diff --git a/checks/cloud/google/gke/enable_auto_repair.rego b/checks/cloud/google/gke/enable_auto_repair.rego index fe65efd9d..b1c658c71 100644 --- a/checks/cloud/google/gke/enable_auto_repair.rego +++ b/checks/cloud/google/gke/enable_auto_repair.rego @@ -25,14 +25,39 @@ package builtin.google.gke.google0063 import rego.v1 import data.lib.cloud.metadata +import data.lib.cloud.value deny contains res if { some cluster in input.google.gke.clusters isManaged(cluster) + autopilot_disabled(cluster) some pool in cluster.nodepools - not pool.management.enableautorepair.value + autorepair_is_disabled_for_pool(pool) res := result.new( "Node pool does not have auto-repair enabled.", metadata.obj_by_path(pool, ["management", "enableautorepair"]), ) } + +autorepair_is_disabled_for_pool(pool) if value.is_false(pool.management.enableautorepair) + +autorepair_is_disabled_for_pool(pool) if not pool.management.enableautorepair + +autopilot_disabled(cluster) if value.is_false(cluster.enableautpilot) + +autopilot_disabled(cluster) if not cluster.enableautpilot + +deny contains res if { + some cluster in input.google.gke.clusters + isManaged(cluster) + cluster.enableautpilot.value + autorepair_is_disabled(cluster) + res := result.new( + "Node pool does not have auto-repair enabled.", + metadata.obj_by_path(cluster, ["autoscaling", "autoprovisioningdefaults", "management", "enableautorepair"]), + ) +} + +autorepair_is_disabled(cluster) if value.is_false(cluster.autoscaling.autoprovisioningdefaults.management.enableautorepair) + +autorepair_is_disabled(cluster) if not cluster.autoscaling.autoprovisioningdefaults.management.enableautorepair diff --git a/checks/cloud/google/gke/enable_auto_repair_test.rego b/checks/cloud/google/gke/enable_auto_repair_test.rego index 69dc0510c..482ff1079 100644 --- a/checks/cloud/google/gke/enable_auto_repair_test.rego +++ b/checks/cloud/google/gke/enable_auto_repair_test.rego @@ -11,9 +11,46 @@ test_deny_auto_repair_disabled if { count(res) == 1 } +test_deny_auto_repair_disabled_for_autopilot if { + inp := {"google": {"gke": {"clusters": [{ + "enableautpilot": {"value": true}, + "autoscaling": {"autoprovisioningdefaults": {"management": {"enableautorepair": {"value": false}}}}, + }]}}} + + res := check.deny with input as inp + count(res) == 1 +} + +test_deny_auto_repair_missing_for_autopilot if { + inp := {"google": {"gke": {"clusters": [{"enableautpilot": {"value": true}}]}}} + + res := check.deny with input as inp + count(res) == 1 +} + test_allow_auto_repair_enabled if { inp := {"google": {"gke": {"clusters": [{"nodepools": [{"management": {"enableautorepair": {"value": true}}}]}]}}} res := check.deny with input as inp res == set() } + +test_allow_auto_repair_enabled_for_autopilot if { + inp := {"google": {"gke": {"clusters": [{ + "enableautpilot": {"value": true}, + "autoscaling": {"autoprovisioningdefaults": {"management": {"enableautorepair": {"value": true}}}}, + }]}}} + + res := check.deny with input as inp + res == set() +} + +test_allow_auto_repair_unresolvable_for_autopilot if { + inp := {"google": {"gke": {"clusters": [{ + "enableautpilot": {"value": true}, + "autoscaling": {"autoprovisioningdefaults": {"management": {"enableautorepair": {"value": false, "unresolvable": true}}}}, + }]}}} + + res := check.deny with input as inp + res == set() +} diff --git a/checks/cloud/google/gke/enable_auto_upgrade.rego b/checks/cloud/google/gke/enable_auto_upgrade.rego index 06d0e6f89..3dfc1ffb1 100644 --- a/checks/cloud/google/gke/enable_auto_upgrade.rego +++ b/checks/cloud/google/gke/enable_auto_upgrade.rego @@ -25,14 +25,39 @@ package builtin.google.gke.google0058 import rego.v1 import data.lib.cloud.metadata +import data.lib.cloud.value deny contains res if { some cluster in input.google.gke.clusters isManaged(cluster) + autopilot_disabled(cluster) some pool in cluster.nodepools - not pool.management.enableautoupgrade.value + autoupgrade_is_disabled_for_pool(pool) res := result.new( - "Node pool does not have auto-upgraade enabled.", + "Node pool does not have auto-repair enabled.", metadata.obj_by_path(pool, ["management", "enableautoupgrade"]), ) } + +autoupgrade_is_disabled_for_pool(pool) if value.is_false(pool.management.enableautoupgrade) + +autoupgrade_is_disabled_for_pool(pool) if not pool.management.enableautoupgrade + +autopilot_disabled(cluster) if value.is_false(cluster.enableautpilot) + +autopilot_disabled(cluster) if not cluster.enableautpilot + +deny contains res if { + some cluster in input.google.gke.clusters + isManaged(cluster) + cluster.enableautpilot.value + autoupgrade_is_disabled(cluster) + res := result.new( + "Node pool does not have auto-repair enabled.", + metadata.obj_by_path(cluster, ["autoscaling", "autoprovisioningdefaults", "management", "enableautoupgrade"]), + ) +} + +autoupgrade_is_disabled(cluster) if value.is_false(cluster.autoscaling.autoprovisioningdefaults.management.enableautoupgrade) + +autoupgrade_is_disabled(cluster) if not cluster.autoscaling.autoprovisioningdefaults.management.enableautoupgrade diff --git a/checks/cloud/google/gke/enable_auto_upgrade_test.rego b/checks/cloud/google/gke/enable_auto_upgrade_test.rego index e23e5f2a3..1d9b86dc3 100644 --- a/checks/cloud/google/gke/enable_auto_upgrade_test.rego +++ b/checks/cloud/google/gke/enable_auto_upgrade_test.rego @@ -11,9 +11,46 @@ test_deny_auto_upgrade_disabled if { count(res) == 1 } +test_deny_auto_repair_disabled_for_autopilot if { + inp := {"google": {"gke": {"clusters": [{ + "enableautpilot": {"value": true}, + "autoscaling": {"autoprovisioningdefaults": {"management": {"enableautoupgrade": {"value": false}}}}, + }]}}} + + res := check.deny with input as inp + count(res) == 1 +} + +test_deny_auto_repair_missing_for_autopilot if { + inp := {"google": {"gke": {"clusters": [{"enableautpilot": {"value": true}}]}}} + + res := check.deny with input as inp + count(res) == 1 +} + test_allow_auto_upgrade_enabled if { inp := {"google": {"gke": {"clusters": [{"nodepools": [{"management": {"enableautoupgrade": {"value": true}}}]}]}}} res := check.deny with input as inp res == set() } + +test_allow_auto_repair_enabled_for_autopilot if { + inp := {"google": {"gke": {"clusters": [{ + "enableautpilot": {"value": true}, + "autoscaling": {"autoprovisioningdefaults": {"management": {"enableautoupgrade": {"value": true}}}}, + }]}}} + + res := check.deny with input as inp + res == set() +} + +test_allow_auto_repair_unresolvable_for_autopilot if { + inp := {"google": {"gke": {"clusters": [{ + "enableautpilot": {"value": true}, + "autoscaling": {"autoprovisioningdefaults": {"management": {"enableautoupgrade": {"value": false, "unresolvable": true}}}}, + }]}}} + + res := check.deny with input as inp + res == set() +} diff --git a/checks/cloud/google/gke/node_pool_uses_cos.rego b/checks/cloud/google/gke/node_pool_uses_cos.rego index 1ea91f68f..592bb0270 100644 --- a/checks/cloud/google/gke/node_pool_uses_cos.rego +++ b/checks/cloud/google/gke/node_pool_uses_cos.rego @@ -22,13 +22,15 @@ # examples: checks/cloud/google/gke/node_pool_uses_cos.yaml package builtin.google.gke.google0054 +import data.lib.cloud.value import rego.v1 deny contains res if { some cluster in input.google.gke.clusters isManaged(cluster) + autopilot_disabled(cluster) image_type := cluster.nodeconfig.imagetype - not lower(image_type.value) in {"cos", "cos_containerd", ""} + image_type_is_not_cos(image_type, {"cos", "cos_containerd", ""}) res := result.new( "Cluster is not configuring node pools to use the COS containerd image type by default.", image_type, @@ -38,11 +40,35 @@ deny contains res if { deny contains res if { some cluster in input.google.gke.clusters isManaged(cluster) + autopilot_disabled(cluster) some pool in cluster.nodepools image_type := pool.nodeconfig.imagetype - not lower(image_type.value) in {"cos", "cos_containerd"} + image_type_is_not_cos(image_type, {"cos", "cos_containerd"}) res := result.new( "Node pool is not using the COS containerd image type.", image_type, ) } + +autopilot_disabled(cluster) if value.is_false(cluster.enableautpilot) + +autopilot_disabled(cluster) if not cluster.enableautpilot + +deny contains res if { + some cluster in input.google.gke.clusters + isManaged(cluster) + cluster.enableautpilot.value + image_type := cluster.autoscaling.autoprovisioningdefaults.imagetype + image_type_is_not_cos(image_type, {"cos", "cos_containerd"}) + res := result.new( + "Node pool is not using the COS containerd image type.", + image_type, + ) +} + +image_type_is_not_cos(image_type, _) if value.is_empty(image_type) + +image_type_is_not_cos(image_type, allowed) if { + value.is_not_empty(image_type) + not lower(image_type.value) in allowed +} diff --git a/checks/cloud/google/gke/node_pool_uses_cos_test.rego b/checks/cloud/google/gke/node_pool_uses_cos_test.rego index f3f882eb7..a02fb89f2 100644 --- a/checks/cloud/google/gke/node_pool_uses_cos_test.rego +++ b/checks/cloud/google/gke/node_pool_uses_cos_test.rego @@ -18,6 +18,16 @@ test_deny_node_pool_image_type_is_ubuntu if { count(res) == 1 } +test_deny_autopilot_image_type_is_ubuntu if { + inp := {"google": {"gke": {"clusters": [{ + "enableautpilot": {"value": true}, + "autoscaling": {"autoprovisioningdefaults": {"imagetype": {"value": "UBUNTU"}}}, + }]}}} + + res := check.deny with input as inp + count(res) == 1 +} + test_allow_node_config_image_type_is_cos if { inp := {"google": {"gke": {"clusters": [{"nodeconfig": {"imagetype": {"value": "COS"}}}]}}} @@ -31,3 +41,23 @@ test_allow_node_pool_image_type_is_cos if { res := check.deny with input as inp res == set() } + +test_allow_autopilot_image_type_is_cos if { + inp := {"google": {"gke": {"clusters": [{ + "enableautpilot": {"value": true}, + "autoscaling": {"autoprovisioningdefaults": {"imagetype": {"value": "COS"}}}, + }]}}} + + res := check.deny with input as inp + res == set() +} + +test_allow_autopilot_image_type_is_unresolvable if { + inp := {"google": {"gke": {"clusters": [{ + "enableautpilot": {"value": true}, + "autoscaling": {"autoprovisioningdefaults": {"imagetype": {"value": "", "unresolvable": true}}}, + }]}}} + + res := check.deny with input as inp + res == set() +} diff --git a/checks/cloud/google/gke/use_service_account.rego b/checks/cloud/google/gke/use_service_account.rego index fa630ce91..b00f05905 100644 --- a/checks/cloud/google/gke/use_service_account.rego +++ b/checks/cloud/google/gke/use_service_account.rego @@ -32,6 +32,7 @@ import data.lib.cloud.value deny contains