fix(deps): update module github.com/knights-analytics/hugot to v0.8.0 #7052
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,16 +1,18 @@ | ||
| module github.com/fullsend-ai/fullsend | ||
|
|
||
| go 1.27.0 | ||
|
|
||
| require ( | ||
| github.com/charmbracelet/lipgloss v1.1.0 | ||
| github.com/cucumber/godog v0.14.1 | ||
| github.com/cucumber/messages/go/v21 v21.0.1 | ||
| github.com/fullsend-ai/fullsend/internal/mintcore v0.0.0 | ||
| github.com/google/cel-go v0.29.2 | ||
| github.com/google/uuid v1.6.0 | ||
| github.com/knights-analytics/hugot v0.8.0 | ||
| github.com/spf13/cobra v1.10.2 | ||
| github.com/spf13/pflag v1.0.10 | ||
| github.com/stretchr/testify v1.12.1 | ||
| github.com/yuin/goldmark v1.8.6 | ||
| go.opentelemetry.io/otel v1.44.0 | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.44.0 | ||
|
|
@@ -20,72 +22,64 @@ require ( | |
| go.uber.org/goleak v1.3.0 | ||
| golang.org/x/crypto v0.54.0 | ||
| golang.org/x/oauth2 v0.36.0 | ||
| golang.org/x/sync v0.23.0 | ||
| golang.org/x/term v0.46.0 | ||
| golang.org/x/text v0.42.0 | ||
| google.golang.org/protobuf v1.36.12 | ||
| gopkg.in/yaml.v3 v3.0.1 | ||
| ) | ||
|
|
||
| require ( | ||
| cel.dev/expr v0.25.1 // indirect | ||
| cloud.google.com/go/compute/metadata v0.9.0 // indirect | ||
| github.com/antlr4-go/antlr/v4 v4.13.1 // indirect | ||
| github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect | ||
| github.com/cenkalti/backoff/v5 v5.0.3 // indirect | ||
| github.com/cespare/xxhash/v2 v2.3.0 // indirect | ||
| github.com/charmbracelet/colorprofile v0.4.3 // indirect | ||
| github.com/charmbracelet/x/ansi v0.11.6 // indirect | ||
| github.com/charmbracelet/x/cellbuf v0.0.15 // indirect | ||
| github.com/charmbracelet/x/term v0.2.2 // indirect | ||
| github.com/clipperhouse/displaywidth v0.11.0 // indirect | ||
| github.com/clipperhouse/uax29/v2 v2.7.0 // indirect | ||
| github.com/cucumber/gherkin/go/v26 v26.2.0 // indirect | ||
| github.com/daulet/tokenizers v1.27.0 // indirect | ||
| github.com/go-logr/logr v1.4.4 // indirect | ||
| github.com/go-logr/stdr v1.2.2 // indirect | ||
| github.com/gofrs/flock v0.13.1 // indirect | ||
| github.com/gofrs/uuid v4.4.0+incompatible // indirect | ||
| github.com/gomlx/compute v0.1.14 // indirect | ||
| github.com/gomlx/compute-onnx v0.1.13 // indirect | ||
| github.com/gomlx/exceptions v0.0.3 // indirect | ||
| github.com/gomlx/go-huggingface v0.4.12 // indirect | ||
| github.com/gomlx/go-xla v0.4.13 // indirect | ||
| github.com/gomlx/gomlx v0.28.16 // indirect | ||
| github.com/gomlx/onnx-gomlx v0.5.13 // indirect | ||
| github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect | ||
| github.com/hashicorp/go-immutable-radix v1.3.1 // indirect | ||
| github.com/hashicorp/go-memdb v1.3.4 // indirect | ||
| github.com/hashicorp/golang-lru v0.5.4 // indirect | ||
| github.com/inconshreveable/mousetrap v1.1.0 // indirect | ||
| github.com/knights-analytics/ortgenai v0.3.2 // indirect | ||
| github.com/lucasb-eyer/go-colorful v1.3.0 // indirect | ||
| github.com/mattn/go-isatty v0.0.20 // indirect | ||
| github.com/mattn/go-runewidth v0.0.21 // indirect | ||
| github.com/microsoft/onnxruntime/go v0.0.0-20260922015325-62e95311b771 // indirect | ||
|
There was a problem hiding this comment. [low] api-contract hugot v0.8.0 replaces the transitive ORT binding github.com/yalue/onnxruntime_go v1.32.0 with github.com/microsoft/onnxruntime/go v0.0.0-20260922015325-62e95311b771 (yalue is absent from PR-head go.mod/go.sum). images/runner/Containerfile:287-291 (not touched by this PR) still pins ORT_VERSION=1.28.1 with a comment justifying that pin by citing yalue/onnxruntime_go v1.32.0's ORT C API version 28 request -- that citation is now stale since the binding it names is no longer a dependency. A C API incompatibility itself was not demonstrated: the Microsoft binding's requested API version could not be verified in this sandbox (no module source available), and dropping yalue does not by itself indicate a higher API request. Even in the worst case this is a bounded risk: internal/cli/scan.go already calls RunMLScan(..., required=false), which fails open by design if initMLScanner cannot create an ORT session; runner-image.yml's paths filter (pre-existing, unrelated to this PR) excludes go.mod/go.sum, but GitHub Actions ignores paths filters on tag pushes, and that build's smoke test asserts a positive injection detection (grep -q "DeBERTa-v3 detected injection"), which would fail rather than pass silently on a fail-open regression. Net effect: the Containerfile's pin-rationale comment is factually wrong regardless of outcome, and the actual ABI compatibility remains unconfirmed but self-gating. Suggested fix: Update the comment at images/runner/Containerfile:287-291 so it no longer cites the removed yalue/onnxruntime_go dependency. Optionally verify the ORT C API version requested by github.com/microsoft/onnxruntime/go@62e95311b771; only bump ARG ORT_VERSION / ORT_SHA256_{AMD64,ARM64} if that version is confirmed