From 5637949f4b3d02e779569367de5123fd07417db9 Mon Sep 17 00:00:00 2001
From: Dhifan Razaqa <67745986+dhifanrazaqa@users.noreply.github.com>
Date: Wed, 30 Jul 2025 13:40:19 +0700
Subject: [PATCH] misc: resolve security issues from Dependabot by upgrading
golang.org/x/net, golang.org/x/crypto, nats.go and nats-server (#27)
* misc: upgrade library to resolve security issue
* misc: upgrade go version to 1.23.4
* misc: update golangci configuration
* misc: upgrade golang version and add golangci-lint to workflows
* bump: update changelog
* misc: remove deprecated config from golangci.yml
---
.github/workflows/go.yml | 8 ++++-
.golangci.yml | 65 ++++++++++++++++++++++++++--------------
CHANGELOG.md | 17 ++++++++++-
VERSION | 2 +-
go.mod | 25 ++++++++--------
go.sum | 48 +++++++++++++++--------------
6 files changed, 105 insertions(+), 60 deletions(-)
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index a932f30..23491e7 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -12,7 +12,13 @@ jobs:
- name: Set up Go
uses: actions/setup-go@v3
with:
- go-version: 1.22
+ go-version: 1.23.4
+
+ - name: Golangci-lint
+ uses: golangci/golangci-lint-action@v6
+ with:
+ version: v1.62.2
+ args: --print-issued-lines=false --exclude-use-default=false --enable=revive --enable=goimports --enable=unconvert --concurrency=2
- name: Test
run: go test -v ./...
diff --git a/.golangci.yml b/.golangci.yml
index 88c5976..37c2bfa 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -13,27 +13,13 @@ run:
# Include test files or not.
# Default: true
- tests: false
+ tests: true
# List of build tags, all linters use it.
# Default: [].
# build-tags:
# - mytag
- # Which dirs to skip: issues from them won't be reported.
- # Can use regexp here: `generated.*`, regexp is applied on full path.
- # Default value is empty list,
- # but default dirs are skipped independently of this option's value (see skip-dirs-use-default).
- # "/" will be replaced by current OS file path separator to properly work on Windows.
- # skip-dirs:
- # - src/external_libs
- # - autogenerated_by_my_lib
-
- # Enables skipping of directories:
- # - vendor$, third_party$, testdata$, examples$, Godeps$, builtin$
- # Default: true
- skip-dirs-use-default: true
-
# Which files to skip: they will be analyzed, but issues from them won't be reported.
# Default value is empty list,
# but there is no need to include all autogenerated files,
@@ -68,15 +54,34 @@ run:
# output configuration options
output:
- # Format: colored-line-number|line-number|json|tab|checkstyle|code-climate|junit-xml|github-actions
- #
- # Multiple can be specified by separating them by comma, output can be provided
- # for each of them by separating format name and path by colon symbol.
+ # The formats used to render issues.
+ # Formats:
+ # - `colored-line-number`
+ # - `line-number`
+ # - `json`
+ # - `colored-tab`
+ # - `tab`
+ # - `html`
+ # - `checkstyle`
+ # - `code-climate`
+ # - `junit-xml`
+ # - `junit-xml-extended`
+ # - `github-actions`
+ # - `teamcity`
+ # - `sarif`
# Output path can be either `stdout`, `stderr` or path to the file to write to.
- # Example: "checkstyle:report.json,colored-line-number"
#
- # Default: colored-line-number
- format: colored-line-number
+ # For the CLI flag (`--out-format`), multiple formats can be specified by separating them by comma.
+ # The output can be specified for each of them by separating format name and path by colon symbol.
+ # Example: "--out-format=checkstyle:report.xml,json:stdout,colored-line-number"
+ # The CLI flag (`--out-format`) override the configuration file.
+ #
+ # Default:
+ # formats:
+ # - format: colored-line-number
+ # path: stdout
+ formats:
+ - format: colored-line-number
# Print lines of code with issue.
# Default: true
@@ -117,8 +122,8 @@ linters:
- typecheck
- ineffassign
- gosimple
- - exhaustive
- nilerr
+ - exhaustive
# Enable all available linters.
# Default: false
@@ -159,6 +164,7 @@ issues:
# Default: https://golangci-lint.run/usage/false-positives/#default-exclusions
exclude:
- "should have a package comment"
+ - "G115"
# Excluding configuration per-path, per-linter, per-text and per-source
exclude-rules:
# Exclude some linters from running on tests files.
@@ -191,6 +197,19 @@ issues:
# If set to true exclude and exclude-rules regular expressions become case-sensitive.
# Default: false
exclude-case-sensitive: false
+ # Which dirs to exclude: issues from them won't be reported.
