diff --git a/.fossa.yml b/.fossa.yml new file mode 100644 index 000000000..0a70affa4 --- /dev/null +++ b/.fossa.yml @@ -0,0 +1 @@ +version: 3 diff --git a/.github/workflows/fossa-scan.yaml b/.github/workflows/fossa-scan.yaml new file mode 100644 index 000000000..6da37e264 --- /dev/null +++ b/.github/workflows/fossa-scan.yaml @@ -0,0 +1,26 @@ +name: FOSSA Scan +on: + pull_request: + +permissions: + repository-projects: read + contents: write + id-token: write + packages: write + actions: write + +jobs: + fossa_scan: + runs-on: ubuntu-latest + + steps: + - name: Checkout code + uses: actions/checkout@v4 + with: + ref: ${{ github.event.pull_request.head.sha }} + + - name: Install FOSSA CLI + run: | + curl -H 'Cache-Control: no-cache' https://raw.githubusercontent.com/fossas/fossa-cli/master/install-latest.sh | bash ; + export FOSSA_API_KEY=${{ secrets.FOSSA_API_KEY }}; + fossa analyze --without-default-filters --debug --revision 1.0 --branch fossa-test --unpack-archives diff --git a/go.mod b/go.mod index 5bf62ad71..4bee2371e 100644 --- a/go.mod +++ b/go.mod @@ -1,28 +1,28 @@ module github.com/kelseyhightower/confd -go 1.19 +go 1.24.2 require ( - github.com/BurntSushi/toml v1.4.0 - github.com/aws/aws-sdk-go v1.55.5 - github.com/fsnotify/fsnotify v1.7.0 + github.com/BurntSushi/toml v1.5.0 + github.com/aws/aws-sdk-go v1.55.6 + github.com/fsnotify/fsnotify v1.9.0 github.com/garyburd/redigo v1.6.4 - github.com/hashicorp/consul/api v1.29.4 - github.com/hashicorp/vault/api v1.14.0 + github.com/hashicorp/consul/api v1.32.0 + github.com/hashicorp/vault/api v1.16.0 github.com/kelseyhightower/memkv v0.1.1 github.com/samuel/go-zookeeper v0.0.0-20201211165307-7117e9ea2414 github.com/sirupsen/logrus v1.9.3 - go.etcd.io/etcd/client/v3 v3.5.15 + go.etcd.io/etcd/client/v3 v3.5.21 gopkg.in/yaml.v2 v2.4.0 ) require ( github.com/armon/go-metrics v0.4.1 // indirect - github.com/cenkalti/backoff/v3 v3.2.2 // indirect + github.com/cenkalti/backoff/v4 v4.3.0 // indirect github.com/coreos/go-semver v0.3.1 // indirect github.com/coreos/go-systemd/v22 v22.5.0 // indirect - github.com/fatih/color v1.17.0 // indirect - github.com/go-jose/go-jose/v4 v4.0.5 // indirect + github.com/fatih/color v1.18.0 // indirect + github.com/go-jose/go-jose/v4 v4.1.0 // indirect github.com/go-test/deep v1.1.0 // indirect github.com/gogo/protobuf v1.3.2 // indirect github.com/golang/protobuf v1.5.4 // indirect @@ -30,37 +30,38 @@ require ( github.com/hashicorp/go-cleanhttp v0.5.2 // indirect github.com/hashicorp/go-hclog v1.6.3 // indirect github.com/hashicorp/go-immutable-radix v1.3.1 // indirect + github.com/hashicorp/go-metrics v0.5.4 // indirect github.com/hashicorp/go-multierror v1.1.1 // indirect github.com/hashicorp/go-retryablehttp v0.7.7 // indirect github.com/hashicorp/go-rootcerts v1.0.2 // indirect - github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8 // indirect + github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 // indirect github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect - github.com/hashicorp/go-sockaddr v1.0.6 // indirect + github.com/hashicorp/go-sockaddr v1.0.7 // indirect github.com/hashicorp/go-version v1.6.0 // indirect github.com/hashicorp/golang-lru v1.0.2 // indirect - github.com/hashicorp/hcl v1.0.1-vault-5 // indirect - github.com/hashicorp/serf v0.10.1 // indirect + github.com/hashicorp/hcl v1.0.1-vault-7 // indirect + github.com/hashicorp/serf v0.10.2 // indirect github.com/jmespath/go-jmespath v0.4.0 // indirect - github.com/mattn/go-colorable v0.1.13 // indirect + github.com/mattn/go-colorable v0.1.14 // indirect github.com/mattn/go-isatty v0.0.20 // indirect github.com/mitchellh/go-homedir v1.1.0 // indirect github.com/mitchellh/mapstructure v1.5.0 // indirect github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e // indirect github.com/ryanuber/go-glob v1.0.0 // indirect - go.etcd.io/etcd/api/v3 v3.5.15 // indirect - go.etcd.io/etcd/client/pkg/v3 v3.5.11 // indirect + go.etcd.io/etcd/api/v3 v3.5.21 // indirect + go.etcd.io/etcd/client/pkg/v3 v3.5.21 // indirect go.uber.org/multierr v1.11.0 // indirect go.uber.org/zap v1.27.0 // indirect golang.org/x/crypto v0.27.0 // indirect - golang.org/x/exp v0.0.0-20240909161429-701f63a606c0 // indirect - golang.org/x/net v0.36.0 // indirect - golang.org/x/sys v0.25.0 // indirect - golang.org/x/text v0.18.0 // indirect - golang.org/x/time v0.6.0 // indirect + golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 // indirect + golang.org/x/net v0.39.0 // indirect + golang.org/x/sys v0.32.0 // indirect + golang.org/x/text v0.24.0 // indirect + golang.org/x/time v0.11.0 // indirect google.golang.org/genproto v0.0.0-20231127180814-3a041ad873d4 // indirect - google.golang.org/genproto/googleapis/api v0.0.0-20240903143218-8af14fe29dc1 // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1 // indirect - google.golang.org/grpc v1.66.1 // indirect - google.golang.org/protobuf v1.34.2 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20250407143221-ac9807e6c755 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20250407143221-ac9807e6c755 // indirect + google.golang.org/grpc v1.71.1 // indirect + google.golang.org/protobuf v1.36.6 // indirect gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f // indirect )