res if { some cluster in input.google.gke.clusters isManaged(cluster) + autopilot_disabled(cluster) value.is_false(cluster.removedefaultnodepool) default_account_is_not_overrided(cluster.nodeconfig) res := result.new( @@ -43,6 +44,7 @@ deny contains res if { deny contains res if { some cluster in input.google.gke.clusters isManaged(cluster) + autopilot_disabled(cluster) some pool in cluster.nodepools default_account_is_not_overrided(pool.nodeconfig) res := result.new( @@ -51,6 +53,21 @@ deny contains res if { ) } +deny contains res if { + some cluster in input.google.gke.clusters + isManaged(cluster) + cluster.enableautpilot.value + default_account_is_not_overrided(cluster.autoscaling.autoprovisioningdefaults) + res := result.new( + "Cluster does not override the default service account.", + metadata.obj_by_path(cluster, ["nodeconfig", "serviceaccount"]), + ) +} + +autopilot_disabled(cluster) if value.is_false(cluster.enableautpilot) + +autopilot_disabled(cluster) if not cluster.enableautpilot + default_account_is_not_overrided(nodeconfig) if value.is_empty(nodeconfig.serviceaccount) default_account_is_not_overrided(nodeconfig) if not nodeconfig.serviceaccount diff --git a/go.mod b/go.mod index 0aea82c43..6f09b2e04 100644 --- a/go.mod +++ b/go.mod @@ -6,8 +6,8 @@ toolchain go1.24.0 require ( github.com/aquasecurity/iamgo v0.0.10 - github.com/aquasecurity/trivy v0.61.1-0.20250407075540-f1329c7ea1aa - github.com/aws-cloudformation/rain v1.22.0 + github.com/aquasecurity/trivy v0.61.1-0.20250408211346-9792611b3627 + github.com/aws-cloudformation/rain v1.21.0 github.com/docker/docker v28.0.4+incompatible github.com/hashicorp/hcl/v2 v2.23.0 github.com/open-policy-agent/opa v1.3.0 @@ -16,8 +16,8 @@ require ( github.com/spf13/viper v1.20.1 github.com/stretchr/testify v1.10.0 github.com/testcontainers/testcontainers-go v0.36.0 - github.com/testcontainers/testcontainers-go/modules/registry v0.36.0 - golang.org/x/text v0.24.0 + github.com/testcontainers/testcontainers-go/modules/registry v0.35.0 + golang.org/x/text v0.23.0 gopkg.in/yaml.v3 v3.0.1 mvdan.cc/sh/v3 v3.11.0 ) @@ -385,15 +385,15 @@ require ( go.uber.org/multierr v1.11.0 // indirect go.uber.org/zap v1.27.0 // indirect golang.org/x/crypto v0.36.0 // indirect - golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 // indirect + golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8 // indirect golang.org/x/mod v0.24.0 // indirect - golang.org/x/net v0.38.0 // indirect + golang.org/x/net v0.37.0 // indirect golang.org/x/oauth2 v0.26.0 // indirect - golang.org/x/sync v0.13.0 // indirect + golang.org/x/sync v0.12.0 // indirect golang.org/x/sys v0.31.0 // indirect golang.org/x/term v0.30.0 // indirect golang.org/x/time v0.11.0 // indirect - golang.org/x/tools v0.31.0 // indirect + golang.org/x/tools v0.29.0 // indirect golang.org/x/xerrors v0.0.0-20240716161551-93cc26a95ae9 // indirect google.golang.org/api v0.218.0 // indirect google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 // indirect diff --git a/go.sum b/go.sum index ae34a385c..8cbcb12cf 100644 --- a/go.sum +++ b/go.sum @@ -801,8 +801,8 @@ github.com/aquasecurity/testdocker v0.0.0-20240730042311-4642e94c7fc8 h1:b43UVqY github.com/aquasecurity/testdocker v0.0.0-20240730042311-4642e94c7fc8/go.mod h1:wXA9k3uuaxY3yu7gxrxZDPo/04FEMJtwyecdAlYrEIo= github.com/aquasecurity/tml v0.6.1 h1:y2ZlGSfrhnn7t4ZJ/0rotuH+v5Jgv6BDDO5jB6A9gwo= github.com/aquasecurity/tml v0.6.1/go.mod h1:OnYMWY5lvI9ejU7yH9LCberWaaTBW7hBFsITiIMY2yY= -github.com/aquasecurity/trivy