From d19b4013a788eb94b378668b2b0281d19d8992ad Mon Sep 17 00:00:00 2001 From: Michael Primeaux Date: Mon, 14 Sep 2026 18:28:49 -0500 Subject: [PATCH] debt: Upgraded dependencies to latest supported versions. --- .goreleaser.yaml | 5 +- CHANGELOG/CHANGELOG-1.x.md | 14 ++++++ README.md | 4 +- go.mod | 8 ++-- go.sum | 16 +++---- vendor/github.com/sixafter/nanoid/.gitignore | 4 +- vendor/github.com/sixafter/nanoid/README.md | 4 +- .../github.com/sixafter/prng-chacha/README.md | 4 +- vendor/golang.org/x/sys/cpu/cpu.go | 21 ++++++--- vendor/golang.org/x/sys/cpu/cpu_gc_riscv64.go | 11 +++++ .../golang.org/x/sys/cpu/cpu_linux_ppc64x.go | 4 ++ .../golang.org/x/sys/cpu/cpu_linux_riscv64.go | 11 +++++ .../golang.org/x/sys/cpu/cpu_netbsd_amd64.go | 47 +++++++++++++++++++ vendor/golang.org/x/sys/cpu/cpu_other_x86.go | 2 +- vendor/golang.org/x/sys/cpu/cpu_riscv64.s | 17 +++++++ vendor/golang.org/x/sys/cpu/cpu_sparc64.go | 12 +++++ vendor/modules.txt | 12 ++--- 17 files changed, 163 insertions(+), 33 deletions(-) create mode 100644 vendor/golang.org/x/sys/cpu/cpu_gc_riscv64.go create mode 100644 vendor/golang.org/x/sys/cpu/cpu_netbsd_amd64.go create mode 100644 vendor/golang.org/x/sys/cpu/cpu_riscv64.s create mode 100644 vendor/golang.org/x/sys/cpu/cpu_sparc64.go diff --git a/.goreleaser.yaml b/.goreleaser.yaml index 31544ff..2ec2ce5 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -465,7 +465,10 @@ homebrew_casks: # Used when the domains of `url` and `homepage` differ. # Templates: allowed. - verified: "github.com/sixafter/nanoid-cli/" + # + # Deprecated by Homebrew (>= 7.0): `brew` warns on the `verified` parameter + # and ignores it, directing casks to the default URL verification behaviour. + #verified: "github.com/sixafter/nanoid-cli/" # Download strategy or format specification # See official Cask Cookbook for allowed values. diff --git a/CHANGELOG/CHANGELOG-1.x.md b/CHANGELOG/CHANGELOG-1.x.md index 93c81c2..322c340 100644 --- a/CHANGELOG/CHANGELOG-1.x.md +++ b/CHANGELOG/CHANGELOG-1.x.md @@ -19,6 +19,19 @@ Date format: `YYYY-MM-DD` --- +## [1.48.2] - 2026-09-14 + +### Added +### Changed +- **debt:** Upgraded dependencies to their latest stable versions. + +### Deprecated +### Removed +### Fixed +### Security + +--- + ## [1.48.1] - 2026-09-02 ### Added @@ -881,6 +894,7 @@ Date format: `YYYY-MM-DD` ### Security [Unreleased]: https://github.com/sixafter/nanoid-cli/compare/v1.48.1...HEAD +[1.48.2]: https://github.com/sixafter/nanoid-cli/compare/v1.48.1...v1.48.2 [1.48.1]: https://github.com/sixafter/nanoid-cli/compare/v1.48.0...v1.48.1 [1.48.0]: https://github.com/sixafter/nanoid-cli/compare/v1.47.6...v1.48.0 [1.47.6]: https://github.com/sixafter/nanoid-cli/compare/v1.47.5...v1.47.6 diff --git a/README.md b/README.md index 57a71c6..2db129e 100644 --- a/README.md +++ b/README.md @@ -34,10 +34,10 @@ using the [NanoID](https://github.com/sixafter/nanoid) Go implementation. To verify the integrity of the release, you can use Cosign to check the signature and checksums. Follow these steps: ```sh -# Fetch the latest release tag from GitHub API (e.g., "v1.48.1") +# Fetch the latest release tag from GitHub API (e.g., "v1.48.2") TAG=$(curl -s https://api.github.com/repos/sixafter/nanoid-cli/releases/latest | jq -r .tag_name) -# Remove leading "v" for filenames (e.g., "v1.48.1" -> "1.48.1") +# Remove leading "v" for filenames (e.g., "v1.48.2" -> "1.48.2") VERSION=${TAG#v} # --------------------------------------------------------------------- diff --git a/go.mod b/go.mod index 59ec3ac..c98ece0 100644 --- a/go.mod +++ b/go.mod @@ -9,7 +9,7 @@ go 1.27 require ( github.com/dustin/go-humanize v1.0.1 - github.com/sixafter/nanoid v1.65.0 + github.com/sixafter/nanoid v1.65.1 github.com/sixafter/semver v1.13.0 github.com/spf13/cobra v1.10.2 github.com/stretchr/testify v1.12.1 @@ -18,9 +18,9 @@ require ( require ( github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/sixafter/aes-ctr-drbg v1.20.0 // indirect - github.com/sixafter/prng-chacha v1.17.0 // indirect + github.com/sixafter/prng-chacha v1.17.1 // indirect github.com/spf13/pflag v1.0.10 // indirect go.yaml.in/yaml/v3 v3.0.5 // indirect - golang.org/x/crypto v0.55.0 // indirect - golang.org/x/sys v0.47.0 // indirect + golang.org/x/crypto v0.57.0 // indirect + golang.org/x/sys v0.48.0 // indirect ) diff --git a/go.sum b/go.sum index f0dbda1..cfde499 100644 --- a/go.sum +++ b/go.sum @@ -8,10 +8,10 @@ github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLf github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= github.com/sixafter/aes-ctr-drbg v1.20.0 h1:O3VbI8XFoQOqsvSfo+KYTnDz1A7cAzcHaAg0lDnXvng= github.com/sixafter/aes-ctr-drbg v1.20.0/go.mod h1:cM+89w3S8+AfWLVX+Pv0mffPmi2lkRVLIWIfTmxT4x8= -github.com/sixafter/nanoid v1.65.0 h1:hxYijATxxPiVTO7viWkRiGl5ndjjfnLQqf+B0BWzTIg= -github.com/sixafter/nanoid v1.65.0/go.mod h1:d35G7hOeeLqtHpAZhpivOUXZ69HnVrMYYfy6zsgicH8= -github.com/sixafter/prng-chacha v1.17.0 h1:jDmy8RUOHv1mMDX/vHlnj/V6nwIWIe3d1yzQBGeFW2o= -github.com/sixafter/prng-chacha v1.17.0/go.mod h1:FmglEI3IjFfFOCFLKHpkv1jVCw6WmZI2JPnaSJAiZ5w= +github.com/sixafter/nanoid v1.65.1 h1:ELKsZi7pQCGvTePYnqsxm6b9uqq9TDM6RzoNewq+TVc= +github.com/sixafter/nanoid v1.65.1/go.mod h1:vljh17w8xQUthl3wf5aa1tTHR/gRjARG3fCH7nIt73I= +github.com/sixafter/prng-chacha v1.17.1 h1:2bvVaQ/DlZiQvwlElvSrgPVBd41Dk9DRhw+95hb9h5U= +github.com/sixafter/prng-chacha v1.17.1/go.mod h1:UseR10HecjoSEcEh2T53R/NcUCbqrOzfIFgfziB9hp0= github.com/sixafter/semver v1.13.0 h1:R9DUaRrGaXw5yGQGCdkGHNmM3VI2CEKX8a3ksGKUxTM= github.com/sixafter/semver v1.13.0/go.mod h1:Ql/w/DodZgY00w4u5KxPMt39XT7AfjyZtghWwyFZ7Mw= github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU= @@ -24,10 +24,10 @@ github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUm go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= -golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M= -golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis= +golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= +golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= golang.org/x/exp v0.0.0-20260112195511-716be5621a96 h1:Z/6YuSHTLOHfNFdb8zVZomZr7cqNgTJvA8+Qz75D8gU= golang.org/x/exp v0.0.0-20260112195511-716be5621a96/go.mod h1:nzimsREAkjBCIEFtHiYkrJyT+2uy9YZJB7H1k68CXZU= -golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= -golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= +golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= diff --git a/vendor/github.com/sixafter/nanoid/.gitignore b/vendor/github.com/sixafter/nanoid/.gitignore index 0ead109..f4275e4 100644 --- a/vendor/github.com/sixafter/nanoid/.gitignore +++ b/vendor/github.com/sixafter/nanoid/.gitignore @@ -30,4 +30,6 @@ go.work.sum .DS_Store dist/ -tmp/ \ No newline at end of file +tmp/ +CLAUDE.md + diff --git a/vendor/github.com/sixafter/nanoid/README.md b/vendor/github.com/sixafter/nanoid/README.md index 675c929..84e597f 100644 --- a/vendor/github.com/sixafter/nanoid/README.md +++ b/vendor/github.com/sixafter/nanoid/README.md @@ -61,10 +61,10 @@ Please see the [nanoid-cli](https://github.com/sixafter/nanoid-cli) for a comman To verify the integrity of the release, follow these steps: ```sh -# Fetch the latest release tag from GitHub API (e.g., "v1.65.0") +# Fetch the latest release tag from GitHub API (e.g., "v1.65.1") TAG=$(curl -s https://api.github.com/repos/sixafter/nanoid/releases/latest | jq -r .tag_name) -# Remove leading "v" for filenames (e.g., "v1.65.0" -> "1.65.0") +# Remove leading "v" for filenames (e.g., "v1.65.1" -> "1.65.1") VERSION=${TAG#v} # --------------------------------------------------------------------- diff --git a/vendor/github.com/sixafter/prng-chacha/README.md b/vendor/github.com/sixafter/prng-chacha/README.md index 84d7b97..55ffda9 100644 --- a/vendor/github.com/sixafter/prng-chacha/README.md +++ b/vendor/github.com/sixafter/prng-chacha/README.md @@ -57,10 +57,10 @@ Please see the [godoc](https://pkg.go.dev/github.com/sixafter/prng-chacha) for d To verify the integrity of the release tarball, you can use Cosign to check the signature against the public key. ```sh -# Fetch the latest release tag from GitHub API (e.g., "v1.17.0") +# Fetch the latest release tag from GitHub API (e.g., "v1.17.1") TAG=$(curl -s https://api.github.com/repos/sixafter/prng-chacha/releases/latest | jq -r .tag_name) -# Remove leading "v" for filenames (e.g., "v1.17.0" -> "1.17.0") +# Remove leading "v" for filenames (e.g., "v1.17.1" -> "1.17.1") VERSION=${TAG#v} # --------------------------------------------------------------------- diff --git a/vendor/golang.org/x/sys/cpu/cpu.go b/vendor/golang.org/x/sys/cpu/cpu.go index f1ce515..df8dbd1 100644 --- a/vendor/golang.org/x/sys/cpu/cpu.go +++ b/vendor/golang.org/x/sys/cpu/cpu.go @@ -182,12 +182,13 @@ var MIPS64X struct { // require kernel support to work (DARN, SCV), so there are feature bits for // those as well. The struct is padded to avoid false sharing. var PPC64 struct { - _ CacheLinePad - HasDARN bool // Hardware random number generator (requires kernel enablement) - HasSCV bool // Syscall vectored (requires kernel enablement) - IsPOWER8 bool // ISA v2.07 (POWER8) - IsPOWER9 bool // ISA v3.00 (POWER9), implies IsPOWER8 - _ CacheLinePad + _ CacheLinePad + HasDARN bool // Hardware random number generator (requires kernel enablement) + HasSCV bool // Syscall vectored (requires kernel enablement) + IsPOWER8 bool // ISA v2.07 (POWER8) + IsPOWER9 bool // ISA v3.00 (POWER9), implies IsPOWER8 + IsPOWER10 bool // ISA v3.1 (POWER10 and POWER11; POWER11 did not add a new architected level), implies IsPOWER9 + _ CacheLinePad } // S390X contains the supported CPU features of the current IBM Z @@ -248,13 +249,21 @@ var RISCV64 struct { HasZvks bool // ShangMi Algorithm Suite HasZvksc bool // ShangMi Algorithm Suite with carryless multiplication HasZvksg bool // ShangMi Algorithm Suite with GCM + VLENB uint // Vector register length in bytes, 0 if undetected _ CacheLinePad } +// doDerived, if non-nil, is called after processing GODEBUG to set "derived" +// feature flags. +var doDerived func() + func init() { archInit() initOptions() processOptions() + if doDerived != nil { + doDerived() + } } // options contains the cpu debug options that can be used in GODEBUG. diff --git a/vendor/golang.org/x/sys/cpu/cpu_gc_riscv64.go b/vendor/golang.org/x/sys/cpu/cpu_gc_riscv64.go new file mode 100644 index 0000000..3d660dd --- /dev/null +++ b/vendor/golang.org/x/sys/cpu/cpu_gc_riscv64.go @@ -0,0 +1,11 @@ +// Copyright 2026 The Go Authors. All rights reserved. +// Use of this source code is governed by a BSD-style +// license that can be found in the LICENSE file. + +//go:build gc + +package cpu + +// Can only be called when the vector extension is present. +// Implemented in cpu_riscv64.s. +func readVLENB() uint diff --git a/vendor/golang.org/x/sys/cpu/cpu_linux_ppc64x.go b/vendor/golang.org/x/sys/cpu/cpu_linux_ppc64x.go index 197188e..70b3dc7 100644 --- a/vendor/golang.org/x/sys/cpu/cpu_linux_ppc64x.go +++ b/vendor/golang.org/x/sys/cpu/cpu_linux_ppc64x.go @@ -11,6 +11,7 @@ const ( // ISA Level _PPC_FEATURE2_ARCH_2_07 = 0x80000000 _PPC_FEATURE2_ARCH_3_00 = 0x00800000 + _PPC_FEATURE2_ARCH_3_1 = 0x00040000 // CPU features _PPC_FEATURE2_DARN = 0x00200000 @@ -21,6 +22,9 @@ func doinit() { // HWCAP2 feature bits PPC64.IsPOWER8 = isSet(hwCap2, _PPC_FEATURE2_ARCH_2_07) PPC64.IsPOWER9 = isSet(hwCap2, _PPC_FEATURE2_ARCH_3_00) + // ISA 3.1 covers both POWER10 and POWER11: POWER11 did not introduce a + // new architected HWCAP level, so there is no separate IsPOWER11. + PPC64.IsPOWER10 = isSet(hwCap2, _PPC_FEATURE2_ARCH_3_1) PPC64.HasDARN = isSet(hwCap2, _PPC_FEATURE2_DARN) PPC64.HasSCV = isSet(hwCap2, _PPC_FEATURE2_SCV) } diff --git a/vendor/golang.org/x/sys/cpu/cpu_linux_riscv64.go b/vendor/golang.org/x/sys/cpu/cpu_linux_riscv64.go index f4fb52e..53e9091 100644 --- a/vendor/golang.org/x/sys/cpu/cpu_linux_riscv64.go +++ b/vendor/golang.org/x/sys/cpu/cpu_linux_riscv64.go @@ -130,6 +130,9 @@ func doinit() { RISCV64.HasFastMisaligned = v == riscv_HWPROBE_MISALIGNED_FAST } } + if RISCV64.HasV { + RISCV64.VLENB = readVLENB() + } // Let's double check with HWCAP if the C extension does not appear to be supported. // This may happen if we're running on a kernel older than 6.4. @@ -137,6 +140,14 @@ func doinit() { if !RISCV64.HasC { RISCV64.HasC = isSet(hwCap, hwcap_RISCV_ISA_C) } + + doDerived = func() { + // If the vector extension is disabled by GODEBUG, then the VLENB is zero. + if !RISCV64.HasV { + RISCV64.VLENB = 0 + } + } + } func isSet(hwc uint, value uint) bool { diff --git a/vendor/golang.org/x/sys/cpu/cpu_netbsd_amd64.go b/vendor/golang.org/x/sys/cpu/cpu_netbsd_amd64.go new file mode 100644 index 0000000..4f981b1 --- /dev/null +++ b/vendor/golang.org/x/sys/cpu/cpu_netbsd_amd64.go @@ -0,0 +1,47 @@ +// Copyright 2026 The Go Authors. All rights reserved. +// Use of this source code is governed by a BSD-style +// license that can be found in the LICENSE file. + +//go:build netbsd && amd64 && gc + +package cpu + +func doinit() { + // NetBSD corrupts avx registers when receiving signals. + // See issue 80285. + // TODO: when NetBSD fixes the bug, add a version + // check and skip here. + X86.HasAVX = false + X86.HasAVX2 = false + // Set these also, just to be safe + X86.HasAVXVNNI = false + X86.HasAVX512 = false + X86.HasAVX512F = false + X86.HasAVX512CD = false + X86.HasAVX512CD = false + X86.HasAVX512ER = false + X86.HasAVX512PF = false + X86.HasAVX512VL = false + X86.HasAVX512BW = false + X86.HasAVX512DQ = false + X86.HasAVX512IFMA = false + X86.HasAVX512VBMI = false + X86.HasAVX5124VNNIW = false + X86.HasAVX5124FMAPS = false + X86.HasAVX512VPOPCNTDQ = false + X86.HasAVX512VPCLMULQDQ = false + X86.HasAVX512VNNI = false + X86.HasAVX512GFNI = false + X86.HasAVX512VAES = false + X86.HasAVX512VBMI2 = false + X86.HasAVX512BITALG = false + X86.HasAVX512BF16 = false + X86.HasAVXIFMA = false + X86.HasAVXVNNI = false + X86.HasAVXVNNIInt8 = false + +} + +func darwinSupportsAVX512() bool { + panic("only implemented for gc && amd64 && darwin") +} diff --git a/vendor/golang.org/x/sys/cpu/cpu_other_x86.go b/vendor/golang.org/x/sys/cpu/cpu_other_x86.go index a0fd7e2..82b7580 100644 --- a/vendor/golang.org/x/sys/cpu/cpu_other_x86.go +++ b/vendor/golang.org/x/sys/cpu/cpu_other_x86.go @@ -2,7 +2,7 @@ // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. -//go:build 386 || amd64p32 || (amd64 && (!darwin || !gc)) +//go:build 386 || amd64p32 || (amd64 && ((!darwin && !netbsd) || !gc)) package cpu diff --git a/vendor/golang.org/x/sys/cpu/cpu_riscv64.s b/vendor/golang.org/x/sys/cpu/cpu_riscv64.s new file mode 100644 index 0000000..b092fb2 --- /dev/null +++ b/vendor/golang.org/x/sys/cpu/cpu_riscv64.s @@ -0,0 +1,17 @@ +// Copyright 2026 The Go Authors. All rights reserved. +// Use of this source code is governed by a BSD-style +// license that can be found in the LICENSE file. + +//go:build gc + +#include "textflag.h" + +// Read the vector register length in bytes from the vlenb CSR. +// May only be called when the vector extension is present. +// func readVLENB() uint +TEXT ·readVLENB(SB), NOSPLIT|NOFRAME, $0-8 + // Go 1.25's assembler does not recognize VLENB, so use its raw CSRR encoding. + // Replace WORD with CSRR VLENB, X10 once go.mod requires Go 1.27. + WORD $0xc2202573 + MOV X10, ret+0(FP) + RET diff --git a/vendor/golang.org/x/sys/cpu/cpu_sparc64.go b/vendor/golang.org/x/sys/cpu/cpu_sparc64.go new file mode 100644 index 0000000..0199ef1 --- /dev/null +++ b/vendor/golang.org/x/sys/cpu/cpu_sparc64.go @@ -0,0 +1,12 @@ +// Copyright 2026 The Go Authors. All rights reserved. +// Use of this source code is governed by a BSD-style +// license that can be found in the LICENSE file. + +//go:build sparc64 + +package cpu + +// The L1 line is 32 bytes; false sharing is governed by the 64-byte L2 line. +const cacheLineSize = 64 + +func initOptions() {} diff --git a/vendor/modules.txt b/vendor/modules.txt index 00a8a21..63e1738 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -7,10 +7,10 @@ github.com/inconshreveable/mousetrap # github.com/sixafter/aes-ctr-drbg v1.20.0 ## explicit; go 1.27 github.com/sixafter/aes-ctr-drbg -# github.com/sixafter/nanoid v1.65.0 +# github.com/sixafter/nanoid v1.65.1 ## explicit; go 1.27 github.com/sixafter/nanoid -# github.com/sixafter/prng-chacha v1.17.0 +# github.com/sixafter/prng-chacha v1.17.1 ## explicit; go 1.27 github.com/sixafter/prng-chacha # github.com/sixafter/semver v1.13.0 @@ -31,10 +31,10 @@ github.com/stretchr/testify/internal/spew # go.yaml.in/yaml/v3 v3.0.5 ## explicit; go 1.16 go.yaml.in/yaml/v3 -# golang.org/x/crypto v0.55.0 -## explicit; go 1.25.0 +# golang.org/x/crypto v0.57.0 +## explicit; go 1.26.0 golang.org/x/crypto/chacha20 golang.org/x/crypto/internal/alias -# golang.org/x/sys v0.47.0 -## explicit; go 1.25.0 +# golang.org/x/sys v0.48.0 +## explicit; go 1.26.0 golang.org/x/sys/cpu