mirror of
https://github.com/alibaba/open-code-review.git
synced 2026-09-14 19:59:52 +08:00
Kite
2190f11fcd
Clears six high-severity Dependabot alerts on the default branch. Runtime (go.mod): - google.golang.org/grpc v1.83.0 -> v1.83.1 GHSA-vp52-pcj8-j9qc / CVE-2026-84304: heap memory exhaustion (OOM) via HTTP/2 DATA frame fragmentation. Pulled in indirectly through internal/telemetry -> otlpmetricgrpc. VS Code extension (development scope): - fast-uri 4.1.2 -> 4.1.4, resolution raised from >=4.1.2 to >=4.1.3 GHSA-f65p-4m7j-42xc / CVE-2026-75975: SSRF via malformed IPv6 normalization GHSA-fph4-wmhf-6fwf / CVE-2026-75899: SSRF via repeated hostname percent-decoding GHSA-jqff-g426-hqxp / CVE-2026-76172: host confusion via percent-encoded scheme normalization GHSA-5jgf-p345-68v8 / CVE-2026-75931: host confusion via skipped IDN canonicalization The existing >=4.1.2 resolution landed exactly on the vulnerable version, so the lower bound had to move. - browserslist 4.28.4 -> 4.28.8, new resolution >=4.28.7 <5 GHSA-73wf-gq98-2v4g / CVE-2026-73088: uncaught crash / prototype write in normalizeStats via untrusted browserslist-stats.json. The upper bound matches the existing style used for brace-expansion and linkify-it. The remaining yarn.lock churn is browserslist's own data packages (caniuse-lite, electron-to-chromium, node-releases, baseline-browser-mapping, update-browserslist-db). No unrelated package was upgraded. Dependency-only change, so no new tests accompany it. Verified with make check, make test, and the extension's build, test and lint targets.
95 lines
4.5 KiB
Modula-2
95 lines
4.5 KiB
Modula-2
module github.com/alibaba/open-code-review
|
|
|
|
go 1.25.5
|
|
|
|
require (
|
|
charm.land/bubbles/v2 v2.1.1
|
|
charm.land/bubbletea/v2 v2.0.8
|
|
charm.land/lipgloss/v2 v2.0.6
|
|
github.com/anthropics/anthropic-sdk-go v1.63.1
|
|
github.com/aws/aws-sdk-go-v2/config v1.32.35
|
|
github.com/bmatcuk/doublestar/v4 v4.10.0
|
|
github.com/charmbracelet/x/term v0.2.2
|
|
github.com/google/uuid v1.6.0
|
|
github.com/modelcontextprotocol/go-sdk v1.7.0
|
|
github.com/openai/openai-go/v3 v3.51.0
|
|
github.com/pkoukk/tiktoken-go v0.1.8
|
|
github.com/spf13/cobra v1.10.2
|
|
github.com/spf13/pflag v1.0.10
|
|
go.opentelemetry.io/otel v1.45.0
|
|
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.45.0
|
|
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.45.0
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.45.0
|
|
go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.45.0
|
|
go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.45.0
|
|
go.opentelemetry.io/otel/metric v1.45.0
|
|
go.opentelemetry.io/otel/sdk v1.45.0
|
|
go.opentelemetry.io/otel/sdk/metric v1.45.0
|
|
go.opentelemetry.io/otel/trace v1.45.0
|
|
)
|
|
|
|
require (
|
|
github.com/atotto/clipboard v0.1.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2 v1.43.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.16 // indirect
|
|
github.com/aws/aws-sdk-go-v2/credentials v1.19.34 // indirect
|
|
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.35 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.35 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.35 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.36 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.15 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.35 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/signin v1.5.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sso v1.33.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sts v1.45.4 // indirect
|
|
github.com/aws/smithy-go v1.27.6 // indirect
|
|
github.com/bahlo/generic-list-go v0.2.0 // indirect
|
|
github.com/buger/jsonparser v1.1.2 // indirect
|
|
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/charmbracelet/colorprofile v0.4.3 // indirect
|
|
github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886 // indirect
|
|
github.com/charmbracelet/x/ansi v0.11.8 // indirect
|
|
github.com/charmbracelet/x/termios v0.1.1 // indirect
|
|
github.com/charmbracelet/x/windows v0.2.2 // indirect
|
|
github.com/clipperhouse/displaywidth v0.11.0 // indirect
|
|
github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
|
|
github.com/dlclark/regexp2 v1.11.0 // indirect
|
|
github.com/go-logr/logr v1.4.4 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/google/jsonschema-go v0.4.3 // indirect
|
|
github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/invopop/jsonschema v0.14.0 // indirect
|
|
github.com/lucasb-eyer/go-colorful v1.4.1 // indirect
|
|
github.com/mattn/go-runewidth v0.0.24 // indirect
|
|
github.com/muesli/cancelreader v0.2.2 // indirect
|
|
github.com/pb33f/ordered-map/v2 v2.3.1 // indirect
|
|
github.com/rivo/uniseg v0.4.7 // indirect
|
|
github.com/segmentio/asm v1.1.3 // indirect
|
|
github.com/segmentio/encoding v0.5.4 // indirect
|
|
github.com/standard-webhooks/standard-webhooks/libraries v0.0.1 // indirect
|
|
github.com/tidwall/gjson v1.19.0 // indirect
|
|
github.com/tidwall/match v1.1.1 // indirect
|
|
github.com/tidwall/pretty v1.2.1 // indirect
|
|
github.com/tidwall/sjson v1.2.5 // indirect
|
|
github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
|
|
github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 // indirect
|
|
go.opentelemetry.io/proto/otlp v1.11.0 // indirect
|
|
go.yaml.in/yaml/v4 v4.0.0-rc.2 // indirect
|
|
golang.org/x/net v0.57.0 // indirect
|
|
golang.org/x/oauth2 v0.36.0 // indirect
|
|
golang.org/x/sync v0.22.0 // indirect
|
|
golang.org/x/sys v0.47.0 // indirect
|
|
golang.org/x/text v0.40.0 // indirect
|
|
golang.org/x/time v0.15.0 // indirect
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect
|
|
google.golang.org/grpc v1.83.1 // indirect
|
|
google.golang.org/protobuf v1.36.11 // indirect
|
|
)
|