From c2ea35ef328795647cfaabaf33e2ce74032f6e07 Mon Sep 17 00:00:00 2001 From: Alex Goodman Date: Mon, 12 Oct 2026 15:00:02 -0400 Subject: [PATCH 01/12] chore: add COPYRIGHT file and update CONTRIBUTORS.md (#5414) Fixes #5394 Signed-off-by: Alex Goodman --- CONTRIBUTORS.md | 2 +- COPYRIGHT | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) create mode 100644 COPYRIGHT diff --git a/CONTRIBUTORS.md b/CONTRIBUTORS.md index 30c2d98f2..a51b6bc5c 100644 --- a/CONTRIBUTORS.md +++ b/CONTRIBUTORS.md @@ -1,6 +1,6 @@ # Syft Contributors -The following Syft components were contributed by external authors/organizations. +This file credits notable contributions from external authors and organizations; see `git log` for everyone who has contributed to Syft. ## GraalVM Native Image diff --git a/COPYRIGHT b/COPYRIGHT new file mode 100644 index 000000000..de40a28ac --- /dev/null +++ b/COPYRIGHT @@ -0,0 +1,4 @@ +Copyright (c) Anchore, Inc. + +See LICENSE for the full license text. +See CONTRIBUTORS.md and git log for a full list of contributors. From f8ffa7382e39a43304bd944930f8e48967ca576b Mon Sep 17 00:00:00 2001 From: Alex Goodman Date: Mon, 12 Oct 2026 15:57:20 -0400 Subject: [PATCH 02/12] chore: bump go-make module and action together (#5415) The go-make module and its action need to move in lockstep, but dependabot bumps them in separate PRs that drift apart. Automation now bumps both together, so dependabot ignores go-make in both ecosystems. Signed-off-by: Alex Goodman --- .github/dependabot.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 638268f38..3f620286f 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -24,6 +24,8 @@ updates: # v1 changed SlicesAsSets hashing, which changes every artifact ID syft produces - dependency-name: "github.com/gohugoio/hashstructure" update-types: ["version-update:semver-major"] + # go-make module and action refs are bumped together by automation + - dependency-name: "github.com/anchore/go-make" - package-ecosystem: "github-actions" directories: @@ -37,3 +39,6 @@ updates: open-pull-requests-limit: 10 labels: - "dependencies" + ignore: + # go-make module and action refs are bumped together by automation + - dependency-name: "anchore/go-make/*" From 07752f0741f311ac9178636d7f9fd878b4a44b7a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 12 Oct 2026 20:21:35 +0000 Subject: [PATCH 03/12] chore(deps): bump github.com/go-git/go-git/v5 from 5.19.2 to 5.19.3 (#5416) Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.19.2 to 5.19.3. - [Release notes](https://github.com/go-git/go-git/releases) - [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md) - [Commits](https://github.com/go-git/go-git/compare/v5.19.2...v5.19.3) --- updated-dependencies: - dependency-name: github.com/go-git/go-git/v5 dependency-version: 5.19.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 5 ++--- go.sum | 10 ++++------ 2 files changed, 6 insertions(+), 9 deletions(-) diff --git a/go.mod b/go.mod index ea067a62b..3dedf99dc 100644 --- a/go.mod +++ b/go.mod @@ -42,7 +42,7 @@ require ( github.com/github/go-spdx/v2 v2.7.0 github.com/gkampitakis/go-snaps v0.5.23 github.com/go-git/go-billy/v5 v5.9.2 - github.com/go-git/go-git/v5 v5.19.2 + github.com/go-git/go-git/v5 v5.19.3 github.com/go-test/deep v1.1.1 github.com/go-viper/mapstructure/v2 v2.5.0 github.com/goccy/go-yaml v1.19.2 @@ -224,7 +224,6 @@ require ( github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect github.com/json-iterator/go v1.1.12 // indirect github.com/kevinburke/ssh_config v1.2.0 // indirect - github.com/klauspost/cpuid/v2 v2.3.0 // indirect github.com/klauspost/pgzip v1.2.6 // indirect github.com/kr/pretty v0.3.1 // indirect github.com/kr/text v0.2.0 // indirect @@ -270,7 +269,7 @@ require ( github.com/pelletier/go-toml/v2 v2.4.3 // indirect github.com/pierrec/lz4/v4 v4.1.26 // indirect github.com/piprate/json-gold v0.7.0 // indirect - github.com/pjbgf/sha1cd v0.6.0 // indirect + github.com/pjbgf/sha1cd v0.7.0 // indirect github.com/pkg/errors v0.9.1 // indirect github.com/pkg/profile v1.7.0 // indirect github.com/pkg/xattr v0.4.12 // indirect diff --git a/go.sum b/go.sum index bc204bb81..0a8c9b4c2 100644 --- a/go.sum +++ b/go.sum @@ -438,8 +438,8 @@ github.com/go-git/go-billy/v5 v5.9.2 h1:OXFSRyz4g20upsGDJgQG9Bak1l/ZEv8GHVYB52O7 github.com/go-git/go-billy/v5 v5.9.2/go.mod h1:ExsU+jcGwXTBOnyilvAnEM1wug1IxHr4yP2ZXsNRtV0= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII= -github.com/go-git/go-git/v5 v5.19.2 h1:wkfn7vOlUBu8ivAWKBWisTiwJK4jYHzTF8Ndv1LyGqY= -github.com/go-git/go-git/v5 v5.19.2/go.mod h1:QqCBE1EFN5ddFmrliLQ3/ntRCUjZU3EJuwuB/jWEHjk= +github.com/go-git/go-git/v5 v5.19.3 h1:qHttbZ+Am7wEjdTpR1XMQ4rl42FK9SIXzZ4o9x7s6M4= +github.com/go-git/go-git/v5 v5.19.3/go.mod h1:Ye4C8dVigkqrv9UsB4NMdSLV4yAIkLiIhW61gcOyhl4= github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU= github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8= github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8= @@ -669,8 +669,6 @@ github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0 github.com/klauspost/compress v1.20.1 h1:T7kKElXUMXrUJ2E9QhQhxFtcK5rPyLdsGZvdbLMPdiQ= github.com/klauspost/compress v1.20.1/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI= github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek= -github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y= -github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0= github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU= github.com/klauspost/pgzip v1.2.6/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs= github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ= @@ -823,8 +821,8 @@ github.com/pierrec/lz4/v4 v4.1.26 h1:GrpZw1gZttORinvzBdXPUXATeqlJjqUG/D87TKMnhjY github.com/pierrec/lz4/v4 v4.1.26/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4= github.com/piprate/json-gold v0.7.0 h1:bEMirgA5y8Z2loTQfxyIFfY+EflxH1CTP6r/KIlcJNw= github.com/piprate/json-gold v0.7.0/go.mod h1:RVhE35veDX19r5gfUAR+IYHkAUuPwJO8Ie/qVeFaIzw= -github.com/pjbgf/sha1cd v0.6.0 h1:3WJ8Wz8gvDz29quX1OcEmkAlUg9diU4GxJHqs0/XiwU= -github.com/pjbgf/sha1cd v0.6.0/go.mod h1:lhpGlyHLpQZoxMv8HcgXvZEhcGs0PG/vsZnEJ7H0iCM= +github.com/pjbgf/sha1cd v0.7.0 h1:ZRNPKHj+gfkLBf0KJv/p1Hmz+7bqCT5o311YX0nq+DA= +github.com/pjbgf/sha1cd v0.7.0/go.mod h1:pKR5Li+qTCo+ebqITZfwPlJGoCFCvSO00qxjbNtTUFQ= github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA= github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= From 46bac23392c25d290fbb2f78bb38d671325bb55e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 12 Oct 2026 20:23:06 +0000 Subject: [PATCH 04/12] chore(deps): bump golang.org/x/tools from 0.50.0 to 0.51.0 (#5417) Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.50.0 to 0.51.0. - [Release notes](https://github.com/golang/tools/releases) - [Commits](https://github.com/golang/tools/compare/v0.50.0...v0.51.0) --- updated-dependencies: - dependency-name: golang.org/x/tools dependency-version: 0.51.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 3dedf99dc..afd53af5c 100644 --- a/go.mod +++ b/go.mod @@ -96,7 +96,7 @@ require ( golang.org/x/mod v0.41.0 golang.org/x/net v0.59.0 golang.org/x/time v0.16.0 - golang.org/x/tools v0.50.0 + golang.org/x/tools v0.51.0 modernc.org/sqlite v1.60.1 ) diff --git a/go.sum b/go.sum index 0a8c9b4c2..db93f0c82 100644 --- a/go.sum +++ b/go.sum @@ -1410,8 +1410,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58= golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk= -golang.org/x/tools v0.50.0 h1:c2ifzfcuY7L90lZ2aKd8S4K2NpASF08SZx9ZuJkHmSU= -golang.org/x/tools v0.50.0/go.mod h1:7ulVMw3831Mwi5EZD6RomGyffr4VFjuNYXf2BbCEAV0= +golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI= +golang.org/x/tools v0.51.0/go.mod h1:9eEncMayCV6zRMGhR5eZEC2iBx98qWcF1HZ9Z7wJOoA= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= From ddc490c5c5606048715f4668e8adcc4a6267df3d Mon Sep 17 00:00:00 2001 From: anchore-oss-update-bot Date: Mon, 12 Oct 2026 16:29:27 -0400 Subject: [PATCH 05/12] chore(deps): update anchore dependencies (#5387) Signed-off-by: anchore-oss-update-bot Co-authored-by: anchore-oss-update-bot --- .github/actions/bootstrap/action.yaml | 2 +- .github/workflows/validations.yaml | 6 +++--- .make/go.mod | 4 ++-- .make/go.sum | 8 ++++---- 4 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/actions/bootstrap/action.yaml b/.github/actions/bootstrap/action.yaml index a0d15846d..82a69b78c 100644 --- a/.github/actions/bootstrap/action.yaml +++ b/.github/actions/bootstrap/action.yaml @@ -30,7 +30,7 @@ runs: using: "composite" steps: - name: Setup go + go-make tooling - uses: anchore/go-make/.github/actions/setup@27a9f35f41b5fe86d68815844efd2ba816e9ba6b # v0.9.1 + uses: anchore/go-make/.github/actions/setup@abf41688f36f2cbec13105747abbe8e60f5c56ca # v0.9.3 with: go-version: ${{ inputs.go-version }} cache-key-prefix: ${{ inputs.cache-key-prefix }} diff --git a/.github/workflows/validations.yaml b/.github/workflows/validations.yaml index d576ae792..64df47f62 100644 --- a/.github/workflows/validations.yaml +++ b/.github/workflows/validations.yaml @@ -99,7 +99,7 @@ jobs: # go-make's setup only (not ./.github/actions/bootstrap): binny ships no windows release, so binny tools # are unavailable here (`make unit` skips the fixture refresh on windows) - name: Setup go + go-make tooling - uses: anchore/go-make/.github/actions/setup@27a9f35f41b5fe86d68815844efd2ba816e9ba6b # v0.9.1 + uses: anchore/go-make/.github/actions/setup@abf41688f36f2cbec13105747abbe8e60f5c56ca # v0.9.3 with: # keep in sync with the go-version default in ./.github/actions/bootstrap go-version: "1.26.2" @@ -195,7 +195,7 @@ jobs: # go-make's setup only (not ./.github/actions/bootstrap): the test only needs make + the snapshot binary - name: Setup go + go-make tooling - uses: anchore/go-make/.github/actions/setup@27a9f35f41b5fe86d68815844efd2ba816e9ba6b # v0.9.1 + uses: anchore/go-make/.github/actions/setup@abf41688f36f2cbec13105747abbe8e60f5c56ca # v0.9.3 with: # keep in sync with the go-version default in ./.github/actions/bootstrap go-version: "1.26.2" @@ -228,7 +228,7 @@ jobs: # go-make's setup only (not ./.github/actions/bootstrap): the test only needs make + the snapshot binary - name: Setup go + go-make tooling - uses: anchore/go-make/.github/actions/setup@27a9f35f41b5fe86d68815844efd2ba816e9ba6b # v0.9.1 + uses: anchore/go-make/.github/actions/setup@abf41688f36f2cbec13105747abbe8e60f5c56ca # v0.9.3 with: # keep in sync with the go-version default in ./.github/actions/bootstrap go-version: "1.26.2" diff --git a/.make/go.mod b/.make/go.mod index 47b40e8de..847e5cffc 100644 --- a/.make/go.mod +++ b/.make/go.mod @@ -2,10 +2,10 @@ module github.com/anchore/syft/.make go 1.26.0 -require github.com/anchore/go-make v0.9.1 +require github.com/anchore/go-make v0.9.3 require ( - github.com/bmatcuk/doublestar/v4 v4.10.0 // indirect + github.com/bmatcuk/doublestar/v4 v4.10.2 // indirect github.com/goccy/go-yaml v1.19.2 // indirect golang.org/x/mod v0.41.0 // indirect golang.org/x/sys v0.48.0 // indirect diff --git a/.make/go.sum b/.make/go.sum index 1c623844b..ad13f6157 100644 --- a/.make/go.sum +++ b/.make/go.sum @@ -1,7 +1,7 @@ -github.com/anchore/go-make v0.9.1 h1:OnC830XJEhdHUPhR8jLpnjmLTco9UThNZfHpLefqd94= -github.com/anchore/go-make v0.9.1/go.mod h1:1KhqPt0STAHLVEngwrXxYsuFftD62Nx497rNujwo8IY= -github.com/bmatcuk/doublestar/v4 v4.10.0 h1:zU9WiOla1YA122oLM6i4EXvGW62DvKZVxIe6TYWexEs= -github.com/bmatcuk/doublestar/v4 v4.10.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc= +github.com/anchore/go-make v0.9.3 h1:D+MkpvEJsOGwkOqKN0rd2zYi9jEzwKtZreNysH0DenI= +github.com/anchore/go-make v0.9.3/go.mod h1:4HuELygGhxex2SaCEgfCbZ0geJ3xFkqtWpmt1NrYwPg= +github.com/bmatcuk/doublestar/v4 v4.10.2 h1:eF7W7HWKg3z9NrWV9pTLnNeoXaqq3Tq9DNKXVMfoCnw= +github.com/bmatcuk/doublestar/v4 v4.10.2/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc= github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM= github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA= golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= From 30200f1d691d4e7e9f78a55e7e7298aeb2672216 Mon Sep 17 00:00:00 2001 From: Weston Steimel Date: Thu, 15 Oct 2026 12:20:55 +0100 Subject: [PATCH 06/12] fix: upgrade to golang.org/x/net v0.61.0 (#5427) Upgrade to golang.org/x/net v0.61.0 to resolve reporting of GO-2026-6612 Signed-off-by: Weston Steimel --- go.mod | 12 ++++++------ go.sum | 24 ++++++++++++------------ 2 files changed, 18 insertions(+), 18 deletions(-) diff --git a/go.mod b/go.mod index afd53af5c..f09a55359 100644 --- a/go.mod +++ b/go.mod @@ -94,7 +94,7 @@ require ( go.yaml.in/yaml/v3 v3.0.5 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f golang.org/x/mod v0.41.0 - golang.org/x/net v0.59.0 + golang.org/x/net v0.61.0 golang.org/x/time v0.16.0 golang.org/x/tools v0.51.0 modernc.org/sqlite v1.60.1 @@ -329,12 +329,12 @@ require ( go.podman.io/image/v5 v5.41.2 // indirect go.podman.io/storage v1.64.1 // indirect go4.org v0.0.0-20230225012048-214862532bf5 // indirect - golang.org/x/crypto v0.57.0 // indirect + golang.org/x/crypto v0.58.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect - golang.org/x/sync v0.23.0 // indirect - golang.org/x/sys v0.48.0 // indirect - golang.org/x/term v0.46.0 // indirect - golang.org/x/text v0.42.0 // indirect + golang.org/x/sync v0.24.0 // indirect + golang.org/x/sys v0.49.0 // indirect + golang.org/x/term v0.47.0 // indirect + golang.org/x/text v0.43.0 // indirect golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect gonum.org/v1/gonum v0.17.0 // indirect google.golang.org/api v0.294.0 // indirect diff --git a/go.sum b/go.sum index db93f0c82..250700ad1 100644 --- a/go.sum +++ b/go.sum @@ -1102,8 +1102,8 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU= golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8= golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M= -golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= -golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= +golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54= +golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8= @@ -1198,8 +1198,8 @@ golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk= golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44= golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM= -golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues= -golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= +golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw= +golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= @@ -1236,8 +1236,8 @@ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y= golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= -golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= -golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= +golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA= +golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= @@ -1317,8 +1317,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= -golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA= +golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= @@ -1328,8 +1328,8 @@ golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU= golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk= golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY= golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s= -golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE= -golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc= +golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM= +golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY= golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= @@ -1345,8 +1345,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY= -golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI= -golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= +golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc= +golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= From 758c2327166dc650bf7fb0bba13f63c41c361c25 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2026 13:24:44 +0000 Subject: [PATCH 07/12] chore(deps): bump github.com/github/go-spdx/v2 from 2.7.0 to 2.7.1 (#5434) Bumps [github.com/github/go-spdx/v2](https://github.com/github/go-spdx) from 2.7.0 to 2.7.1. - [Release notes](https://github.com/github/go-spdx/releases) - [Commits](https://github.com/github/go-spdx/compare/v2.7.0...v2.7.1) --- updated-dependencies: - dependency-name: github.com/github/go-spdx/v2 dependency-version: 2.7.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index f09a55359..5fee27507 100644 --- a/go.mod +++ b/go.mod @@ -39,7 +39,7 @@ require ( github.com/dustin/go-humanize v1.1.0 github.com/elliotchance/phpserialize v1.4.0 github.com/facebookincubator/nvdtools v0.1.5 - github.com/github/go-spdx/v2 v2.7.0 + github.com/github/go-spdx/v2 v2.7.1 github.com/gkampitakis/go-snaps v0.5.23 github.com/go-git/go-billy/v5 v5.9.2 github.com/go-git/go-git/v5 v5.19.3 diff --git a/go.sum b/go.sum index 250700ad1..abee9059a 100644 --- a/go.sum +++ b/go.sum @@ -422,8 +422,8 @@ github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxv github.com/gabriel-vasile/mimetype v1.4.15 h1:05iP/CYtZ/w455R/KZM6rZ5ieAdh99UPtd+d3YzLmaI= github.com/gabriel-vasile/mimetype v1.4.15/go.mod h1:azpTcoLcDZRNgFou5j+APrqQx9HqVPWa6ijYQIIVswQ= github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04= -github.com/github/go-spdx/v2 v2.7.0 h1:GzfXx4wFdlilARxmFRXW/mgUy3A4vSqZocCMFV6XFdQ= -github.com/github/go-spdx/v2 v2.7.0/go.mod h1:Ftc45YYG1WzpzwEPKRVm9Jv8vDqOrN4gWoCkK+bHer0= +github.com/github/go-spdx/v2 v2.7.1 h1:+siV9wnsncI5pg4otH/sKvqGL8UkcLdPh16TSJYY1V4= +github.com/github/go-spdx/v2 v2.7.1/go.mod h1:Ftc45YYG1WzpzwEPKRVm9Jv8vDqOrN4gWoCkK+bHer0= github.com/gkampitakis/ciinfo v0.3.4 h1:5eBSibVuSMbb/H6Elc0IIEFbkzCJi3lm94n0+U7Z0KY= github.com/gkampitakis/ciinfo v0.3.4/go.mod h1:1NIwaOcFChN4fa/B0hEBdAb6npDlFL8Bwx4dfRLRqAo= github.com/gkampitakis/go-snaps v0.5.23 h1:okh5QR48zpUjpWtu65AtqxdCY8huJq+dEDuUzd1PuKg= From 0f1cd9c6f2c779d9e48e9b475479473bde172db4 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2026 13:26:10 +0000 Subject: [PATCH 08/12] chore(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 (#5432) Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 7.0.1 to 7.0.2. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/validations.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/validations.yaml b/.github/workflows/validations.yaml index 64df47f62..1f4d03e24 100644 --- a/.github/workflows/validations.yaml +++ b/.github/workflows/validations.yaml @@ -171,7 +171,7 @@ jobs: run: make snapshot-smoke-test - name: Upload snapshot artifacts - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 #v7.0.2 with: name: snapshot path: snapshot/ From 83ba8304c1c825bc597c806181b3bb770499f87c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2026 13:27:06 +0000 Subject: [PATCH 09/12] chore(deps): bump github.com/gookit/color from 1.6.1 to 1.6.2 (#5435) Bumps [github.com/gookit/color](https://github.com/gookit/color) from 1.6.1 to 1.6.2. - [Release notes](https://github.com/gookit/color/releases) - [Commits](https://github.com/gookit/color/compare/v1.6.1...v1.6.2) --- updated-dependencies: - dependency-name: github.com/gookit/color dependency-version: 1.6.