From 09fbeceec59efa94f46e56c343cc218c341af86a Mon Sep 17 00:00:00 2001 From: Michael Primeaux Date: Sun, 12 Jul 2026 08:53:00 -0500 Subject: [PATCH] debt: Update dependencies to latest stable versions. --- .github/workflows/ci.yaml | 4 +- .github/workflows/codeql-analysis.yaml | 2 +- .github/workflows/release.yaml | 6 +-- CHANGELOG.md | 16 +++++- README.md | 4 +- go.mod | 7 +-- go.sum | 2 - graph.go | 5 +- vendor/golang.org/x/exp/LICENSE | 27 ---------- vendor/golang.org/x/exp/PATENTS | 22 -------- .../x/exp/constraints/constraints.go | 54 ------------------- vendor/modules.txt | 3 -- 12 files changed, 27 insertions(+), 125 deletions(-) delete mode 100644 vendor/golang.org/x/exp/LICENSE delete mode 100644 vendor/golang.org/x/exp/PATENTS delete mode 100644 vendor/golang.org/x/exp/constraints/constraints.go diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 85df586..c38e980 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -45,7 +45,7 @@ jobs: # Ref: https://github.com/actions/checkout - name: Checkout Source - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: fetch-depth: 0 @@ -75,7 +75,7 @@ jobs: # Ref: https://github.com/SonarSource/sonarqube-scan-action - name: Scan with SonarQube - uses: sonarsource/sonarqube-scan-action@v7 + uses: sonarsource/sonarqube-scan-action@v8 env: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} GITHUB_USER: ${{ github.actor }} diff --git a/.github/workflows/codeql-analysis.yaml b/.github/workflows/codeql-analysis.yaml index 62e819d..d45f46e 100644 --- a/.github/workflows/codeql-analysis.yaml +++ b/.github/workflows/codeql-analysis.yaml @@ -61,7 +61,7 @@ jobs: # Ref: https://github.com/actions/checkout - name: Checkout Source - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: fetch-depth: 0 diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index dacbe2e..b45024e 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -38,7 +38,7 @@ jobs: # Ref: https://github.com/actions/checkout - name: "Checkout Source" - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: fetch-depth: 0 @@ -54,7 +54,7 @@ jobs: # Ref: https://github.com/sigstore/cosign-installer - name: Install Cosign - uses: sigstore/cosign-installer@v4.0.0 # v4.0.0 + uses: sigstore/cosign-installer@v4.1.2 # Ref: https://github.com/anchore/sbom-action - name: Generate SBOM via Syft @@ -65,7 +65,7 @@ jobs: # Ref: https://github.com/goreleaser/goreleaser-action - name: "Release" - uses: goreleaser/goreleaser-action@v6 + uses: goreleaser/goreleaser-action@v7 with: version: latest args: release --clean ${{ env.flags }} diff --git a/CHANGELOG.md b/CHANGELOG.md index cfdf8f3..ed384d9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,6 +17,19 @@ Date format: `YYYY-MM-DD` ### Fixed ### Security +--- +## [0.12.2] - 2026-07-12 + +### Added +### Changed +### Deprecated +- **debt:** Deprecated the use of `golang.org/x/exp/constraints`. + +### Removed +### Fixed +### Security +- **debt:** Upgraded dependencies to their latest stable versions. + --- ## [0.12.1] - 2026-01-16 @@ -203,7 +216,8 @@ Date format: `YYYY-MM-DD` ### Fixed ### Security -[Unreleased]: https://github.com/sixafter/graph/compare/v0.12.1...HEAD +[Unreleased]: https://github.com/sixafter/graph/compare/v0.12.2...HEAD +[0.12.2]: https://github.com/sixafter/graph/compare/v0.12.1...v0.12.2 [0.12.1]: https://github.com/sixafter/graph/compare/v0.12.0...v0.12.1 [0.12.0]: https://github.com/sixafter/graph/compare/v0.11.0...v0.12.0 [0.11.0]: https://github.com/sixafter/graph/compare/v0.10.0...v0.11.0 diff --git a/README.md b/README.md index c99b524..ab5104c 100644 --- a/README.md +++ b/README.md @@ -57,10 +57,10 @@ This Go-based graph library is designed for versatility, performance, and extens To verify the integrity of the release tarball, you can use Cosign to check the signature and checksums. Follow these steps: ```sh -# Fetch the latest release tag from GitHub API (e.g., "v0.12.0") +# Fetch the latest release tag from GitHub API (e.g., "v0.12.2") TAG=$(curl -s https://api.github.com/repos/sixafter/graph/releases/latest | jq -r .tag_name) -# Remove leading "v" for filenames (e.g., "v0.12.0" -> "0.12.0") +# Remove leading "v" for filenames (e.g., "v0.12.2" -> "0.12.2") VERSION=${TAG#v} # --------------------------------------------------------------------- diff --git a/go.mod b/go.mod index 5edbcd3..e73b567 100644 --- a/go.mod +++ b/go.mod @@ -5,12 +5,9 @@ module github.com/sixafter/graph -go 1.25 +go 1.26 -require ( - github.com/stretchr/testify v1.11.1 - golang.org/x/exp v0.0.0-20260112195511-716be5621a96 -) +require github.com/stretchr/testify v1.11.1 require ( github.com/davecgh/go-spew v1.1.1 // indirect diff --git a/go.sum b/go.sum index de44499..c4c1710 100644 --- a/go.sum +++ b/go.sum @@ -4,8 +4,6 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= -golang.org/x/exp v0.0.0-20260112195511-716be5621a96 h1:Z/6YuSHTLOHfNFdb8zVZomZr7cqNgTJvA8+Qz75D8gU= -golang.org/x/exp v0.0.0-20260112195511-716be5621a96/go.mod h1:nzimsREAkjBCIEFtHiYkrJyT+2uy9YZJB7H1k68CXZU= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= diff --git a/graph.go b/graph.go index 4677ca7..9995d68 100644 --- a/graph.go +++ b/graph.go @@ -8,14 +8,13 @@ package graph import ( + "cmp" "context" - - "golang.org/x/exp/constraints" ) type Ordered interface { comparable // Ensures equality (`==`, `!