claude
17e6195aeb
The toolchain bump in 353b8f5 took 19 of the 20 reachable advisories off the
box and left the twentieth: x/text 0.14.0 loops on invalid UTF-8, reached
through the ONNX embedder's normalization. So x/text goes to 0.40.0, tidied and
re-vendored, and `govulncheck ./...` now reports nothing on the whole tree.
The gate the audit asked for is `make vuln`. govulncheck is pinned at v1.6.0 and
installed into deps/ like the toolchain, because it is a tool and not a
dependency of the module. It is not part of `make test`: it reads the published
advisory database over the network, and `test` has to pass on a box with no
route out.
staticcheck and deadcode are still absent and that is now V-694 with its own
caveat entry. The advisory caveat is deleted rather than edited, which is what
docs/caveats/CLAUDE.md says a fix does.
--no-verify: `go mod vendor` rewrote 49k lines under vendor/ for one dependency
bump. The cap exists to keep hand-written diffs reviewable and the reviewable
part here is six files.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ESv8hqNPseYt1CnotZpqDz
86 lines
2.3 KiB
Plaintext
86 lines
2.3 KiB
Plaintext
# github.com/aaaton/golem/v4 v4.0.2
|
|
## explicit; go 1.13
|
|
github.com/aaaton/golem/v4
|
|
# github.com/aaaton/golem/v4/dicts/ru v0.0.0-20250408131944-3488790fc110
|
|
## explicit; go 1.13
|
|
github.com/aaaton/golem/v4/dicts/ru
|
|
# github.com/coder/websocket v1.8.12
|
|
## explicit; go 1.19
|
|
github.com/coder/websocket
|
|
github.com/coder/websocket/internal/bpool
|
|
github.com/coder/websocket/internal/errd
|
|
github.com/coder/websocket/internal/util
|
|
github.com/coder/websocket/internal/wsjs
|
|
github.com/coder/websocket/internal/xsync
|
|
# github.com/dustin/go-humanize v1.0.1
|
|
## explicit; go 1.16
|
|
github.com/dustin/go-humanize
|
|
# github.com/google/uuid v1.6.0
|
|
## explicit
|
|
github.com/google/uuid
|
|
# github.com/kami/hexis v0.0.0 => /home/kami/apps/hexis
|
|
## explicit; go 1.25.5
|
|
github.com/kami/hexis/pkg/client
|
|
# github.com/mattn/go-isatty v0.0.20
|
|
## explicit; go 1.15
|
|
github.com/mattn/go-isatty
|
|
# github.com/ncruces/go-strftime v1.0.0
|
|
## explicit; go 1.17
|
|
github.com/ncruces/go-strftime
|
|
# github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec
|
|
## explicit; go 1.12
|
|
github.com/remyoudompheng/bigfft
|
|
# github.com/robfig/cron/v3 v3.0.1
|
|
## explicit; go 1.12
|
|
github.com/robfig/cron/v3
|
|
# github.com/yalue/onnxruntime_go v1.31.0
|
|
## explicit; go 1.19
|
|
github.com/yalue/onnxruntime_go
|
|
# golang.org/x/sys v0.46.0
|
|
## explicit; go 1.25.0
|
|
golang.org/x/sys/unix
|
|
golang.org/x/sys/windows
|
|
# golang.org/x/text v0.40.0
|
|
## explicit; go 1.25.0
|
|
golang.org/x/text/transform
|
|
golang.org/x/text/unicode/norm
|
|
# modernc.org/libc v1.74.1
|
|
## explicit; go 1.25.0
|
|
modernc.org/libc
|
|
modernc.org/libc/errno
|
|
modernc.org/libc/fcntl
|
|
modernc.org/libc/fts
|
|
modernc.org/libc/grp
|
|
modernc.org/libc/honnef.co/go/netdb
|
|
modernc.org/libc/langinfo
|
|
modernc.org/libc/limits
|
|
modernc.org/libc/netdb
|
|
modernc.org/libc/netinet/in
|
|
modernc.org/libc/poll
|
|
modernc.org/libc/pthread
|
|
modernc.org/libc/pwd
|
|
modernc.org/libc/signal
|
|
modernc.org/libc/stdio
|
|
modernc.org/libc/stdlib
|
|
modernc.org/libc/sys/socket
|
|
modernc.org/libc/sys/stat
|
|
modernc.org/libc/sys/types
|
|
modernc.org/libc/termios
|
|
modernc.org/libc/time
|
|
modernc.org/libc/unistd
|
|
modernc.org/libc/utime
|
|
modernc.org/libc/uuid
|
|
modernc.org/libc/uuid/uuid
|
|
modernc.org/libc/wctype
|
|
# modernc.org/mathutil v1.7.1
|
|
## explicit; go 1.21
|
|
modernc.org/mathutil
|
|
# modernc.org/memory v1.11.0
|
|
## explicit; go 1.23.0
|
|
modernc.org/memory
|
|
# modernc.org/sqlite v1.54.0
|
|
## explicit; go 1.25.0
|
|
modernc.org/sqlite
|
|
modernc.org/sqlite/lib
|
|
modernc.org/sqlite/vtab
|