mirror of
https://tangled.org/evan.jarrett.net/at-container-registry
synced 2026-09-22 10:14:15 +00:00
Evan JarrettandClaude Fable 5.1
dcee8f6a62
go get -u across the root, scanner, and deploy modules, then tidy. The credential helpers pin atcr.io v0.1.4 for standalone go install and are left alone (go work sync tried to strip that pin; reverted). Direct upgrades in the root: indigo 20260901 to 20260903, aws-sdk-go-v2 core 1.45.1 to 1.47.0 with config, credentials, and s3 alongside, x/crypto 0.55 to 0.57, x/net, x/sync, x/sys, x/image, klauspost/compress 1.20, go-containerregistry 0.22.1, goldmark 1.8.6, regclient 0.11.6 (pinned only by the integration-tagged package, so the bulk upgrade skipped it). Scanner and deploy had no direct updates; their indirect sets moved. The indigo delta is a hardening series: identity.DefaultDirectory and oauth.NewClientApp now carry an SSRF-guarded transport that refuses loopback and private ranges, did:web and well-known bodies are size capped, all auth-server endpoints must be HTTPS URLs, and MST decoding validates PrefixLen on untrusted nodes. Production is unaffected. The testmode seam in pkg/atproto absorbs the rest: a probe confirmed an untagged build now refuses 127.0.0.1 with indigo's unsafe-address error and a tagged build dials through. Two OAuth tests drove the real client against httptest servers on loopback and failed untagged after the bump; three siblings in the same fixtures passed only because the refused dial happened to satisfy a "transient error" assertion. All five, with their fixtures and fake stores, move under //go:build testmode in sibling files. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UwYzaG3Yy7uA8FbZ5qk3tQ
221 lines
11 KiB
AMPL
221 lines
11 KiB
AMPL
module atcr.io
|
|
|
|
go 1.26.7
|
|
|
|
require (
|
|
github.com/aws/aws-sdk-go-v2 v1.47.0
|
|
github.com/aws/aws-sdk-go-v2/config v1.33.4
|
|
github.com/aws/aws-sdk-go-v2/credentials v1.20.4
|
|
github.com/aws/aws-sdk-go-v2/service/s3 v1.113.1
|
|
github.com/bluesky-social/indigo v0.0.0-20260903211445-41278964ec8e
|
|
github.com/charmbracelet/huh v1.0.0
|
|
github.com/charmbracelet/huh/spinner v0.0.0-20260223110133-9dc45e34a40b
|
|
github.com/charmbracelet/lipgloss v1.1.0
|
|
github.com/did-method-plc/go-didplc v0.2.2
|
|
github.com/distribution/distribution/v3 v3.1.1
|
|
github.com/distribution/reference v0.6.0
|
|
github.com/go-chi/chi/v5 v5.3.2
|
|
github.com/go-chi/render v1.0.3
|
|
github.com/go-viper/mapstructure/v2 v2.5.0
|
|
github.com/goki/freetype v1.0.5
|
|
github.com/golang-jwt/jwt/v5 v5.3.1
|
|
github.com/google/go-containerregistry v0.22.1
|
|
github.com/google/go-querystring v1.2.0
|
|
github.com/google/uuid v1.6.0
|
|
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674
|
|
github.com/ipfs/go-block-format v0.2.4
|
|
github.com/ipfs/go-cid v0.6.2
|
|
github.com/ipfs/go-ipfs-blockstore v1.3.1
|
|
github.com/ipfs/go-ipld-cbor v0.3.0
|
|
github.com/ipfs/go-ipld-format v0.6.4
|
|
github.com/ipld/go-car v0.6.3
|
|
github.com/johannesboyne/gofakes3 v1.2.0
|
|
github.com/klauspost/compress v1.20.0
|
|
github.com/microcosm-cc/bluemonday v1.0.27
|
|
github.com/multiformats/go-multihash v0.2.3
|
|
github.com/opencontainers/go-digest v1.0.0
|
|
github.com/opencontainers/image-spec v1.1.1
|
|
github.com/regclient/regclient v0.11.6
|
|
github.com/spf13/cobra v1.10.2
|
|
github.com/spf13/viper v1.21.0
|
|
github.com/srwiley/oksvg v0.0.0-20221011165216-be6e8873101c
|
|
github.com/srwiley/rasterx v0.0.0-20220730225603-2ab79fcdd4ef
|
|
github.com/stretchr/testify v1.12.1
|
|
github.com/stripe/stripe-go/v84 v84.4.1
|
|
github.com/tursodatabase/go-libsql v0.0.0-20260424063416-3051e37e6e04
|
|
github.com/whyrusleeping/cbor-gen v0.3.1
|
|
github.com/yuin/goldmark v1.8.6
|
|
go.opentelemetry.io/otel v1.46.0
|
|
go.yaml.in/yaml/v4 v4.0.0-rc.6
|
|
golang.org/x/crypto v0.57.0
|
|
golang.org/x/image v0.46.0
|
|
golang.org/x/net v0.59.0
|
|
golang.org/x/sync v0.23.0
|
|
golang.org/x/sys v0.48.0
|
|
golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da
|
|
oras.land/oras-go/v2 v2.6.2
|
|
)
|
|
|
|
require (
|
|
github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 // indirect
|
|
github.com/RussellLuo/slidingwindow v0.0.0-20200528002341-535bb99d338b // indirect
|
|
