From 87ba37b614ee15d9d7e214d47c68a15faeab0049 Mon Sep 17 00:00:00 2001 From: Devesh-Skyflow Date: Mon, 22 Jun 2026 10:35:14 +0530 Subject: [PATCH] SK-2871: fix outdated dependencies and security advisories - Bump Go floor 1.23.0 -> 1.25.0 and pin toolchain go1.25.11 to pull in patched crypto/tls, crypto/x509 and html/template (CVE-2026-32283, CVE-2026-32280, CVE-2026-27142). 1.23/1.24 are EOL and never receive these fixes; 1.25 is the lowest security-supported line. - Upgrade golang.org/x/net v0.41.0 -> v0.56.0 (CVE-2026-33814, HIGH); x/sys, x/text, x/tools pulled forward by tidy. - Remove ghost dependency github.com/hetiansu5/urlquery (unimported). - Replace sirupsen/logrus with stdlib log/slog in utils/logger; public API (Debug/Info/Warn/Error/SetOutput/SetLogLevel, LogLevel constants) is unchanged. Only the log-line text format differs. No source/API changes for consumers. Most consumers on the default GOTOOLCHAIN=auto pick up the new floor transparently. Co-Authored-By: Claude Opus 4.8 (1M context) --- v2/go.mod | 14 ++++++------ v2/go.sum | 25 +++++++------------- v2/utils/logger/logger.go | 48 +++++++++++++++++++++++---------------- 3 files changed, 44 insertions(+), 43 deletions(-) diff --git a/v2/go.mod b/v2/go.mod index 9faedaa..77572fc 100644 --- a/v2/go.mod +++ b/v2/go.mod @@ -1,14 +1,14 @@ module github.com/skyflowapi/skyflow-go/v2 -go 1.23.0 +go 1.25.0 + +toolchain go1.25.11 require ( github.com/golang-jwt/jwt/v4 v4.5.2 github.com/google/uuid v1.6.0 - github.com/hetiansu5/urlquery v1.2.7 github.com/onsi/ginkgo/v2 v2.23.4 github.com/onsi/gomega v1.38.0 - github.com/sirupsen/logrus v1.9.3 github.com/stretchr/testify v1.8.4 ) @@ -20,9 +20,9 @@ require ( github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect github.com/pmezard/go-difflib v1.0.0 // indirect go.uber.org/automaxprocs v1.6.0 // indirect - golang.org/x/net v0.41.0 // indirect - golang.org/x/sys v0.33.0 // indirect - golang.org/x/text v0.26.0 // indirect - golang.org/x/tools v0.33.0 // indirect + golang.org/x/net v0.56.0 // indirect + golang.org/x/sys v0.46.0 // indirect + golang.org/x/text v0.38.0 // indirect + golang.org/x/tools v0.45.0 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect ) diff --git a/v2/go.sum b/v2/go.sum index 5c6fe05..cba37b9 100644 --- a/v2/go.sum +++ b/v2/go.sum @@ -1,4 +1,3 @@ -github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY= @@ -13,8 +12,6 @@ github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 h1:BHT72Gu3keYf3ZEu2J github.com/google/pprof v0.0.0-20250403155104-27863c87afa6/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/hetiansu5/urlquery v1.2.7 h1:jn0h+9pIRqUziSPnRdK/gJK8S5TCnk+HZZx5fRHf8K0= -github.com/hetiansu5/urlquery v1.2.7/go.mod h1:wFpZdTHRdwt7mk0EM/DdZEWtEN4xf8HJoH/BLXm/PG0= github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= @@ -27,28 +24,22 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/prashantv/gostub v1.1.0 h1:BTyx3RfQjRHnUWaGF9oQos79AlQ5k8WNktv7VGvVH4g= github.com/prashantv/gostub v1.1.0/go.mod h1:A5zLQHz7ieHGG7is6LLXLz7I8+3LZzsrV0P1IAHhP5U= -github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ= -github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ= -github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= -github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk= github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo= go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs= go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8= -golang.org/x/net v0.41.0 h1:vBTly1HeNPEn3wtREYfy4GZ/NECgw2Cnl+nK6Nz3uvw= -golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA= -golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw= -golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= -golang.org/x/text v0.26.0 h1:P42AVeLghgTYr4+xUnTRKDMqpar+PtX7KWuNQL21L8M= -golang.org/x/text v0.26.0/go.mod h1:QK15LZJUUQVJxhz7wXgxSy/CJaTFjd0G+YLonydOVQA= -golang.org/x/tools v0.33.0 h1:4qz2S3zmRxbGIhDIAgjxvFutSvH5EfnsYrRBj0UI0bc= -golang.org/x/tools v0.33.0/go.mod h1:CIJMaWEY88juyUfo7UbgPqbC8rU2OqfAV1h2Qp0oMYI= +golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o= +golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec= +golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw= +golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE= +golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4= +golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8= +golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0= google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY= google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY= gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= -gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= diff --git a/v2/utils/logger/logger.go b/v2/utils/logger/logger.go index b6f1650..3f42cba 100644 --- a/v2/utils/logger/logger.go +++ b/v2/utils/logger/logger.go @@ -1,9 +1,10 @@ package logger import ( + "fmt" "io" - - "github.com/sirupsen/logrus" + "log/slog" + "os" ) type LogLevel int @@ -16,49 +17,58 @@ const ( OFF ) -var log = logrus.New() +var ( + writer io.Writer = os.Stderr + levelVar = new(slog.LevelVar) + log *slog.Logger +) func init() { - var formatter = &logrus.TextFormatter{ - FullTimestamp: true, - } - log.SetFormatter(formatter) - log.SetLevel(logrus.ErrorLevel) + levelVar.Set(slog.LevelError) + rebuild() +} + +// rebuild recreates the underlying logger. slog handlers are immutable and +// bound to a writer, so the logger must be rebuilt when the output changes. +// The level is held in a *slog.LevelVar, so level changes do not require it. +func rebuild() { + log = slog.New(slog.NewTextHandler(writer, &slog.HandlerOptions{Level: levelVar})) } func Debug(args ...interface{}) { - log.Debug(args...) + log.Debug(fmt.Sprint(args...)) } func Info(args ...interface{}) { - log.Info(args...) + log.Info(fmt.Sprint(args...)) } func Warn(args ...interface{}) { - log.Warn(args...) + log.Warn(fmt.Sprint(args...)) } func Error(args ...interface{}) { - log.Error(args...) + log.Error(fmt.Sprint(args...)) } func SetOutput(w io.Writer) { - log.SetOutput(w) + writer = w + rebuild() } func SetLogLevel(level LogLevel) { switch level { case INFO: - log.SetLevel(logrus.InfoLevel) + levelVar.Set(slog.LevelInfo) case DEBUG: - log.SetLevel(logrus.DebugLevel) + levelVar.Set(slog.LevelDebug) case WARN: - log.SetLevel(logrus.WarnLevel) + levelVar.Set(slog.LevelWarn) case ERROR: - log.SetLevel(logrus.ErrorLevel) + levelVar.Set(slog.LevelError) case OFF: - log.SetOutput(io.Discard) + SetOutput(io.Discard) default: - log.SetLevel(logrus.ErrorLevel) + levelVar.Set(slog.LevelError) } }