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 5fee27507..fd7f1a6c7 100644 --- a/go.mod +++ b/go.mod @@ -51,7 +51,7 @@ require ( github.com/google/go-containerregistry v0.22.1 github.com/google/licensecheck v0.3.1 github.com/google/uuid v1.6.0 - github.com/gookit/color v1.6.1 + github.com/gookit/color v1.6.2 github.com/gpustack/gguf-parser-go v0.26.4 github.com/hashicorp/go-cleanhttp v0.5.2 github.com/hashicorp/go-getter v1.8.9 diff --git a/go.sum b/go.sum index abee9059a..8f9405c21 100644 --- a/go.sum +++ b/go.sum @@ -575,8 +575,8 @@ github.com/googleapis/gax-go/v2 v2.24.0/go.mod h1:IaTHBDd7NHxSCiu0vEs8pQZu4dGZrW github.com/gookit/assert v0.1.1 h1:lh3GcawXe/p+cU7ESTZ5Ui3Sm/x8JWpIis4/1aF0mY0= github.com/gookit/assert v0.1.1/go.mod h1:jS5bmIVQZTIwk42uXl4lyj4iaaxx32tqH16CFj0VX2E= github.com/gookit/color v1.2.5/go.mod h1:AhIE+pS6D4Ql0SQWbBeXPHw7gY0/sjHoA4s/n1KB7xg= -github.com/gookit/color v1.6.1 h1:KoTnDxJPRgrL0SoX0f8rCFg2zI0t4E3GZZBMo2nN8LU= -github.com/gookit/color v1.6.1/go.mod h1:9ACFc7/1IpHGBW8RwuDm/0YEnhg3dwwXpoMsmtyHfjs= +github.com/gookit/color v1.6.2 h1:M6TJRJMuDFPYkrWmjOvMj+E0xIjcHq8lMPy7+vv0z1Y= +github.com/gookit/color v1.6.2/go.mod h1:9ACFc7/1IpHGBW8RwuDm/0YEnhg3dwwXpoMsmtyHfjs= github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY= github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ= github.com/gpustack/gguf-parser-go v0.26.4 h1:B9CRrQBcIB7I/MJFZvzPZ+e+cbc1xBzQJcmpi9l/mKU= From 50ea42989edf39873bdb9d9e49e52abc341e91cb Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2026 13:27:46 +0000 Subject: [PATCH 10/12] chore(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 (#5433) Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 8.0.1 to 8.0.2. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/validations.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/validations.yaml b/.github/workflows/validations.yaml index 1f4d03e24..18eb48bce 100644 --- a/.github/workflows/validations.yaml +++ b/.github/workflows/validations.yaml @@ -188,7 +188,7 @@ jobs: with: persist-credentials: false - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 #v8.0.2 with: name: snapshot path: snapshot @@ -221,7 +221,7 @@ jobs: with: persist-credentials: false - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 #v8.0.2 with: name: snapshot path: snapshot @@ -261,7 +261,7 @@ jobs: download-test-fixture-cache: true - name: Download snapshot artifacts - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 #v8.0.2 with: name: snapshot path: snapshot @@ -307,7 +307,7 @@ jobs: download-test-fixture-cache: true - name: Download snapshot artifacts - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 #v8.0.2 with: name: snapshot path: snapshot @@ -339,7 +339,7 @@ jobs: download-test-fixture-cache: true - name: Download snapshot artifacts - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 #v8.0.2 with: name: snapshot path: snapshot From a81193226ffdd07b71126dda04e753d6d2e22324 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2026 13:28:00 +0000 Subject: [PATCH 11/12] chore(deps): bump github.com/hashicorp/go-getter from 1.8.9 to 1.8.10 (#5436) Bumps [github.com/hashicorp/go-getter](https://github.com/hashicorp/go-getter) from 1.8.9 to 1.8.10. - [Release notes](https://github.com/hashicorp/go-getter/releases) - [Changelog](https://github.com/hashicorp/go-getter/blob/main/CHANGELOG.md) - [Commits](https://github.com/hashicorp/go-getter/compare/v1.8.9...v1.8.10) --- updated-dependencies: - dependency-name: github.com/hashicorp/go-getter dependency-version: 1.8.10 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 56 ++++++++++++++--------------- go.sum | 112 ++++++++++++++++++++++++++++----------------------------- 2 files changed, 84 insertions(+), 84 deletions(-) diff --git a/go.mod b/go.mod index fd7f1a6c7..14107e4b7 100644 --- a/go.mod +++ b/go.mod @@ -54,7 +54,7 @@ require ( github.com/gookit/color v1.6.2 github.com/gpustack/gguf-parser-go v0.26.4 github.com/hashicorp/go-cleanhttp v0.5.2 - github.com/hashicorp/go-getter v1.8.9 + github.com/hashicorp/go-getter v1.8.10 github.com/hashicorp/go-multierror v1.1.1 github.com/hashicorp/hcl/v2 v2.25.0 github.com/iancoleman/strcase v0.3.0 @@ -109,16 +109,16 @@ require ( require ( cel.dev/expr v0.25.2 // indirect cloud.google.com/go v0.123.0 // indirect - cloud.google.com/go/auth v0.23.2 // indirect + cloud.google.com/go/auth v0.23.3 // indirect cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect - cloud.google.com/go/compute/metadata v0.9.0 // indirect + cloud.google.com/go/compute/metadata v0.9.1 // indirect cloud.google.com/go/iam v1.12.0 // indirect cloud.google.com/go/monitoring v1.30.0 // indirect - cloud.google.com/go/storage v1.65.1 // indirect + cloud.google.com/go/storage v1.68.0 // indirect cyphar.com/go-pathrs v0.2.5 // indirect dario.cat/mergo v1.0.2 // indirect github.com/DataDog/zstd v1.5.5 // indirect - github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0 // indirect + github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.34.0 // indirect github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.57.0 // indirect github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.57.0 // indirect github.com/Masterminds/goutils v1.1.1 // indirect @@ -135,23 +135,23 @@ require ( github.com/apparentlymart/go-textseg/v17 v17.0.1 // indirect github.com/aquasecurity/go-version v0.0.1 // indirect github.com/atotto/clipboard v0.1.4 // indirect - github.com/aws/aws-sdk-go-v2 v1.44.0 // indirect + github.com/aws/aws-sdk-go-v2 v1.47.1 // indirect github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.20 // indirect - github.com/aws/aws-sdk-go-v2/config v1.32.40 // indirect - github.com/aws/aws-sdk-go-v2/credentials v1.19.39 // indirect - github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.40 // indirect - github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.40 // indirect - github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.40 // indirect - github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.41 // indirect + github.com/aws/aws-sdk-go-v2/config v1.33.6 // indirect + github.com/aws/aws-sdk-go-v2/credentials v1.20.6 // indirect + github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.1 // indirect + github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.4 // indirect + github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.4 // indirect + github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.4 // indirect github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19 // indirect - github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.10.0 // indirect - github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.40 // indirect - github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.41 // indirect - github.com/aws/aws-sdk-go-v2/service/s3 v1.108.0 // indirect - github.com/aws/aws-sdk-go-v2/service/signin v1.6.0 // indirect - github.com/aws/aws-sdk-go-v2/service/sso v1.34.0 // indirect - github.com/aws/aws-sdk-go-v2/service/ssooidc v1.39.0 // indirect - github.com/aws/aws-sdk-go-v2/service/sts v1.46.0 // indirect + github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.11.5 // indirect + github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.4 // indirect + github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.20.4 // indirect + github.com/aws/aws-sdk-go-v2/service/s3 v1.114.0 // indirect + github.com/aws/aws-sdk-go-v2/service/signin v1.10.1 // indirect + github.com/aws/aws-sdk-go-v2/service/sso v1.38.1 // indirect + github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.1 // indirect + github.com/aws/aws-sdk-go-v2/service/sts v1.51.1 // indirect github.com/aws/smithy-go v1.28.1 // indirect github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect github.com/bahlo/generic-list-go v0.2.0 // indirect @@ -211,9 +211,9 @@ require ( github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect github.com/google/go-intervals v0.0.2 // indirect github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 // indirect - github.com/google/s2a-go v0.1.9 // indirect - github.com/googleapis/enterprise-certificate-proxy v0.3.20 // indirect - github.com/googleapis/gax-go/v2 v2.24.0 // indirect + github.com/google/s2a-go v0.1.10 // indirect + github.com/googleapis/enterprise-certificate-proxy v0.3.22 // indirect + github.com/googleapis/gax-go/v2 v2.24.1 // indirect github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.74 // indirect github.com/hashicorp/errwrap v1.1.0 // indirect github.com/hashicorp/go-version v1.9.0 // indirect @@ -295,7 +295,7 @@ require ( github.com/spf13/cast v1.10.0 // indirect github.com/spf13/pflag v1.0.10 // indirect github.com/spf13/viper v1.21.0 // indirect - github.com/spiffe/go-spiffe/v2 v2.7.0 // indirect + github.com/spiffe/go-spiffe/v2 v2.8.1 // indirect github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6 // indirect github.com/stretchr/objx v0.5.3 // indirect github.com/subosito/gotenv v1.6.0 // indirect @@ -330,18 +330,18 @@ require ( go.podman.io/storage v1.64.1 // indirect go4.org v0.0.0-20230225012048-214862532bf5 // indirect golang.org/x/crypto v0.58.0 // indirect - golang.org/x/oauth2 v0.36.0 // indirect + golang.org/x/oauth2 v0.37.0 // indirect golang.org/x/sync v0.24.0 // indirect golang.org/x/sys v0.49.0 // indirect golang.org/x/term v0.47.0 // indirect golang.org/x/text v0.43.0 // indirect golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect gonum.org/v1/gonum v0.17.0 // indirect - google.golang.org/api v0.294.0 // indirect + google.golang.org/api v0.299.0 // indirect google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260825221802-da73d73af1c5 // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5 // indirect - google.golang.org/grpc v1.83.2 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260921155816-b14227669459 // indirect + google.golang.org/grpc v1.84.0 // indirect google.golang.org/protobuf v1.36.12 // indirect gopkg.in/warnings.v0 v0.1.2 // indirect modernc.org/libc v1.77.1 // indirect diff --git a/go.sum b/go.sum index 8f9405c21..989cdfa56 100644 --- a/go.sum +++ b/go.sum @@ -31,8 +31,8 @@ cloud.google.com/go v0.98.0/go.mod h1:ua6Ush4NALrHk5QXDWnjvZHN93OuF0HfuEPq9I1X0c cloud.google.com/go v0.99.0/go.mod h1:w0Xx2nLzqWJPuozYQX+hFfCSI8WioryfRDzkoI/Y2ZA= cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE= cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU= -cloud.google.com/go/auth v0.23.2 h1:pxSCpfiji41hpzpPdMCftEUCezpgpqmmDdYiAjCKXxo= -cloud.google.com/go/auth v0.23.2/go.mod h1:4DhBRcqvtljQN3dJ57qtqbib5ZGCYE5f2crfiiC2EM0= +cloud.google.com/go/auth v0.23.3 h1:UMK+oBtuNGMCR/6i6mmySUItqjOazpJrbmZyhGbGBWo= +cloud.google.com/go/auth v0.23.3/go.mod h1:fClbry28fo7XkxhSeT6AQtAVAp6Jy0fW9N99PoPNPFM= cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc= cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c= cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o= @@ -41,8 +41,8 @@ cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvf cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg= cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc= cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ= -cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs= -cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10= +cloud.google.com/go/compute/metadata v0.9.1 h1:CTE1OWBQ0vnF5uHwdFAQJvMQ0Fi/KRcqqKTo9V0F8Ik= +cloud.google.com/go/compute/metadata v0.9.1/go.mod h1:NtnlvB6X3t4R6xSWyVX/ZWk493PCxGQlhI/iqxh4M8I= cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE= cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk= cloud.google.com/go/firestore v1.6.1/go.mod h1:asNXNOzBdyVQmEU+ggO8UPodTkEVFW5Qx+rwHnAz+EY= @@ -63,8 +63,8 @@ cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0Zeo cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk= cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs= cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0= -cloud.google.com/go/storage v1.65.1 h1:LRRpBJUTf+OXDPX9jZUKZ3mSLIsz3htG+qUpeNZovyA= -cloud.google.com/go/storage v1.65.1/go.mod h1:UsS9OgFg/XHOSYakQ8ZtLWWeyGkk1WnmD/GsGfN0BHM= +cloud.google.com/go/storage v1.68.0 h1:gqrAMJ51OZjYgU6AJ2U60um90YQhSjq8HEIQNtJ4C/8= +cloud.google.com/go/storage v1.68.0/go.mod h1:UsS9OgFg/XHOSYakQ8ZtLWWeyGkk1WnmD/GsGfN0BHM= cloud.google.com/go/trace v1.16.0 h1:GmQovzFc5F0CNfl0VLgL64aoTtu7xsM0YajW2GlG9+E= cloud.google.com/go/trace v1.16.0/go.mod h1:r+bdAn16dKLSV1G2D5v3e58IlQlizfxWrUfjx7kM7X0= cyphar.com/go-pathrs v0.2.5 h1:SnX9FBvnoyn3lUs1dkMgZ52bAETpirNu3FTRh5HlRik= @@ -84,8 +84,8 @@ github.com/CycloneDX/cyclonedx-go v0.12.0/go.mod h1:V2577HhxDDCDLYfkm55WJrz16nHT github.com/DataDog/datadog-go v3.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ= github.com/DataDog/zstd v1.5.5 h1:oWf5W7GtOLgp6bciQYDmhHHjdhYkALu6S/5Ni9ZgSvQ= github.com/DataDog/zstd v1.5.5/go.mod h1:g4AWEaM3yOg3HYfnJ3YIawPnVdXJh9QME85blwSAmyw= -github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0 h1:l7+6kwRMJNwdCvYdDl7Eax+wzEYHSnNY7zrrfbhDdTA= -github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0/go.mod h1:pJTkW8hEUIIi3Pf65lPZOnn4Y81yCllX6IWk2jNXdkM= +github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.34.0 h1:yzIYdwuro811Z27D3T80Wkd3rqZzb0K43nner7Eh1yE= +github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.34.0/go.mod h1:pJTkW8hEUIIi3Pf65lPZOnn4Y81yCllX6IWk2jNXdkM= github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.57.0 h1:jLdiS1vO+XJFyDSWRHBx56r4s/NNtcl5J6KyCcWUX/w= github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.57.0/go.mod h1:8lmpHY+1VRoteiOwyrQMDt1YGXOrFKCz+1wJW7n3ODY= github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.57.0 h1:cSjUzZ7KU8hicTgzaSv9NmSyM9fTVK3y5lsBUl3wOis= @@ -175,40 +175,40 @@ github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPd github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs= github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z4= github.com/atotto/clipboard v0.1.4/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI= -github.com/aws/aws-sdk-go-v2 v1.44.0 h1:4IbaHhtzy+4h37z4JQyO9a2QsiCml3CNYHtq5hIHigo= -github.com/aws/aws-sdk-go-v2 v1.44.0/go.mod h1:bttEH6JqnUL8LepvDVfdrds/fZ5bCIxzpe3abyUrhDU= +github.com/aws/aws-sdk-go-v2 v1.47.1 h1:uOIZnp4PK3ZhKI0dNrJrhTEsLxbpXHTAJlwoS1pvAtw= +github.com/aws/aws-sdk-go-v2 v1.47.1/go.mod h1:bttEH6JqnUL8LepvDVfdrds/fZ5bCIxzpe3abyUrhDU= github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.20 h1:GPRlPwz40I2B2VrBEASOA3Bi77NyeqejNLkifosX0rs= github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.20/go.mod h1:g7PNzKcsOKWb4fkSRBA7BZVAS6Y8IcxzN+nRohhQ1Q8= -github.com/aws/aws-sdk-go-v2/config v1.32.40 h1:lAVC9gMmKusmqDRe32dPtgKl/BWvJmMJoWELKHCAObw= -github.com/aws/aws-sdk-go-v2/config v1.32.40/go.mod h1:8xOJLbe/hOj1g4PVsfJYV7O2byq+UGET1onDdUgbwqc= -github.com/aws/aws-sdk-go-v2/credentials v1.19.39 h1:XOg8LC3Kgnsa3WiPQjc7Bi8k5IBN92cPYfIV9XMFss0= -github.com/aws/aws-sdk-go-v2/credentials v1.19.39/go.mod h1:GonTDBQ+mTpCVNwaHjj0PagspfrYYMEqOx7FehoEP/I= -github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.40 h1:r5aGipEVgI9aT/tAGjdrPbDQvIAKdTrS3rUPQtG4Rmo= -github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.40/go.mod h1:vOD3CnPxAdkL6MWZeROkZsTlskklMFfgVFkHzx/oZpY= -github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.40 h1:UIXlbijuB2XK1Kr57fo8iIxCuaSHJzwZ1uo+2tbEYIk= -github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.40/go.mod h1:wcEsL6jscjZjVUinb0Q5qD/GXOG1yT3GNfmT9HuDwzU= -github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.40 h1:xLQVRDs2NddDmK9BEyh5KSlJ1Gpy5/GIJXrV6WcVGAE= -github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.40/go.mod h1:XRXnpFVFGLaEVK+olDdFIM1vNa04ETW452oFGEPUxAo= -github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.41 h1:nv/ILuCY0yXACzMQwvtt/HbqDDjemZiI0AeDbxGQlnU= -github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.41/go.mod h1:dzvOSpxaPqQ3j0xS6Lc1vyVuWW0RBj7s/QqYpzu3Q/0= +github.com/aws/aws-sdk-go-v2/config v1.33.6 h1:MBjkSTLczek/UgiK+EYPIoRTqE7gP8vtW3OFbFo7Nug= +github.com/aws/aws-sdk-go-v2/config v1.33.6/go.mod h1:grRAFzdAZJrwcbasJRg2MPvIrVjtlfXllHssN6+E1JE= +github.com/aws/aws-sdk-go-v2/credentials v1.20.6 h1:NpAFXCU7NzXNkdGK3zQTtsRJ+3v9tZQV0xcdRw8uBdw= +github.com/aws/aws-sdk-go-v2/credentials v1.20.6/go.mod h1:mcZCoiPnyMvP8VMNbygNX5lLqSlkYJIMPODylQMurOk= +github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.1 h1:8gALAAmacnIXh+z6VkdDanv4/IkG5APdg4DZLDTmLog= +github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.1/go.mod h1:Z7IJhJU+poOdJjUR2wpyY21ossQ1XS/R3Lk9Msq5kM4= +github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.4 h1:CLq4+8UHCI+ZZYl/EuJxXovaIVN2xeeT8JV+dsApQ5E= +github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.4/go.mod h1:Wv4q5sAM04xAMkoOedxLx2inVf6K5FdxYp+A61L+q/0= +github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.4 h1:dD4MR81I7YkpEBRk6UP9rocC2QnT3qVuXwzlYTtfGEs= +github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.4/go.mod h1:EcXV1kAFd5XwSkDHlj94gnF3q5CkJyYiIJfH8N0VmrE= +github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.4 h1:7Wo47d/xn/7KttCSBd8EGYeZ7ULRFRkUHr6vkZPBzVQ= +github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.4/go.mod h1:tDB2IVC1xC3vX8o+6uRlzhTxP3g1b77CZXFX/oD2FnQ= github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19 h1:bAdDl/HkGCcGPoe25ToSHEw23VIxt6CT5fLcg111BKg= github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19/go.mod h1:KaUzbLxv4CeSxh6ZCl9B4m7CuFenS8kUEaDs+f/DQr4= -github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.10.0 h1:U8/A0RRBaEspzH1uul3JHLbypXwEGUkRkvoT9f0ATcM= -github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.10.0/go.mod h1:UELStX5KwtJNtQxa+UuF8dc3z4UYc40e8yHYJSozNwY= -github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.40 h1:gr3Fw1cxZXNCdeo/lQ7isHEHzvHVM7z75qb2zW9aMjw= -github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.40/go.mod h1:8z/9CmfnQhiuXD7Ykbcg4a/whSWsniE0ODSx9uwVzfk= -github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.41 h1:Q9DIKDuJix/oJnQxFpQ26L0EwVa/YNo4k2kbktrjQjE= -github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.41/go.mod h1:x+TuqkOIG1SZS0+yN54sExGA9ZpjhPO6vPdYnpTFX1M= -github.com/aws/aws-sdk-go-v2/service/s3 v1.108.0 h1:Yp+x5PKXEmoqHsgP/pAkBy5Tyq1UlXAzM0OInh0vxWw= -github.com/aws/aws-sdk-go-v2/service/s3 v1.108.0/go.mod h1:locV6DtXyp7Xzr2BG6jtsbeBi3YAWJ/CY4xUThYmIwQ= -github.com/aws/aws-sdk-go-v2/service/signin v1.6.0 