fix(ops-10179): Phase 1 CVE/deps migration

.github/workflows/integration.yml

@@ -10,84 +10,60 @@ on:
       - bugfix/*
       - refactor/*
       - chore/*
+      - feat/*
+      - fix/*
 
 jobs:
   test:
-    strategy:
-      matrix:
-        os: [ "ubuntu-latest" ]
-        go: [ ">=1.25.0" ]
-    name: Test with Go ${{ matrix.go }} on ${{ matrix.os }}
-    runs-on: ${{ matrix.os }}
-
+    runs-on: ubuntu-latest
+    env:
+      GOPRIVATE: github.com/blokur
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
-      - name: Set up Go ${{ matrix.go }}
+      - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: ${{ matrix.go }}
+          go-version-file: "go.mod"
+
+      - name: Granting Private Modules Access
+        env:
+          GITHUB_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
+          GITHUB_USER: bkrps
+          GOPRIVATE: github.com/blokur
+        run: git config --global url."https://${GITHUB_USER}:${GITHUB_TOKEN}@github.com".insteadOf "https://github.com"
 
       - uses: satackey/action-docker-layer-caching@v0
         continue-on-error: true
 
-      - name: Tidy modules
-        run: go mod tidy
-
       - name: Running Tests
         run: make ci_tests
 
-  audit:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        os: [ "ubuntu-latest" ]
-        go: [ ">=1.25.0" ]
-
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v5
-
-      - name: Set up Go ${{ matrix.go }}
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ matrix.go }}
-
-      - name: Tidy modules
-        run: go mod tidy
-
-      - name: Check for go vulnerabilities
-        run: |
-          go install golang.org/x/vuln/cmd/govulncheck@latest
-          govulncheck ./...
-
-      - name: WriteGoList
-        run: go list -json -deps > go.list
-
   lint:
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        os: [ "ubuntu-latest" ]
-        go: [ ">=1.25.0" ]
-
+    env:
+      GOPRIVATE: github.com/blokur
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
-      - name: Set up Go ${{ matrix.go }}
+      - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: ${{ matrix.go }}
+          go-version-file: "go.mod"
 
-      - name: Tidy modules
-        run: go mod tidy
+      - name: Granting Private Modules Access
+        env:
+          GITHUB_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
+          GITHUB_USER: bkrps
+          GOPRIVATE: github.com/blokur
+        run: git config --global url."https://${GITHUB_USER}:${GITHUB_TOKEN}@github.com".insteadOf "https://github.com"
+
+      - name: govulncheck
+        run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v8
+        uses: golangci/golangci-lint-action@v9
         with:
           args: --timeout 5m0s
-
-      - id: govulncheck
-        uses: golang/govulncheck-action@v1

.golangci.yml

@@ -63,8 +63,10 @@ linters:
           - gochecknoinits # I'm OK with inits for tests.
           - gocritic # Some of these are actually correct and should not be ignored / changed.
           - gosec # Some errors I tried to fix, others (such as forcing crypto/rand) make no sense.
+          - modernize # pre-existing test style; not rewriting test logic in the CVE pass.
           - testifylint # I tried to remove a few of them.
           - wrapcheck
+          - wsl_v5
         path: _test\.go
       - linters:
           - lll

config.go

@@ -292,6 +292,7 @@ func Buffer(n int) ConfigFunc {
 
 // DeprecatedLogger lets the user to provide their own logger. The default
 // logger is a noop struct.
+//
 // Deprecated: please use the new Logger function.
 func DeprecatedLogger(l logger) ConfigFunc {
 	return func(c *config) {

