detached 3cd4df6

Merge pull request #60 from frkr/fix/securityissues

fix: CVE fix
commit
3cd4df65606499496530c5fe0900aca227366026
author
Patric Eckhart · · 2026-07-06 05:51 UTC
committer
GitHub · · 2026-07-06 05:51 UTC
merge of
902f459 + ddd2917 · diff against the first parent
signature
GPG UnverifiedB5690EEEBB952194 The key is unknown
refs
tag: v0.2.60
5 files · +10 -7
Unified
UnifiedSplit
M go.mod +2 -2
@@ -1,13 +1,13 @@
11 module github.com/patriceckhart/zot
22
3-go 1.22
3+go 1.25.0
44
55 require (
66 github.com/alecthomas/chroma/v2 v2.23.1
77 github.com/google/uuid v1.6.0
88 github.com/mattn/go-runewidth v0.0.16
99 github.com/sahilm/fuzzy v0.1.1
10- golang.org/x/image v0.18.0
10+ golang.org/x/image v0.43.0
1111 golang.org/x/sys v0.26.0
1212 golang.org/x/term v0.25.0
1313 )
@@ -1,13 +1,13 @@
1 module github.com/patriceckhart/zot1 module github.com/patriceckhart/zot
2 2
3-go 1.223+go 1.25.0
4 4
5 require (5 require (
6 github.com/alecthomas/chroma/v2 v2.23.16 github.com/alecthomas/chroma/v2 v2.23.1
7 github.com/google/uuid v1.6.07 github.com/google/uuid v1.6.0
8 github.com/mattn/go-runewidth v0.0.168 github.com/mattn/go-runewidth v0.0.16
9 github.com/sahilm/fuzzy v0.1.19 github.com/sahilm/fuzzy v0.1.1
10- golang.org/x/image v0.18.010+ golang.org/x/image v0.43.0
11 golang.org/x/sys v0.26.011 golang.org/x/sys v0.26.0
12 golang.org/x/term v0.25.012 golang.org/x/term v0.25.0
13 )13 )
M go.sum +2 -2
@@ -18,8 +18,8 @@ github.com/rivo/uniseg v0.2.0 h1:S1pD9weZBuJdFmowNwbpi7BJ8TNftyUImj/0WQi72jY=
1818 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
1919 github.com/sahilm/fuzzy v0.1.1 h1:ceu5RHF8DGgoi+/dR5PsECjCDH1BE3Fnmpo7aVXOdRA=
2020 github.com/sahilm/fuzzy v0.1.1/go.mod h1:VFvziUEIMCrT6A6tw2RFIXPXXmzXbOsSHF0DOI8ZK9Y=
21-golang.org/x/image v0.18.0 h1:jGzIakQa/ZXI1I0Fxvaa9W7yP25TqT6cHIHn+6CqvSQ=
22-golang.org/x/image v0.18.0/go.mod h1:4yyo5vMFQjVjUcVk4jEQcU9MGy/rulF5WvUILseCM2E=
21+golang.org/x/image v0.43.0 h1:FLxcP4ec2350nTfOC8ysKtqYSIFbk/QGjw1ZHNP4tsY=
22+golang.org/x/image v0.43.0/go.mod h1:rrpelvGFt+kLPAjPM4HeWPgrl0FtafueU//e5N0qk/Q=
2323 golang.org/x/sys v0.26.0 h1:KHjCJyddX0LoSTb3J+vWpupP9p0oznkqVk/IfjymZbo=
2424 golang.org/x/sys v0.26.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
2525 golang.org/x/term v0.25.0 h1:WtHI/ltw4NvSUig5KARz9h521QvRC8RmF/cuYqifU24=
@@ -18,8 +18,8 @@ github.com/rivo/uniseg v0.2.0 h1:S1pD9weZBuJdFmowNwbpi7BJ8TNftyUImj/0WQi72jY=
18 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=18 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
19 github.com/sahilm/fuzzy v0.1.1 h1:ceu5RHF8DGgoi+/dR5PsECjCDH1BE3Fnmpo7aVXOdRA=19 github.com/sahilm/fuzzy v0.1.1 h1:ceu5RHF8DGgoi+/dR5PsECjCDH1BE3Fnmpo7aVXOdRA=
20 github.com/sahilm/fuzzy v0.1.1/go.mod h1:VFvziUEIMCrT6A6tw2RFIXPXXmzXbOsSHF0DOI8ZK9Y=20 github.com/sahilm/fuzzy v0.1.1/go.mod h1:VFvziUEIMCrT6A6tw2RFIXPXXmzXbOsSHF0DOI8ZK9Y=