h1:agcr0j8YeFEzdXNo17Rg9MbbjLRjrimabwNtji4e+lU= -github.com/aws/aws-sdk-go-v2/service/signin v1.6.0/go.mod h1:qU5PxgQ4JiUOOMotzfO3+5oUda5W+8JDVKyLQqlrJik= -github.com/aws/aws-sdk-go-v2/service/sso v1.34.0 h1:FxaN8/sn61DTXNI6Gt678tFJUY8iUsCchm6Y/F/RjaA= -github.com/aws/aws-sdk-go-v2/service/sso v1.34.0/go.mod h1:vu4OY6s8LJtT8BtYG2LD6BGSZMptkYn3o5hvCPB22jc= -github.com/aws/aws-sdk-go-v2/service/ssooidc v1.39.0 h1:crWKPeGYTBTuBxQ3p73kjfJvt4brUIsr+Fuypko8FxY= -github.com/aws/aws-sdk-go-v2/service/ssooidc v1.39.0/go.mod h1:HjjZVhaBz0JBR/kbWKThmNDhFKS7y6EURuk493tJk9Y= -github.com/aws/aws-sdk-go-v2/service/sts v1.46.0 h1:IZ63JdogSNNjex/jsODNv7jGDcO/xJYd9FsgyfCsp1g= -github.com/aws/aws-sdk-go-v2/service/sts v1.46.0/go.mod h1:I+rwAf3spG5dITBaAo3xXRowk8kiOhtU1kYxfvCTC44= +github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.11.5 h1:/TYsZXdA8UTa+WCtCYSAJIr1vwl0+eho6TUgJGwFFO8= +github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.11.5/go.mod h1:qPqp1Uwd/BqdhPufv6oem9j5J7HNsgc2V22dUiDPn+s= +github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.4 h1:29SvnfGhXjTl8ONxFwbj2rs6lbhiFXD2CgFQmbT/bXY= +github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.4/go.mod h1:wm04I5DMuNVvZHFe/dHnUxincvNbbK7AiNBbYsQivek= +github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.20.4 h1:pPiWfgeNxqluKEph7hvU88kuGKBPOWzO+Dk9t2zqqNs= +github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.20.4/go.mod h1:YlwGoIUDG/3kBQbdNOVs/xKZ9J01G8e/6D1mRBj9uTk= +github.com/aws/aws-sdk-go-v2/service/s3 v1.114.0 h1:VMAdYqr4Jn/8ATs9BHC5riwrs0d6m1Z2ohFriSwZwm0= +github.com/aws/aws-sdk-go-v2/service/s3 v1.114.0/go.mod h1:9APRWGLFITKD+xzWSIyT9V7QV4bNlEuIieWlzXgGFlI= +github.com/aws/aws-sdk-go-v2/service/signin v1.10.1 h1:DzCCWLzcIRQ77F3DEUljud7bEjTgFOIKXP52NmVRyhU= +github.com/aws/aws-sdk-go-v2/service/signin v1.10.1/go.mod h1:xpo/geVldu8payT375WekctUzopG/hBU7miiqItMUlw= +github.com/aws/aws-sdk-go-v2/service/sso v1.38.1 h1:Umtl/0YZhng4xndfW3lKJrYYP7NLEjI6bGXVomwLcs0= +github.com/aws/aws-sdk-go-v2/service/sso v1.38.1/go.mod h1:rRD/dnm7q0HYE/I5TMaPgkWyyUGLcwuxHLABsLnQ3e0= +github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.1 h1:orIWdNiLgzrhu/11RcPPKO/SBzUUymbUQuZbSPImghg= +github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.1/go.mod h1:skwM/xsbR/1ReUTesv9BhpJp1VjajR7DWQnuVLwiXsQ= +github.com/aws/aws-sdk-go-v2/service/sts v1.51.1 h1:0HOqZXRvMytH6bFHVIc0oJX07sZjfhz0zXtjs6gdE8s= +github.com/aws/aws-sdk-go-v2/service/sts v1.51.1/go.mod h1:26zA0GhDrLo+yiLI2yXWxqB1PdsShfLikoI7GOEgugM= github.com/aws/smithy-go v1.28.1 h1:R/nXH00c8qcfCzQVELtRw+eLQWtzv+VAIEFJ1/xxXlQ= github.com/aws/smithy-go v1.28.1/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc= github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k= @@ -558,20 +558,20 @@ github.com/google/pprof v0.0.0-20240227163752-401108e1b7e7/go.mod h1:czg5+yv1E0Z github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo= github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk= github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI= -github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0= -github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM= +github.com/google/s2a-go v0.1.10 h1:EMp+aOuXN6l8cE/gjF5Bt+vyZxsUuyCWe9chDWR/+uU= +github.com/google/s2a-go v0.1.10/go.mod h1:pz4tyvwXvJLLbyrkh6FW1eS2zPUXMaTmyNhYtyP2tNw= github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/googleapis/enterprise-certificate-proxy v0.3.20 h1:t/xL64VUoN69MuMRQuJETqYGOw4Z9mSRJK9epIEtwFk= -github.com/googleapis/enterprise-certificate-proxy v0.3.20/go.mod h1:L3D/IQExI6LqEjBdXcZQ1WluSgigQmSwBboFstVPM4w= +github.com/googleapis/enterprise-certificate-proxy v0.3.22 h1:NU4XpII6jD+Dxcot94fqjE+AfJoE/lQP9q3faYGzC/c= +github.com/googleapis/enterprise-certificate-proxy v0.3.22/go.mod h1:L3D/IQExI6LqEjBdXcZQ1WluSgigQmSwBboFstVPM4w= github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg= github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk= github.com/googleapis/gax-go/v2 v2.1.0/go.mod h1:Q3nei7sK6ybPYH7twZdmQpAd1MKb7pfu6SK+H1/DsU0= github.com/googleapis/gax-go/v2 v2.1.1/go.mod h1:hddJymUZASv3XPyGkUpKj8pPO47Rmb0eJc8R6ouapiM= -github.com/googleapis/gax-go/v2 v2.24.0 h1:myMaPYyF9MecEmvQqMqomIwn9t/4KCZN9qnwsS76wlg= -github.com/googleapis/gax-go/v2 v2.24.0/go.mod h1:IaTHBDd7NHxSCiu0vEs8pQZu4dGZrWwuSoxCnk16OFM= +github.com/googleapis/gax-go/v2 v2.24.1 h1:AtqTN21IXMMWo99LiEVAiBfNNQmO40d8xUfZI640mc0= +github.com/googleapis/gax-go/v2 v2.24.1/go.mod h1:bWeBei0NVwaNZKb2y1HUBS7gLXIF3/Tu3pq7j8D2Tb0= github.com/gookit/assert v0.1.1 h1:lh3GcawXe/p+cU7ESTZ5Ui3Sm/x8JWpIis4/1aF0mY0= github.com/gookit/assert v0.1.1/go.mod h1:jS5bmIVQZTIwk42uXl4lyj4iaaxx32tqH16CFj0VX2E= github.com/gookit/color v1.2.5/go.mod h1:AhIE+pS6D4Ql0SQWbBeXPHw7gY0/sjHoA4s/n1KB7xg= @@ -593,8 +593,8 @@ github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtng github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80= github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ= github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48= -github.com/hashicorp/go-getter v1.8.9 h1:1AOTMUmz/S/GuqOTE6+bg6nwPXTEbKr3Tc/T/lVS7is= -github.com/hashicorp/go-getter v1.8.9/go.mod h1:qI7vH/m552bXutKe4UkWptOJl4bo2KeO/CSOoh4s0ps= +github.com/hashicorp/go-getter v1.8.10 h1:uufJp+uacA0fSDRxclsHkiE6yUQTKgwv5b25QexgVM8= +github.com/hashicorp/go-getter v1.8.10/go.mod h1:5HyKGCQmT+I3MGAM76vk/fWpktjwxn7xruCUr9CrVuo= github.com/hashicorp/go-hclog v0.12.0/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ= github.com/hashicorp/go-hclog v1.0.0/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ= github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60= @@ -945,8 +945,8 @@ github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3A github.com/spf13/viper v1.10.0/go.mod h1:SoyBPwAtKDzypXNDFKN5kzH7ppppbGZtls1UpIy5AsM= github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU= github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY= -github.com/spiffe/go-spiffe/v2 v2.7.0 h1:uXe1MflJoHw58wAUvxVlcM7WpKtijWG7I1UidcGh6g4= -github.com/spiffe/go-spiffe/v2 v2.7.0/go.mod h1:47Q0Q9/AqGha8QLHp+kxpH4Wca7X7EnOtlIJy3mxZ3U= +github.com/spiffe/go-spiffe/v2 v2.8.1 h1:eXZMLsu+3MLEPJyGJkolqtVrteZfQdUpOWj6LTiDl/E= +github.com/spiffe/go-spiffe/v2 v2.8.1/go.mod h1:47Q0Q9/AqGha8QLHp+kxpH4Wca7X7EnOtlIJy3mxZ3U= github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6 h1:pnnLyeX7o/5aX8qUQ69P/mLojDqwda8hFOCBTmP/6hw= github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6/go.mod h1:39R/xuhNgVhi+K0/zst4TLrJrVmbm6LVgl4A0+ZFS5M= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= @@ -1217,8 +1217,8 @@ golang.org/x/oauth2 v0.0.0-20210805134026-6f1e6394065a/go.mod h1:KelEdhl1UZF7XfJ golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= golang.org/x/oauth2 v0.0.0-20211005180243-6b3c2da341f1/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= -golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= -golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= +golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98= +golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -1452,8 +1452,8 @@ google.golang.org/api v0.57.0/go.mod h1:dVPlbZyBo2/OjBpmvNdpn2GRm6rPy75jyU7bmhdr google.golang.org/api v0.59.0/go.mod h1:sT2boj7M9YJxZzgeZqXogmhfmRWDtPzT31xkieUbuZU= google.golang.org/api v0.61.0/go.mod h1:xQRti5UdCmoCEqFxcz93fTl338AVqDgyaDRuOZ3hg9I= google.golang.org/api v0.62.0/go.mod h1:dKmwPCydfsad4qCH08MSdgWjfHOyfpd4VtDGgRFdavw= -google.golang.org/api v0.294.0 h1:8gASjJxdtcIieB3OqbkLcF0FfbXVNqKtU5iozD1ssvA= -google.golang.org/api v0.294.0/go.mod h1:02qB8+Ox1ZFzcaKFMguy1nQLJmSIyvV6Ff4txJEXtl4= +google.golang.org/api v0.299.0 h1:b3K+ydSMd0kh6TQI6bJyApRQfqQX2MfSOaVkpM59mJw= +google.golang.org/api v0.299.0/go.mod h1:zlR3GVA8b2R5nv5Ij9UWe37StVB3cxDD7DBFi4ZFsHw= google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM= google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= @@ -1528,8 +1528,8 @@ google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d h1:C9v1o0/4quuhOAf google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d/go.mod h1:Wz2wFJntZFmLGo7pLDXZ3wYk5hyc0Mb+SkHhDDXT+lU= google.golang.org/genproto/googleapis/api v0.0.0-20260825221802-da73d73af1c5 h1:izFU9hz7aeLI/Mi1J0991ae+xcwRLr7hTqWnB/9aIIU= google.golang.org/genproto/googleapis/api v0.0.0-20260825221802-da73d73af1c5/go.mod h1:3LhxRw4YYkf+ylAfgaY9JlVLFKhokkCV8duhLLe7+t0= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5 h1:1VUiZAXyC+zmiFYi+WLtBzr68Cj8wOofHjjrA/kkizc= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5/go.mod h1:DjtHYE8FKJLivXcBEjGwndXfIC23G0VpXiXKqG179uA= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260921155816-b14227669459 h1:b0xCahf3FK2m2Cv0p4vTozGPWncCvLfwV86UNg8xWU8= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260921155816-b14227669459/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc= google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c= google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38= google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM= @@ -1557,8 +1557,8 @@ google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnD google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34= google.golang.org/grpc v1.40.1/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34= google.golang.org/grpc v1.42.