mirror of
https://github.com/docker/compose.git
synced 2026-02-09 10:09:26 +08:00
6ee7146354
full diff: https://github.com/golang/crypto/compare/v0.44.0...v0.45.0 Hello gophers, We have tagged version v0.45.0 of golang.org/x/crypto in order to address two security issues. This version fixes a vulnerability in the golang.org/x/crypto/ssh package and a vulnerability in the golang.org/x/crypto/ssh/agent package which could cause programs to consume unbounded memory or panic respectively. SSH servers parsing GSSAPI authentication requests don't validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption. Thanks to Jakub Ciolek for reporting this issue. This is CVE-2025-58181 and Go issue https://go.dev/issue/76363. SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read. Thanks to Jakub Ciolek for reporting this issue. This is CVE-2025-47914 and Go issue https://go.dev/issue/76364. Cheers, Go Security team Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
166 lines
7.8 KiB
Modula-2
166 lines
7.8 KiB
Modula-2
module github.com/docker/compose/v5
|
|
|
|
go 1.24.9
|
|
|
|
require (
|
|
github.com/AlecAivazis/survey/v2 v2.3.7
|
|
github.com/DefangLabs/secret-detector v0.0.0-20250403165618-22662109213e
|
|
github.com/Microsoft/go-winio v0.6.2
|
|
github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
|
|
github.com/buger/goterm v1.0.4
|
|
github.com/compose-spec/compose-go/v2 v2.9.2-0.20251125103817-dbfe61974b3f
|
|
github.com/containerd/console v1.0.5
|
|
github.com/containerd/containerd/v2 v2.2.1-0.20251115011841-efd86f2b0bc2
|
|
github.com/containerd/errdefs v1.0.0
|
|
github.com/containerd/platforms v1.0.0-rc.2
|
|
github.com/distribution/reference v0.6.0
|
|
github.com/docker/buildx v0.30.1
|
|
github.com/docker/cli v28.5.2+incompatible
|
|
github.com/docker/cli-docs-tool v0.10.0
|
|
github.com/docker/docker v28.5.2+incompatible
|
|
github.com/docker/go-connections v0.6.0
|
|
github.com/docker/go-units v0.5.0
|
|
github.com/eiannone/keyboard v0.0.0-20220611211555-0d226195f203
|
|
github.com/fsnotify/fsevents v0.2.0
|
|
github.com/go-viper/mapstructure/v2 v2.4.0
|
|
github.com/google/go-cmp v0.7.0
|
|
github.com/google/uuid v1.6.0
|
|
github.com/hashicorp/go-version v1.8.0
|
|
github.com/jonboulle/clockwork v0.5.0
|
|
github.com/mattn/go-shellwords v1.0.12
|
|
github.com/mitchellh/go-ps v1.0.0
|
|
github.com/moby/buildkit v0.26.2
|
|
github.com/moby/go-archive v0.1.0
|
|
github.com/moby/patternmatcher v0.6.0
|
|
github.com/moby/sys/atomicwriter v0.1.0
|
|
github.com/moby/term v0.5.2
|
|
github.com/morikuni/aec v1.0.0
|
|
github.com/opencontainers/go-digest v1.0.0
|
|
github.com/opencontainers/image-spec v1.1.1
|
|
github.com/otiai10/copy v1.14.1
|
|
github.com/sirupsen/logrus v1.9.3
|
|
github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966
|
|
github.com/spf13/cobra v1.10.1
|
|
github.com/spf13/pflag v1.0.10
|
|
github.com/stretchr/testify v1.11.1
|
|
github.com/tilt-dev/fsnotify v1.4.8-0.20220602155310-fff9c274a375
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0
|
|
go.opentelemetry.io/otel v1.38.0
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0
|
|
go.opentelemetry.io/otel/metric v1.38.0
|
|
go.opentelemetry.io/otel/sdk v1.38.0
|
|
go.opentelemetry.io/otel/trace v1.38.0
|
|
go.uber.org/goleak v1.3.0
|
|
go.uber.org/mock v0.6.0
|
|
golang.org/x/sync v0.18.0
|
|
golang.org/x/sys v0.38.0
|
|
google.golang.org/grpc v1.77.0
|
|
gopkg.in/yaml.v3 v3.0.1
|
|
gotest.tools/v3 v3.5.2
|
|
tags.cncf.io/container-device-interface v1.0.1
|
|
)
|
|
|
|
require (
|
|
github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/containerd/containerd/api v1.10.0 // indirect
|
|
github.com/containerd/continuity v0.4.5 // indirect
|
|
github.com/containerd/errdefs/pkg v0.3.0 // indirect
|
|
github.com/containerd/log v0.1.0 // indirect
|
|
github.com/containerd/ttrpc v1.2.7 // indirect
|
|
github.com/containerd/typeurl/v2 v2.2.3 // indirect
|
|
github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
|
|
github.com/davecgh/go-spew v1.1.1 // indirect
|
|
github.com/docker/distribution v2.8.3+incompatible // indirect
|
|
github.com/docker/docker-credential-helpers v0.9.3 // indirect
|
|
github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c // indirect
|
|
github.com/docker/go-metrics v0.0.1 // indirect
|
|
github.com/felixge/httpsnoop v1.0.4 // indirect
|
|
