Sync version/0-48-2-RC1 with beta; fix CI blockers

.github/workflows/build.yml

@@ -36,7 +36,7 @@ jobs:
     strategy:
       matrix:
         go-version:
-          - 1.26.6
+          - 1.26.10
         sys:
           - { os: ubuntu-latest }
           - { os: macos-15-intel, shell: zsh }

activestate.yaml

@@ -434,7 +434,7 @@ scripts:
 
       git fetch --quiet origin $TARGET_BRANCH:refs/remotes/origin/$TARGET_BRANCH
 
-      CHANGED=$(git diff --name-only origin/$TARGET_BRANCH | grep -v testdata | grep -v vendor)
+      CHANGED=$(git diff --name-only origin/$TARGET_BRANCH | grep -v testdata | grep -v vendor || true)
       NO_NEWLINE=0
       for FILE in $CHANGED; do
           if file "$FILE" | grep -q -E 'text|ASCII'; then

changelog.md

@@ -34,6 +34,7 @@ and this project adheres to
 ### Security
 
 - Updated `github.com/klauspost/compress` to v1.18.7 to remediate CVE-2026-63209 (GHSA-259r-337f-4rfw).
+- Updated to Go 1.26.10 and `golang.org/x/net` v0.60.0 to remediate 14 CVEs in the Go standard library and HTTP/2 handling.
 
 ## 0.48.1
 

go.mod

@@ -1,6 +1,6 @@
 module github.com/ActiveState/cli
 
-go 1.26.6
+go 1.26.10
 
 require (
 	github.com/99designs/gqlgen v0.17.54
@@ -52,7 +52,7 @@ require (
 	github.com/vbauerster/mpb/v7 v7.1.5
 	github.com/vektah/gqlparser/v2 v2.5.16
 	golang.org/x/crypto v0.57.0 // indirect
-	golang.org/x/net v0.58.0
+	golang.org/x/net v0.60.0
 	golang.org/x/sys v0.48.0
 	golang.org/x/term v0.46.0
 	golang.org/x/text v0.42.0

go.sum

@@ -850,8 +850,8 @@ golang.org/x/net v0.0.0-20210421230115-4e50805a0758/go.mod h1:72T/g9IO56b78aLF+1
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
-golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=

internal/keypairs/equal_test.go

@@ -0,0 +1,22 @@
+package keypairs_test
+
+import (
+	"testing"
+
+	"github.com/ActiveState/cli/internal/keypairs"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// requireSameRSAKey asserts that two keypairs hold the same RSA private key.
+// Comparing the structs directly also compares rsa.PrivateKey's precomputed
+// internals, whose representation can differ between a generated key and the
+// same key parsed back from PEM.
+func requireSameRSAKey(t *testing.T, expected, actual keypairs.Keypair) {
+	t.Helper()
+	expectedRSA, ok := expected.(*keypairs.RSAKeypair)
+	require.True(t, ok, "expected keypair is not an RSA keypair")
+	actualRSA, ok := actual.(*keypairs.RSAKeypair)
+	require.True(t, ok, "actual keypair is not an RSA keypair")
+	assert.True(t, expectedRSA.PrivateKey.Equal(actualRSA.PrivateKey), "RSA private keys differ")
+}

internal/keypairs/generate_test.go

@@ -58,7 +58,7 @@ func (suite *KeypairGenerateTestSuite) TestGenerate_NoPassphrase() {
 	validationKeypair, err := keypairs.ParseRSA(encKeypair.EncodedPrivateKey)
 	suite.Require().Nil(err)
 	suite.Require().NotNil(validationKeypair)
-	suite.Equal(encKeypair.Keypair, validationKeypair)
+	requireSameRSAKey(suite.T(), encKeypair.Keypair, validationKeypair)
 
 	// verify encoded public key matches generated keypair's public key
 	validationPublicKey, err := keypairs.ParseRSAPublicKey(encKeypair.EncodedPublicKey)
@@ -79,7 +79,7 @@ func (suite *KeypairGenerateTestSuite) TestGenerate_WithPassphrase() {
 	validationKeypair, err := keypairs.ParseEncryptedRSA(encKeypair.EncodedPrivateKey, "tuxedomoon")
 	suite.Require().Nil(err)
 	suite.Require().NotNil(validationKeypair)
-	suite.Equal(encKeypair.Keypair, validationKeypair)
+	requireSameRSAKey(suite.T(), encKeypair.Keypair, validationKeypair)
 
