Dmitry VerkhoturovandGitHub
1f34984dab
rest.CORS refuses "*" together with credentials since go-pkgz/rest#52, so the bump and the option have to land together: the option does not exist in v1.22.0 and the panic fires at construction, inside routes(), which makes it a startup failure rather than a request-time one. The wildcard stays. The comment widget is embedded on arbitrary third-party sites, so the set of origins is not knowable, which is why the escape hatch was asked for upstream instead of accepting the panic. What it costs is unchanged and now written next to the call: any site a signed-in user visits can read authenticated responses, so state-changing requests have to keep being protected by something other than the origin, X-XSRF-Token today. The example module is tidied in the same commit, as it reaches go-pkgz/rest through the replace directive and its indirect graph would otherwise keep the old pin and fail the readonly module check in CI. The bump also carries testify to v1.12.0, which drops go-spew and go-difflib from the module graph.
37 lines
1.2 KiB
AMPL
37 lines
1.2 KiB
AMPL
module github.com/umputun/remark42/memory_store
|
|
|
|
go 1.25.0
|
|
|
|
require (
|
|
github.com/go-pkgz/jrpc v0.4.0
|
|
github.com/go-pkgz/lgr v0.12.3
|
|
github.com/jessevdk/go-flags v1.6.1
|
|
github.com/stretchr/testify v1.12.0
|
|
github.com/umputun/remark42/backend v1.1000.0
|
|
)
|
|
|
|
require (
|
|
github.com/Depado/bfchroma/v2 v2.0.0 // indirect
|
|
github.com/PuerkitoBio/goquery v1.12.0 // indirect
|
|
github.com/alecthomas/chroma/v2 v2.27.0 // indirect
|
|
github.com/andybalholm/cascadia v1.3.4 // indirect
|
|
github.com/aymerick/douceur v0.2.0 // indirect
|
|
github.com/dlclark/regexp2/v2 v2.2.2 // indirect
|
|
github.com/go-pkgz/rest v1.24.0 // indirect
|
|
github.com/go-pkgz/routegroup v1.6.0 // indirect
|
|
github.com/gorilla/css v1.0.1 // indirect
|
|
github.com/kr/text v0.2.0 // indirect
|
|
github.com/microcosm-cc/bluemonday v1.0.27 // indirect
|
|
github.com/rogpeppe/go-internal v1.14.1 // indirect
|
|
github.com/rs/xid v1.6.0 // indirect
|
|
github.com/russross/blackfriday/v2 v2.1.0 // indirect
|
|
go.etcd.io/bbolt v1.5.0 // indirect
|
|
golang.org/x/crypto v0.53.0 // indirect
|
|
golang.org/x/image v0.45.0 // indirect
|
|
golang.org/x/net v0.56.0 // indirect
|
|
golang.org/x/sys v0.47.0 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
)
|
|
|
|
replace github.com/umputun/remark42/backend v1.1000.0 => ../../
|