Skip to content

Commit a3fec59

Browse files
loretoloreto
authored
Last round of updates in opensource repo (#534)
## Summary Last round of updates in opensource repo. Only dependency remaining is anthropic ... but that's a big breaking change. ## How was it tested? devbox run test ## Community Contribution License All community contributions in this pull request are licensed to the project maintainers under the terms of the [Apache 2 License](https://www.apache.org/licenses/LICENSE-2.0). By creating this pull request I represent that I have the right to license the contributions to the project maintainers under the Apache 2 License as stated in the [Community Contribution License](https://github.com/jetify-com/opensource/blob/main/CONTRIBUTING.md#community-contribution-license).
1 parent 74d979a commit a3fec59

File tree

19 files changed

+124
-125
lines changed

19 files changed

+124
-125
lines changed

‎aisdk/ai/go.mod

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@ go 1.24.0
44

55
require (
66
github.com/anthropics/anthropic-sdk-go v0.2.0-alpha.13
7-
github.com/k0kubun/pp/v3 v3.4.1
8-
github.com/openai/openai-go v1.0.0
9-
github.com/sashabaranov/go-openai v1.40.0
7+
github.com/k0kubun/pp/v3 v3.5.0
8+
github.com/openai/openai-go v1.11.0
9+
github.com/sashabaranov/go-openai v1.40.5
1010
github.com/stretchr/testify v1.10.0
11-
github.com/tidwall/gjson v1.14.4
11+
github.com/tidwall/gjson v1.18.0
1212
go.jetify.com/pkg v0.0.0-20250717231756-146bdaf5a718
13-
go.jetify.com/sse v0.0.0-20250521180548-aeb6bc6de065
13+
go.jetify.com/sse v0.1.0
1414
)
1515

1616
require (

‎aisdk/ai/go.sum

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@ github.com/anthropics/anthropic-sdk-go v0.2.0-alpha.13/go.mod h1:GJxtdOs9K4neo8G
33
github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
44
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
55
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
6-
github.com/k0kubun/pp/v3 v3.4.1 h1:1WdFZDRRqe8UsR61N/2RoOZ3ziTEqgTPVqKrHeb779Y=
7-
github.com/k0kubun/pp/v3 v3.4.1/go.mod h1:+SiNiqKnBfw1Nkj82Lh5bIeKQOAkPy6Xw9CAZUZ8npI=
6+
github.com/k0kubun/pp/v3 v3.5.0 h1:iYNlYA5HJAJvkD4ibuf9c8y6SHM0QFhaBuCqm1zHp0w=
7+
github.com/k0kubun/pp/v3 v3.5.0/go.mod h1:5lzno5ZZeEeTV/Ky6vs3g6d1U3WarDrH8k240vMtGro=
88
github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
99
github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
1010
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -13,19 +13,19 @@ github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHP
1313
github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
1414
github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
1515
github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
16-
github.com/openai/openai-go v1.0.0 h1:KtP+VfrgzX9dHwHrLwHeyWmS0jjm16N+753Vi7OwEYg=
17-
github.com/openai/openai-go v1.0.0/go.mod h1:g461MYGXEXBVdV5SaR/5tNzNbSfwTBBefwc+LlDCK0Y=
16+
github.com/openai/openai-go v1.11.0 h1:ztH+W0ug5Kh9+/EErHa8KAmhwixkzjK57rXyE+ZnSCk=
17+
github.com/openai/openai-go v1.11.0/go.mod h1:g461MYGXEXBVdV5SaR/5tNzNbSfwTBBefwc+LlDCK0Y=
1818
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
1919
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
2020
github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
2121
github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
22-
github.com/sashabaranov/go-openai v1.40.0 h1:Peg9Iag5mUJtPW00aYatlsn97YML0iNULiLNe74iPrU=
23-
github.com/sashabaranov/go-openai v1.40.0/go.mod h1:lj5b/K+zjTSFxVLijLSTDZuP7adOgerWeFyZLUhAKRg=
22+
github.com/sashabaranov/go-openai v1.40.5 h1:SwIlNdWflzR1Rxd1gv3pUg6pwPc6cQ2uMoHs8ai+/NY=
23+
github.com/sashabaranov/go-openai v1.40.5/go.mod h1:lj5b/K+zjTSFxVLijLSTDZuP7adOgerWeFyZLUhAKRg=
2424
github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
2525
github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
2626
github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
27-
github.com/tidwall/gjson v1.14.4 h1:uo0p8EbA09J7RQaflQ1aBRffTR7xedD2bcIVSYxLnkM=
28-
github.com/tidwall/gjson v1.14.4/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
27+
github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=
28+
github.com/tidwall/gjson v1.18.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
2929
github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
3030
github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
3131
github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
@@ -35,8 +35,8 @@ github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
3535
github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
3636
go.jetify.com/pkg v0.0.0-20250717231756-146bdaf5a718 h1:7//pmsdybvyum5o2gU1IrMl64ymJ6qwT4fLP+8yVE94=
3737
go.jetify.com/pkg v0.0.0-20250717231756-146bdaf5a718/go.mod h1:spU50M2nfHA0YRYyCp0S3FhD+Maw0X10xTMMuFrHHEM=
38-
go.jetify.com/sse v0.0.0-20250521180548-aeb6bc6de065 h1:qIfcJxr3QZG+bNZTONXjENzrsR3SeM7rP+hvpe9RFOE=
39-
go.jetify.com/sse v0.0.0-20250521180548-aeb6bc6de065/go.mod h1:zFADPn3Z0aZJe3+PbArGMGwe3oTwHxPZIwNILoRCmU8=
38+
go.jetify.com/sse v0.1.0 h1:zLIT5XFlUVuTl68bHalpFDYbfSfXJPkmAbtmBqIHl2Q=
39+
go.jetify.com/sse v0.1.0/go.mod h1:zFADPn3Z0aZJe3+PbArGMGwe3oTwHxPZIwNILoRCmU8=
4040
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
4141
golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
4242
golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=

