From 650fe655eb43f757c717e98c85d156ade27ede41 Mon Sep 17 00:00:00 2001 From: Gal Topper Date: Wed, 4 Nov 2026 17:17:27 +0700 Subject: [PATCH] Remediate frames image vulnerabilities MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Description IG-25353 Fixes the critical and high vulnerabilities reported for the frames image (`frames:0.13.13`) as part of the 3.7.4 security update (IG-25353, IG-25298, IG-25299). The main cause was the Dockerfile. It had a single stage, so the released image was the whole `golang:1.24-alpine` build image: the Go toolchain, the module cache, the source tree, and the `framesd` binary three times over (including a stray `framesd-v0.13.13-linux-amd64` from the release job's `make frames-bin`). The toolchain alone accounted for 20 critical and 480 high findings. ### Changes - **Two-stage Dockerfile.** `framesd` is built in `golang:1.27-alpine` with `CGO_ENABLED=0`. Only the binary is copied into `alpine:3.24`, which runs `apk upgrade` at build time. - bash stays in the runtime image, because the platform starts the container via `/bin/bash` (see IG-23283 and #673). - The released binary was already built with `CGO_ENABLED=0`. Setting it explicitly keeps the same behavior (static binary, pure-Go DNS resolver), and it can't clash with the runtime image's libc. - `go.mod`/`go.sum` are copied and downloaded before the source, so the module download is cached as a separate layer. - **Go 1.27.** Go 1.24 no longer gets security fixes, and several stdlib fixes are only available in 1.26.10+/1.27.3+. CI (`pr.yaml`, `release.yaml`) is updated to match. - **Go dependencies:** - `google.golang.org/grpc` 1.79.3 → 1.85.0 - `golang.org/x/net` 0.48.0 → 0.62.0 - `golang.org/x/text` 0.32.0 → 0.43.0 - `github.com/valyala/fasthttp` 1.44.0 → 1.77.0 - `github.com/klauspost/compress` 1.15.9 → 1.20.3 - fasthttp 1.77.0 replaced `github.com/andybalholm/brotli` (vulnerable 1.0.4) with `github.com/molecule-man/go-brrr`, so brotli is no longer a dependency. - **Release workflow.** Removed the `release-docker-internal` job, which pushed to the defunct IGZ Artifactory (`artifactory.iguazeng.com:6555`). The PyPI job now depends on `release-docker`, so it no longer waits on that push. The platform pulls frames from `gcr.io/iguazio` (`dockerRepos.iguazio_b` in avrez-manifest), and 3.7.4 and 3.8.0 resolve `~0.13.0`. Releasing 0.13.14 is therefore enough, with no avrez-manifest change. - **`.dockerignore` / `.gitignore`.** Local config, build outputs, IDE files and the Python client are kept out of the build context. Local config and build outputs are also kept out of git. The patterns are anchored to the repo root, so `cmd/framesd/` isn't affected. ### Trivy scan Trivy 0.76.1, critical/high only: | Image | OS | Go | Critical | High | |---|---|---|---|---| | `gcr.io/iguazio/frames:0.13.13` | Alpine 3.23.0 | 1.24.11 | 28 | 607 | | This PR (local build) | Alpine 3.24.3 | 1.27.3 | 0 | 0 | The new image has no findings at any severity. Image size went from 1.09 GB to 61.7 MB. ### Testing On a local build of the image: - `framesd` starts with `config_example.yaml`, and the HTTP (8080), gRPC (8081) and profiling (8082) servers listen. - `/bin/bash` is present and works. - An HTTPS request from inside the container succeeds, using the stock Alpine CA bundle. - `/usr/local/go`, `/go` and `/frames` are absent, and `/usr/local/bin/framesd` is the only `framesd` file. - `go version -m` shows go1.27.3 with `CGO_ENABLED=0`, and `ldd` reports a static binary. --- .dockerignore | 9 ++++ .github/workflows/pr.yaml | 4 +- .github/workflows/release.yaml | 33 ++------------ .gitignore | 8 ++++ cmd/framesd/Dockerfile | 14 ++++-- go.mod | 22 +++++----- go.sum | 79 +++++++++++----------------------- 7 files changed, 68 insertions(+), 101 deletions(-) diff --git a/.dockerignore b/.dockerignore index 6b8710a7..95a14920 100644 --- a/.dockerignore +++ b/.dockerignore @@ -1 +1,10 @@ .git +.github +.idea +**/.DS_Store +clients +config.yaml +Pipfile +Pipfile.lock +/framesd +/framesd-* diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml index 77ddc344..21cdc387 100644 --- a/.github/workflows/pr.yaml +++ b/.github/workflows/pr.yaml @@ -37,7 +37,7 @@ jobs: runs-on: [ self-hosted, Linux ] if: ${{ contains( github.event.pull_request.labels.