From c774a5de283abbdfe3b227994180be6f03795297 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 13 Sep 2026 09:27:47 +0000 Subject: [PATCH 1/5] build(deps): bump github/codeql-action/init Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from c20e34f438d671fc35777cc9820dd7adf8252874 to faaca9a8f6edddba5725ffe5adefdab6669a2eca. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/c20e34f438d671fc35777cc9820dd7adf8252874...faaca9a8f6edddba5725ffe5adefdab6669a2eca) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: faaca9a8f6edddba5725ffe5adefdab6669a2eca dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- .github/workflows/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 1c6272d..f3cfe48 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -25,7 +25,7 @@ jobs: language: [javascript-typescript, go] steps: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - - uses: github/codeql-action/init@c20e34f438d671fc35777cc9820dd7adf8252874 # v3 + - uses: github/codeql-action/init@faaca9a8f6edddba5725ffe5adefdab6669a2eca # v3 with: languages: ${{ matrix.language }} - uses: github/codeql-action/autobuild@c20e34f438d671fc35777cc9820dd7adf8252874 # v3 From cf33731da7a9bd23038b561fbc32b4628712052b Mon Sep 17 00:00:00 2001 From: YashasVM Date: Mon, 12 Oct 2026 21:28:56 +0530 Subject: [PATCH 2/5] ci: align CodeQL action pins --- .github/workflows/codeql.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f3cfe48..a57ec21 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -28,5 +28,5 @@ jobs: - uses: github/codeql-action/init@faaca9a8f6edddba5725ffe5adefdab6669a2eca # v3 with: languages: ${{ matrix.language }} - - uses: github/codeql-action/autobuild@c20e34f438d671fc35777cc9820dd7adf8252874 # v3 - - uses: github/codeql-action/analyze@c20e34f438d671fc35777cc9820dd7adf8252874 # v3 + - uses: github/codeql-action/autobuild@faaca9a8f6edddba5725ffe5adefdab6669a2eca # v3 + - uses: github/codeql-action/analyze@faaca9a8f6edddba5725ffe5adefdab6669a2eca # v3 From 0b8a3e1fd68c42815b10a79f371a364e12b653f7 Mon Sep 17 00:00:00 2001 From: YashasVM Date: Mon, 12 Oct 2026 21:40:12 +0530 Subject: [PATCH 3/5] fix: update Go toolchain for security patches --- .github/workflows/ci.yml | 2 +- .github/workflows/release.yml | 4 ++-- .github/workflows/security.yml | 2 +- README.md | 2 +- go.mod | 4 ++-- go.sum | 2 ++ 6 files changed, 9 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b939127..fcf7f19 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,7 +19,7 @@ jobs: cache: npm - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: '1.26.8' + go-version: '1.26.9' cache: true - run: npm ci - run: npm test diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3c950e1..8606e21 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,7 +19,7 @@ jobs: cache: npm - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: '1.26.8' + go-version: '1.26.9' cache: true - run: npm ci - run: npm test @@ -53,7 +53,7 @@ jobs: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: '1.26.8' + go-version: '1.26.9' cache: true - name: Build env: diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index b705c6a..3008ee9 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -23,7 +23,7 @@ jobs: cache: npm - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: '1.26.8' + go-version: '1.26.9' cache: true - run: npm ci - run: npm audit --audit-level=moderate diff --git a/README.md b/README.md index 49b07cb..347edcd 100644 --- a/README.md +++ b/README.md @@ -70,7 +70,7 @@ expire on their own, and keep no file data. ## Develop -Requires Node.js 24+, npm, and Go 1.26.8+. +Requires Node.js 24+, npm, and Go 1.26.9+. ```bash npm ci diff --git a/go.mod b/go.mod index d8e9023..e599645 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/YashasVM/cd -go 1.26.8 +go 1.26.9 require ( github.com/gorilla/websocket v1.5.3 @@ -26,7 +26,7 @@ require ( github.com/pion/turn/v5 v5.1.2 // indirect github.com/wlynxg/anet v0.0.5 // indirect golang.org/x/crypto v0.57.0 // indirect - golang.org/x/net v0.59.0 // indirect + golang.org/x/net v0.60.0 // indirect golang.org/x/sys v0.48.0 // indirect golang.org/x/time v0.14.0 // indirect ) diff --git a/go.sum b/go.sum index fbcad06..1f011fa 100644 --- a/go.sum +++ b/go.sum @@ -44,6 +44,8 @@ golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues= golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI= From 424ee397c80b27a866bb5d863bfdfcb71368d052 Mon Sep 17 00:00:00 2001 From: YashasVM Date: Mon, 12 Oct 2026 21:46:27 +0530 Subject: [PATCH 4/5] chore: allow exact test fixture secret matches --- .gitleaks.toml | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/.gitleaks.toml b/.gitleaks.toml index 7bdbac3..e69de29 100644 --- a/.gitleaks.toml +++ b/.gitleaks.toml @@ -1,12 +0,0 @@ -title = "CD gitleaks configuration" - -[extend] -useDefault = true - -[[allowlists]] -description = "Historical invalid-secret test fixture" -condition = "AND" -targetRules = ["generic-api-key"] -regexTarget = "match" -regexes = ['''invalid-secret-[0-9]+'''] -paths = ['''^cdx/src/transfer/transfer_test\.go$'''] From 3c6ea92fdaf03001905e195ee6efb1217b2c6dc9 Mon Sep 17 00:00:00 2001 From: YashasVM Date: Mon, 12 Oct 2026 21:48:15 +0530 Subject: [PATCH 5/5] chore: allow exact test fixture secret matches --- .gitleaks.toml | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/.gitleaks.toml b/.gitleaks.toml index e69de29..b317231 100644 --- a/.gitleaks.toml +++ b/.gitleaks.toml @@ -0,0 +1,28 @@ +title = "CD gitleaks configuration" + +[extend] +useDefault = true + +[[allowlists]] +description = "Historical invalid-secret test fixture" +condition = "AND" +targetRules = ["generic-api-key"] +regexTarget = "match" +regexes = ['''invalid-secret-[0-9]+'''] +paths = ['''^cdx/src/transfer/transfer_test\.go$'''] + +[[allowlists]] +description = "Exact dummy values in test fixtures" +condition = "AND" +targetRules = ["generic-api-key"] +regexTarget = "secret" +regexes = ["^aO6Ww6lyA10XmqHEgQYHyA$"] +paths = ["^cmd/cdx/detach_test\\.go$"] + +[[allowlists]] +description = "Exact dummy values in test fixtures" +condition = "AND" +targetRules = ["generic-api-key"] +regexTarget = "secret" +regexes = ["^EBESExQVFhcYGRobHB0eHyAhIiMkJSYnKCkqKywtLi8$", "^iLGO6mZeaJglq0Dtlt7gVbXAxzfaRuuTB2EKU9pUzhI$", "^tv3A13vt67jg7N3OmSO\\-390R19s9pecIXKUhZ0p9IAg$"] +paths = ["^fixtures/resume\\-v2\\.json$"]