mirror of
https://tangled.org/evan.jarrett.net/at-container-registry
synced 2026-09-22 18:24:21 +00:00
Evan JarrettandClaude Fable 5.1
dcee8f6a62
go get -u across the root, scanner, and deploy modules, then tidy. The credential helpers pin atcr.io v0.1.4 for standalone go install and are left alone (go work sync tried to strip that pin; reverted). Direct upgrades in the root: indigo 20260901 to 20260903, aws-sdk-go-v2 core 1.45.1 to 1.47.0 with config, credentials, and s3 alongside, x/crypto 0.55 to 0.57, x/net, x/sync, x/sys, x/image, klauspost/compress 1.20, go-containerregistry 0.22.1, goldmark 1.8.6, regclient 0.11.6 (pinned only by the integration-tagged package, so the bulk upgrade skipped it). Scanner and deploy had no direct updates; their indirect sets moved. The indigo delta is a hardening series: identity.DefaultDirectory and oauth.NewClientApp now carry an SSRF-guarded transport that refuses loopback and private ranges, did:web and well-known bodies are size capped, all auth-server endpoints must be HTTPS URLs, and MST decoding validates PrefixLen on untrusted nodes. Production is unaffected. The testmode seam in pkg/atproto absorbs the rest: a probe confirmed an untagged build now refuses 127.0.0.1 with indigo's unsafe-address error and a tagged build dials through. Two OAuth tests drove the real client against httptest servers on loopback and failed untagged after the bump; three siblings in the same fixtures passed only because the refused dial happened to satisfy a "transient error" assertion. All five, with their fixtures and fake stores, move under //go:build testmode in sibling files. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UwYzaG3Yy7uA8FbZ5qk3tQ
46 lines
1.9 KiB
AMPL
46 lines
1.9 KiB
AMPL
module atcr.io/deploy
|
|
|
|
go 1.26.7
|
|
|
|
require (
|
|
github.com/UpCloudLtd/upcloud-go-api/v8 v8.41.0
|
|
github.com/charmbracelet/huh v1.0.0
|
|
github.com/spf13/cobra v1.10.2
|
|
go.yaml.in/yaml/v3 v3.0.5
|
|
)
|
|
|
|
require (
|
|
github.com/UpCloudLtd/httplog v0.0.0-20260624214043-23b0cab8e085 // indirect
|
|
github.com/atotto/clipboard v0.1.4 // indirect
|
|
github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
|
|
github.com/catppuccin/go v0.3.0 // indirect
|
|
github.com/charmbracelet/bubbles v1.0.0 // indirect
|
|
github.com/charmbracelet/bubbletea v1.3.10 // indirect
|
|
github.com/charmbracelet/colorprofile v0.4.3 // indirect
|
|
github.com/charmbracelet/lipgloss v1.1.0 // indirect
|
|
github.com/charmbracelet/x/ansi v0.11.8 // indirect
|
|
github.com/charmbracelet/x/cellbuf v0.0.15 // indirect
|
|
github.com/charmbracelet/x/exp/strings v0.1.0 // indirect
|
|
github.com/charmbracelet/x/term v0.2.2 // indirect
|
|
github.com/clipperhouse/displaywidth v0.11.0 // indirect
|
|
github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/lucasb-eyer/go-colorful v1.4.1 // indirect
|
|
github.com/mattn/go-isatty v0.0.24 // indirect
|
|
github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75 // indirect
|
|
github.com/mattn/go-runewidth v0.0.30 // indirect
|
|
github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
|
|
github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
|
|
github.com/muesli/cancelreader v0.2.2 // indirect
|
|
github.com/muesli/termenv v0.16.0 // indirect
|
|
github.com/rivo/uniseg v0.4.7 // indirect
|
|
github.com/spf13/pflag v1.0.10 // indirect
|
|
github.com/stretchr/testify v1.12.1 // indirect
|
|
github.com/xo/terminfo v1.0.0 // indirect
|
|
golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba // indirect
|
|
golang.org/x/sys v0.48.0 // indirect
|
|
golang.org/x/text v0.42.0 // indirect
|
|
)
|