mirror of
https://github.com/lukaszraczylo/graphql-monitoring-proxy.git
synced 2026-10-17 06:17:40 +00:00
lukaszraczylo
6e571f8fa0
Fiber v3.3.0 and earlier never set the HSTS header in the helmet middleware (GHSA-gv83-gqw6-9j2c, GO-2026-5912). Version v3.4.0 fixes that and adds an open-redirect fix and X-Forwarded-For hardening. Version v3.4.0 does NOT contain the loopback SSRF block that v3.5.0 added to the proxy middleware, so the 127.0.0.1 backend behaviour is unchanged. The full race test suite, including the loopback proxy tests, passes. Transitive bumps: fasthttp v1.71.0 to v1.72.0, klauspost/compress to v1.19.0.
82 lines
3.4 KiB
AMPL
82 lines
3.4 KiB
AMPL
module github.com/lukaszraczylo/graphql-monitoring-proxy
|
|
|
|
go 1.25.0
|
|
|
|
toolchain go1.26.6
|
|
|
|
require (
|
|
github.com/MicahParks/keyfunc/v3 v3.8.1
|
|
github.com/VictoriaMetrics/metrics v1.44.0
|
|
github.com/alicebob/miniredis/v2 v2.33.0
|
|
github.com/avast/retry-go/v4 v4.7.0
|
|
github.com/goccy/go-json v0.10.6
|
|
github.com/gofiber/contrib/v3/websocket v1.2.0
|
|
github.com/gofiber/fiber/v3 v3.4.0
|
|
github.com/gofrs/flock v0.13.0
|
|
github.com/golang-jwt/jwt/v5 v5.3.1
|
|
github.com/google/uuid v1.6.0
|
|
github.com/gookit/goutil v0.7.6
|
|
github.com/gorilla/websocket v1.5.3
|
|
github.com/graphql-go/graphql v0.8.1
|
|
github.com/jackc/pgx/v5 v5.10.0
|
|
github.com/lukaszraczylo/ask v0.0.0-20240916204100-6e9ef53a62d9
|
|
github.com/lukaszraczylo/go-ratecounter v0.1.12
|
|
github.com/lukaszraczylo/go-simple-graphql v1.2.89
|
|
github.com/lukaszraczylo/oss-telemetry v0.2.3
|
|
github.com/redis/go-redis/v9 v9.20.1
|
|
github.com/sony/gobreaker v1.0.0
|
|
github.com/stretchr/testify v1.11.1
|
|
github.com/valyala/fasthttp v1.72.0
|
|
go.opentelemetry.io/otel v1.44.0
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0
|
|
go.opentelemetry.io/otel/sdk v1.44.0
|
|
go.opentelemetry.io/otel/trace v1.44.0
|
|
go.uber.org/automaxprocs v1.6.0
|
|
google.golang.org/grpc v1.82.1
|
|
)
|
|
|
|
require (
|
|
github.com/MicahParks/jwkset v0.11.1 // indirect
|
|
github.com/alicebob/gopher-json v0.0.0-20200520072559-a9ecdc9d1d3a // indirect
|
|
github.com/andybalholm/brotli v1.2.2 // indirect
|
|
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
|
github.com/fasthttp/websocket v1.5.12 // indirect
|
|
github.com/go-logr/logr v1.4.3 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/gofiber/schema v1.8.0 // indirect
|
|
github.com/gofiber/utils/v2 v2.1.1 // indirect
|
|
github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
|
|
github.com/jackc/pgpassfile v1.0.0 // indirect
|
|
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
|
|
github.com/jackc/puddle/v2 v2.2.2 // indirect
|
|
github.com/klauspost/compress v1.19.0 // indirect
|
|
github.com/mattn/go-colorable v0.1.15 // indirect
|
|
github.com/mattn/go-isatty v0.0.22 // indirect
|
|
github.com/philhofer/fwd v1.2.0 // indirect
|
|
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
|
|
github.com/savsgio/gotils v0.0.0-20250924091648-bce9a52d7761 // indirect
|
|
github.com/tinylib/msgp v1.6.4 // indirect
|
|
github.com/valyala/bytebufferpool v1.0.0 // indirect
|
|
github.com/valyala/fastrand v1.1.0 // indirect
|
|
github.com/valyala/histogram v1.2.0 // indirect
|
|
github.com/yuin/gopher-lua v1.1.1 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.44.0 // indirect
|
|
go.opentelemetry.io/proto/otlp v1.10.0 // indirect
|
|
go.uber.org/atomic v1.11.0 // indirect
|
|
golang.org/x/crypto v0.53.0 // indirect
|
|
golang.org/x/net v0.56.0 // indirect
|
|
golang.org/x/sync v0.21.0 // indirect
|
|
golang.org/x/sys v0.46.0 // indirect
|
|
golang.org/x/term v0.44.0 // indirect
|
|
golang.org/x/text v0.39.0 // indirect
|
|
golang.org/x/time v0.15.0 // indirect
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20260618152121-87f3d3e198d3 // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20260618152121-87f3d3e198d3 // indirect
|
|
google.golang.org/protobuf v1.36.11 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
)
|