From fde79f0d6f5fd752d54cd33dcae73495c8ce8265 Mon Sep 17 00:00:00 2001 From: NSMBot Date: Thu, 22 Oct 2026 12:55:51 +0000 Subject: [PATCH] Update go.mod and go.sum to latest version from networkservicemesh/sdk@main PR link: https://github.com/networkservicemesh/sdk/pull/1763 Commit: 7da7564 Author: Network Service Mesh Bot Date: 2026-10-22 07:55:15 -0500 Message: - Update from update/networkservicemesh/api (#1763) * Update go.mod and go.sum to latest version from networkservicemesh/api@main PR link: https://github.com/networkservicemesh/api/pull/ Commit: c979690 Author: Botond Szirtes Date: 2026-10-22 13:38:00 +0200 Message: - Uplift grpc, x/net, x/text, x/sys to resolve CVEs (#205) - google.golang.org/grpc v1.82.1 -> v1.83.2 (CVE-2026-84303, CVE-2026-84304, CVE-2026-84445) - golang.org/x/net v0.56.0 -> v0.60.0 (CVE-2026-78659, CVE-2026-97032) - golang.org/x/text v0.39.0 -> v0.42.0 (CVE-2026-56851, v0.42.0 instead of v0.41.0 as it is the minimum required by x/net v0.60.0) - golang.org/x/sys v0.46.0 -> v0.48.0 (pulled up by x/net v0.60.0 minimum requirement) x/net v0.60.0, x/text v0.42.0 and x/sys v0.48.0 all declare go 1.26.0, so the go directive and the CI Go toolchain pins were bumped accordingly. Signed-off-by: NSMBot * Fix non-constant format string in traceLogger Infof and Warnf traceLogger.format() already applies fmt.Sprintf, so its result is final log text. Passing it on to Logger.Infof/Warnf as a format string made fmt parse it a second time, corrupting any message whose data contains a percent sign (e.g. "label=50% done" became "label=50%!d(MISSING)one"). Delegate to the non-format Info/Warn variants instead, matching what Errorf, Fatalf, Debugf and Tracef already do. This is also reported by vet's printf analyzer once the module's go directive reaches 1.26.0, which failed the golangci-lint job and, because go test runs printf as part of its default vet subset, the build-and-test and code-cov jobs as well. Signed-off-by: Botond Szirtes * Add 2026 copyright header to logruslogger The goheader linter derives the required year from the file's git modification year, so touching the file in 2026 made the existing 2021-2022 / 2023-2024 holder lines insufficient. Signed-off-by: Botond Szirtes * Bump code-cov Go toolchain pin to 1.26.0 The go directive moved to 1.26.0 when x/net v0.60.0 was pulled in, but the code-cov job still pinned setup-go to 1.25.0. GOTOOLCHAIN then downloaded a second toolchain, and the job failed with: compile: version "go1.26.0" does not match go tool version "go1.25.0" Signed-off-by: Botond Szirtes --------- Signed-off-by: NSMBot Signed-off-by: Botond Szirtes Co-authored-by: NSMBot Signed-off-by: NSMBot --- Dockerfile | 2 +- go.mod | 14 +++++++------- go.sum | 44 ++++++++++++++++++++++---------------------- 3 files changed, 30 insertions(+), 30 deletions(-) diff --git a/Dockerfile b/Dockerfile index 0879c02..d6b911c 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.25 as go +FROM golang:1.26 as go ENV GO111MODULE=on ENV CGO_ENABLED=0 ENV GOBIN=/bin diff --git a/go.mod b/go.mod index bf95723..f6e4836 100644 --- a/go.mod +++ b/go.mod @@ -1,15 +1,15 @@ module github.com/networkservicemesh/cmd-csi-driver -go 1.25.0 +go 1.26.0 require ( github.com/container-storage-interface/spec v1.7.0 github.com/kelseyhightower/envconfig v1.4.0 - github.com/networkservicemesh/sdk v0.5.1-0.20260904121949-572d69f3c19a + github.com/networkservicemesh/sdk v0.5.1-0.20261022125515-7da756454dbc github.com/pkg/errors v0.9.1 github.com/spiffe/spiffe-csi v0.2.3 github.com/stretchr/testify v1.11.1 - google.golang.org/grpc v1.82.1 + google.golang.org/grpc v1.83.2 ) require ( @@ -17,10 +17,10 @@ require ( github.com/golang/protobuf v1.5.4 // indirect github.com/kr/pretty v0.1.0 // indirect github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect - golang.org/x/net v0.56.0 // indirect - golang.org/x/sys v0.46.0 // indirect - golang.org/x/text v0.39.0 // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect + golang.org/x/net v0.60.0 // indirect + golang.org/x/sys v0.48.0 // indirect + golang.org/x/text v0.42.0 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect google.golang.org/protobuf v1.36.11 // indirect gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect diff --git a/go.sum b/go.sum index 7bea578..51e6e82 100644 --- a/go.sum +++ b/go.sum @@ -21,8 +21,8 @@ github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORN github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= -github.com/networkservicemesh/sdk v0.5.1-0.20260904121949-572d69f3c19a h1:7KTUcucnbfTrX4D4176sjBBXtBefQYd0ISOS21H/8zg= -github.com/networkservicemesh/sdk v0.5.1-0.20260904121949-572d69f3c19a/go.mod h1:cW3sYIyKzdtcuv+W7UhYCy1mZ5K1I5VXfh3MvFV/Sv0= +github.com/networkservicemesh/sdk v0.5.1-0.20261022125515-7da756454dbc h1:+yFgRcQreLuilo32tMg9RQyDyweSdkdT1HXmlAygH1E= +github.com/networkservicemesh/sdk v0.5.1-0.20261022125515-7da756454dbc/go.mod h1:iSO57RvQ+J1sn13Qbhjv0t+n9lEAGxfmwWn4Nh0jCIY= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= @@ -33,28 +33,28 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I= -go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0= -go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM= -go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY= -go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg= -go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg= -go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw= -go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A= -go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A= -go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0= -golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o= -golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec= -golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw= -golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus= -golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM= +go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= +go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= +go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= +go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= +go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58= +go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0= +go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI= +go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA= +go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= +go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= +golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= +golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI= +golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 h1:RmoJA1ujG+/lRGNfUnOMfhCy5EipVMyvUE+KNbPbTlw= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= -google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE= -google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU= +google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=