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU= -google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU= -google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8= +google.golang.org/grpc v1.84.0 h1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0= +google.golang.org/grpc v1.84.0/go.mod h1:ljCht0DrxQrXBDRTZp52Qxh3Ffk8CdYm2sj4O2QN2C0= google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw= google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0= From f15c3343e29dfb20cf6d82c820e7090b49808c96 Mon Sep 17 00:00:00 2001 From: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com> Date: Mon, 19 Oct 2026 14:40:43 -0400 Subject: [PATCH 12/12] Pin Gguff lib to prevent dropping packages (#5447) * test: catalog GGUF models larger than the header gguf-parser-go v0.26.3+ rejects a header whose tensors declare more data than follows it. Syft parses only a 50 MB copy of each model, so any larger model is dropped. Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> * fix: fix parser with rollback and verify with test Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> * fix: bound GGUF tensor info before the parser reads it The header pre-scan stopped after the metadata KVs and left tensor infos to gguf-parser-go. Older releases of the library allocate whatever length a tensor name declares, so a tiny file could force a multi-GB allocation, or a fatal out of memory that panic recovery can't catch. - tensor names are bounded like metadata keys (non-empty, length limit, shared string budget) - dimension count is capped at `GGML_MAX_DIMS` - a tensor count larger than the header now fails at EOF in the pre-scan Signed-off-by: Alex Goodman * fix: give the GGUF header copy the model's real size The cataloger copies at most 50 MB of a model and parses that copy. Newer gguf-parser-go releases check the tensor data the header declares against the file size, so the truncated copy of any larger model was rejected. - after the header is validated, the copy is extended to the size the resolver reports for the model, leaving the tail as a hole the parser never reads - sources that report no size (OCI model artifacts today) keep the old behavior Signed-off-by: Alex Goodman * chore(deps): restore gguf-parser-go v0.26.4 The header copy now carries the model's real size, so the pin to v0.26.0 and its dependabot ignore are no longer needed. This also brings back upstream's string and array length bounds, and the library's own `IsNumeric`. Signed-off-by: Alex Goodman * fix: keep the extended GGUF header copy sparse on Windows NTFS reserves disk for the full length of a file extended with truncate unless the file is marked sparse, so cataloging a large model on Windows reserved the model's size in the temp dir until cleanup. - the header copy is marked sparse (`FSCTL_SET_SPARSE`) before it is extended - if the filesystem can't make it sparse (FAT32, exFAT), the copy is not extended, and models larger than it fail to parse as before - `golang.org/x/sys` moves from an indirect to a direct dependency Signed-off-by: Alex Goodman --------- Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> Signed-off-by: Alex Goodman Co-authored-by: Alex Goodman --- go.mod | 2 +- syft/pkg/cataloger/ai/cataloger_test.go | 39 ++++++ syft/pkg/cataloger/ai/parse_gguf.go | 44 +++++- syft/pkg/cataloger/ai/parse_gguf_model.go | 42 +++++- syft/pkg/cataloger/ai/parse_gguf_test.go | 10 ++ syft/pkg/cataloger/ai/sparse_other.go | 11 ++ syft/pkg/cataloger/ai/sparse_windows.go | 14 ++ syft/pkg/cataloger/ai/sparse_windows_test.go | 39 ++++++ syft/pkg/cataloger/ai/test_helpers_test.go | 38 ++++++ test/cli/model_cataloging_test.go | 62 +++++++++ .../models/gguf-header-only/generate.go | 126 ++++++++++++++++++ .../models/gguf-header-only/header.gguf | Bin 0 -> 16832 bytes 12 files changed, 415 insertions(+), 12 deletions(-) create mode 100644 syft/pkg/cataloger/ai/sparse_other.go create mode 100644 syft/pkg/cataloger/ai/sparse_windows.go create mode 100644 syft/pkg/cataloger/ai/sparse_windows_test.go create mode 100644 test/cli/model_cataloging_test.go create mode 100644 test/cli/testdata/models/gguf-header-only/generate.go create mode 100644 test/cli/testdata/models/gguf-header-only/header.gguf diff --git a/go.mod b/go.mod index 14107e4b7..bd5087147 100644 --- a/go.mod +++ b/go.mod @@ -103,6 +103,7 @@ require ( require ( github.com/pb33f/ordered-map/v2 v2.3.2 github.com/tailscale/hujson v0.0.0-20260302212456-ecc657c15afd + golang.org/x/sys v0.49.0 howett.net/plist v1.0.1 ) @@ -332,7 +333,6 @@ require ( golang.org/x/crypto v0.58.0 // indirect golang.org/x/oauth2 v0.37.0 // indirect golang.org/x/sync v0.24.0 // indirect - golang.org/x/sys v0.49.0 // indirect golang.org/x/term v0.47.0 // indirect golang.org/x/text v0.43.0 // indirect golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect diff --git a/syft/pkg/cataloger/ai/cataloger_test.go b/syft/pkg/cataloger/ai/cataloger_test.go index 1ab6b59dd..8a7b3e72c 100644 --- a/syft/pkg/cataloger/ai/cataloger_test.go +++ b/syft/pkg/cataloger/ai/cataloger_test.go @@ -129,6 +129,45 @@ func TestGGUFCataloger(t *testing.T) { }, expectedRelationships: nil, }, + { + // syft copies at most maxHeaderSize bytes of a model to parse, so in any model larger than that the + // tensors declare far more data than the copy holds + name: "catalog GGUF file larger than the header copy", + setup: func(t *testing.T) string { + dir := t.TempDir() + data := newTestGGUFBuilder(). + withStringKV("general.architecture", "qwen2"). + withUint32KV("general.file_type", 0). // ALL_F32 + withTensor("token_embd.weight", ggmlTypeF32, 1024, 8192). // 32 MiB + withTensor("blk.0.ffn_up.weight", ggmlTypeF32, 1024, 8192). // 32 MiB + build() + + path := filepath.Join(dir, "qwen2.5-0.5b-instruct-f32.gguf") + require.NoError(t, os.WriteFile(path, data, 0644)) + // the tensor data is never read, so it is left as a sparse range: alignment padding, then 64 MiB + require.NoError(t, os.Truncate(path, int64(len(data))+32+64<<20)) + return dir + }, + expectedPackages: []pkg.Package{ + { + Name: "qwen2.5-0.5b-instruct-f32", + Type: pkg.ModelPkg, + Licenses: pkg.NewLicenseSet(), + Metadata: pkg.GGUFFileHeader{ + Architecture: "qwen2", + Quantization: "F32", + Parameters: 2 * 1024 * 8192, + GGUFVersion: 3, + TensorCount: 2, + MetadataKeyValuesHash: "fddec34fd07b3547", + RemainingKeyValues: map[string]any{ + "general.file_type": uint32(0), + }, + }, + }, + }, + expectedRelationships: nil, + }, } for _, tt := range tests { diff --git a/syft/pkg/cataloger/ai/parse_gguf.go b/syft/pkg/cataloger/ai/parse_gguf.go index efcfc232d..84ea197ed 100644 --- a/syft/pkg/cataloger/ai/parse_gguf.go +++ b/syft/pkg/cataloger/ai/parse_gguf.go @@ -28,6 +28,8 @@ const ( maxGGUFSplitTensors = 1 << 17 // maxGGUFKeyLength is the key length limit from the GGUF spec. maxGGUFKeyLength = 65535 + // maxGGUFTensorDims is GGML_MAX_DIMS. + maxGGUFTensorDims = 4 // maxGGUFKVCount bounds the metadata KV count. Real files hold hundreds; vocabularies live in arrays. maxGGUFKVCount = 65536 // maxGGUFReadStringBytes bounds, across the header, the key and string bytes the library reads in @@ -78,10 +80,10 @@ func copyHeader(w io.Writer, r io.Reader) error { return nil } -// validateGGUFHeader walks the metadata KV section and rejects values that gguf-parser-go would panic -// on, recurse on without bound, or overallocate for. It reads without storing anything. -// ponytail: tensor infos are not checked here (zero block size types, dimension overflow); those -// panics are recoverable and are left to the per-file panic recovery in the generic cataloger. +// validateGGUFHeader walks the metadata KV and tensor info sections and rejects values that gguf-parser-go +// would panic on, recurse on without bound, or overallocate for. It reads without storing anything. +// ponytail: tensor types and dimensions are not checked here (zero block size types, dimension overflow); +// those panics are recoverable and are left to the per-file panic recovery in the generic cataloger. func validateGGUFHeader(r io.Reader) error { v := &ggufHeaderValidator{ r: bufio.NewReader(r), @@ -96,8 +98,9 @@ func validateGGUFHeader(r io.Reader) error { return fmt.Errorf("reading header prefix: %w", err) } v.v1 = prefix.Version <= 1 - // the tensor count is validated by the library - if _, err := v.readLen(); err != nil { + // tensors are walked below, so a count beyond the header runs into EOF + tensorCount, err := v.readLen() + if err != nil { return fmt.Errorf("reading tensor count: %w", err) } kvCount, err := v.readLen() @@ -121,9 +124,38 @@ func validateGGUFHeader(r io.Reader) error { return fmt.Errorf("metadata key %q: %w", key, err) } } + + for i := uint64(0); i < tensorCount; i++ { + if err := v.skipTensorInfo(); err != nil { + return fmt.Errorf("tensor info %d: %w", i, err) + } + } return nil } +// skipTensorInfo consumes one tensor info: name, dimension count, dimensions, type, data offset. +func (v *ggufHeaderValidator) skipTensorInfo() error { + // the library reads names in full, so they are bounded like keys + if _, err := v.readKey(); err != nil { + return fmt.Errorf("name: %w", err) + } + var nDims uint32 + if err := binary.Read(v.r, binary.LittleEndian, &nDims); err != nil { + return err + } + if nDims > maxGGUFTensorDims { + return fmt.Errorf("dimension count %d exceeds %d", nDims, maxGGUFTensorDims) + } + for range nDims { + if _, err := v.readLen(); err != nil { + return err + } + } + // type (uint32) and data offset (uint64) + _, err := v.r.Discard(4 + 8) + return err +} + type ggufHeaderValidator struct { r *bufio.Reader v1 bool // v1 uses 32-bit lengths diff --git a/syft/pkg/cataloger/ai/parse_gguf_model.go b/syft/pkg/cataloger/ai/parse_gguf_model.go index 6b9a89259..478cca01d 100644 --- a/syft/pkg/cataloger/ai/parse_gguf_model.go +++ b/syft/pkg/cataloger/ai/parse_gguf_model.go @@ -5,6 +5,7 @@ import ( "encoding/json" "fmt" "io" + "os" "path/filepath" "sort" "strings" @@ -13,6 +14,7 @@ import ( gguf_parser "github.com/gpustack/gguf-parser-go" "github.com/anchore/syft/internal" + "github.com/anchore/syft/internal/log" "github.com/anchore/syft/internal/tmpdir" "github.com/anchore/syft/syft/artifact" "github.com/anchore/syft/syft/file" @@ -22,7 +24,7 @@ import ( // parseGGUFModel parses a GGUF model file and returns the discovered package. // This implementation only reads the header portion of the file, not the entire model. -func parseGGUFModel(ctx context.Context, _ file.Resolver, _ *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) { +func parseGGUFModel(ctx context.Context, resolver file.Resolver, _ *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) { defer internal.CloseAndLogError(reader, reader.Path()) td := tmpdir.FromContext(ctx) @@ -34,7 +36,6 @@ func parseGGUFModel(ctx context.Context, _ file.Resolver, _ *generic.Environment return nil, nil, fmt.Errorf("failed to create temp file: %w", err) } defer cleanup() - tempPath := tempFile.Name() // copy and validate the GGUF file header (bounded to maxHeaderSize) if err := copyHeader(tempFile, reader); err != nil { @@ -45,14 +46,18 @@ func parseGGUFModel(ctx context.Context, _ file.Resolver, _ *generic.Environment tempFile.Close() return nil, nil, fmt.Errorf("failed to rewind GGUF header: %w", err) } - err = validateGGUFHeader(tempFile) + if err := validateGGUFHeader(tempFile); err != nil { + tempFile.Close() + return nil, nil, fmt.Errorf("invalid GGUF header: %w", err) + } + err = extendToModelSize(tempFile, modelSize(resolver, reader.Location)) tempFile.Close() if err != nil { - return nil, nil, fmt.Errorf("invalid GGUF header: %w", err) + return nil, nil, fmt.Errorf("failed to extend GGUF header copy: %w", err) } // Parse using gguf-parser-go with options to skip unnecessary data - ggufFile, err := gguf_parser.ParseGGUFFile(tempPath, + ggufFile, err := gguf_parser.ParseGGUFFile(tempFile.Name(), gguf_parser.SkipLargeMetadata(), ) if err != nil { @@ -99,6 +104,33 @@ func parseGGUFModel(ctx context.Context, _ file.Resolver, _ *generic.Environment return []pkg.Package{p}, nil, nil } +// modelSize returns the size of the model file, or 0 when the resolver can't say. +func modelSize(resolver file.Resolver, loc file.Location) int64 { + if resolver == nil { + return 0 + } + m, err := resolver.FileMetadataByLocation(loc) + if err != nil || m.FileInfo == nil { + return 0 + } + return m.Size() +} + +// extendToModelSize grows the header copy to the model's real size, since the parser checks the tensor data +// the header declares against the file size. It must run after validation so the header itself never reads +// from the hole. The file is marked sparse first so the hole takes no disk space; where that isn't possible +// the copy is left as is, and the parser rejects models larger than it. +func extendToModelSize(f *os.File, size int64) error { + if size <= maxHeaderSize { + return nil + } + if err := markSparse(f); err != nil { + log.Debugf("unable to mark GGUF header copy sparse, not extending it: %v", err) + return nil + } + return f.Truncate(size) +} + // computeKVMetadataHash computes a stable hash of the sanitized KV metadata for use as a global identifier func computeKVMetadataHash(metadata gguf_parser.GGUFMetadataKVs) (string, error) { // Sort the KV pairs by key for stable hashing diff --git a/syft/pkg/cataloger/ai/parse_gguf_test.go b/syft/pkg/cataloger/ai/parse_gguf_test.go index c5d8d5253..59874d5e8 100644 --- a/syft/pkg/cataloger/ai/parse_gguf_test.go +++ b/syft/pkg/cataloger/ai/parse_gguf_test.go @@ -57,6 +57,11 @@ func TestParseGGUFModel_malformedHeader(t *testing.T) { // a header that declares more KVs than the cap, with none following tooManyKVs := append(append([]byte("GGUF"), le(uint32(3))...), le([]uint64{0, maxGGUFKVCount + 1})...) + // a tensor whose name declares far more bytes than the file holds + hostileTensorName := newTestGGUFBuilder().withStringKV("general.architecture", "llama") + hostileTensorName.tensorCount = 1 + hugeTensorName := append(hostileTensorName.build(), le(uint64(1<<40))...) + tests := []struct { name string builder *testGGUFBuilder @@ -150,6 +155,11 @@ func TestParseGGUFModel_malformedHeader(t *testing.T) { name: "skipped scalar array", builder: newTestGGUFBuilder().withRawKV("tokenizer.ggml.scores", ggufTypeArray, ggufArray(ggufTypeFloat32, 3, make([]byte, 12))), }, + {name: "tensor name too long", data: hugeTensorName, wantErr: true}, + {name: "tensor name empty", builder: newTestGGUFBuilder().withTensor("", ggmlTypeF32, 1), wantErr: true}, + {name: "tensor with too many dimensions", builder: newTestGGUFBuilder().withTensor("t", ggmlTypeF32, 1, 1, 1, 1, 1), wantErr: true}, + {name: "tensor count beyond the header", builder: newTestGGUFBuilder().withTensorCount(1), wantErr: true}, + {name: "tensor info", builder: newTestGGUFBuilder().withTensor("t", ggmlTypeF32, 8)}, // ponytail: zero block size tensor types and dimension overflow panic inside tensor info parsing; // those are left to the generic cataloger's panic handling rather than checked here. } diff --git a/syft/pkg/cataloger/ai/sparse_other.go b/syft/pkg/cataloger/ai/sparse_other.go new file mode 100644 index 000000000..bed7b6c46 --- /dev/null +++ b/syft/pkg/cataloger/ai/sparse_other.go @@ -0,0 +1,11 @@ +//go:build !windows + +package ai + +import "os" + +// markSparse is a no-op: the filesystems syft runs on elsewhere leave the range a file is extended by with +// Truncate as a hole. +func markSparse(_ *os.File) error { + return nil +} diff --git a/syft/pkg/cataloger/ai/sparse_windows.go b/syft/pkg/cataloger/ai/sparse_windows.go new file mode 100644 index 000000000..849885584 --- /dev/null +++ b/syft/pkg/cataloger/ai/sparse_windows.go @@ -0,0 +1,14 @@ +package ai + +import ( + "os" + + "golang.org/x/sys/windows" +) + +// markSparse sets the sparse attribute on the file. NTFS reserves disk space for the whole length of a file +// extended with Truncate unless it is sparse. +func markSparse(f *os.File) error { + var n uint32 + return windows.DeviceIoControl(windows.Handle(f.Fd()), windows.FSCTL_SET_SPARSE, nil, 0, nil, 0, &n, nil) +} diff --git a/syft/pkg/cataloger/ai/sparse_windows_test.go b/syft/pkg/cataloger/ai/sparse_windows_test.go new file mode 100644 index 000000000..64d78089e --- /dev/null +++ b/syft/pkg/cataloger/ai/sparse_windows_test.go @@ -0,0 +1,39 @@ +package ai + +import ( + "os" + "path/filepath" + "testing" + "unsafe" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + "golang.org/x/sys/windows" +) + +// fileStandardInfo mirrors FILE_STANDARD_INFO, which golang.org/x/sys/windows does not define. +type fileStandardInfo struct { + AllocationSize int64 + EndOfFile int64 + NumberOfLinks uint32 + DeletePending bool + Directory bool +} + +func TestExtendToModelSize_doesNotReserveDiskOnWindows(t *testing.T) { + const size = 1 << 30 + f, err := os.Create(filepath.Join(t.TempDir(), "header.gguf")) + require.NoError(t, err) + defer f.Close() + _, err = f.Write(make([]byte, 4096)) + require.NoError(t, err) + + require.NoError(t, extendToModelSize(f, size)) + + var info fileStandardInfo + require.NoError(t, windows.GetFileInformationByHandleEx(windows.Handle(f.Fd()), windows.FileStandardInfo, + (*byte)(unsafe.Pointer(&info)), uint32(unsafe.Sizeof(info)))) + assert.Equal(t, int64(size), info.EndOfFile) + // a non-sparse file would have the whole length allocated + assert.Less(t, info.AllocationSize, int64(16<<20)) +} diff --git a/syft/pkg/cataloger/ai/test_helpers_test.go b/syft/pkg/cataloger/ai/test_helpers_test.go index d11ce8bb1..836256f64 100644 --- a/syft/pkg/cataloger/ai/test_helpers_test.go +++ b/syft/pkg/cataloger/ai/test_helpers_test.go @@ -30,6 +30,13 @@ type testGGUFBuilder struct { version uint32 tensorCount uint64 kvPairs []testKVPair + tensors []testTensorInfo +} + +type testTensorInfo struct { + name string + dims []uint64 + ggmlType uint32 } type testKVPair struct { @@ -72,6 +79,13 @@ func (b *testGGUFBuilder) withUint32KV(key string, value uint32) *testGGUFBuilde return b } +// withTensor adds a tensor info and counts it in the header tensor count. +func (b *testGGUFBuilder) withTensor(name string, ggmlType uint32, dims ...uint64) *testGGUFBuilder { + b.tensors = append(b.tensors, testTensorInfo{name: name, dims: dims, ggmlType: ggmlType}) + b.tensorCount++ + return b +} + // withRawKV adds a KV whose value bytes are written verbatim, for arrays and malformed values. func (b *testGGUFBuilder) withRawKV(key string, valueType uint32, raw []byte) *testGGUFBuilder { b.kvPairs = append(b.kvPairs, testKVPair{key: key, valueType: valueType, value: raw}) @@ -145,6 +159,19 @@ func (b *testGGUFBuilder) build() []byte { } } + // Write tensor infos: name, dimension count, dimensions, type, data offset + var offset uint64 + for _, ti := range b.tensors { + b.writeString(ti.name) + binary.Write(b.buf, binary.LittleEndian, uint32(len(ti.dims))) + for _, d := range ti.dims { + b.writeLen(d) + } + binary.Write(b.buf, binary.LittleEndian, ti.ggmlType) + binary.Write(b.buf, binary.LittleEndian, offset) + offset += 32 + } + return b.buf.Bytes() } @@ -154,3 +181,14 @@ func (b *testGGUFBuilder) buildInvalidMagic() []byte { binary.Write(buf, binary.LittleEndian, uint32(0x12345678)) return buf.Bytes() } + +// GGML tensor types used by the test builder +const ( + ggmlTypeF32 = 0 + ggmlTypeF16 = 1 + ggmlTypeQ4_0 = 2 + ggmlTypeQ8_0 = 8 + ggmlTypeQ2_K = 10 + ggmlTypeQ4_K = 12 + ggmlTypeQ6_K = 14 +) diff --git a/test/cli/model_cataloging_test.go b/test/cli/model_cataloging_test.go new file mode 100644 index 000000000..50703b9a2 --- /dev/null +++ b/test/cli/model_cataloging_test.go @@ -0,0 +1,62 @@ +package cli + +import ( + "encoding/json" + "os" + "path/filepath" + "testing" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +// modelSize is larger than the 50 MB syft copies from a model to parse its header, and than the tensor data +// the header fixture declares. +const modelSize = 512 << 20 + +// TestGGUFModelIsCataloged scans a model larger than the header copy syft parses: a real GGUF header followed +// by a sparse range standing in for the tensor data. Models under the copy size are parsed whole, so only a +// model this large catches a parser that checks the declared tensor data against the bytes it was given. +func TestGGUFModelIsCataloged(t *testing.T) { + root := t.TempDir() + header, err := os.ReadFile("testdata/models/gguf-header-only/header.gguf") + require.NoError(t, err) + modelPath := filepath.Join(root, "qwen2.5-0.5b-instruct-q2_k.gguf") + require.NoError(t, os.WriteFile(modelPath, header, 0o600)) + require.NoError(t, os.Truncate(modelPath, modelSize)) + + out := filepath.Join(t.TempDir(), "sbom.json") + cmd, stdout, stderr := runSyft(t, nil, "scan", "dir:"+root, "-o", "syft-json="+out) + defer logOutputOnFailure(t, cmd, stdout, stderr) + assertSuccessfulReturnCode(t, stdout, stderr, cmd.ProcessState.ExitCode()) + + b, err := os.ReadFile(out) + require.NoError(t, err, "no SBOM written") + var doc struct { + Artifacts []struct { + Name string `json:"name"` + Type string `json:"type"` + Licenses []struct { + Value string `json:"value"` + } `json:"licenses"` + Metadata struct { + Architecture string `json:"architecture"` + Quantization string `json:"quantization"` + Parameters uint64 `json:"parameters"` + TensorCount uint64 `json:"tensorCount"` + } `json:"metadata"` + } `json:"artifacts"` + } + require.NoError(t, json.Unmarshal(b, &doc), "SBOM is not valid JSON") + require.Len(t, doc.Artifacts, 1, "expected the model package") + + model := doc.Artifacts[0] + assert.Equal(t, "qwen2.5-0.5b-instruct", model.Name) + assert.Equal(t, "model", model.Type) + require.Len(t, model.Licenses, 1) + assert.Equal(t, "apache-2.0", model.Licenses[0].Value) + assert.Equal(t, "qwen2", model.Metadata.Architecture) + assert.Equal(t, "Q2_K_L", model.Metadata.Quantization) + assert.Equal(t, uint64(290), model.Metadata.TensorCount) + assert.Equal(t, uint64(494032768), model.Metadata.Parameters) +} diff --git a/test/cli/testdata/models/gguf-header-only/generate.go b/test/cli/testdata/models/gguf-header-only/generate.go new file mode 100644 index 000000000..909a88e3b --- /dev/null +++ b/test/cli/testdata/models/gguf-header-only/generate.go @@ -0,0 +1,126 @@ +// generate writes header.gguf: the header of a GGUF model shaped like Qwen2.5-0.5B-Instruct at Q2_K (290 +// tensors declaring about 175 MB of data), padded to the tensor data alignment. Tests extend a copy to a +// model's size as a sparse file, which stands in for the full model without storing its data. +// +// This file lives under testdata/ so the Go build system ignores it. Run it when changing the fixture: +// +// go run ./testdata/models/gguf-header-only/generate.go ./testdata/models/gguf-header-only/header.gguf +package main + +import ( + "bytes" + "encoding/binary" + "fmt" + "os" +) + +const ( + typeUint32 = 4 + typeString = 8 + typeArray = 9 + + ggmlF32 = 0 + ggmlQ2K = 10 + ggmlQ3K = 11 + ggmlQ4K = 12 + fileQ2K = 10 +) + +type tensor struct { + name string + typ uint32 + dims []uint64 +} + +type writer struct{ bytes.Buffer } + +func (w *writer) le(v any) { _ = binary.Write(w, binary.LittleEndian, v) } + +func (w *writer) str(s string) { + w.le(uint64(len(s))) + w.WriteString(s) +} + +func main() { + if len(os.Args) != 2 { + fmt.Fprintln(os.Stderr, "usage: generate ") + os.Exit(1) + } + + const ( + hidden = 896 + kvDim = 128 + ffn = 4864 + vocab = 151936 + layers = 24 + ) + tensors := []tensor{{"token_embd.weight", ggmlQ4K, []uint64{hidden, vocab}}} + for i := range layers { + blk := func(n string) string { return fmt.Sprintf("blk.%d.%s", i, n) } + tensors = append(tensors, + tensor{blk("attn_norm.weight"), ggmlF32, []uint64{hidden}}, + tensor{blk("attn_q.weight"), ggmlQ2K, []uint64{hidden, hidden}}, + tensor{blk("attn_q.bias"), ggmlF32, []uint64{hidden}}, + tensor{blk("attn_k.weight"), ggmlQ2K, []uint64{hidden, kvDim}}, + tensor{blk("attn_k.bias"), ggmlF32, []uint64{kvDim}}, + tensor{blk("attn_v.weight"), ggmlQ3K, []uint64{hidden, kvDim}}, + tensor{blk("attn_v.bias"), ggmlF32, []uint64{kvDim}}, + tensor{blk("attn_output.weight"), ggmlQ3K, []uint64{hidden, hidden}}, + tensor{blk("ffn_norm.weight"), ggmlF32, []uint64{hidden}}, + tensor{blk("ffn_gate.weight"), ggmlQ2K, []uint64{hidden, ffn}}, + tensor{blk("ffn_up.weight"), ggmlQ2K, []uint64{hidden, ffn}}, + tensor{blk("ffn_down.weight"), ggmlQ3K, []uint64{ffn, hidden}}, + ) + } + tensors = append(tensors, tensor{"output_norm.weight", ggmlF32, []uint64{hidden}}) + + var w writer + w.le(uint32(0x46554747)) // "GGUF" + w.le(uint32(3)) + w.le(uint64(len(tensors))) + w.le(uint64(6)) // metadata KV count + + w.str("general.architecture") + w.le(uint32(typeString)) + w.str("qwen2") + w.str("general.name") + w.le(uint32(typeString)) + w.str("qwen2.5-0.5b-instruct") + w.str("general.license") + w.le(uint32(typeString)) + w.str("apache-2.0") + w.str("general.file_type") + w.le(uint32(typeUint32)) + w.le(uint32(fileQ2K)) + w.str("qwen2.block_count") + w.le(uint32(typeUint32)) + w.le(uint32(layers)) + // a vocabulary the parser skips over + w.str("tokenizer.ggml.tokens") + w.le(uint32(typeArray)) + w.le(uint32(typeString)) + w.le(uint64(3)) + for _, tok := range []string{"!", "\"", "#"} { + w.str(tok) + } + + var offset uint64 + for _, t := range tensors { + w.str(t.name) + w.le(uint32(len(t.dims))) + for _, d := range t.dims { + w.le(d) + } + w.le(t.typ) + w.le(offset) + offset += 1 << 20 // not used by syft; real offsets depend on each type's block size + } + + // pad to the default 32-byte alignment, where the tensor data starts + w.Write(make([]byte, (32-w.Len()%32)%32)) + + if err := os.WriteFile(os.Args[1], w.Bytes(), 0o644); err != nil { + fmt.Fprintln(os.Stderr, err) + os.Exit(1) + } +} diff --git a/test/cli/testdata/models/gguf-header-only/header.gguf b/test/cli/testdata/models/gguf-header-only/header.gguf new file mode 100644 index 0000000000000000000000000000000000000000..ccf53c968fef87a0bc8a92d0529054a511c4acc8 GIT binary patch literal 16832 zcmb80OLE&*7KYKCPIvl|1bOvih9qONU?t9DhEZqA40>!x3N5Q7Q?N|g)fr(4SOS)S zC143y0+zrfg!plR+(X=7=TKFatP($bR~Mf|kcax|r~m!;y(o&l`orPf;qA}khv;+n z@oKZ(+@IgB&hIZ@Uhg)SyNCPD2Zyh{@4o)}-DZ3CkE0uJ&tKt2U-&m#J$sU_o?Se- z-oDx0KV0rUK7wwqFE`sa;Qr>mbY7fazT7-HTcw{I-T1}z?dJLJ|HbA{hc65_pKgHl ztS)ZvE^nS+-aTx0!wvp@_&2R(cXzYdUjMqeUtL|jx?SPZH-A0cVEC?vofzKSW<+03 z|CzQY`g#%pe7<>g@yqJn=KAX8?vDqqbO$JZ9zKhrX=8@}|8sbEc)Pg0S*5G<-ERAQ zdw2iJ(SvBBakD7KhtI}OeCl;b=)~jBC4i=tdcxPMi|g|@OIONVHzAi>(&);V>*jZt z1I7<)dh8{+-t?%mddC*M@t_?@Z7g1Zcp;8chNCjXIaH(G0xb=+l+j=$b&LMsvV& zcZ`h|#A|A_1nf6@W@xlptkzL_qcu?fT+V2?(T2J7MqB1$jdskXH`+57Yjh95Z`5ss zvC#;3hkm1HdZRIcOpPXh{YFQl;rD1tyrxDoz<#6O7#dwKR_iFe(HyAX=!}LNEtpGh zv}7*UXvJK5qcwA}MjHTrqi!RNjke(ZM!(S;?FeLQvBONW1}T_ztL~?Mk@lD z8m$4#vu?bvZ;02_XbaeH^qHa2Zn0WN>5cY4{YGar+~}UU^hTrMLFxREb$D3eT&&R; zfPWSopf{Q@7i%;H;5X`A#zr&nexuLyM%M%~HJSsKyJKv$AYN0WC1AhN?+lGri`68(;JQPoYxXEHJSkS z8y$^?`}&l4O^s%N{YJkxG`e1_)=_$+IZ(gR84WjDFqhtF$y}__in;VgYvy8&HURua z-9{K2ZNdAweXlp#5y;eN57=*XG#VP+6R)Y!@kwXD(H{(r#(1jQU#+9`MiZcZqca+A zG-WQm(TurRqig2U8_k)EHCh1h8+99DY_tULH~NF#Xhk4Xqcvc8){Xb|4e^>9Z2|j@ z{%B~lTddYmdZRs1ztI^DH@asoz0v3|$Je9I#TtzP_-DZZdZP(*u|`t>exuH1Y%~M! zH~ORA=$b&LMsvV&cZ`h|#A|A_1pF^NPd-jNo>~S?6|iaGH#{1dFul?m?56=G8#Oi5 zrgz#>8w<6gHoerI+E}W45dR76hOt!)A;qNda4Lp$9-kBrqstIwsx<+9bo!0Crp#>W zH3Kbrb)%0*zuon6!Sm=SFp9;)^l?ZWMLAf}>&%9Ktrpa#_gYdL>$Rdbz1N!BSg#ET z(d%imrxpkB?-idKhEE-%OuhD?MX#gNa+%7^re34rWdf1t)iQvJfr$mrVKIwIkmA~3lO5$)8V@7IQzO})0D zMX#1&RJUC4JW|qn?ZJv(XExmHp4#+Y@yeelWMjR?c$I}X8E$=guL;5WPB^ z@p>S`0YtBcq12jDre1TFt7R}%Ef+kGm$Y7Mu;QG~Y`E8k+Voyq zYGb{2)TZ~^Qyc4b4?^^M+I%X)i-|<9h5=Q~C{wQqXwmEFG+Ym)%xvm411)-Wqmsw3 zUzZDZnErSx2P=A=*>JA~wduW<)W&+Ps7>#+rZ(1V148tA+N`R@0YtBcVO7T{Q?ET} z(d+0m^txweQ?KL8QAMwofmMuGv5E!HV<+wRYXVmEIuGbV5(f~y8U|MtqfEWlppQc>%Xwj=>c-1WzJddEXUVE^j*O?9X zx~De1*XYCH0cFU>dW}Jdli}8<_nJ@}>oo--dUZDI^(zh_dNmBO){HXsnu9*tB4e)w zGn;xXL5p53gRE+~;CURS^;&}!1`^5_u5k%>va!8^m^JnEBa{o zffT(O23j$rOuZ(cMX#gNa6OPRv#Hk%wCL51Rvy28T`t&RhU-_bqSu)X_gYY!-fKy1 ztk;U#^j>RfW4$&YM6ajKwptuO^lBJxb&N9g+JhFoj!r|bduBHE8sSgI{9ey2^Q{<| zzu*bedriRlz5dRIdrhfL?=_<~*6W(u^j>pnW4#t2{9dQsFkTOoIDp^l;Q+&Z^P|6T zDn^-ltwA51e&h8(!_1~$ThO9c%Y3U_E_j|%Y1aciSkdduhI`#po8IgAH;N$}>otyt zJ6Lft-1_uh6R;s0>oo--dUZBquNe*?dNs_q){HXsnu9*tB4e)wGn;xXL5p53^Q~&R z;CV)+^;&}!=X7Sny*AXQ_u5h$>$Rgcz1N=FSg(5!qSw>rTjOiWMX!eWR*Y8}1t?Rm z324!){ZFl!+0<(WTJ-A1E05lttd|R(XH;6RIatx_%!Yd{s7>#+q&C)TMQwVoHMOx` z8xW$`)8<<(4j{@i%(ps5nR@L(i(c)2cE!x5UdLy8rg+A?pvSL#;_1f2y=L(3H@*=O A%K!iX literal 0 HcmV?d00001