‎aisdk/ai/provider/openai/internal/codec/decode_stream.go

Lines changed: 49 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -156,8 +156,6 @@ func (d *streamDecoder) decodeEvent(event responses.ResponseStreamEventUnion) ap
156156
return d.decodeReasoningSummaryTextDelta(event)
157157
case "response.output_text.annotation.added":
158158
return d.decodeOutputTextAnnotationAdded(event)
159-
case "response.text_annotation.delta":
160-
return d.decodeTextAnnotationDelta(event)
161159
case "error":
162160
return d.decodeError(event)
163161
// Event types that we're aware of but don't yet expose to clients:
@@ -181,11 +179,32 @@ func (d *streamDecoder) decodeEvent(event responses.ResponseStreamEventUnion) ap
181179
"response.audio.done",
182180
"response.audio.transcript.delta",
183181
"response.audio.transcript.done",
184-
"response.code_interpreter_call.code.delta",
185-
"response.code_interpreter_call.code.done",
182+
"response.code_interpreter_call_code.delta",
183+
"response.code_interpreter_call_code.done",
186184
"response.code_interpreter_call.completed",
187185
"response.code_interpreter_call.in_progress",
188-
"response.code_interpreter_call.interpreting":
186+
"response.code_interpreter_call.interpreting",
187+
// Image generation events
188+
"response.image_generation_call.completed",
189+
"response.image_generation_call.generating",
190+
"response.image_generation_call.in_progress",
191+
"response.image_generation_call.partial_image",
192+
// MCP (Model Context Protocol) events
193+
"response.mcp_call_arguments.delta",
194+
"response.mcp_call_arguments.done",
195+
"response.mcp_call.completed",
196+
"response.mcp_call.failed",
197+
"response.mcp_call.in_progress",
198+
"response.mcp_list_tools.completed",
199+
"response.mcp_list_tools.failed",
200+
"response.mcp_list_tools.in_progress",
201+
// Additional reasoning events
202+
"response.reasoning.delta",
203+
"response.reasoning.done",
204+
"response.reasoning_summary.delta",
205+
"response.reasoning_summary.done",
206+
// Other events
207+
"response.queued":
189208
// We're aware these events exist but we don't expose them to clients yet.
190209
return nil
191210
default:
@@ -335,40 +354,44 @@ func (d *streamDecoder) decodeResponseFailedOrIncomplete(event responses.Respons
335354