+ # Can use regexp here: `generated.*`, regexp is applied on full path,
+ # including the path prefix if one is set.
+ # Default dirs are skipped independently of this option's value (see exclude-dirs-use-default).
+ # "/" will be replaced by current OS file path separator to properly work on Windows.
+ # Default: []
+ # exclude-dirs:
+ # - src/external_libs
+ # - autogenerated_by_my_lib
+ # Enables exclude of directories:
+ # - vendor$, third_party$, testdata$, examples$, Godeps$, builtin$
+ # Default: true
+ exclude-dirs-use-default: true
# The list of ids of default excludes to include or disable.
# https://golangci-lint.run/usage/false-positives/#default-exclusions
# Default: []
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 58a28a4..5e08691 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,19 @@
# Ferstream
+
+## [v1.9.3] - 2025-07-29
+### Other Improvements
+- upgrade go version to 1.23.4
+- upgrade library to resolve security issue
+
+
+
+## [v1.9.2] - 2025-07-14
+### Fixes
+- fix register jetstream to register all clients first before init stream and subscribe ([#25](https://github.com/kumparan/ferstream/issues/25))
+
+
## [v1.9.1] - 2024-07-11
### Other Improvements
@@ -134,7 +147,9 @@
- implement jetstream
-[Unreleased]: https://github.com/kumparan/ferstream/compare/v1.9.1...HEAD
+[Unreleased]: https://github.com/kumparan/ferstream/compare/v1.9.3...HEAD
+[v1.9.3]: https://github.com/kumparan/ferstream/compare/v1.9.2...v1.9.3
+[v1.9.2]: https://github.com/kumparan/ferstream/compare/v1.9.1...v1.9.2
[v1.9.1]: https://github.com/kumparan/ferstream/compare/v1.9.0...v1.9.1
[v1.9.0]: https://github.com/kumparan/ferstream/compare/v1.8.3...v1.9.0
[v1.8.3]: https://github.com/kumparan/ferstream/compare/v1.8.2...v1.8.3
diff --git a/VERSION b/VERSION
index 424d0d7..2e1b985 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-ferstream@v1.9.1
+ferstream@v1.9.3
diff --git a/go.mod b/go.mod
index c7ea32a..74b10ff 100644
--- a/go.mod
+++ b/go.mod
@@ -1,10 +1,10 @@
module github.com/kumparan/ferstream
-go 1.22
+go 1.23.4
require (
github.com/kumparan/tapao v1.2.0
- github.com/nats-io/nats.go v1.36.0
+ github.com/nats-io/nats.go v1.43.0
github.com/pkg/errors v0.9.1
github.com/sirupsen/logrus v1.9.3
github.com/stretchr/testify v1.9.0
@@ -20,32 +20,33 @@ require (
github.com/globalsign/mgo v0.0.0-20181015135952-eeefdecb41b8 // indirect
github.com/gofrs/uuid/v5 v5.2.0 // indirect
github.com/goodsign/monday v1.0.2 // indirect
+ github.com/google/go-tpm v0.9.5 // indirect
github.com/gorilla/css v1.0.1 // indirect
- github.com/klauspost/compress v1.17.9 // indirect
+ github.com/klauspost/compress v1.18.0 // indirect
github.com/kr/text v0.2.0 // indirect
github.com/leekchan/accounting v1.0.0 // indirect
github.com/microcosm-cc/bluemonday v1.0.27 // indirect
- github.com/minio/highwayhash v1.0.2 // indirect
- github.com/nats-io/jwt/v2 v2.5.7 // indirect
+ github.com/minio/highwayhash v1.0.3 // indirect
+ github.com/nats-io/jwt/v2 v2.7.4 // indirect
github.com/oklog/ulid v1.3.1 // indirect
github.com/pmezard/go-difflib v1.0.0 // indirect
github.com/robfig/cron/v3 v3.0.1 // indirect
github.com/shopspring/decimal v1.4.0 // indirect
github.com/vmihailenco/msgpack/v5 v5.3.5 // indirect