to exceed 28. There was a problem hiding this comment. [low] api-contract hugot v0.8.0 replaces the transitive ORT binding github.com/yalue/onnxruntime_go v1.32.0 with github.com/microsoft/onnxruntime/go v0.0.0-20260922015325-62e95311b771 (yalue is absent from PR-head go.mod/go.sum). images/runner/Containerfile:287-291 (not touched by this PR) still pins ARG ORT_VERSION=1.28.1 with a comment justifying that pin by citing yalue/onnxruntime_go v1.32.0's ORT C API version 28 request -- that citation is now stale since the binding it names is no longer a dependency. This repo's hugot call sites (internal/security/mlscan_ort.go, onnxguard.go, onnxguard_integration_test.go) use NewORTSession plus options.WithOnnxLibraryPath/WithIntraOpNumThreads, hugot.NewPipeline(TextClassificationConfig), pipelines.WithSoftmax/WithSingleLabel, and RunPipeline -- none of hugot v0.7.8's breaking-change surfaces (fileutil.FileSystem, fileutil.WalkDir, pipeline constructors taking *options.Options) are exercised. A C API incompatibility with the new Microsoft binding was not demonstrated -- its requested ORT C API version could not be verified in this sandbox (no module source available). The failure mode is bounded, not silent: internal/cli/scan.go calls RunMLScan(..., required=false), which fails open (returns ScanResult{Safe: true}) if initMLScanner cannot create an ORT session; ORT-tagged sources compile only under //go:build ORT; and .github/workflows/runner-image.yml's paths filter (pre-existing, excludes go.mod/go.sum) is ignored on tag pushes, whose smoke test asserts a positive injection detection (grep -q "DeBERTa-v3 detected injection") and would fail rather than pass silently on a fail-open regression. This PR's go.mod/go.sum content is byte-identical to what was evaluated at the prior head SHA 6c85eb3 -- only a rebase onto a newer base-branch tip changed the commit hash. Re-verified against the unchanged code and the unchanged Containerfile; the finding still holds at low severity. Suggested fix: Update the comment at images/runner/Containerfile:287-291 so it no longer cites the removed yalue/onnxruntime_go dependency. Optionally verify the ORT C API version requested by github.com/microsoft/onnxruntime/go@62e95311b771; only bump ARG ORT_VERSION / ORT_SHA256_{AMD64,ARM64} if that version is confirmed to exceed 28. |
||
| github.com/muesli/termenv v0.16.0 // indirect | ||
| github.com/pkg/errors v0.9.1 // indirect | ||
| github.com/rivo/uniseg v0.4.7 // indirect | ||
| github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect | ||
| go.opentelemetry.io/auto/sdk v1.2.1 // indirect | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 // indirect | ||
| go.opentelemetry.io/otel/metric v1.44.0 // indirect | ||
| go.yaml.in/yaml/v3 v3.0.5 // indirect | ||
| golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba // indirect | ||
| golang.org/x/image v0.46.0 // indirect | ||
| golang.org/x/net v0.56.0 // indirect | ||
| golang.org/x/sys v0.48.0 // indirect | ||
| google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect | ||
| google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect | ||
| google.golang.org/grpc v1.82.1 // indirect | ||
| k8s.io/klog/v2 v2.140.0 // indirect | ||
| ) | ||
|
|
||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[medium] api-contract
hugot v0.8.0 replaces github.com/yalue/onnxruntime_go v1.32.0 with github.com/microsoft/onnxruntime/go v0.0.0-20260922015325-62e95311b771 (go.mod:67). The runner image still pins ONNX Runtime 1.28.1, and images/runner/Containerfile:287-291 still documents that pin as matching yalue/onnxruntime_go v1.32.0's request for ORT C API version 28 -- that rationale is stale regardless of compatibility, since the cited dependency is gone. Whether the new Microsoft binding requests a higher ORT C API version was not verified (module source unavailable). If it does, internal/security/mlscan_ort.go's initMLScanner fails to create an ORT session and RunMLScan(required=false) (the only caller,
fullsend scan input) fails open, returning Safe=true with only a stderr warning. This PR's own CI does not exercise that path: go test ./... skips the //go:build ORT files, and .github/workflows/runner-image.yml's paths filter excludes go.mod/go.sum. The next semver-tag release build would catch a real incompatibility instead -- GitHub Actions ignores paths filters on tag pushes, and the smoke test there asserts a positive injection-detection string that a fail-open degradation would not produce, failing that job rather than shipping silently.Suggested fix: Check the ORT C API version requested by github.com/microsoft/onnxruntime/go@62e95311b771. If higher than 28, bump ARG ORT_VERSION and ORT_SHA256_{AMD64,ARM64} in images/runner/Containerfile to a compatible release and update the comment. If still 28, update the comment so it no longer cites the removed yalue/onnxruntime_go dependency. Build the runner image locally and run the fullsend scan input injection/benign smoke checks before merge.