21-golang.org/x/image v0.18.0 h1:jGzIakQa/ZXI1I0Fxvaa9W7yP25TqT6cHIHn+6CqvSQ=21+golang.org/x/image v0.43.0 h1:FLxcP4ec2350nTfOC8ysKtqYSIFbk/QGjw1ZHNP4tsY=
22-golang.org/x/image v0.18.0/go.mod h1:4yyo5vMFQjVjUcVk4jEQcU9MGy/rulF5WvUILseCM2E=22+golang.org/x/image v0.43.0/go.mod h1:rrpelvGFt+kLPAjPM4HeWPgrl0FtafueU//e5N0qk/Q=
23 golang.org/x/sys v0.26.0 h1:KHjCJyddX0LoSTb3J+vWpupP9p0oznkqVk/IfjymZbo=23 golang.org/x/sys v0.26.0 h1:KHjCJyddX0LoSTb3J+vWpupP9p0oznkqVk/IfjymZbo=
24 golang.org/x/sys v0.26.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=24 golang.org/x/sys v0.26.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
25 golang.org/x/term v0.25.0 h1:WtHI/ltw4NvSUig5KARz9h521QvRC8RmF/cuYqifU24=25 golang.org/x/term v0.25.0 h1:WtHI/ltw4NvSUig5KARz9h521QvRC8RmF/cuYqifU24=
M packages/provider/auth/callback.go +2 -1
@@ -2,6 +2,7 @@ package auth
22
33 import (
44 "context"
5+ "errors"
56 "fmt"
67 "net"
78 "net/http"
@@ -91,7 +92,7 @@ func (cs *CallbackServer) handle(w http.ResponseWriter, r *http.Request) {
9192 }
9293 w.WriteHeader(http.StatusBadRequest)
9394 _, _ = w.Write([]byte(oauthErrorHTML(msg)))
94- cs.deliver(CallbackResult{Err: fmt.Errorf(msg), RawPath: r.URL.RequestURI()})
95+ cs.deliver(CallbackResult{Err: errors.New(msg), RawPath: r.URL.RequestURI()})
9596 return
9697 }
9798 code := q.Get("code")
@@ -2,6 +2,7 @@ package auth
2 2
3 import (3 import (
4 "context"4 "context"
5+ "errors"
5 "fmt"6 "fmt"
6 "net"7 "net"
7 "net/http"8 "net/http"
@@ -91,7 +92,7 @@ func (cs *CallbackServer) handle(w http.ResponseWriter, r *http.Request) {
91 }92 }
92 w.WriteHeader(http.StatusBadRequest)93 w.WriteHeader(http.StatusBadRequest)
93 _, _ = w.Write([]byte(oauthErrorHTML(msg)))94 _, _ = w.Write([]byte(oauthErrorHTML(msg)))
94- cs.deliver(CallbackResult{Err: fmt.Errorf(msg), RawPath: r.URL.RequestURI()})95+ cs.deliver(CallbackResult{Err: errors.New(msg), RawPath: r.URL.RequestURI()})
95 return96 return
96 }97 }
97 code := q.Get("code")98 code := q.Get("code")
M packages/provider/auth/manager.go +2 -1
@@ -2,6 +2,7 @@ package auth
22
33 import (
44 "context"
5+ "errors"
56 "fmt"
67 "net/url"
78 "os"
@@ -81,7 +82,7 @@ func (m *Manager) Close() {
8182 // StartAPIKey launches the API-key login flow.
8283 func (m *Manager) StartAPIKey(provider string) (string, error) {
8384 if !isKnownAPIKeyProvider(provider) {
84- return "", fmt.Errorf(apiKeyProviderMessage())
85+ return "", errors.New(apiKeyProviderMessage())
8586 }
8687 if err := m.ensureKeyServer(); err != nil {
8788 return "", err
@@ -2,6 +2,7 @@ package auth
2 2
3 import (3 import (
4 "context"4 "context"
5+ "errors"
5 "fmt"6 "fmt"
6 "net/url"7 "net/url"
7 "os"8 "os"
@@ -81,7 +82,7 @@ func (m *Manager) Close() {
81 // StartAPIKey launches the API-key login flow.82 // StartAPIKey launches the API-key login flow.
