Version 0.48.1-RC1

.github/workflows/build.yml

@@ -39,7 +39,7 @@ jobs:
           - 1.24.6
         sys:
           - { os: ubuntu-latest }
-          - { os: macos-13, shell: zsh }
+          - { os: macos-15-intel, shell: zsh }
           - { os: macos-latest, shell: zsh }
           - { os: windows-2025 }
           - { os: ubuntu-24.04-arm }
@@ -443,7 +443,7 @@ jobs:
         name: Install Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.23.x
+          go-version: 1.24.x
 
       - # === Install State Tool ===
         name: Install State Tool
@@ -512,7 +512,7 @@ jobs:
         with:
           name: |
             session-build-ubuntu-latest
-            session-build-macos-13
+            session-build-macos-15-intel
             session-build-macos-latest
             session-build-windows-2025
-            session-build-ubuntu-24.04-arm
+            session-build-ubuntu-24.04-arm

.github/workflows/release.yml

@@ -31,7 +31,7 @@ jobs:
         name: Install Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.23.x'
+          go-version: '1.24.x'
 
       - # === Install State Tool ===
         name: Install State Tool

.golangci.yaml

@@ -1,53 +1,57 @@
-issues:
-  exclude-dirs:
-    - vendor
-  exclude-rules:
-    - linters:
-        - staticcheck
-      text: "SA9004"
-
-linters-settings:
-  errcheck:
-    exclude-functions:
-      - fmt.Fprintln
-      - (*github.com/ActiveState/termtest.TermTest).Expect
-      - (*github.com/ActiveState/termtest.TermTest).ExpectExitCode
-      - (*github.com/ActiveState/termtest.TermTest).ExpectNotExitCode
-      - (*github.com/ActiveState/termtest.TermTest).ExpectRe
-      - (*github.com/ActiveState/termtest.TermTest).Expect
-      - (*github.com/ActiveState/termtest.TermTest).WaitForInput
-      - (*github.com/ActiveState/termtest.TermTest).SendLine
-      - (*github.com/ActiveState/termtest.TermTest).ExpectInput
-      - (*github.com/ActiveState/termtest.TermTest).ExpectExit
-      - (*github.com/ActiveState/termtest.TermTest).Wait
-      - (*github.com/ActiveState/logging.fileHandler).Printf
-      - (*github.com/ActiveState/logging.standardHandler).Printf
-      - (*github.com/ActiveState/cli/internal/testhelpers/e2e.Session).Close
-      - (*github.com/ActiveState/cli/internal/testhelpers/e2e.SpawnedCmd).ExpectInput
-      - (*github.com/ActiveState/cli/internal/testhelpers/e2e.SpawnedCmd).Send
-      - (*github.com/ActiveState/cli/internal/testhelpers/e2e.SpawnedCmd).SendLine
-      - (*github.com/ActiveState/cli/internal/testhelpers/e2e.SpawnedCmd).SendEnter
-      - (*github.com/ActiveState/cli/internal/testhelpers/e2e.SpawnedCmd).SendKeyDown
-      - (*github.com/ActiveState/cli/internal/testhelpers/e2e.SpawnedCmd).ExpectRe
-      - (*github.com/ActiveState/cli/internal/testhelpers/e2e.SpawnedCmd).Wait
-      - (*github.com/ActiveState/cli/internal/testhelpers/e2e.Session).ClearCache
-      - (*github.com/ActiveState/cli/internal/testhelpers/e2e.Dirs).Close
-      - github.com/ActiveState/cli/internal/testhelpers/osutil.RemoveConfigFile
-      - (*github.com/ActiveState/cli/internal/logging.standardHandler).Emit
-      - (*github.com/ActiveState/cli/internal/logging.fileHandler).Emit
-  govet:
-    disable:
-      - composites
-
-# When issues occur with linting us the snippet below to help with debugging
-# linters:
-#   # Disable all and re-enable the default linters as a starting point.
-#   disable-all: true
-#   enable:
-#     - errcheck
-#     - gosimple
-#     - govet
-#     - ineffassign
-#     - staticcheck
-#     - typecheck
-#     - unused
+version: "2"
+linters:
+  settings:
+    errcheck:
+      exclude-functions:
+        - fmt.Fprintln
+        - (*github.com/ActiveState/termtest.TermTest).Expect
+        - (*github.com/ActiveState/termtest.TermTest).ExpectExitCode
+        - (*github.com/ActiveState/termtest.TermTest).ExpectNotExitCode
+        - (*github.com/ActiveState/termtest.TermTest).ExpectRe
+        - (*github.com/ActiveState/termtest.TermTest).Expect
+        - (*github.com/ActiveState/termtest.TermTest).WaitForInput
+        - (*github.com/ActiveState/termtest.TermTest).SendLine
+        - (*github.com/ActiveState/termtest.TermTest).ExpectInput
+        - (*github.com/ActiveState/termtest.TermTest).ExpectExit
+        - (*github.com/ActiveState/termtest.TermTest).Wait
+        - (*github.com/ActiveState/logging.fileHandler).Printf
+        - (*github.com/ActiveState/logging.standardHandler).Printf
+        - (*github.com/ActiveState/cli/internal/testhelpers/e2e.Session).Close
+        - (*github.com/ActiveState/cli/internal/testhelpers/e2e.SpawnedCmd).ExpectInput
+        - (*github.com/ActiveState/cli/internal/testhelpers/e2e.SpawnedCmd).Send
+        - (*github.com/ActiveState/cli/internal/testhelpers/e2e.SpawnedCmd).SendLine
+        - (*github.com/ActiveState/cli/internal/testhelpers/e2e.SpawnedCmd).SendEnter
+        - (*github.com/ActiveState/cli/internal/testhelpers/e2e.SpawnedCmd).SendKeyDown
+        - (*github.com/ActiveState/cli/internal/testhelpers/e2e.SpawnedCmd).ExpectRe
+        - (*github.com/ActiveState/cli/internal/testhelpers/e2e.SpawnedCmd).Wait
+        - (*github.com/ActiveState/cli/internal/testhelpers/e2e.Session).ClearCache
+        - (*github.com/ActiveState/cli/internal/testhelpers/e2e.Dirs).Close
+        - github.com/ActiveState/cli/internal/testhelpers/osutil.RemoveConfigFile
+        - (*github.com/ActiveState/cli/internal/logging.standardHandler).Emit
+        - (*github.com/ActiveState/cli/internal/logging.fileHandler).Emit
+    govet:
+      disable:
+        - composites
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    rules:
+      - linters:
+          - staticcheck
+        text: SA9004
+    paths:
+      - vendor
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