github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
- golang.org/x/sys v0.21.0 // indirect
- golang.org/x/text v0.16.0 // indirect
- golang.org/x/time v0.5.0 // indirect
+ golang.org/x/sys v0.34.0 // indirect
+ golang.org/x/text v0.27.0 // indirect
+ golang.org/x/time v0.12.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
)
require (
github.com/graph-gophers/graphql-go v1.5.0 // indirect
github.com/kumparan/go-utils v1.39.2
- github.com/nats-io/nats-server/v2 v2.10.17
- github.com/nats-io/nkeys v0.4.7 // indirect
+ github.com/nats-io/nats-server/v2 v2.11.6
+ github.com/nats-io/nkeys v0.4.11 // indirect
github.com/nats-io/nuid v1.0.1 // indirect
- golang.org/x/crypto v0.24.0 // indirect
- golang.org/x/net v0.26.0 // indirect
+ golang.org/x/crypto v0.40.0 // indirect
+ golang.org/x/net v0.42.0 // indirect
google.golang.org/grpc v1.65.0 // indirect
)
diff --git a/go.sum b/go.sum
index dd44a07..bd56151 100644
--- a/go.sum
+++ b/go.sum
@@ -1,5 +1,7 @@
github.com/agiledragon/gomonkey/v2 v2.12.0 h1:ek0dYu9K1rSV+TgkW5LvNNPRWyDZVIxGMCFI6Pz9o38=
github.com/agiledragon/gomonkey/v2 v2.12.0/go.mod h1:ap1AmDzcVOAz1YpeJ3TCzIgstoaWLA6jbbgxfB4w2iY=
+github.com/antithesishq/antithesis-sdk-go v0.4.3-default-no-op h1:+OSa/t11TFhqfrX0EOSqQBDJ0YlpmK0rDSiB19dg9M0=
+github.com/antithesishq/antithesis-sdk-go v0.4.3-default-no-op/go.mod h1:IUpT2DPAKh6i/YhSbt6Gl3v2yvUZjmKncl7U91fup7E=
github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
github.com/cockroachdb/apd v1.1.0 h1:3LFP3629v+1aKXU5Q37mxmRxX/pIu1nijXydLShEq5I=
@@ -24,12 +26,14 @@ github.com/goodsign/monday v1.0.2/go.mod h1:r4T4breXpoFwspQNM+u2sLxJb2zyTaxVGqUf
github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-tpm v0.9.5 h1:ocUmnDebX54dnW+MQWGQRbdaAcJELsa6PqZhJ48KwVU=
+github.com/google/go-tpm v0.9.5/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
github.com/gorilla/css v1.0.1 h1:ntNaBIghp6JmvWnxbZKANoLyuXTPZ4cAMlo6RyhlbO8=
github.com/gorilla/css v1.0.1/go.mod h1:BvnYkspnSzMmwRK+b8/xgNPLiIuNZr6vbZBTPQ2A3b0=
github.com/graph-gophers/graphql-go v1.5.0 h1:fDqblo50TEpD0LY7RXk/LFVYEVqo3+tXMNMPSVXA1yc=
github.com/graph-gophers/graphql-go v1.5.0/go.mod h1:YtmJZDLbF1YYNrlNAuiO5zAStUWc3XZT07iGsVqe1Os=
-github.com/klauspost/compress v1.17.9 h1:6KIumPrER1LHsvBVuDa0r5xaG0Es51mhhB9BQB2qeMA=
-github.com/klauspost/compress v1.17.9/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ibi7bDH9ttBbw=
+github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
+github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -44,16 +48,16 @@ github.com/lib/pq v1.0.0 h1:X5PMW56eZitiTeO7tKzZxFCSpbFZJtkMMooicw2us9A=
github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
github.com/microcosm-cc/bluemonday v1.0.27 h1:MpEUotklkwCSLeH+Qdx1VJgNqLlpY2KXwXFM08ygZfk=
github.com/microcosm-cc/bluemonday v1.0.27/go.mod h1:jFi9vgW+H7c3V0lb6nR74Ib/DIB5OBs92Dimizgw2cA=
-github.com/minio/highwayhash v1.0.2 h1:Aak5U0nElisjDCfPSG79Tgzkn2gl66NxOMspRrKnA/g=
-github.com/minio/highwayhash v1.0.2/go.mod h1:BQskDq+xkJ12lmlUUi7U0M5Swg3EWR+dLTk+kldvVxY=
-github.com/nats-io/jwt/v2 v2.5.7 h1:j5lH1fUXCnJnY8SsQeB/a/z9Azgu2bYIDvtPVNdxe2c=
-github.com/nats-io/jwt/v2 v2.5.7/go.mod h1:ZdWS1nZa6WMZfFwwgpEaqBV8EPGVgOTDHN/wTbz0Y5A=
-github.com/nats-io/nats-server/v2 v2.10.17 h1:PTVObNBD3TZSNUDgzFb1qQsQX4mOgFmOuG9vhT+KBUY=