82 func (m *Manager) StartAPIKey(provider string) (string, error) {83 func (m *Manager) StartAPIKey(provider string) (string, error) {
83 if !isKnownAPIKeyProvider(provider) {84 if !isKnownAPIKeyProvider(provider) {
84- return "", fmt.Errorf(apiKeyProviderMessage())85+ return "", errors.New(apiKeyProviderMessage())
85 }86 }
86 if err := m.ensureKeyServer(); err != nil {87 if err := m.ensureKeyServer(); err != nil {
87 return "", err88 return "", err
M packages/provider/auth/server.go +2 -1
@@ -2,6 +2,7 @@ package auth
22
33 import (
44 "context"
5+ "errors"
56 "fmt"
67 "html/template"
78 "net"
@@ -204,7 +205,7 @@ func (s *Server) handleCallback(w http.ResponseWriter, r *http.Request) {
204205 msg += ": " + d
205206 }
206207 s.errorPage(w, msg)
207- s.results <- LoginResult{Provider: provider, Method: "oauth", Err: fmt.Errorf(msg)}
208+ s.results <- LoginResult{Provider: provider, Method: "oauth", Err: errors.New(msg)}
208209 return
209210 }
210211 code := q.Get("code")
@@ -2,6 +2,7 @@ package auth
2 2
3 import (3 import (
4 "context"4 "context"
5+ "errors"
5 "fmt"6 "fmt"
6 "html/template"7 "html/template"
7 "net"8 "net"
@@ -204,7 +205,7 @@ func (s *Server) handleCallback(w http.ResponseWriter, r *http.Request) {
204 msg += ": " + d205 msg += ": " + d
205 }206 }
206 s.errorPage(w, msg)207 s.errorPage(w, msg)
207- s.results <- LoginResult{Provider: provider, Method: "oauth", Err: fmt.Errorf(msg)}208+ s.results <- LoginResult{Provider: provider, Method: "oauth", Err: errors.New(msg)}
208 return209 return
209 }210 }
210 code := q.Get("code")211 code := q.Get("code")

Keyboard shortcuts

Single-key shortcuts are on. ctrl k and esc work whatever this says.

ctrl k :
go to a section, branch, tag, file or repository
?
this list
j k
move the row cursor down / up
enter
open the row under the cursor; on Files, a directory opens or closes in place
↑ ↓ ← → home end
in the file tree (focus on a row): previous / next row, close / open a directory or go to its parent / first entry, first / last row. They never open a file
l h
on Files: open a directory or a file / close a directory or go up to its parent, then to the parent page. Elsewhere: into the side panel (on a merge request, its files) / back to the content; there j k move between its controls
g g G
first / last row
/
filter the list; on Files, find a file anywhere in the repository (esc clears, enter opens the best match)
b
switch branch or tag
g s g f g c g b g m g i g r g a
tabs: summary, files, commits, branches & tags, merge requests, issues, releases, actions (when available)
g h
home
w
wide mode: use the whole width of the screen, or not (remembered)
y
copy a permalink pinned to the commit
d u x
diff: split / unified / collapse or expand all
e E
diff: the whole file in view / every file, with the lines the hunks hide
n
merge request: next note in the diff
esc
close a dialog, leave a field

Branches 1

Tags 476

↑↓ moveenter openesc close