Repository navigation
Bump dependencies to fix security alerts - #240
Merged
Merged
Conversation
wu-sheng
force-pushed
the
bump/security-deps-2026-11-02
branch
from
November 2, 2026 17:06
1f4fbfa to
ac9f310
Compare
- golang.org/x/net v0.60.0 -> v0.62.0 (GO-2026-6860, GO-2026-6866), with golang.org/x/crypto v0.58.0, x/sync v0.24.0, x/sys v0.49.0, x/term v0.47.0 and x/text v0.43.0 by minimum version selection. - dist/LICENSE regenerated with license-eye (d38fe05); only the version lines change. CHANGES.md updated. GitHub Actions: actions/checkout v3/v4 -> v7, actions/setup-go v4/v5 -> v7, actions/upload-artifact v4 -> v7, in the workflows and in the actions/setup composite action. infra-e2e: apache/skywalking-infra-e2e cf589b4 -> 56ac8be in the three e2e jobs. Its verifier now requires every entry of a `contains` block to match a distinct actual item (infra-e2e #137, #143). The basic case's dependency-instance expectation listed a CLIENT detect point the instance relation never reports (the OAP returns only SERVER); the old verifier accepted the partial match. The expected file now lists SERVER only.
wu-sheng
force-pushed
the
bump/security-deps-2026-11-02
branch
from
November 3, 2026 00:36
ac9f310 to
b2324ce
Compare
mrproliu
approved these changes
Nov 3, 2026
mrproliu
approved these changes
Nov 3, 2026
wu-sheng
added a commit
that referenced
this pull request
Nov 7, 2026
infra-e2e #132 (pulled in by the cf589b4 -> 56ac8be bump in #240) makes the http trigger stop after `times` requests. Before it, `times` only decided when the trigger reported its first result, and the requests kept going until the verify phase finished. The basic case's `times: 10` now means 30 seconds of traffic, and the nightly CI failed on 3 of the 4 nights since #240, every time on `metrics linear service_relation_client_cpm`, whose whole 30-minute window came back empty while the other 15 cases passed. `times: -1` (endless, infra-e2e #134) restores the continuous traffic, the same as the live-debugging case.
wu-sheng
added a commit
that referenced
this pull request
Nov 7, 2026
…tions/setup, and stale docs (#242) * Fix the Go version in actions/setup and stale build/release docs before 0.16.0 actions/setup installed Go 1.24, while go.mod requires go 1.26.0 since #227. setup-go exports GOTOOLCHAIN=local, so the build either fails or, where sudo drops that variable, downloads the go1.26.0 toolchain instead of using the latest 1.26 patch. It now installs "1.26", like CI. README: - Build from source: needs Go 1.26+; `make build` only builds, a plain `make` also runs license/lint/test (license-eye, golangci-lint); the binaries are swctl-<version>-<os>-<arch> for the seven platforms, not swctl-latest-<os>-amd64. - The GitHub Actions example used `apache/skywalking-cli@main`; the default branch is `master`, there is no `main`. CONTRIBUTING: - Compiling: Go 1.26+, seven binaries, not three. - How to release: the tag has no `v` prefix and is pushed only after `make release` succeeds; three links pointed at How-to-release.md anchors that do not exist; mention pre-release.sh and release.sh. How-to-release.md: fix the unclosed BuildKit link. * Keep the basic e2e trigger running until verification ends infra-e2e #132 (pulled in by the cf589b4 -> 56ac8be bump in #240) makes the http trigger stop after `times` requests. Before it, `times` only decided when the trigger reported its first result, and the requests kept going until the verify phase finished. The basic case's `times: 10` now means 30 seconds of traffic, and the nightly CI failed on 3 of the 4 nights since #240, every time on `metrics linear service_relation_client_cpm`, whose whole 30-minute window came back empty while the other 15 cases passed. `times: -1` (endless, infra-e2e #134) restores the continuous traffic, the same as the live-debugging case.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bump golang.org/x/net in swctl past the versions OSV flags, regenerate
dist/LICENSE, and move CI to current GitHub Actions majors and skywalking-infra-e2e.Dependencies
go.modgo.modgo.modgo.modgovulncheck on master lists both x/net advisories in a required module but not reachable from swctl code. CHANGES.md: one line under a new 0.16.0 Bug Fixes section (0.15.0 is released).
GitHub Actions
actions/setupcomposite action this repository publishesinfra-e2e
apache/skywalking-infra-e2e
cf589b4->56ac8be(current main, CI green) in the three e2e jobs. The action sets up Go 1.26 itself to builde2e.The newer verifier requires every entry of a
containsblock to match a distinct actual item (apache/skywalking-infra-e2e#137, #143); the old one accepted a partial match.test/cases/basic/expected/dependency-instance.ymlexpected the consumer -> provider instance call to carry both SERVER and CLIENT detect points, but the OAP reports only SERVER for it, so the case failed on 56ac8be. The expectation now lists SERVER only. Checked locally withe2e verifybuilt at 56ac8be against the actual output from the failed run: the new file passes and the old one fails the same way CI did.License
dist/LICENSEregenerated withlicense-eye dependency resolveat the Makefile's pin (d38fe05); only the x/* version lines change. The same run on master produced no diff, so there was no earlier drift.dist/licensesis unchanged.Verified locally (Go 1.27.1)
go build ./...: passgo test ./...: pass (11 packages)make license-header: passmake lint(golangci-lint is not installed here), the e2e jobsLeft out on purpose
openpgpis unmaintained) has no fixed version; govulncheck finds it unreachable.