activestate.yaml

@@ -55,12 +55,12 @@ scripts:
     if: ne .Shell "cmd"
     value: |
       if ! type "go" &> /dev/null; then
-        echo "go is not installed. Please install Go version 1.23 or above."
+        echo "go is not installed. Please install Go version 1.24 or above."
         exit 1
       fi
       if ! type "golangci-lint" &> /dev/null; then
         echo "golangci-lint was not found on your PATH. Installing .."
-        go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.59.1
+        go install github.com/golangci/golangci-lint/cmd/golangci-lint@v2.6.2
       fi
       git config core.hooksPath .githooks
       if ! type "swagger" &> /dev/null; then

changelog.md

@@ -6,6 +6,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 0.48.1
+
+### Security
+
+Addressed all known, fixable CVEs.
+
 ## 0.48.0
 
 ### Added

go.mod

@@ -1,6 +1,6 @@
 module github.com/ActiveState/cli
 
-go 1.24.6
+go 1.24.9
 
 require (
 	github.com/99designs/gqlgen v0.17.54
@@ -51,11 +51,11 @@ require (
 	github.com/thoas/go-funk v0.8.0
 	github.com/vbauerster/mpb/v7 v7.1.5
 	github.com/vektah/gqlparser/v2 v2.5.16
-	golang.org/x/crypto v0.41.0 // indirect
-	golang.org/x/net v0.43.0
-	golang.org/x/sys v0.35.0
-	golang.org/x/term v0.34.0
-	golang.org/x/text v0.28.0
+	golang.org/x/crypto v0.45.0 // indirect
+	golang.org/x/net v0.47.0
+	golang.org/x/sys v0.38.0
+	golang.org/x/term v0.37.0
+	golang.org/x/text v0.31.0
 	gopkg.in/AlecAivazis/survey.v1 v1.8.8
 	gopkg.in/toast.v1 v1.0.0-20180812000517-0a84660828b2
 	gopkg.in/yaml.v2 v2.4.0
@@ -74,9 +74,8 @@ require (
 	github.com/charmbracelet/lipgloss v0.9.1
 	github.com/go-git/go-git/v5 v5.13.1
 	github.com/gowebpki/jcs v1.0.1
-	github.com/klauspost/compress v1.11.4
 	github.com/mark3labs/mcp-go v0.33.0
-	github.com/mholt/archiver/v3 v3.5.1
+	github.com/mholt/archives v0.1.5
 	github.com/zijiren233/yaml-comment v0.2.1
 )
 
