25.4 // indirect
|
|
github.com/go-openapi/swag/stringutils v0.25.4 // indirect
|
|
github.com/go-openapi/swag/typeutils v0.25.4 // indirect
|
|
github.com/go-openapi/swag/yamlutils v0.25.4 // indirect
|
|
github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
|
|
github.com/google/uuid v1.6.0 // indirect
|
|
github.com/hashicorp/go-version v1.8.0 // indirect
|
|
github.com/invopop/jsonschema v0.13.0 // indirect
|
|
github.com/mailru/easyjson v0.9.1 // indirect
|
|
github.com/oklog/ulid v1.3.1 // indirect
|
|
github.com/spf13/cast v1.10.0 // indirect
|
|
github.com/wk8/go-ordered-map/v2 v2.1.8 // indirect
|
|
github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
|
|
go.mongodb.org/mongo-driver v1.17.6 // indirect
|
|
go.uber.org/multierr v1.11.0 // indirect
|
|
go.yaml.in/yaml/v3 v3.0.4 // indirect
|
|
golang.org/x/crypto v0.52.0 // indirect
|
|
golang.org/x/net v0.55.0 // indirect
|
|
golang.org/x/sys v0.45.0 // indirect
|
|
golang.org/x/text v0.37.0 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
)
|