v0.61.1-0.20250407075540-f1329c7ea1aa h1:hTCqB55JsyhElf63U3xtDcKba5jxd1MbAj5eedR0TAI= -github.com/aquasecurity/trivy v0.61.1-0.20250407075540-f1329c7ea1aa/go.mod h1:rHsc1HjiYz3ItMw1tziCvmvAIt8p7Xs+2amw+HThAx8= +github.com/aquasecurity/trivy v0.61.1-0.20250408211346-9792611b3627 h1:i3VxWBmvYSJLok2mzAfTiDT0Sj73rWIFBqAix+zjB14= +github.com/aquasecurity/trivy v0.61.1-0.20250408211346-9792611b3627/go.mod h1:rHsc1HjiYz3ItMw1tziCvmvAIt8p7Xs+2amw+HThAx8= github.com/aquasecurity/trivy-db v0.0.0-20250227071930-8bd8a9b89e2d h1:T16WrTi21YsMLQVhtp1r1hOIYK3x4BjnftpL9cp64Eo= github.com/aquasecurity/trivy-db v0.0.0-20250227071930-8bd8a9b89e2d/go.mod h1:4bTsQPtMBN8v+UfUlE1aQBN1imftefnDafHBF85+aT8= github.com/aquasecurity/trivy-java-db v0.0.0-20240109071736-184bd7481d48 h1:JVgBIuIYbwG+ekC5lUHUpGJboPYiCcxiz06RCtz8neI= @@ -815,8 +815,8 @@ github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPd github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs= github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so= github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw= -github.com/aws-cloudformation/rain v1.22.0 h1:uK+qAKLLSp7dxdMohEm8xzIinz+3+azZX2sPrdymUlw= -github.com/aws-cloudformation/rain v1.22.0/go.mod h1:eatG8FXSMhgK2HsfpXQAdwarKUQOyl3xxILDFSkO9tM= +github.com/aws-cloudformation/rain v1.21.0 h1:VcMthCM/UFojCngAgF3tkbyuG+gP98PN8b53py688Mo= +github.com/aws-cloudformation/rain v1.21.0/go.mod h1:je+IG7S/xX8uA07eJB4mvOc+3dyaWCzb/UMsY7NRHYo= github.com/aws/aws-sdk-go v1.44.122/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo= github.com/aws/aws-sdk-go v1.55.6 h1:cSg4pvZ3m8dgYcgqB97MrcdjUmZ1BeMYKUxMMB89IPk= github.com/aws/aws-sdk-go v1.55.6/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU= @@ -846,8 +846,8 @@ github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3 h1:eAh2A4b github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3/go.mod h1:0yKJC/kb8sAnmlYa6Zs3QVYqaC8ug2AbnNChv5Ox3uA= github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15 h1:dM9/92u2F1JbDaGooxTq18wmmFzbJRfXfVfy96/1CXM= github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15/go.mod h1:SwFBy2vjtA0vZbjjaFtfN045boopadnoVPhu4Fv66vY= -github.com/aws/aws-sdk-go-v2/service/kms v1.38.1 h1:tecq7+mAav5byF+Mr+iONJnCBf4B4gon8RSp4BrweSc= -github.com/aws/aws-sdk-go-v2/service/kms v1.38.1/go.mod h1:cQn6tAF77Di6m4huxovNM7NVAozWTZLsDRp9t8Z/WYk= +github.com/aws/aws-sdk-go-v2/service/kms v1.37.10 h1:nqYgJ+twjn6hrhTS97j3tlpNXrw4E9N2zQBgw2FAQMg= +github.com/aws/aws-sdk-go-v2/service/kms v1.37.10/go.mod h1:wHYtyttsH+A6d2MzXYl8cIf4O2Kw1Kg0qzromSX/wOs= github.com/aws/aws-sdk-go-v2/service/s3 v1.79.1 h1:2Ku1xwAohSSXHR1tpAnyVDSQSxoDMA+/NZBytW+f4qg= github.com/aws/aws-sdk-go-v2/service/s3 v1.79.1/go.mod h1:U5SNqwhXB3Xe6F47kXvWihPl/ilGaEDe8HD/50Z9wxc= github.com/aws/aws-sdk-go-v2/service/sso v1.25.3 h1:1Gw+9ajCV1jogloEv1RRnvfRFia2cL6c9cuKV2Ps+G8= @@ -1861,8 +1861,8 @@ github.com/testcontainers/testcontainers-go v0.36.0 h1:YpffyLuHtdp5EUsI5mT4sRw8G github.com/testcontainers/testcontainers-go v0.36.0/go.mod h1:yk73GVJ0KUZIHUtFna6MO7QS144qYpoY8lEEtU9Hed0= github.com/testcontainers/testcontainers-go/modules/localstack v0.36.0 h1:zVwbe46NYg2vtC26aF0ndClK5S9J7TgAliQbTLyHm+0= github.com/testcontainers/testcontainers-go/modules/localstack v0.36.0/go.mod h1:rxyzj5nX/OUn7QK5PVxKYHJg1eeNtNzWMX2hSbNNJk0= -github.com/testcontainers/testcontainers-go/modules/registry v0.36.0 h1:ECmkTSgyUx2HG97BRdVwWt3RK0+6z8hRSGLTOHSRcjA= -github.com/testcontainers/testcontainers-go/modules/registry