github.com/ajg/form v1.9.0 // indirect
|
|
github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
|
|
github.com/atotto/clipboard v0.1.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.20 // indirect
|
|
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.0 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.3 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.3 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.3 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.11.3 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.3 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.20.3 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/signin v1.10.0 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sso v1.38.0 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.0 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sts v1.50.0 // indirect
|
|
github.com/aws/smithy-go v1.28.1 // indirect
|
|
github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
|
|
github.com/aymerick/douceur v0.2.0 // indirect
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/bshuster-repo/logrus-logstash-hook v1.1.0 // indirect
|
|
github.com/catppuccin/go v0.3.0 // indirect
|
|
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/charmbracelet/bubbles v1.0.0 // indirect
|
|
github.com/charmbracelet/bubbletea v1.3.10 // indirect
|
|
github.com/charmbracelet/colorprofile v0.4.3 // indirect
|
|
github.com/charmbracelet/x/ansi v0.11.8 // indirect
|
|
github.com/charmbracelet/x/cellbuf v0.0.15 // indirect
|
|
github.com/charmbracelet/x/exp/strings v0.1.0 // indirect
|
|
github.com/charmbracelet/x/term v0.2.2 // indirect
|
|
github.com/clipperhouse/displaywidth v0.11.0 // indirect
|
|
github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
|
|
github.com/coreos/go-systemd/v22 v22.7.0 // indirect
|
|
github.com/docker/cli v29.8.0+incompatible // indirect
|
|
github.com/docker/docker-credential-helpers v0.9.9 // indirect
|
|
github.com/docker/go-events v0.1.0 // indirect
|
|
github.com/docker/go-metrics v0.1.0 // indirect
|
|
github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 // indirect
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/earthboundkid/versioninfo/v2 v2.24.1 // indirect
|
|
github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
|
|
github.com/fatih/color v1.19.0 // indirect
|
|
github.com/felixge/httpsnoop v1.1.0 // indirect
|
|
github.com/fsnotify/fsnotify v1.10.1 // indirect
|
|
github.com/gammazero/chanqueue v1.1.2 // indirect
|
|
github.com/gammazero/deque v1.2.1 // indirect
|
|
github.com/go-jose/go-jose/v4 v4.1.5 // indirect
|
|
github.com/go-logr/logr v1.4.4 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/gogo/protobuf v1.3.2 // indirect
|
|
github.com/golang/snappy v1.0.0 // indirect
|
|
github.com/gorilla/css v1.0.1 // indirect
|
|
github.com/gorilla/handlers v1.5.2 // indirect
|
|
github.com/gorilla/mux v1.8.1 // indirect
|
|
github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 // indirect
|
|
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
|
|
github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
|
|
github.com/hashicorp/golang-lru v1.0.2 // indirect
|
|
github.com/hashicorp/golang-lru/arc/v2 v2.0.7 // indirect
|
|
github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/ipfs/bbloom v0.1.0 // indirect
|
|
github.com/ipfs/boxo v0.42.2 // indirect
|
|
github.com/ipfs/go-cidutil v0.1.2 // indirect
|
|
github.com/ipfs/go-datastore v0.9.2 // indirect
|
|
github.com/ipfs/go-dsqueue v0.2.0 // indirect
|
|
github.com/ipfs/go-ipfs-ds-help v1.1.1 // indirect
|
|
github.com/ipfs/go-ipld-legacy v0.3.0 // indirect
|
|
github.com/ipfs/go-log v1.0.5 // indirect
|
|
github.com/ipfs/go-log/v2 v2.9.2 // indirect
|
|
github.com/ipfs/go-metrics-interface v0.3.0 // indirect
|
|
github.com/ipld/go-codec-dagpb v1.7.0 // indirect
|
|
github.com/ipld/go-ipld-prime v0.24.0 // indirect
|
|
github.com/jinzhu/inflection v1.0.0 // indirect
|
|
github.com/jinzhu/now v1.1.5 // indirect
|
|
github.com/klauspost/cpuid/v2 v2.4.0 // indirect
|
|
github.com/libsql/sqlite-antlr4-parser v0.0.0-20240721121621-c0bdc870f11c // indirect
|
|
github.com/lucasb-eyer/go-colorful v1.4.1 // indirect
|
|
github.com/mattn/go-isatty v0.0.24 // indirect
|
|
