mirror of
https://gitea.com/gitea/tea.git
synced 2026-09-10 07:26:33 -04:00
c2947c23d9
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/crypto](https://pkg.go.dev/golang.org/x/crypto) | [`v0.54.0` → `v0.55.0`](https://cs.opensource.google/go/x/crypto/+/refs/tags/v0.54.0...refs/tags/v0.55.0) |  |  | --- ### Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh [CVE-2026-56854](https://nvd.nist.gov/vuln/detail/CVE-2026-56854) / [GO-2026-6303](https://pkg.go.dev/vuln/GO-2026-6303) <details> <summary>More information</summary> #### Details The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback. #### Severity Unknown #### References - [https://go.dev/issue/80213](https://go.dev/issue/80213) - [https://go.dev/cl/797040](https://go.dev/cl/797040) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6303) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/tea/pulls/1106 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com>
88 lines
3.6 KiB
Modula-2
88 lines
3.6 KiB
Modula-2
module gitea.dev/tea
|
|
|
|
go 1.26.0
|
|
|
|
toolchain go1.26.6
|
|
|
|
require (
|
|
charm.land/glamour/v2 v2.0.1
|
|
charm.land/huh/v2 v2.0.3
|
|
charm.land/lipgloss/v2 v2.0.5
|
|
code.gitea.io/gitea-vet v0.2.3
|
|
gitea.com/noerw/unidiff-comments v0.0.0-20220822113322-50f4daa0e35c
|
|
gitea.dev/sdk v1.2.0
|
|
github.com/adrg/xdg v0.5.3
|
|
github.com/araddon/dateparse v0.0.0-20210429162001-6b43995a97de
|
|
github.com/enescakir/emoji v1.0.0
|
|
github.com/go-signet/sdk-go v1.1.0
|
|
github.com/muesli/termenv v0.16.0
|
|
github.com/olekukonko/tablewriter v1.1.4
|
|
github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966
|
|
github.com/stretchr/testify v1.11.1
|
|
github.com/urfave/cli-docs/v3 v3.1.0
|
|
github.com/urfave/cli/v3 v3.10.1
|
|
golang.org/x/crypto v0.55.0
|
|
golang.org/x/oauth2 v0.36.0
|
|
golang.org/x/sys v0.47.0
|
|
golang.org/x/term v0.45.0
|
|
gopkg.in/yaml.v3 v3.0.1
|
|
)
|
|
|
|
require (
|
|
charm.land/bubbles/v2 v2.1.0 // indirect
|
|
charm.land/bubbletea/v2 v2.0.6 // indirect
|
|
github.com/42wim/httpsig v1.2.4 // indirect
|
|
github.com/alecthomas/chroma/v2 v2.24.1 // indirect
|
|
github.com/atotto/clipboard v0.1.4 // indirect
|
|
github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
|
|
github.com/aymerick/douceur v0.2.0 // indirect
|
|
github.com/catppuccin/go v0.3.0 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/charmbracelet/colorprofile v0.4.3 // indirect
|
|
github.com/charmbracelet/ultraviolet v0.0.0-20260511121909-c840852527f3 // indirect
|
|
github.com/charmbracelet/x/ansi v0.11.7 // indirect
|
|
github.com/charmbracelet/x/exp/ordered v0.1.0 // indirect
|
|
github.com/charmbracelet/x/exp/slice v0.0.0-20260511125431-fe5d686e0c99 // indirect
|
|
github.com/charmbracelet/x/exp/strings v0.1.0 // indirect
|
|
github.com/charmbracelet/x/term v0.2.2 // indirect
|
|
github.com/charmbracelet/x/termios v0.1.1 // indirect
|
|
github.com/charmbracelet/x/windows v0.2.2 // indirect
|
|
github.com/clipperhouse/displaywidth v0.11.0 // indirect
|
|
github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
|
|
github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
|
|
github.com/danieljoos/wincred v1.2.3 // indirect
|
|
github.com/davecgh/go-spew v1.1.1 // indirect
|
|
github.com/davidmz/go-pageant v1.0.2 // indirect
|
|
github.com/dlclark/regexp2 v1.12.0 // indirect
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/fatih/color v1.19.0 // indirect
|
|
github.com/goccy/go-json v0.10.6 // indirect
|
|
github.com/godbus/dbus/v5 v5.2.2 // indirect
|
|
github.com/gorilla/css v1.0.1 // indirect
|
|
github.com/hashicorp/go-version v1.9.0 // indirect
|
|
github.com/lucasb-eyer/go-colorful v1.4.0 // indirect
|
|
github.com/mattn/go-colorable v0.1.14 // indirect
|
|
github.com/mattn/go-isatty v0.0.22 // indirect
|
|
github.com/mattn/go-runewidth v0.0.23 // indirect
|
|
github.com/microcosm-cc/bluemonday v1.0.27 // indirect
|
|
github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
|
|
github.com/muesli/cancelreader v0.2.2 // indirect
|
|
github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 // indirect
|
|
github.com/olekukonko/errors v1.3.0 // indirect
|
|
github.com/olekukonko/ll v0.1.8 // indirect
|
|
github.com/pmezard/go-difflib v1.0.0 // indirect
|
|
github.com/rivo/uniseg v0.4.7 // indirect
|
|
github.com/russross/blackfriday/v2 v2.1.0 // indirect
|
|
github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
|
|
github.com/yuin/goldmark v1.8.2 // indirect
|
|
github.com/yuin/goldmark-emoji v1.0.6 // indirect
|
|
github.com/zalando/go-keyring v0.2.8 // indirect
|
|
golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
|
|
golang.org/x/net v0.57.0 // indirect
|
|
golang.org/x/sync v0.22.0 // indirect
|
|
golang.org/x/text v0.41.0 // indirect
|
|
golang.org/x/tools v0.48.0 // indirect
|
|
)
|
|
|
|
retract v1.3.3 // accidental release, tag deleted
|