*.name, 'safe-to-test') }} container: - image: golang:1.24-alpine + image: golang:1.27-alpine credentials: username: ${{ secrets.DOCKER_HUB_USERNAME }} password: ${{ secrets.DOCKER_HUB_TOKEN }} @@ -109,7 +109,7 @@ jobs: - uses: actions/setup-go@v3 with: - go-version: "^1.24.3" + go-version: "^1.27.3" - name: Run Python tests run: make test-py diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index f8184ff2..85d23587 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -27,7 +27,7 @@ jobs: name: Lint & test Go code runs-on: [ self-hosted, Linux ] container: - image: golang:1.24-alpine + image: golang:1.27-alpine credentials: username: ${{ secrets.DOCKER_HUB_USERNAME }} password: ${{ secrets.DOCKER_HUB_TOKEN }} @@ -100,7 +100,7 @@ jobs: - uses: actions/setup-go@v3 with: - go-version: "^1.24.3" + go-version: "^1.27.3" - name: Run Python tests run: make test-py @@ -131,7 +131,7 @@ jobs: - uses: actions/setup-go@v3 with: - go-version: "^1.24.3" + go-version: "^1.27.3" - name: Build binaries for ${{ matrix.go-os }} run: make frames-bin @@ -165,37 +165,12 @@ jobs: - name: Push frames image to GCR run: docker push gcr.io/iguazio/frames:${{ env.FRAMES_TAG }} - release-docker-internal: - name: Release to internal docker repository - runs-on: [ self-hosted, linux ] - if: github.event_name == 'release' - needs: - - release-docker - - steps: - - name: Login to artifactory - run: docker login -u ${{ secrets.ARTIFACTORY_DOCKER_USERNAME }} -p ${{ secrets.ARTIFACTORY_DOCKER_PASSWORD }} ${{ vars.ARTIFACTORY_REGISTRY }} - - - name: Set image tag - run: | - echo FRAMES_TAG=`echo ${{ github.event.release.tag_name }} | sed s/^v//` >> $GITHUB_ENV - cat $GITHUB_ENV - - - name: Pull docker from public repository - run: docker pull gcr.io/iguazio/frames:${{ env.FRAMES_TAG }} - - - name: Tag frames image for artifactory - run: docker tag gcr.io/iguazio/frames:${{ env.FRAMES_TAG }} ${{ vars.ARTIFACTORY_REGISTRY }}/iguazio/frames:${{ env.FRAMES_TAG }} - - - name: Push frames image to artifactory - run: docker push ${{ vars.ARTIFACTORY_REGISTRY }}/iguazio/frames:${{ env.FRAMES_TAG }} - release-python-library: name: Release python library runs-on: ubuntu-latest if: github.event_name == 'release' needs: - - release-docker-internal + - release-docker steps: - uses: actions/checkout@v4 diff --git a/.gitignore b/.gitignore index 7b4ccb1d..87263037 100644 --- a/.gitignore +++ b/.gitignore @@ -148,3 +148,11 @@ dmypy.json # Pyre type checker .pyre/ + +# macOS +.DS_Store + +# Local framesd config and build outputs +/config.yaml +/framesd +/framesd-* diff --git a/cmd/framesd/Dockerfile b/cmd/framesd/Dockerfile index a76f41d2..455fedb1 100644 --- a/cmd/framesd/Dockerfile +++ b/cmd/framesd/Dockerfile @@ -18,14 +18,20 @@ # You can also use -e V3IO_GRPC_PORT=9999 and -e V3IO_HTTP_PORT=9998 to set ports # (don't forget to update the -p accordingly) -FROM --platform=linux/amd64 golang:1.24-alpine AS build +FROM --platform=linux/amd64 golang:1.27-alpine AS build WORKDIR /frames +COPY go.mod go.sum ./ +RUN go mod download COPY . . ARG FRAMES_VERSION=unknown -RUN GOOS=linux GOARCH=amd64 go build -ldflags="-X main.Version=${FRAMES_VERSION}" ./cmd/framesd -RUN cp framesd /usr/local/bin -RUN apk add bash +RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-X main.Version=${FRAMES_VERSION}" -o /usr/local/bin/framesd ./cmd/framesd + +FROM --platform=linux/amd64 alpine:3.24 + +# bash is required: the platform starts the framesd container via /bin/bash (IG-23283) +RUN apk upgrade --no-cache && apk add --no-cache bash +COPY --from=build /usr/local/bin/framesd /usr/local/bin/framesd VOLUME /etc/framesd ENV V3IO_GRPC_PORT=8081 diff --git a/go.mod b/go.mod index 625d49f6..3b14f9da 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/v3io/frames -go 1.24.0 +go 1.27.0 require ( github.com/ghodss/yaml v1.0.0 @@ -12,30 +12,30 @@ require ( github.com/stretchr/testify v1.8.4 github.com/v3io/v3io-go v0.3.12 github.com/v3io/v3io-tsdb v0.15.0 - github.com/valyala/fasthttp v1.44.0 + github.com/valyala/fasthttp v1.77.0 github.com/xwb1989/sqlparser