336355
// decodeReasoningSummaryTextDelta handles reasoning summary text delta events
337356
func (d *streamDecoder) decodeReasoningSummaryTextDelta(event responses.ResponseStreamEventUnion) api.StreamEvent {
357+
// Need to use the specific As method to get the event data
358+
reasoningDelta := event.AsResponseReasoningSummaryTextDelta()
338359
return &api.ReasoningEvent{
339-
TextDelta: event.Delta,
360+
TextDelta: reasoningDelta.Delta,
340361
}
341362
}
342363

343364
// decodeOutputTextAnnotationAdded handles response.output_text.annotation.added events
344365
func (d *streamDecoder) decodeOutputTextAnnotationAdded(event responses.ResponseStreamEventUnion) api.StreamEvent {
345366
addedEvent := event.AsResponseOutputTextAnnotationAdded()
346-
if addedEvent.Annotation.Type == "url_citation" {
347-
citation := addedEvent.Annotation.AsURLCitation()
348-
sourceEvent := &api.SourceEvent{
349-
Source: api.Source{
350-
SourceType: "url",
351-
ID: fmt.Sprintf("source-%d", d.annotationCounter),
352-
URL: citation.URL,
353-
Title: citation.Title,
354-
},
355-
}
356-
d.annotationCounter++
357-
return sourceEvent
367+
368+
// Since Annotation is type 'any', we need to type assert it
369+
annotationMap, ok := addedEvent.Annotation.(map[string]interface{})
370+
if !ok {
371+
return nil
358372
}
359-
return nil
360-
}
361373

362-
// decodeTextAnnotationDelta handles response.text_annotation.delta events
363-
func (d *streamDecoder) decodeTextAnnotationDelta(event responses.ResponseStreamEventUnion) api.StreamEvent {
364-
if event.Annotation.Type == "url_citation" {
365-
citation := event.Annotation.AsURLCitation()
374+
annotationType, ok := annotationMap["type"].(string)
375+
if !ok {
376+
return nil
377+
}
378+
379+
if annotationType == "url_citation" {
380+
// Extract URL and Title from the annotation map
381+
url, urlOk := annotationMap["url"].(string)
382+
title, _ := annotationMap["title"].(string)
383+
384+
// Only create source event if we have at least a URL
385+
if !urlOk || url == "" {
386+
return nil
387+
}
388+
366389
sourceEvent := &api.SourceEvent{
367390
Source: api.Source{
368391
SourceType: "url",
369392
ID: fmt.Sprintf("source-%d", d.annotationCounter),
370-
URL: citation.URL,
371-
Title: citation.Title,
393+
URL: url,
394+
Title: title, // Title can be empty, that's ok
372395
},
373396
}
374397
d.annotationCounter++

‎envsec/go.mod

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,8 @@ require (
7171
github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
7272
go.jetify.com/typeid/v2 v2.0.0-alpha.3 // indirect
7373
golang.org/x/crypto v0.40.0 // indirect
74+
golang.org/x/exp v0.0.0-20250717185816-542afb5b7346 // indirect
75+
golang.org/x/net v0.42.0 // indirect
7476
golang.org/x/oauth2 v0.30.0 // indirect
7577
golang.org/x/sys v0.34.0 // indirect
7678
golang.org/x/term v0.33.0 // indirect