 	// verify encoded public key matches generated keypair's public key
 	validationPublicKey, err := keypairs.ParseRSAPublicKey(encKeypair.EncodedPublicKey)
@@ -123,7 +123,7 @@ func (suite *KeypairGenerateTestSuite) TestGenerateAndSave_Success_NoPassphrase(
 	validationKeypair, err := keypairs.ParseRSA(encKeypair.EncodedPrivateKey)
 	suite.Require().Nil(err)
 	suite.Require().NotNil(validationKeypair)
-	suite.Equal(encKeypair.Keypair, validationKeypair)
+	requireSameRSAKey(suite.T(), encKeypair.Keypair, validationKeypair)
 
 	// verify encoded public key matches generated keypair's public key
 	validationPublicKey, err := keypairs.ParseRSAPublicKey(encKeypair.EncodedPublicKey)
@@ -149,7 +149,7 @@ func (suite *KeypairGenerateTestSuite) TestGenerateAndSave_Success_WithPassphras
 	validationKeypair, err := keypairs.ParseEncryptedRSA(encKeypair.EncodedPrivateKey, "bauhaus")
 	suite.Require().Nil(err)
 	suite.Require().NotNil(validationKeypair)
-	suite.Equal(encKeypair.Keypair, validationKeypair)
+	requireSameRSAKey(suite.T(), encKeypair.Keypair, validationKeypair)
 
 	// verify encoded public key matches generated keypair's public key
 	validationPublicKey, err := keypairs.ParseRSAPublicKey(encKeypair.EncodedPublicKey)

internal/keypairs/local_save_test.go

@@ -37,7 +37,7 @@ func (suite *KeypairLocalSaveTestSuite) TestSave_Success() {
 
 	kp2, err := keypairs.Load(suite.cfg, "save-testing")
 	suite.Require().Nil(err)
-	suite.Equal(kp, kp2)
+	requireSameRSAKey(suite.T(), kp, kp2)
 
 	fileInfo := suite.statConfigDirFile("save-testing.key")
 	if runtime.GOOS != "windows" {
@@ -54,7 +54,7 @@ func (suite *KeypairLocalSaveTestSuite) TestSaveWithDefaults_Success() {
 
 	kp2, err := keypairs.Load(suite.cfg, constants.KeypairLocalFileName)
 	suite.Require().Nil(err)
-	suite.Equal(kp, kp2)
+	requireSameRSAKey(suite.T(), kp, kp2)
 
 	fileInfo := suite.statConfigDirFile(constants.KeypairLocalFileName + ".key")
 	if runtime.GOOS != "windows" {

internal/keypairs/rsa_keypair_test.go

@@ -85,7 +85,7 @@ func (suite *RSAKeypairTestSuite) TestParseRSA_ParsesKeypair() {
 	kp2, err := keypairs.ParseRSA(encPrivKey)
 	suite.Require().Nil(err)
 	suite.Implements((*keypairs.Keypair)(nil), kp2)
-	suite.Equal(kp, kp2)
+	requireSameRSAKey(suite.T(), kp, kp2)
 }
 
 func (suite *RSAKeypairTestSuite) TestParseRSA_EncodingNotOfPrivateKey() {
@@ -137,7 +137,7 @@ func (suite *RSAKeypairTestSuite) TestParseRSA_EmptyPassphraseButStillEncrypted(
 	kp2, err := keypairs.ParseRSA(encrPrivKey)
 	suite.Require().Nil(err)
 	suite.Implements((*keypairs.Keypair)(nil), kp2)
-	suite.Equal(kp, kp2)
+	requireSameRSAKey(suite.T(), kp, kp2)
 }
 
 func (suite *RSAKeypairTestSuite) TestParseRSA_KeypairNotPEMEncoded() {
@@ -156,7 +156,7 @@ func (suite *RSAKeypairTestSuite) TestParseEncryptedRSA_ParsesKeypair() {
 	kp2, err := keypairs.ParseEncryptedRSA(keyPEM, "abc123")
 	suite.Require().Nil(err)
 	suite.Implements((*keypairs.Keypair)(nil), kp2)
-	suite.Equal(kp, kp2)
+	requireSameRSAKey(suite.T(), kp, kp2)
 }
 
 func (suite *RSAKeypairTestSuite) TestParseEncryptedRSA_KeypairNotPEMEncoded() {