=`) is supported. - constraints.Ordered + cmp.Ordered } // Interface represents a generic graph metadata structure consisting of vertices of diff --git a/vendor/golang.org/x/exp/LICENSE b/vendor/golang.org/x/exp/LICENSE deleted file mode 100644 index 2a7cf70..0000000 --- a/vendor/golang.org/x/exp/LICENSE +++ /dev/null @@ -1,27 +0,0 @@ -Copyright 2009 The Go Authors. - -Redistribution and use in source and binary forms, with or without -modification, are permitted provided that the following conditions are -met: - - * Redistributions of source code must retain the above copyright -notice, this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above -copyright notice, this list of conditions and the following disclaimer -in the documentation and/or other materials provided with the -distribution. - * Neither the name of Google LLC nor the names of its -contributors may be used to endorse or promote products derived from -this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS -"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR -A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT -OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT -LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/vendor/golang.org/x/exp/PATENTS b/vendor/golang.org/x/exp/PATENTS deleted file mode 100644 index 7330990..0000000 --- a/vendor/golang.org/x/exp/PATENTS +++ /dev/null @@ -1,22 +0,0 @@ -Additional IP Rights Grant (Patents) - -"This implementation" means the copyrightable works distributed by -Google as part of the Go project. - -Google hereby grants to You a perpetual, worldwide, non-exclusive, -no-charge, royalty-free, irrevocable (except as stated in this section) -patent license to make, have made, use, offer to sell, sell, import, -transfer and otherwise run, modify and propagate the contents of this -implementation of Go, where such license applies only to those patent -claims, both currently owned or controlled by Google and acquired in -the future, licensable by Google that are necessarily infringed by this -implementation of Go. This grant does not include claims that would be -infringed only as a consequence of further modification of this -implementation. If you or your agent or exclusive licensee institute or -order or agree to the institution of patent litigation against any -entity (including a cross-claim or counterclaim in a lawsuit) alleging -that this implementation of Go or any code incorporated within this -implementation of Go constitutes direct or contributory patent -infringement, or inducement of patent infringement, then any patent -rights granted to you under this License for this implementation of Go -shall terminate as of the date such litigation is filed. diff --git a/vendor/golang.org/x/exp/constraints/constraints.go b/vendor/golang.org/x/exp/constraints/constraints.go deleted file mode 100644 index 9d260ba..0000000 --- a/vendor/golang.org/x/exp/constraints/constraints.go +++ /dev/null @@ -1,54 +0,0 @@ -// Copyright 2021 The Go Authors. All rights reserved. -// Use of this source code is governed by a BSD-style -// license that can be found in the LICENSE file. - -// Package constraints defines a set of useful constraints to be used -// with type parameters. -package constraints - -import "cmp" - -// Signed is a constraint that permits any signed integer type. -// If future releases of Go add new predeclared signed integer types, -// this constraint will be modified to include them. -type Signed interface { - ~int | ~int8 | ~int16 | ~int32 | ~int64 -} - -// Unsigned is a constraint that permits any unsigned integer type. -// If future releases of Go add new predeclared unsigned integer types, -// this constraint will be modified to include them. -type Unsigned interface { - ~uint | ~uint8 | ~uint16 | ~uint32 | ~uint64 | ~uintptr -} - -// Integer is a constraint that permits any integer type. -// If future releases of Go add new predeclared integer types, -// this constraint will be modified to include them. -type Integer interface { - Signed | Unsigned -} - -// Float is a constraint that permits any floating-point type. -// If future releases of Go add new predeclared floating-point types, -// this constraint will be modified to include them. -type Float interface { - ~float32 | ~float64 -} - -// Complex is a constraint that permits any complex numeric type. -// If future releases of Go add new predeclared complex numeric types, -// this constraint will be modified to include them. -type Complex interface { - ~complex64 | ~complex128 -} - -// Ordered is a constraint that permits any ordered type: any type -// that supports the operators < <= >= >. -// If future releases of Go add new ordered types, -// this constraint will be modified to include them. -// -// This type is redundant since Go 1.21 introduced [cmp.Ordered]. -// -//go:fix inline -type Ordered = cmp.Ordered diff --git a/vendor/modules.txt b/vendor/modules.txt index 3140b32..966d5a7 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -8,9 +8,6 @@ github.com/pmezard/go-difflib/difflib ## explicit; go 1.17 github.com/stretchr/testify/assert github.com/stretchr/testify/assert/yaml -# golang.org/x/exp v0.0.0-20260112195511-716be5621a96 -## explicit; go 1.24.0 -golang.org/x/exp/constraints # gopkg.in/yaml.v3 v3.0.1 ## explicit gopkg.in/yaml.v3