‎envsec/go.sum

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -159,17 +159,17 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5y
159159
golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
160160
golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
161161
golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
162-
golang.org/x/exp v0.0.0-20220909182711-5c715a9e8561 h1:MDc5xs78ZrZr3HMQugiXOAkSZtfTpbJLDr/lwfgO53E=
163-
golang.org/x/exp v0.0.0-20220909182711-5c715a9e8561/go.mod h1:cyybsKvd6eL0RnXn6p/Grxp8F5bW7iYuBgsNCOHpMYE=
162+
golang.org/x/exp v0.0.0-20250717185816-542afb5b7346 h1:vuCObX8mQzik1tfEcYxWZBuVsmQtD1IjxCyPKM18Bh4=
163+
golang.org/x/exp v0.0.0-20250717185816-542afb5b7346/go.mod h1:A+z0yzpGtvnG90cToK5n2tu8UJVP2XUATh+r+sfOOOc=
164164
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
165165
golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
166166
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
167167
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
168168
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
169169
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
170170
golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
171-
golang.org/x/net v0.41.0 h1:vBTly1HeNPEn3wtREYfy4GZ/NECgw2Cnl+nK6Nz3uvw=
172-
golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA=
171+
golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
172+
golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
173173
golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
174174
golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
175175
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