v0.0.0-20180606152119-120387863bf2 - golang.org/x/text v0.32.0 - google.golang.org/grpc v1.79.3 - google.golang.org/protobuf v1.36.10 + golang.org/x/text v0.43.0 + google.golang.org/grpc v1.85.0 + google.golang.org/protobuf v1.36.12 ) require ( - github.com/andybalholm/brotli v1.0.4 // indirect github.com/cespare/xxhash v1.1.0 // indirect github.com/davecgh/go-spew v1.1.1 // indirect github.com/imdario/mergo v0.3.7 // indirect - github.com/klauspost/compress v1.15.9 // indirect + github.com/klauspost/compress v1.20.3 // indirect github.com/logrusorgru/aurora/v4 v4.0.0 // indirect + github.com/molecule-man/go-brrr v1.3.0 // indirect github.com/pmezard/go-difflib v1.0.0 // indirect github.com/rcrowley/go-metrics v0.0.0-20181016184325-3113b8401b8a // indirect github.com/rogpeppe/go-internal v1.14.1 // indirect github.com/valyala/bytebufferpool v1.0.0 // indirect go.uber.org/multierr v1.11.0 // indirect go.uber.org/zap v1.27.0 // indirect - golang.org/x/net v0.48.0 // indirect - golang.org/x/sync v0.19.0 // indirect - golang.org/x/sys v0.39.0 // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect + golang.org/x/net v0.62.0 // indirect + golang.org/x/sync v0.24.0 // indirect + golang.org/x/sys v0.49.0 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1 // indirect gopkg.in/yaml.v2 v2.2.8 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect zombiezen.com/go/capnproto2 v2.17.0+incompatible // indirect diff --git a/go.sum b/go.sum index 8b520a8d..238e2dc6 100644 --- a/go.sum +++ b/go.sum @@ -1,37 +1,29 @@ github.com/OneOfOne/xxhash v1.2.2 h1:KMrpdQIwFcEqXDklaen+P1axHaj9BSKzvpUUfnHldSE= github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU= -github.com/andybalholm/brotli v1.0.4 h1:V7DdXeJtZscaqfNuAdSRuRFzuiKlHSC/Zh3zl9qY3JY= -github.com/andybalholm/brotli v1.0.4/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig= github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko= github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc= -github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= -github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk= github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04= -github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= -github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= -github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= -github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= github.com/golang/groupcache v0.0.0-20191027212112-611e8accdfc9 h1:uHTyIjqVhYRhLbJ8nIiOJHkEZZ+5YoOsAbD3sk82NiE= github.com/golang/groupcache v0.0.0-20191027212112-611e8accdfc9/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek= github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= -github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= -github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/imdario/mergo v0.3.7 h1:Y+UAYTZ7gDEuOfhxKWy+dvb5dRQ6rJjFSdX2HZY1/gI= github.com/imdario/mergo v0.3.7/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA= -github.com/klauspost/compress v1.15.9 h1:wKRjX6JRtDdrE9qwa4b/Cip7ACOshUI4smpCQanqjSY= -github.com/klauspost/compress v1.15.9/go.mod h1:PhcZ0MbTNciWF3rruxRgKxI5NkcHHrHUDtV4Yw2GlzU= +github.com/klauspost/compress v1.20.3 h1:zWNoFqq/lSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4= +github.com/klauspost/compress v1.20.3/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= github.com/logrusorgru/aurora/v4 v4.0.0 h1:sRjfPpun/63iADiSvGGjgA1cAYegEWMPCJdUpJYn9JA= github.com/logrusorgru/aurora/v4 v4.0.0/go.mod h1:lP0iIa2nrnT/qoFXcOZSrZQpJ1o6n2CUf/hyHi2Q4ZQ= +github.com/molecule-man/go-brrr v1.3.0 h1:KEGPkUk9PYFw5+Sv/evCOSU5OmMDXCGFqQ9YjRB7GeU= +github.com/molecule-man/go-brrr v1.3.0/go.mod h1:7ybW6/7gA3oKY45jOfVNjSJDtrr6ea4tzbsTkjmQDC4= github.com/nuclio/errors v0.0.4 h1:Uf/Kfje0VJGYeuNAhuFNaL6bm0O1WCQOg8vEjiY85oQ= github.com/nuclio/errors v0.0.4/go.mod h1:KV56dHK50bOG4+fSUvCZA9D9Ky4utc5LBGGDCpxa8dY= github.com/nuclio/logger v0.0.1 h1:e+vT/Ug65RC+u0QX2J+lq3P57ZBwJ1ZA6Q2LCEcViwE= @@ -62,55 +54,32 @@ github.com/v3io/v3io-tsdb v0.15.0 h1:KY/QgK5prxDWAf9UPlCKo9tWav3y55CqSSAIPqZjEjY github.com/v3io/v3io-tsdb v0.15.0/go.mod