github.com/fvbommel/sortorder v1.1.0 // indirect
|
|
github.com/go-logr/logr v1.4.3 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/gofrs/flock v0.13.0 // indirect
|
|
github.com/gogo/protobuf v1.3.2 // indirect
|
|
github.com/golang-jwt/jwt/v5 v5.3.0 // indirect
|
|
github.com/golang/protobuf v1.5.4 // indirect
|
|
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
|
|
github.com/gorilla/mux v1.8.1 // indirect
|
|
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 // indirect
|
|
github.com/hashicorp/errwrap v1.1.0 // indirect
|
|
github.com/hashicorp/go-multierror v1.1.1 // indirect
|
|
github.com/in-toto/in-toto-golang v0.9.0 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf // indirect
|
|
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
|
|
github.com/klauspost/compress v1.18.1 // indirect
|
|
github.com/magiconair/properties v1.8.9 // indirect
|
|
github.com/mattn/go-colorable v0.1.14 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/mattn/go-runewidth v0.0.16 // indirect
|
|
github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b // indirect
|
|
github.com/miekg/pkcs11 v1.1.1 // indirect
|
|
github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
|
|
github.com/mitchellh/mapstructure v1.5.0 // indirect
|
|
github.com/moby/docker-image-spec v1.3.1 // indirect
|
|
github.com/moby/locker v1.0.1 // indirect
|
|
github.com/moby/sys/capability v0.4.0 // indirect
|
|
github.com/moby/sys/sequential v0.6.0 // indirect
|
|
github.com/moby/sys/signal v0.7.1 // indirect
|
|
github.com/moby/sys/symlink v0.3.0 // indirect
|
|
github.com/moby/sys/user v0.4.0 // indirect
|
|
github.com/moby/sys/userns v0.1.0 // indirect
|
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
|
github.com/otiai10/mint v1.6.3 // indirect
|
|
github.com/pelletier/go-toml v1.9.5 // indirect
|
|
github.com/pkg/errors v0.9.1 // indirect
|
|
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
|
|
github.com/pmezard/go-difflib v1.0.0 // indirect
|
|
github.com/prometheus/client_golang v1.23.2 // indirect
|
|
github.com/prometheus/client_model v0.6.2 // indirect
|
|
github.com/prometheus/common v0.66.1 // indirect
|
|
github.com/prometheus/procfs v0.16.1 // indirect
|
|
github.com/rivo/uniseg v0.2.0 // indirect
|
|
github.com/russross/blackfriday/v2 v2.1.0 // indirect
|
|
github.com/santhosh-tekuri/jsonschema/v6 v6.0.1 // indirect
|
|
github.com/secure-systems-lab/go-securesystemslib v0.9.1 // indirect
|
|
github.com/shibumi/go-pathspec v1.3.0 // indirect
|
|
github.com/theupdateframework/notary v0.7.0 // indirect
|
|
github.com/tonistiigi/dchapes-mode v0.0.0-20250318174251-73d941a28323 // indirect
|
|
github.com/tonistiigi/fsutil v0.0.0-20250605211040-586307ad452f // indirect
|
|
github.com/tonistiigi/go-csvvalue v0.0.0-20240814133006-030d3b2625d0 // indirect
|
|
github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea // indirect
|
|
github.com/tonistiigi/vt100 v0.0.0-20240514184818-90bafcd6abab // indirect
|
|
github.com/xhit/go-str2duration/v2 v2.1.0 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.63.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.38.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.38.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.38.0 // indirect
|
|
go.opentelemetry.io/otel/sdk/metric v1.38.0 // indirect
|
|
go.opentelemetry.io/proto/otlp v1.7.1 // indirect
|
|
go.yaml.in/yaml/v2 v2.4.2 // indirect
|
|
go.yaml.in/yaml/v4 v4.0.0-rc.3 // indirect
|
|
golang.org/x/crypto v0.45.0 // indirect
|
|
golang.org/x/net v0.47.0 // indirect
|
|
golang.org/x/term v0.37.0 // indirect
|
|
golang.org/x/text v0.31.0 // indirect
|
|
golang.org/x/time v0.14.0 // indirect
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20251022142026-3a174f9686a8 // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20251022142026-3a174f9686a8 // indirect
|
|
google.golang.org/protobuf v1.36.10 // indirect
|
|
gopkg.in/ini.v1 v1.67.0 // indirect
|
|
)
|
|
|
|
exclude (
|
|
// FIXME(thaJeztah): remove this once kubernetes updated their dependencies to no longer need this.
|
|
//
|
|
// For additional details, see this PR and links mentioned in that PR:
|
|
// https://github.com/kubernetes-sigs/kustomize/pull/5830#issuecomment-2569960859
|
|
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
|
|
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
|
|
)
|