Tags: louvri/gold
Tags
Bump grpc to v1.83.2 to clear Dependabot alerts (#20) Upgrades the indirect google.golang.org/grpc dependency in the pubsub and storage modules from v1.79.3 to v1.83.2, resolving four open Dependabot alerts: - GHSA-hrxh-6v49-42gf (high, <1.82.1) - pubsub, storage - GHSA-vp52-pcj8-j9qc (high, <=1.83.0) - pubsub, storage go mod tidy carried the transitive closure forward (otel 1.43->1.44, x/net 0.55->0.58, x/crypto 0.52->0.55, genproto, x/text, x/sys) and dropped otel/sdk and otel/sdk/metric from pubsub, which no longer reach that module's build graph. No source changes. govulncheck confirms no grpc advisory remains in either module. Claude-Session: https://claude.ai/code/session_01LmtAdcd3yy5LxF8yNYRiZQ Co-authored-by: Phillip Leonardo <phillip.leonardo@idexpress.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Bump grpc to v1.83.2 to clear Dependabot alerts (#20) Upgrades the indirect google.golang.org/grpc dependency in the pubsub and storage modules from v1.79.3 to v1.83.2, resolving four open Dependabot alerts: - GHSA-hrxh-6v49-42gf (high, <1.82.1) - pubsub, storage - GHSA-vp52-pcj8-j9qc (high, <=1.83.0) - pubsub, storage go mod tidy carried the transitive closure forward (otel 1.43->1.44, x/net 0.55->0.58, x/crypto 0.52->0.55, genproto, x/text, x/sys) and dropped otel/sdk and otel/sdk/metric from pubsub, which no longer reach that module's build graph. No source changes. govulncheck confirms no grpc advisory remains in either module. Claude-Session: https://claude.ai/code/session_01LmtAdcd3yy5LxF8yNYRiZQ Co-authored-by: Phillip Leonardo <phillip.leonardo@idexpress.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Upgrade indirect dependencies to clear Dependabot alerts (#19) * Upgrade indirect dependencies to clear Dependabot alerts Bumps golang.org/x/crypto to v0.52.0 and golang.org/x/net to v0.55.0 across the pubsub and storage modules, resolving all 28 open Dependabot alerts. go mod tidy carries golang.org/x/sys to v0.45.0 and golang.org/x/text to v0.37.0. The 26 x/crypto alerts (8 rated critical) are all in the ssh package, which gold does not use and which arrives transitively; govulncheck confirms none of the vulnerable code is reachable. Upgrading regardless to keep the dependency surface clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Fix gofmt violation in redis/client.go Removes a trailing blank line at end of file. Pre-existing and unrelated to the dependency upgrade; separated into its own commit for review. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Phillip Leonardo <phillip.leonardo@idexpress.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Upgrade indirect dependencies to clear Dependabot alerts (#19) * Upgrade indirect dependencies to clear Dependabot alerts Bumps golang.org/x/crypto to v0.52.0 and golang.org/x/net to v0.55.0 across the pubsub and storage modules, resolving all 28 open Dependabot alerts. go mod tidy carries golang.org/x/sys to v0.45.0 and golang.org/x/text to v0.37.0. The 26 x/crypto alerts (8 rated critical) are all in the ssh package, which gold does not use and which arrives transitively; govulncheck confirms none of the vulnerable code is reachable. Upgrading regardless to keep the dependency surface clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Fix gofmt violation in redis/client.go Removes a trailing blank line at end of file. Pre-existing and unrelated to the dependency upgrade; separated into its own commit for review. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Phillip Leonardo <phillip.leonardo@idexpress.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Upgrade indirect dependencies to clear Dependabot alerts (#19) * Upgrade indirect dependencies to clear Dependabot alerts Bumps golang.org/x/crypto to v0.52.0 and golang.org/x/net to v0.55.0 across the pubsub and storage modules, resolving all 28 open Dependabot alerts. go mod tidy carries golang.org/x/sys to v0.45.0 and golang.org/x/text to v0.37.0. The 26 x/crypto alerts (8 rated critical) are all in the ssh package, which gold does not use and which arrives transitively; govulncheck confirms none of the vulnerable code is reachable. Upgrading regardless to keep the dependency surface clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Fix gofmt violation in redis/client.go Removes a trailing blank line at end of file. Pre-existing and unrelated to the dependency upgrade; separated into its own commit for review. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Phillip Leonardo <phillip.leonardo@idexpress.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bump vulnerable deps (grpc, go-jose, otel/sdk) to fix Dependabot aler… …ts (#18) * Bump vulnerable dependencies to fix Dependabot alerts Resolves 4 open Dependabot alerts: - google.golang.org/grpc 1.79.2 -> 1.79.3 (critical, GHSA-auth bypass via missing leading slash in :path) in storage and pubsub - github.com/go-jose/go-jose/v4 4.1.3 -> 4.1.4 (high, panic in JWE decryption) in storage - go.opentelemetry.io/otel/sdk 1.42.0 -> 1.43.0 (high, BSD kenv PATH hijacking) in storage; sibling otel packages bumped to 1.43.0 for consistency Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Add missing go.sum entries for otel 1.43.0 in pubsub CI runs each module with GOWORK=off, so the workspace-synced otel/sdk 1.43.0 in pubsub needed independent go.sum entries. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Phillip Leonardo <phillip.leonardo@idexpress.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Bump vulnerable deps (grpc, go-jose, otel/sdk) to fix Dependabot aler… …ts (#18) * Bump vulnerable dependencies to fix Dependabot alerts Resolves 4 open Dependabot alerts: - google.golang.org/grpc 1.79.2 -> 1.79.3 (critical, GHSA-auth bypass via missing leading slash in :path) in storage and pubsub - github.com/go-jose/go-jose/v4 4.1.3 -> 4.1.4 (high, panic in JWE decryption) in storage - go.opentelemetry.io/otel/sdk 1.42.0 -> 1.43.0 (high, BSD kenv PATH hijacking) in storage; sibling otel packages bumped to 1.43.0 for consistency Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Add missing go.sum entries for otel 1.43.0 in pubsub CI runs each module with GOWORK=off, so the workspace-synced otel/sdk 1.43.0 in pubsub needed independent go.sum entries. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Phillip Leonardo <phillip.leonardo@idexpress.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Upgrade Google Cloud dependencies to v2 (#17) * Upgrade Google Cloud dependencies and fix CI for sub-module structure - Migrate pubsub from v1 to v2 (Topic→Publisher, Subscription→Subscriber) - Bump storage to latest v1.61.3 - Replace deprecated WithCredentialsJSON/WithCredentialsFile with WithAuthCredentialsJSON/WithAuthCredentialsFile for credential type safety - Update CI with path filtering, dynamic change detection, and golangci-lint - Add GOWORK=off to CI for proper sub-module isolation Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add missing go.sum entries for sub-module isolation go.sum was incomplete for GOWORK=off builds because workspace mode resolved transitive dependencies from sibling modules. Running go mod tidy with GOWORK=off ensures each module's go.sum is self-contained. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Phillip Leonardo <phillip.leonardo@idexpress.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Upgrade Google Cloud dependencies to v2 (#17) * Upgrade Google Cloud dependencies and fix CI for sub-module structure - Migrate pubsub from v1 to v2 (Topic→Publisher, Subscription→Subscriber) - Bump storage to latest v1.61.3 - Replace deprecated WithCredentialsJSON/WithCredentialsFile with WithAuthCredentialsJSON/WithAuthCredentialsFile for credential type safety - Update CI with path filtering, dynamic change detection, and golangci-lint - Add GOWORK=off to CI for proper sub-module isolation Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add missing go.sum entries for sub-module isolation go.sum was incomplete for GOWORK=off builds because workspace mode resolved transitive dependencies from sibling modules. Running go mod tidy with GOWORK=off ensures each module's go.sum is self-contained. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Phillip Leonardo <phillip.leonardo@idexpress.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Restructure into Go workspace, fix bugs, and add CI/CD (#16) * Restructure into Go workspace, fix bugs, and add CI/CD - Reorganize from monolith to Go workspace with separate modules (pubsub/, redis/, storage/) replacing old cloud_* packages - Fix Lock TTL bug: time.Duration (nanoseconds) was passed directly to Lua EX command instead of seconds, causing ~317 year TTLs - Fix security: generateUniqueValue now returns error instead of silently ignoring rand.Read failure (predictable lock tokens) - Fix security: Lock/Unlock now check script.Run errors instead of swallowing them via .Val() - Remove cleanUpCloudClient anti-pattern (os.Exit in library code) - Replace log.Printf with proper error wrapping in pubsub - Use %w instead of %v in all fmt.Errorf for proper error chains - Unexport fields on unexported structs (Go convention) - Fix all golangci-lint errcheck violations - Update all READMEs to reflect current API and module paths - Add CI workflow (lint, build, test on PR) - Add release workflow (auto-tag on merge to main) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Fix CI: use working-directory per module and install golangci-lint from source The golangci-lint-action pre-built binary targets Go 1.24 which is incompatible with Go 1.25 modules. Building from source with Go 1.25 resolves this. Also use matrix strategy and working-directory instead of cross-module build from workspace root. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Fix remaining errcheck issues and replace golangci-lint with go vet + staticcheck golangci-lint pre-built binaries target Go 1.24 which is incompatible with Go 1.25 modules. Use go vet and staticcheck (built from source with the correct Go version) instead. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Phillip Leonardo <phillip.leonardo@idexpress.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
PreviousNext