mirror of
https://github.com/alibaba/open-code-review.git
synced 2026-10-02 09:24:52 +08:00
Kite
2190f11fcd
Clears six high-severity Dependabot alerts on the default branch. Runtime (go.mod): - google.golang.org/grpc v1.83.0 -> v1.83.1 GHSA-vp52-pcj8-j9qc / CVE-2026-84304: heap memory exhaustion (OOM) via HTTP/2 DATA frame fragmentation. Pulled in indirectly through internal/telemetry -> otlpmetricgrpc. VS Code extension (development scope): - fast-uri 4.1.2 -> 4.1.4, resolution raised from >=4.1.2 to >=4.1.3 GHSA-f65p-4m7j-42xc / CVE-2026-75975: SSRF via malformed IPv6 normalization GHSA-fph4-wmhf-6fwf / CVE-2026-75899: SSRF via repeated hostname percent-decoding GHSA-jqff-g426-hqxp / CVE-2026-76172: host confusion via percent-encoded scheme normalization GHSA-5jgf-p345-68v8 / CVE-2026-75931: host confusion via skipped IDN canonicalization The existing >=4.1.2 resolution landed exactly on the vulnerable version, so the lower bound had to move. - browserslist 4.28.4 -> 4.28.8, new resolution >=4.28.7 <5 GHSA-73wf-gq98-2v4g / CVE-2026-73088: uncaught crash / prototype write in normalizeStats via untrusted browserslist-stats.json. The upper bound matches the existing style used for brace-expansion and linkify-it. The remaining yarn.lock churn is browserslist's own data packages (caniuse-lite, electron-to-chromium, node-releases, baseline-browser-mapping, update-browserslist-db). No unrelated package was upgraded. Dependency-only change, so no new tests accompany it. Verified with make check, make test, and the extension's build, test and lint targets.
95 lines
4.5 KiB
AMPL
95 lines
4.5 KiB
AMPL
module github.com/alibaba/open-code-review
|
|
|
|
go 1.25.5
|
|
|
|
require (
|
|
charm.land/bubbles/v2 v2.1.1
|
|
charm.land/bubbletea/v2 v2.0.8
|
|
charm.land/lipgloss/v2 v2.0.6
|
|
github.com/anthropics/anthropic-sdk-go v1.63.1
|
|
github.com/aws/aws-sdk-go-v2/config v1.32.35
|
|
github.com/bmatcuk/doublestar/v4 v4.10.0
|
|
github.com/charmbracelet/x/term v0.2.2
|
|
github.com/google/uuid v1.6.0
|
|
github.com/modelcontextprotocol/go-sdk v1.7.0
|
|
github.com/openai/openai-go/v3 v3.51.0
|
|
github.com/pkoukk/tiktoken-go v0.1.8
|
|
github.com/spf13/cobra v1.10.2
|
|
github.com/spf13/pflag v1.0.10
|
|
go.opentelemetry.io/otel v1.45.0
|
|
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.45.0
|
|
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.45.0
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.45.0
|
|
go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.45.0
|
|
go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.45.0
|
|
go.opentelemetry.io/otel/metric v1.45.0
|
|
go.opentelemetry.io/otel/sdk v1.45.0
|
|
go.opentelemetry.io/otel/sdk/metric v1.45.0
|
|
go.opentelemetry.io/otel/trace v1.45.0
|
|
)
|
|
|
|
require (
|
|
github.com/atotto/clipboard v0.1.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2 v1.43.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.16 // indirect
|
|
github.com/aws/aws-sdk-go-v2/credentials v1.19.34 // indirect
|
|
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.35 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.35 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.35 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.36 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.15 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.35 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/signin v1.5.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sso v1.33.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sts v1.45.4 // indirect
|
|
github.com/aws/smithy-go v1.27.6 // indirect
|
|
github.com/bahlo/generic-list-go v0.2.0 // indirect
|
|
github.com/buger/jsonparser v1.1.2 // indirect
|
|
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/charmbracelet/colorprofile v0.4.3 // indirect
|
|
github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886 // indirect
|
|
github.com/charmbracelet/x/ansi v0.11.8 // indirect
|
|
github.com/charmbracelet/x/termios v0.1.1 // indirect
|
|
github.com/charmbracelet/x/windows v0.2.2 // indirect
|
|
github.com/clipperhouse/displaywidth v0.11.0 // indirect
|
|
github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
|
|
github.com/dlclark/regexp2 v1.11.0 // indirect
|
|
github.com/go-logr/logr v1.4.4 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/google/jsonschema-go v0.4.3 // indirect
|
|
github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/invopop/jsonschema v0.14.0 // indirect
|
|
github.com/lucasb-eyer/go-colorful v1.4.1 // indirect
|
|
github.com/mattn/go-runewidth v0.0.24 // indirect
|
|
github.com/muesli/cancelreader v0.2.2 // indirect
|
|
github.com/pb33f/ordered-map/v2 v2.3.1 // indirect
|
|
github.com/rivo/uniseg v0.4.7 // indirect
|
|
github.com/segmentio/asm v1.1.3 // indirect
|
|
github.com/segmentio/encoding v0.5.4 // indirect
|
|
github.com/standard-webhooks/standard-webhooks/libraries v0.0.1 // indirect
|
|
github.com/tidwall/gjson v1.19.0 // indirect
|
|
github.com/tidwall/match v1.1.1 // indirect
|
|
github.com/tidwall/pretty v1.2.1 // indirect
|
|
github.com/tidwall/sjson v1.2.5 // indirect
|
|
github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
|
|
github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 // indirect
|
|
go.opentelemetry.io/proto/otlp v1.11.0 // indirect
|
|
go.yaml.in/yaml/v4 v4.0.0-rc.2 // indirect
|
|
golang.org/x/net v0.57.0 // indirect
|
|
golang.org/x/oauth2 v0.36.0 // indirect
|
|
golang.org/x/sync v0.22.0 // indirect
|
|
golang.org/x/sys v0.47.0 // indirect
|
|
golang.org/x/text v0.40.0 // indirect
|
|
golang.org/x/time v0.15.0 // indirect
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect
|
|
google.golang.org/grpc v1.83.1 // indirect
|
|
google.golang.org/protobuf v1.36.11 // indirect
|
|
)
|