go.mod

@@ -1,77 +1,75 @@
 module github.com/blokur/harego/v2
 
-go 1.24.0
+go 1.26.4
 
 require (
 	github.com/arsham/retry/v2 v2.1.0
-	github.com/blokur/testament v0.5.0
+	github.com/blokur/testament v1.0.0
 	github.com/bombsimon/logrusr/v4 v4.1.0
 	github.com/containers/storage v1.59.1
-	github.com/docker/docker v28.4.0+incompatible
 	github.com/go-logr/logr v1.4.3
 	github.com/google/go-cmp v0.7.0
-	github.com/rabbitmq/amqp091-go v1.10.0
-	github.com/sirupsen/logrus v1.9.3
+	github.com/moby/moby/api v1.54.2
+	github.com/rabbitmq/amqp091-go v1.11.0
+	github.com/sirupsen/logrus v1.9.4
 	github.com/stretchr/testify v1.11.1
-	github.com/testcontainers/testcontainers-go v0.38.0
-	github.com/testcontainers/testcontainers-go/modules/rabbitmq v0.38.0
+	github.com/testcontainers/testcontainers-go v0.42.0
+	github.com/testcontainers/testcontainers-go/modules/rabbitmq v0.42.0
 )
 
 require (
 	dario.cat/mergo v1.0.2 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/containerd/platforms v0.2.1 // indirect
 	github.com/cpuguy83/dockercfg v0.3.2 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
-	github.com/docker/go-connections v0.6.0 // indirect
+	github.com/docker/go-connections v0.7.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
-	github.com/ebitengine/purego v0.8.4 // indirect
+	github.com/ebitengine/purego v0.10.1 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/klauspost/compress v1.18.0 // indirect
-	github.com/lufia/plan9stats v0.0.0-20250827001030-24949be3fa54 // indirect
+	github.com/klauspost/compress v1.18.6 // indirect
+	github.com/lufia/plan9stats v0.0.0-20260330125221-c963978e514e // indirect
 	github.com/magiconair/properties v1.8.10 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/moby/go-archive v0.1.0 // indirect
-	github.com/moby/patternmatcher v0.6.0 // indirect
+	github.com/moby/go-archive v0.2.0 // indirect
+	github.com/moby/moby/client v0.4.1 // indirect
+	github.com/moby/patternmatcher v0.6.1 // indirect
 	github.com/moby/sys/sequential v0.6.0 // indirect
 	github.com/moby/sys/user v0.4.0 // indirect
 	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/moby/term v0.5.2 // indirect
-	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
-	github.com/shirou/gopsutil/v4 v4.25.8 // indirect
-	github.com/stretchr/objx v0.5.2 // indirect
-	github.com/tklauser/go-sysconf v0.3.15 // indirect
-	github.com/tklauser/numcpus v0.10.0 // indirect
+	github.com/shirou/gopsutil/v4 v4.26.5 // indirect
+	github.com/stretchr/objx v0.5.3 // indirect
+	github.com/tklauser/go-sysconf v0.4.0 // indirect
+	github.com/tklauser/numcpus v0.12.0 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect
-	go.opentelemetry.io/otel v1.38.0 // indirect
-	go.opentelemetry.io/otel/metric v1.38.0 // indirect
-	go.opentelemetry.io/otel/trace v1.38.0 // indirect
-	golang.org/x/crypto v0.42.0 // indirect
-	golang.org/x/exp v0.0.0-20250911091902-df9299821621 // indirect
-	golang.org/x/net v0.44.0 // indirect
-	golang.org/x/sys v0.36.0 // indirect
-	golang.org/x/time v0.12.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250908214217-97024824d090 // indirect
-	google.golang.org/grpc v1.75.1 // indirect
-	google.golang.org/protobuf v1.36.9 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 // indirect
+	go.opentelemetry.io/otel v1.44.0 // indirect
+	go.opentelemetry.io/otel/metric v1.44.0 // indirect
+	go.opentelemetry.io/otel/trace v1.44.0 // indirect
+	golang.org/x/crypto v0.52.0 // indirect
+	golang.org/x/exp v0.0.0-20260529124908-c761662dc8c9 // indirect
+	golang.org/x/sys v0.45.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
+	google.golang.org/grpc v1.81.1 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )