From dc54d1027c51e1bd4a5922837f6805a3c3127bcf Mon Sep 17 00:00:00 2001 From: Thibaut Lapierre Date: Sun, 25 Oct 2026 11:31:22 +0100 Subject: [PATCH] deps: Go 1.27.3, undici 8.12.3, zod 4.6.7 (vuln) --- Containerfile | 2 +- go.mod | 2 +- go.work | 2 +- operator/Dockerfile | 2 +- operator/go.mod | 2 +- web/package-lock.json | 12 ++++++------ 6 files changed, 11 insertions(+), 11 deletions(-) diff --git a/Containerfile b/Containerfile index d408dbf..b60ba3b 100644 --- a/Containerfile +++ b/Containerfile @@ -14,7 +14,7 @@ RUN npm run build # --- Stage 2: build the static Go binary --- # CGO is disabled, so the Go toolchain cross-compiles for $TARGETARCH on the native build # host (no QEMU) — buildx sets TARGETOS/TARGETARCH per target platform. -FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.27.2@sha256:820153096fda4de6ac1b7194d12e416b7dd8f4e9a33d17e0345b111b945162d8 AS build +FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.27.3@sha256:f20d83a83e18dbd2a4714b8ffd4b30b287b6243962dd75608e86abcc63ba4efc AS build # GOWORK=off: the repo-root go.work arrives with `COPY . .` and would change the build # list after `go mod download`, sending the build to the network uncached. ENV GOTOOLCHAIN=auto CGO_ENABLED=0 GOWORK=off GOFLAGS="-buildvcs=false -mod=readonly" \ diff --git a/go.mod b/go.mod index ef9a073..35f1013 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/epheo/dotvirt -go 1.27.2 +go 1.27.3 // npm packages can ship .go files (flatted does); keep them out of ./... ignore ./web/node_modules diff --git a/go.work b/go.work index aa48a95..1a850aa 100644 --- a/go.work +++ b/go.work @@ -5,7 +5,7 @@ // client versions. It imports the app's shared pkg/forge via the replace in // operator/go.mod (which also lets the operator build standalone, e.g. in its // container image). -go 1.27.2 +go 1.27.3 use ( . diff --git a/operator/Dockerfile b/operator/Dockerfile index f1c2a53..abbacd3 100644 --- a/operator/Dockerfile +++ b/operator/Dockerfile @@ -3,7 +3,7 @@ # docker build -f operator/Dockerfile -t quay.io/epheo/dotvirt-operator: . # CGO is disabled, so the manager cross-compiles for $TARGETARCH on the native build host # (no QEMU) — buildx sets TARGETOS/TARGETARCH per target platform. -FROM --platform=$BUILDPLATFORM golang:1.27.2@sha256:820153096fda4de6ac1b7194d12e416b7dd8f4e9a33d17e0345b111b945162d8 AS build +FROM --platform=$BUILDPLATFORM golang:1.27.3@sha256:f20d83a83e18dbd2a4714b8ffd4b30b287b6243962dd75608e86abcc63ba4efc AS build ARG TARGETOS TARGETARCH ENV GOPROXY="https://proxy.golang.org|direct" WORKDIR /src diff --git a/operator/go.mod b/operator/go.mod index 9c01656..78e5f94 100644 --- a/operator/go.mod +++ b/operator/go.mod @@ -1,6 +1,6 @@ module github.com/epheo/dotvirt/operator -go 1.27.2 +go 1.27.3 require ( github.com/epheo/dotvirt v0.0.0 diff --git a/web/package-lock.json b/web/package-lock.json index 5588a13..8808ad5 100644 --- a/web/package-lock.json +++ b/web/package-lock.json @@ -4802,9 +4802,9 @@ } }, "node_modules/undici": { - "version": "8.11.2", - "resolved": "https://registry.npmjs.org/undici/-/undici-8.11.2.tgz", - "integrity": "sha512-u4UB2/IrKdU6lFxumHmmo1a3fCQO5tzQllRorfoRS63txhrB7xTpSn1PftwC4qEHkOaqP95fCWW4lJzwErwzhQ==", + "version": "8.12.3", + "resolved": "https://registry.npmjs.org/undici/-/undici-8.12.3.tgz", + "integrity": "sha512-+fdndUTwBP86cVjihTp21hZHo7d6oj1c/47XPA3lL8mM0XHs+C4EkcjmgRsFnFk2f/UONGDy9ItBItmXsLOQHw==", "dev": true, "license": "MIT", "engines": { @@ -5506,9 +5506,9 @@ "license": "MIT" }, "node_modules/zod": { - "version": "4.6.5", - "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.5.tgz", - "integrity": "sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q==", + "version": "4.6.7", + "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.7.tgz", + "integrity": "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==", "dev": true, "license": "MIT", "funding": {