-github.com/nats-io/nats-server/v2 v2.10.17/go.mod h1:5OUyc4zg42s/p2i92zbbqXvUNsbF0ivdTLKshVMn2YQ=
-github.com/nats-io/nats.go v1.36.0 h1:suEUPuWzTSse/XhESwqLxXGuj8vGRuPRoG7MoRN/qyU=
-github.com/nats-io/nats.go v1.36.0/go.mod h1:Ubdu4Nh9exXdSz0RVWRFBbRfrbSxOYd26oF0wkWclB8=
-github.com/nats-io/nkeys v0.4.7 h1:RwNJbbIdYCoClSDNY7QVKZlyb/wfT6ugvFCiKy6vDvI=
-github.com/nats-io/nkeys v0.4.7/go.mod h1:kqXRgRDPlGy7nGaEDMuYzmiJCIAAWDK0IMBtDmGD0nc=
+github.com/minio/highwayhash v1.0.3 h1:kbnuUMoHYyVl7szWjSxJnxw11k2U709jqFPPmIUyD6Q=
+github.com/minio/highwayhash v1.0.3/go.mod h1:GGYsuwP/fPD6Y9hMiXuapVvlIUEhFhMTh0rxU3ik1LQ=
+github.com/nats-io/jwt/v2 v2.7.4 h1:jXFuDDxs/GQjGDZGhNgH4tXzSUK6WQi2rsj4xmsNOtI=
+github.com/nats-io/jwt/v2 v2.7.4/go.mod h1:me11pOkwObtcBNR8AiMrUbtVOUGkqYjMQZ6jnSdVUIA=
+github.com/nats-io/nats-server/v2 v2.11.6 h1:4VXRjbTUFKEB+7UoaKL3F5Y83xC7MxPoIONOnGgpkHw=
+github.com/nats-io/nats-server/v2 v2.11.6/go.mod h1:2xoztlcb4lDL5Blh1/BiukkKELXvKQ5Vy29FPVRBUYs=
+github.com/nats-io/nats.go v1.43.0 h1:uRFZ2FEoRvP64+UUhaTokyS18XBCR/xM2vQZKO4i8ug=
+github.com/nats-io/nats.go v1.43.0/go.mod h1:iRWIPokVIFbVijxuMQq4y9ttaBTMe0SFdlZfMDd+33g=
+github.com/nats-io/nkeys v0.4.11 h1:q44qGV008kYd9W1b1nEBkNzvnWxtRSQ7A8BoqRrcfa0=
+github.com/nats-io/nkeys v0.4.11/go.mod h1:szDimtgmfOi9n25JpfIdGw12tZFYXqhGxjhVxsatHVE=
github.com/nats-io/nuid v1.0.1 h1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=
github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c=
github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
@@ -88,18 +92,18 @@ go.opentelemetry.io/otel v1.6.3/go.mod h1:7BgNga5fNlF/iZjG06hM3yofffp0ofKCDwSXx1
go.opentelemetry.io/otel/trace v1.6.3/go.mod h1:GNJQusJlUgZl9/TQBPKU/Y/ty+0iVB5fjhKeJGZPGFs=
go.uber.org/mock v0.4.0 h1:VcM4ZOtdbR4f6VXfiOpwpVJDL6lCReaZ6mw31wqh7KU=
go.uber.org/mock v0.4.0/go.mod h1:a6FSlNadKUHUa9IP5Vyt1zh4fC7uAwxMutEAscFbkZc=
-golang.org/x/crypto v0.24.0 h1:mnl8DM0o513X8fdIkmyFE/5hTYxbwYOjDS/+rK6qpRI=
-golang.org/x/crypto v0.24.0/go.mod h1:Z1PMYSOR5nyMcyAVAIQSKCDwalqy85Aqn1x3Ws4L5DM=
-golang.org/x/net v0.26.0 h1:soB7SVo0PWrY4vPW/+ay0jKDNScG2X9wFeYlXIvJsOQ=
-golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
-golang.org/x/sys v0.0.0-20190130150945-aca44879d564/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
+golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
+golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
+golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.21.0 h1:rF+pYz3DAGSQAxAu1CbC7catZg4ebC4UIeIhKxBZvws=
golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/text v0.16.0 h1:a94ExnEXNtEwYLGJSIUxnWoxoRz/ZcCsV63ROupILh4=
-golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
-golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
-golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
+golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
+golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
+golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
+golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
google.golang.org/grpc v1.65.0 h1:bs/cUb4lp1G5iImFFd3u5ixQzweKizoZJAwBNLR42lc=
google.golang.org/grpc v1.65.0/go.mod h1:WgYC2ypjlB0EiQi6wdKixMqukr6lBc0Vo+oOgjrM5ZQ=