github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75 // indirect
|
|
github.com/mattn/go-runewidth v0.0.30 // indirect
|
|
github.com/minio/sha256-simd v1.0.1 // indirect
|
|
github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
|
|
github.com/mr-tron/base58 v1.3.0 // indirect
|
|
github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
|
|
github.com/muesli/cancelreader v0.2.2 // indirect
|
|
github.com/muesli/termenv v0.16.0 // indirect
|
|
github.com/multiformats/go-base32 v0.1.0 // indirect
|
|
github.com/multiformats/go-base36 v0.2.0 // indirect
|
|
github.com/multiformats/go-multibase v0.3.0 // indirect
|
|
github.com/multiformats/go-multicodec v0.10.0 // indirect
|
|
github.com/multiformats/go-varint v0.1.0 // indirect
|
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
|
github.com/opentracing/opentracing-go v1.2.0 // indirect
|
|
github.com/pelletier/go-toml/v2 v2.4.3 // indirect
|
|
github.com/polydawn/refmt v0.90.0 // indirect
|
|
github.com/prometheus/client_golang v1.24.1 // indirect
|
|
github.com/prometheus/client_model v0.6.3 // indirect
|
|
github.com/prometheus/common v0.71.0 // indirect
|
|
github.com/prometheus/otlptranslator v1.0.0 // indirect
|
|
github.com/prometheus/procfs v0.22.0 // indirect
|
|
github.com/redis/go-redis/extra/rediscmd/v9 v9.22.0 // indirect
|
|
github.com/redis/go-redis/extra/redisotel/v9 v9.22.0 // indirect
|
|
github.com/redis/go-redis/v9 v9.22.0 // indirect
|
|
github.com/rivo/uniseg v0.4.7 // indirect
|
|
github.com/ryszard/goskiplist v0.0.0-20150312221310-2dfbae5fcf46 // indirect
|
|
github.com/sagikazarmark/locafero v0.12.0 // indirect
|
|
github.com/sirupsen/logrus v1.10.2 // indirect
|
|
github.com/spaolacci/murmur3 v1.1.0 // indirect
|
|
github.com/spf13/afero v1.15.0 // indirect
|
|
github.com/spf13/cast v1.10.0 // indirect
|
|
github.com/spf13/pflag v1.0.10 // indirect
|
|
github.com/subosito/gotenv v1.6.0 // indirect
|
|
github.com/ulikunitz/xz v0.5.16 // indirect
|
|
github.com/xo/terminfo v1.0.0 // indirect
|
|
gitlab.com/yawning/secp256k1-voi v0.0.0-20230925100816-f2616030848b // indirect
|
|
gitlab.com/yawning/tuplehash v0.0.0-20230713102510-df83abbf9a02 // indirect
|
|
go.etcd.io/bbolt v1.5.0 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
|
go.opentelemetry.io/contrib/bridges/prometheus v0.71.0 // indirect
|
|
go.opentelemetry.io/contrib/exporters/autoexport v0.71.0 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.22.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.22.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.46.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.46.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.46.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.46.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/prometheus v0.68.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.22.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.46.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.46.0 // indirect
|
|
go.opentelemetry.io/otel/log v0.22.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.46.0 // indirect
|
|
go.opentelemetry.io/otel/sdk v1.46.0 // indirect
|
|
go.opentelemetry.io/otel/sdk/log v0.22.0 // indirect
|
|
go.opentelemetry.io/otel/sdk/metric v1.46.0 // indirect
|
|
go.opentelemetry.io/otel/trace v1.46.0 // indirect
|
|
go.opentelemetry.io/proto/otlp v1.11.0 // indirect
|
|
go.shabbyrobe.org/gocovmerge v0.0.0-20230507111327-fa4f82cfbf4d // indirect
|
|
go.uber.org/atomic v1.11.0 // indirect
|
|
go.uber.org/multierr v1.11.0 // indirect
|
|
go.uber.org/zap v1.28.0 // indirect
|
|
go.yaml.in/yaml/v3 v3.0.5 // indirect
|
|
golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba // indirect
|
|
golang.org/x/text v0.42.0 // indirect
|
|
golang.org/x/time v0.16.0 // indirect
|
|
golang.org/x/tools v0.50.0 // indirect
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20260911204522-f61a6ca850bd // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20260911204522-f61a6ca850bd // indirect
|
|
google.golang.org/grpc v1.83.2 // indirect
|
|
google.golang.org/protobuf v1.36.12 // indirect
|
|
gopkg.in/yaml.v2 v2.4.0 // indirect
|
|
gorm.io/gorm v1.31.2 // indirect
|
|
gotest.tools/v3 v3.5.2 // indirect
|
|
lukechampine.com/blake3 v1.4.1 // indirect
|
|
)
|