kami/Maven
1
0
Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Take the 19 standard library advisories off the box (V-682)

Browse Source 
govulncheck found 20 reachable advisories on 2026-08-10: 19 in the
standard library and one in x/text. Go 1.25.12 closes the 19. The
reachable traces that mattered are mavweb's HTML template escaping and
the mavgpud proxy's TLS, both of which face the LAN.

deps/ is gitignored and make deps-go builds the toolchain, so the bump
is the version, its checksum and the go directive. Nothing is vendored
by this commit.

x/text stays at 0.14.0 (owner's call, 2026-08-11). Its one advisory is
reached only through the ONNX embedder normalizing his own text, so
nothing hostile arrives there, and 0.39.0 regenerates the Unicode
tables for 41,385 changed lines against a 300-line pre-commit cap that
exempts only markdown. The bump is worth doing when vendor/ is exempt
from the guard, not before.

No govulncheck make target either: it would fail on the x/text finding
from the day it landed, and a gate that is red on arrival teaches
people to skip it.

make fmt-check, make vet, make build and make test pass on 1.25.12,
65 packages ok. The four TestONNX measurements pass in 29.6s.
This commit is contained in:
claude
2026-08-11 12:27:10 +04:00
parent a1d018dc47
commit 353b8f5a16
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile
+2 -2
View File
@@ -4,7 +4,7 @@
# `test` below fail on the two packages that have no test files. deps-go builds # `test` below fail on the two packages that have no test files. deps-go builds
# the missing tools in, so the vendored tree is self-sufficient. Keep the version # the missing tools in, so the vendored tree is self-sufficient. Keep the version
# here in step with the `go` directive in go.mod. # here in step with the `go` directive in go.mod.
GO_VERSION := 1.25.5 GO_VERSION := 1.25.12
GO := $(shell pwd)/deps/go/go/bin/go GO := $(shell pwd)/deps/go/go/bin/go
export GOTOOLCHAIN := local export GOTOOLCHAIN := local
GOFLAGS := GOFLAGS :=
@@ -73,7 +73,7 @@ run-web: build-web
# builds them on demand, but `go test -coverprofile` calls covdata through # builds them on demand, but `go test -coverprofile` calls covdata through
# base.Tool(), which only stats pkg/tool and exits. So build them in once here. # base.Tool(), which only stats pkg/tool and exits. So build them in once here.
GO_TARBALL := go$(GO_VERSION).linux-amd64.tar.gz GO_TARBALL := go$(GO_VERSION).linux-amd64.tar.gz
GO_SHA256 := 9e9b755d63b36acf30c12a9a3fc379243714c1c6d3dd72861da637f336ebb35b GO_SHA256 := 234828b7a89e0e303d2556310ee549fbcf253d28de937bac3da13d6294262ac1
deps-go: deps-sentinel deps-go: deps-sentinel
@mkdir -p deps/go @mkdir -p deps/go
cd deps/go && curl -fLO 'https://go.dev/dl/$(GO_TARBALL)' cd deps/go && curl -fLO 'https://go.dev/dl/$(GO_TARBALL)'
go.mod
+1 -1
View File
@@ -1,6 +1,6 @@
module github.com/kami/maven module github.com/kami/maven
go 1.25.5 go 1.25.12
require ( require (
github.com/coder/websocket v1.8.12 github.com/coder/websocket v1.8.12