‎go.work.sum

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,11 @@ github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 h1:ywEEhmNahHBihViHepv3xP
1818
github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0/go.mod h1:iZDifYGJTIgIIkYRNWPENUnqx6bJ2xnSDFI2tjwZNuY=
1919
github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2 h1:XHOnouVk1mxXfQidrMEnLlPk9UMeRtyBTnEFtxkV0kU=
2020
github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
21+
github.com/ProtonMail/go-crypto v1.3.0 h1:ILq8+Sf5If5DCpHQp4PbZdS1J7HDFRXz/+xKBiRGFrw=
22+
github.com/ProtonMail/go-crypto v1.3.0/go.mod h1:9whxjD8Rbs29b4XWbB8irEcE8KHMqaR2e7GWU1R+/PE=
2123
github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d/go.mod h1:asat636LX7Bqt5lYEZ27JNDcqxfjdBQuJ/MM4CN/Lzo=
24+
github.com/anthropics/anthropic-sdk-go v0.2.0-alpha.13 h1:xXipLb6/J8hP0GqKPBqK9mBa8nO8KbJWNI4CGx3rYmY=
25+
github.com/anthropics/anthropic-sdk-go v0.2.0-alpha.13/go.mod h1:GJxtdOs9K4neo8Gg65CjJ7jNautmldGli5/OFNabOoo=
2226
github.com/aws/aws-sdk-go-v2 v1.26.1 h1:5554eUqIYVWpU0YmeeYZ0wU64H2VLBs8TlhRB2L+EkA=
2327
github.com/aws/aws-sdk-go-v2 v1.26.1/go.mod h1:ffIFB97e2yNsv4aTSGkqtHnppsIJzw7G7BReUZ3jCXM=
2428
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.3 h1:tW1/Rkad38LA15X4UQtjXZXNKsCgkshC3EbmcUmghTg=
@@ -73,6 +77,8 @@ github.com/chzyer/readline v1.5.1 h1:upd/6fQk4src78LMRzh5vItIt361/o4uq553V8B5sGI
7377
github.com/chzyer/readline v1.5.1/go.mod h1:Eh+b79XXUwfKfcPLepksvw2tcLE/Ct21YObkaSkeBlk=
7478
github.com/chzyer/test v0.0.0-20210722231415-061457976a23 h1:dZ0/VyGgQdVGAss6Ju0dt5P0QltE0SFY5Woh6hbIfiQ=
7579
github.com/chzyer/test v1.0.0 h1:p3BQDXSxOhOG0P9z6/hGnII4LGiEPOYBhs8asl/fC04=
80+
github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ0=
81+
github.com/cloudflare/circl v1.6.1/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
7682
github.com/codeclysm/extract/v3 v3.1.1 h1:iHZtdEAwSTqPrd+1n4jfhr1qBhUWtHlMTjT90+fJVXg=
7783
github.com/codeclysm/extract/v3 v3.1.1/go.mod h1:ZJi80UG2JtfHqJI+lgJSCACttZi++dHxfWuPaMhlOfQ=
7884
github.com/cpuguy83/go-md2man/v2 v2.0.4 h1:wfIWP927BUkWJb2NmU/kNDYIBTh/ziUX91+lVfRxZq4=
@@ -108,6 +114,8 @@ github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6
108114
github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
109115
github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
110116
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
117+
github.com/google/go-github/v53 v53.2.0 h1:wvz3FyF53v4BK+AsnvCmeNhf8AkTaeh2SoYu/XUvTtI=
118+
github.com/google/go-github/v53 v53.2.0/go.mod h1:XhFRObz+m/l+UCm9b7KSIC3lT3NWSXGt7mOsAWEloao=
111119
github.com/google/s2a-go v0.1.7 h1:60BLSyTrOV4/haCDW4zb1guZItoSq8foHCXrAnjBo/o=
112120
github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
113121
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -171,6 +179,8 @@ golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
171179
golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
172180
golang.org/x/mod v0.25.0 h1:n7a+ZbQKQA/Ysbyb0/6IbB1H/X41mKgbhfv7AfG/44w=
173181
golang.org/x/mod v0.25.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
182+
golang.org/x/mod v0.26.0 h1:EGMPT//Ezu+ylkCijjPc+f4Aih7sZvaAr+O3EHBxvZg=
183+
golang.org/x/mod v0.26.0/go.mod h1:/j6NAhSk8iQ723BGAUyoAcn7SlD7s15Dp9Nd/SfeaFQ=
174184
golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
175185
golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
176186
golang.org/x/net v0.30.0/go.mod h1:2wGyMJ5iFasEhkwi13ChkO/t1ECNC4X4eBKkVFyYFlU=
@@ -195,6 +205,8 @@ golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2 h1:IRJeR9r1pYWsHKTRe/I
195205
golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
196206
golang.org/x/telemetry v0.0.0-20240521205824-bda55230c457 h1:zf5N6UOrA487eEFacMePxjXAJctxKmyjKUsjA11Uzuk=
197207
golang.org/x/telemetry v0.0.0-20240521205824-bda55230c457/go.mod h1:pRgIJT+bRLFKnoM1ldnzKoxTIn14Yxz928LQRYYgIN0=
208+
golang.org/x/telemetry v0.0.0-20250710130107-8d8967aff50b h1:DU+gwOBXU+6bO0sEyO7o/NeMlxZxCZEvI7v+J4a1zRQ=
209+
golang.org/x/telemetry v0.0.0-20250710130107-8d8967aff50b/go.mod h1:4ZwOYna0/zsOKwuR5X/m0QFOJpSZvAxFfkQT+Erd9D4=
198210
golang.org/x/term v0.19.0/go.mod h1:2CuTdWZ7KHSQwUzKva0cbMg6q2DMI3Mmxp+gKJbskEk=
199211
golang.org/x/term v0.22.0/go.mod h1:F3qCibpT5AMpCRfhfT53vVJwhLtIVHhB9XDjfFvnMI4=
200212
golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
@@ -208,7 +220,10 @@ golang.org/x/tools v0.20.0/go.mod h1:WvitBU7JJf6A4jOdg4S1tviW9bhUxkgeCui/0JHctQg
208220
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
209221
golang.org/x/tools v0.26.0 h1:v/60pFQmzmT9ExmjDv2gGIfi3OqfKoEP6I5+umXlbnQ=
210222
golang.org/x/tools v0.26.0/go.mod h1:TPVVj70c7JJ3WCazhD8OdXcZg/og+b9+tH/KxylGwH0=
211-
golang.org/x/tools v0.34.0 h1:qIpSLOxeCYGg9TrcJokLBG4KFA6d795g0xkBkiESGlo=
223+
golang.org/x/tools/go/expect v0.1.0-deprecated h1:jY2C5HGYR5lqex3gEniOQL0r7Dq5+VGVgY1nudX5lXY=
224+
golang.org/x/tools/go/expect v0.1.0-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
225+
golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM=
226+
golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated/go.mod h1:RVAQXBGNv1ib0J382/DPCRS/BPnsGebyM1Gj5VSDpG8=
212227
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
213228
google.golang.org/api v0.189.0 h1:equMo30LypAkdkLMBqfeIqtyAnlyig1JSZArl4XPwdI=
214229
google.golang.org/api v0.189.0/go.mod h1:FLWGJKb0hb+pU2j+rJqwbnsF+ym+fQs73rbJ+KAUgy8=

‎pkg/auth/session/idclaims.go

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
package session
22

33
import (
4-
"github.com/go-jose/go-jose/v3/jwt"
4+
"github.com/go-jose/go-jose/v4"
5+
"github.com/go-jose/go-jose/v4/jwt"
56
)
67

78
// Standard claims:
@@ -48,7 +49,19 @@ func (t *Token) IDClaims() *IDClaims {
4849
return nil
4950
}
5051

51-
jwtTok, err := jwt.ParseSigned(t.IDToken)
52+
// Parse the JWT to validate its structure and ensure it uses a supported algorithm.
53+
// We then use UnsafeClaimsWithoutVerification to extract claims without signature
54+
// verification. Per JWT spec (RFC 7519), we accept:
55+
// - MUST: HS256 ("none" is not supported by go-jose for security reasons)
56+
// - RECOMMENDED: RS256, ES256
57+
// - Optional but common: other variants for broader compatibility
58+
jwtTok, err := jwt.ParseSigned(t.IDToken, []jose.SignatureAlgorithm{
59+
jose.HS256, jose.HS384, jose.HS512,
60+
jose.RS256, jose.RS384, jose.RS512,
61+
jose.ES256, jose.ES384, jose.ES512,
62+
jose.PS256, jose.PS384, jose.PS512,
63+
jose.EdDSA,
64+
})
5265
if err != nil {
5366
return nil
5467
}

‎pkg/auth/session/token.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
package session
22

33
import (
4-
"github.com/go-jose/go-jose/v3"
4+
"github.com/go-jose/go-jose/v4"
55
"golang.org/x/oauth2"
66
)
77

‎pkg/go.mod

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ require (
99
github.com/codeclysm/extract/v4 v4.0.0
1010
github.com/coreos/go-oidc/v3 v3.14.1
1111
github.com/fatih/color v1.18.0
12-
github.com/go-jose/go-jose/v3 v3.0.4
13-
github.com/google/go-github/v53 v53.2.0
12+
github.com/go-jose/go-jose/v4 v4.1.1
13+
github.com/google/go-github/v73 v73.0.0
1414
github.com/google/renameio/v2 v2.0.0
1515
github.com/gosimple/slug v1.15.0
1616
github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79
@@ -33,13 +33,10 @@ require (
3333
)
3434

3535
require (
36-
github.com/ProtonMail/go-crypto v1.3.0 // indirect
37-
github.com/cloudflare/circl v1.6.1 // indirect
36+
github.com/arduino/go-paths-helper v1.13.1 // indirect
3837
github.com/davecgh/go-spew v1.1.1 // indirect
39-
github.com/go-jose/go-jose/v4 v4.1.1 // indirect
4038
github.com/gofrs/uuid/v5 v5.3.2 // indirect
4139
github.com/google/btree v1.1.3 // indirect
42-
github.com/google/go-cmp v0.7.0 // indirect
4340
github.com/google/go-querystring v1.1.0 // indirect
4441
github.com/gosimple/unidecode v1.0.1 // indirect
4542
github.com/h2non/filetype v1.1.3 // indirect
@@ -53,4 +50,5 @@ require (
5350
github.com/spf13/pflag v1.0.7 // indirect
5451
github.com/ulikunitz/xz v0.5.12 // indirect
5552
golang.org/x/crypto v0.40.0 // indirect
53+
golang.org/x/net v0.42.0 // indirect
5654
)

0 commit comments

Comments
 (0)