h1:51u02Redt1xkXQRapnnwFdD4lklnzUOSR6+CrbjbCMQ= github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw= github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc= -github.com/valyala/fasthttp v1.44.0 h1:R+gLUhldIsfg1HokMuQjdQ5bh9nuXHPIfvkYUu9eR5Q= -github.com/valyala/fasthttp v1.44.0/go.mod h1:f6VbjjoI3z1NDOZOv17o6RvtRSWxC77seBFc2uWtgiY= -github.com/valyala/tcplisten v1.0.0/go.mod h1:T0xQ8SeCZGxckz9qRXTfG43PvQ/mcWh7FwZEA7Ioqkc= -go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= -go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/otel v1.39.0 h1:8yPrr/S0ND9QEfTfdP9V+SiwT4E0G7Y5MO7p85nis48= -go.opentelemetry.io/otel v1.39.0/go.mod h1:kLlFTywNWrFyEdH0oj2xK0bFYZtHRYUdv1NklR/tgc8= -go.opentelemetry.io/otel/metric v1.39.0 h1:d1UzonvEZriVfpNKEVmHXbdf909uGTOQjA0HF0Ls5Q0= -go.opentelemetry.io/otel/metric v1.39.0/go.mod h1:jrZSWL33sD7bBxg1xjrqyDjnuzTUB0x1nBERXd7Ftcs= -go.opentelemetry.io/otel/sdk v1.39.0 h1:nMLYcjVsvdui1B/4FRkwjzoRVsMK8uL/cj0OyhKzt18= -go.opentelemetry.io/otel/sdk v1.39.0/go.mod h1:vDojkC4/jsTJsE+kh+LXYQlbL8CgrEcwmt1ENZszdJE= -go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2WKg+sEJTtB8= -go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew= -go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI= -go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA= +github.com/valyala/fasthttp v1.77.0 h1:6mxBJdHabRmU4Cmw79Uqhgvjzsp6pjOaQk2t8COflzo= +github.com/valyala/fasthttp v1.77.0/go.mod h1:m8oTPC8riDDky07invpl+Gz3RixnAN5BbwyUuVB5H2o= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0= go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y= go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8= go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E= -golang.org/x/crypto v0.0.0-20220214200702-86341886e292/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= -golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= -golang.org/x/net v0.0.0-20220906165146-f3363e06e74c/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk= -golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU= -golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY= -golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4= -golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= -golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk= -golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= -golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= -golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= -golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU= -golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY= -golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= -gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk= -gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E= -google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 h1:gRkg/vSppuSQoDjxyiGfN4Upv/h/DQmIR10ZU8dh4Ww= -google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk= -google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE= -google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ= -google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE= -google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= +golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY= +golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI= +golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA= +golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= +golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA= +golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc= +golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s= +golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI= +golang.org/x/tools v0.51.0/go.mod h1:9eEncMayCV6zRMGhR5eZEC2iBx98qWcF1HZ9Z7wJOoA= +gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= +gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1 h1:utmqiUzZAEINbLmRyAt1QjVkMyLQ+lvIwCpLaB1rZfw= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/grpc v1.85.0 h1:BPBCfuVRQ1qvBhKDOq9uvQllMvO59rKsYhXpp7Dd8vw= +google.golang.org/grpc v1.85.0/go.mod h1:0rQrOD58yjal/0EaVbGBANindixsCZNQPDV3VKtaKuQ= +google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= +google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=