v0.36.0/go.mod h1:yOg+DPbBRRfWvId8kIS0Cbu8n+l2HoM/+6IPPAJa3VU= +github.com/testcontainers/testcontainers-go/modules/registry v0.35.0 h1:WEErFo3kuZ05PPI7V9xLFzU23zHtvOp1szzAICjlAt8= +github.com/testcontainers/testcontainers-go/modules/registry v0.35.0/go.mod h1:CXANRjVb5eP30thpEUf0cWkcUPSJjpsR8Y68URwdHxI= github.com/tetratelabs/wazero v1.9.0 h1:IcZ56OuxrtaEz8UYNRHBrUa9bYeX9oVY93KspZZBf/I= github.com/tetratelabs/wazero v1.9.0/go.mod h1:TSbcXCfFP0L2FGkRPxHphadXPjo1T6W+CseNNY7EkjM= github.com/thales-e-security/pool v0.0.2 h1:RAPs4q2EbWsTit6tpzuvTFlgFRJ3S8Evf5gtvVDbmPg= @@ -2042,8 +2042,8 @@ golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u0 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM= golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU= golang.org/x/exp v0.0.0-20220827204233-334a2380cb91/go.mod h1:cyybsKvd6eL0RnXn6p/Grxp8F5bW7iYuBgsNCOHpMYE= -golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 h1:nDVHiLt8aIbd/VzvPWN6kSOPE7+F/fNFDSXLVYkE/Iw= -golang.org/x/exp v0.0.0-20250305212735-054e65f0b394/go.mod h1:sIifuuw/Yco/y6yb6+bDNfyeQ/MdPUy/hKEMYQV17cM= +golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8 h1:yqrTHse8TCMW1M1ZCP+VAR/l0kKxwaAIqN/il7x4voA= +golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8/go.mod h1:tujkw807nyEEAamNbDrEGzRav+ilXA7PCRAd6xsmwiU= golang.org/x/image v0.0.0-20180708004352-c73c2afc3b81/go.mod h1:ux5Hcp/YLpHSI86hEcLt0YII63i6oz57MZXIpbrjZUs= golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js= golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0= @@ -2161,8 +2161,8 @@ golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY= golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44= golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM= golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k= -golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8= -golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8= +golang.org/x/net v0.37.0 h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c= +golang.org/x/net v0.37.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= @@ -2214,8 +2214,8 @@ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y= golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= -golang.org/x/sync v0.13.0 h1:AauUjRAJ9OSnvULf/ARrrVywoJDy0YS2AwQ98I37610= -golang.org/x/sync v0.13.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= +golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw= +golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= @@ -2354,8 +2354,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ= -golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0= -golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU= +golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY= +golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= @@ -2431,8 +2431,8 @@ golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s= golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58= golang.org/x/tools v0.17.0/go.mod h1:xsh6VxdV005rRVaS6SSAf9oiAqljS7UZUacMZ8Bnsps= golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk= -golang.org/x/tools v0.31.0 h1:0EedkvKDbh+qistFTd0Bcwe/YLh4vHwWEkiI0toFIBU= -golang.org/x/tools v0.31.0/go.mod h1:naFTU+Cev749tSJRXJlna0T3WxKvb1kWEx15xA4SdmQ= +golang.org/x/tools v0.29.0 h1:Xx0h3TtM9rzQpQuR4dKLrdglAmCEN5Oi+P74JdhdzXE= +golang.org/x/tools v0.29.0/go.mod h1:KMQVMRsVxU6nHCFXrBPhDB8XncLNLM0lIy/F14RP588= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=