@@ -85,7 +84,8 @@ require (
 	github.com/ActiveState/pty v0.0.0-20230628221854-6fb90eb08a14 // indirect
 	github.com/Microsoft/go-winio v0.6.1 // indirect
 	github.com/ProtonMail/go-crypto v1.1.3 // indirect
-	github.com/andybalholm/brotli v1.0.1 // indirect
+	github.com/STARRY-S/zip v0.2.3 // indirect
+	github.com/andybalholm/brotli v1.2.0 // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.11 // indirect
 	github.com/aws/aws-sdk-go-v2/credentials v1.17.71 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.33 // indirect
@@ -102,6 +102,9 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/sts v1.34.1 // indirect
 	github.com/aws/smithy-go v1.22.4 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
+	github.com/bodgit/plumbing v1.3.0 // indirect
+	github.com/bodgit/sevenzip v1.6.1 // indirect
+	github.com/bodgit/windows v1.0.1 // indirect
 	github.com/cloudflare/circl v1.6.1 // indirect
 	github.com/containerd/console v1.0.4-0.20230313162750-1ae8d489ac81 // indirect
 	github.com/cyphar/filepath-securejoin v0.3.6 // indirect
@@ -110,22 +113,29 @@ require (
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/hinshun/vt10x v0.0.0-20220301184237-5011da428d02 // indirect
-	github.com/klauspost/pgzip v1.2.5 // indirect
+	github.com/klauspost/compress v1.18.0 // indirect
+	github.com/klauspost/pgzip v1.2.6 // indirect
 	github.com/kr/pty v1.1.8 // indirect
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
 	github.com/maruel/natural v1.1.0 // indirect
 	github.com/mattn/go-localereader v0.0.1 // indirect
+	github.com/mikelolasagasti/xz v1.0.1 // indirect
+	github.com/minio/minlz v1.0.1 // indirect
 	github.com/muesli/ansi v0.0.0-20211018074035-2e021307bc4b // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/muesli/reflow v0.3.0 // indirect
 	github.com/muesli/termenv v0.15.2 // indirect
-	github.com/pierrec/lz4/v4 v4.1.2 // indirect
+	github.com/nwaples/rardecode/v2 v2.2.0 // indirect
+	github.com/pierrec/lz4/v4 v4.1.22 // indirect
 	github.com/pjbgf/sha1cd v0.3.0 // indirect
 	github.com/shoenig/go-m1cpu v0.1.6 // indirect
 	github.com/skeema/knownhosts v1.3.0 // indirect
+	github.com/sorairolake/lzip-go v0.3.8 // indirect
 	github.com/sosodev/duration v1.3.1 // indirect
+	github.com/spf13/afero v1.15.0 // indirect
 	github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
-	golang.org/x/sync v0.16.0 // indirect
+	go4.org v0.0.0-20230225012048-214862532bf5 // indirect
+	golang.org/x/sync v0.18.0 // indirect
 )
 
 require (
@@ -138,7 +148,7 @@ require (
 	github.com/agnivade/levenshtein v1.1.1 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5 // indirect
+	github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
 	github.com/gammazero/deque v0.0.0-20200721202602-07291166fe33 // indirect
 	github.com/go-openapi/analysis v0.20.0 // indirect
@@ -147,7 +157,6 @@ require (
 	github.com/go-openapi/loads v0.20.2 // indirect
 	github.com/go-openapi/spec v0.20.3 // indirect
 	github.com/go-stack/stack v1.8.0 // indirect
-	github.com/golang/snappy v0.0.4 // indirect
 	github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
@@ -163,7 +172,6 @@ require (
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/nu7hatch/gouuid v0.0.0-20131221200532-179d4d0c4d8d // indirect
-	github.com/nwaples/rardecode v1.1.3 // indirect
 	github.com/oklog/ulid v1.3.1 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
 	github.com/pelletier/go-toml v1.7.0 // indirect
@@ -179,12 +187,11 @@ require (
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/valyala/fasttemplate v1.2.2 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
-	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	go.mongodb.org/mongo-driver v1.5.3 // indirect
-	golang.org/x/mod v0.26.0
+	golang.org/x/mod v0.29.0
 	golang.org/x/time v0.12.0 // indirect
-	golang.org/x/tools v0.35.0 // indirect
+	golang.org/x/tools v0.38.0 // indirect
 	gopkg.in/fsnotify.v1 v1.4.7 // indirect
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect