mirror of
https://github.com/navidrome/navidrome.git
synced 2026-10-08 10:27:08 +02:00
964d3c778b
Bumps all 13 direct dependencies that had newer releases, plus the go-taglib fork pin. No source changes were needed. The jwx bump to v3.3.0 carries a security fix (GHSA-4cf7-xm37-g63h): custom claim, header and JWK names were written unescaped, so a name containing a quote could inject extra members. Navidrome is not affected - every claim name we emit is a hardcoded literal - but the fix is worth taking. cascadia v1.3.5 similarly limits selector nesting to avoid a stack overflow, and our only selector is a constant. go-sqlite3 v1.14.52 is the only bump with real behavior change: it flushes the statement cache on schema changes, steps cached statements eagerly, and drops the per-row goroutine used for query cancellation. goose v3.28.0 raises its minimum to Go 1.26 and otherwise only touches MySQL, ClickHouse and Azure SQL, which we do not use. The golang.org/x bumps are routine. govulncheck reports no reachable vulnerabilities. The taglib fork pin picks up two fixes. Audio properties are now clamped with std::max(0, ...) before the unsigned conversion, so a malformed file no longer reports a duration of ~49 days; this ports upstream sentriz/go-taglib 0524e91 and additionally covers bitsPerSample, which is specific to this fork. Bit depth is also now reported for DSDIFF, TrueAudio and Shorten, which previously returned 0. Both values reach media_file only on re-extraction, so existing libraries need a full scan to pick them up.
149 lines
6.1 KiB
Modula-2
149 lines
6.1 KiB
Modula-2
module github.com/navidrome/navidrome
|
|
|
|
go 1.27
|
|
|
|
// Fork to implement raw tags support
|
|
replace go.senan.xyz/taglib => github.com/deluan/go-taglib v0.0.0-20260910183509-2ca9506dd7ec
|
|
|
|
require (
|
|
github.com/Masterminds/squirrel v1.5.4
|
|
github.com/andybalholm/cascadia v1.3.5
|
|
github.com/bmatcuk/doublestar/v4 v4.10.0
|
|
github.com/deluan/rest v0.0.0-20211102003136-6260bc399cbf
|
|
github.com/deluan/sanitize v0.0.0-20241120162836-fdfd8fdfaa55
|
|
github.com/dexterlb/mpvipc v0.0.0-20260722094525-0cf47d745b36
|
|
github.com/djherbis/atime v1.1.0
|
|
github.com/djherbis/fscache v0.10.2-0.20260829235704-6d85d5878c22
|
|
github.com/djherbis/stream v1.5.1
|
|
github.com/djherbis/times v1.6.0
|
|
github.com/dustin/go-humanize v1.0.1
|
|
github.com/extism/go-sdk v1.7.1
|
|
github.com/fatih/structs v1.1.0
|
|
github.com/gen2brain/webp v0.6.4
|
|
github.com/go-chi/chi/v5 v5.3.2
|
|
github.com/go-chi/cors v1.2.2
|
|
github.com/go-chi/httprate v0.16.0
|
|
github.com/go-chi/jwtauth/v5 v5.4.0
|
|
github.com/go-viper/encoding/ini v0.1.1
|
|
github.com/go-viper/mapstructure/v2 v2.5.0
|
|
github.com/gohugoio/hashstructure v1.1.0
|
|
github.com/google/go-pipeline v0.0.0-20230411140531-6cbedfc1d3fc
|
|
github.com/google/uuid v1.6.0
|
|
github.com/google/wire v0.7.0
|
|
github.com/gorilla/websocket v1.5.3
|
|
github.com/hashicorp/go-multierror v1.1.1
|
|
github.com/jellydator/ttlcache/v3 v3.4.1
|
|
github.com/kardianos/service v1.3.0
|
|
github.com/kr/pretty v0.3.1
|
|
github.com/lestrrat-go/jwx/v3 v3.3.0
|
|
github.com/mattn/go-sqlite3 v1.14.52
|
|
github.com/microcosm-cc/bluemonday v1.0.27
|
|
github.com/mileusna/useragent v1.3.5
|
|
github.com/onsi/ginkgo/v2 v2.32.2
|
|
github.com/onsi/gomega v1.43.0
|
|
github.com/pelletier/go-toml/v2 v2.4.3
|
|
github.com/pmezard/go-difflib v1.0.0
|
|
github.com/pocketbase/dbx v1.12.0
|
|
github.com/pressly/goose/v3 v3.28.0
|
|
github.com/prometheus/client_golang v1.24.1
|
|
github.com/rjeczalik/notify v0.9.3
|
|
github.com/robfig/cron/v3 v3.0.1
|
|
github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06
|
|
github.com/santhosh-tekuri/jsonschema/v6 v6.0.3
|
|
github.com/sirupsen/logrus v1.10.2
|
|
github.com/spf13/cobra v1.10.2
|
|
github.com/spf13/viper v1.21.0
|
|
github.com/stretchr/testify v1.12.1
|
|
github.com/tetratelabs/wazero v1.12.0
|
|
github.com/unrolled/secure v1.17.0
|
|
github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342
|
|
github.com/zeebo/xxh3 v1.1.0
|
|
go.senan.xyz/taglib v0.11.1
|
|
go.uber.org/goleak v1.3.0
|
|
golang.org/x/image v0.46.0
|
|
golang.org/x/net v0.59.0
|
|
golang.org/x/sync v0.23.0
|
|
golang.org/x/sys v0.48.0
|
|
golang.org/x/term v0.46.0
|
|
golang.org/x/text v0.42.0
|
|
golang.org/x/time v0.16.0
|
|
gopkg.in/yaml.v3 v3.0.1
|
|
)
|
|
|
|
require (
|
|
dario.cat/mergo v1.0.2 // indirect
|
|
github.com/Masterminds/semver/v3 v3.5.0 // indirect
|
|
github.com/atombender/go-jsonschema v0.20.0 // indirect
|
|
github.com/aymerick/douceur v0.2.0 // indirect
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/cespare/reflex v0.3.2 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/creack/pty v1.1.24 // indirect
|
|
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 // indirect
|
|
github.com/dylibso/observe-sdk/go v0.0.0-20240828172851-9145d8ad07e1 // indirect
|
|
github.com/ebitengine/purego v0.10.2 // indirect
|
|
github.com/fsnotify/fsnotify v1.10.1 // indirect
|
|
github.com/go-logr/logr v1.4.4 // indirect
|
|
github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
|
|
github.com/gobwas/glob v0.2.3 // indirect
|
|
github.com/goccy/go-json v0.10.6 // indirect
|
|
github.com/goccy/go-yaml v1.19.2 // indirect
|
|
github.com/google/go-cmp v0.7.0 // indirect
|
|
github.com/google/pprof v0.0.0-20260825171938-4d453200e7d9 // indirect
|
|
github.com/google/subcommands v1.2.0 // indirect
|
|
github.com/gorilla/css v1.0.1 // indirect
|
|
github.com/hashicorp/errwrap v1.1.0 // indirect
|
|
github.com/ianlancetaylor/demangle v0.0.0-20260724033716-83e58baca724 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
|
|
github.com/klauspost/cpuid/v2 v2.4.0 // indirect
|
|
github.com/kr/text v0.2.0 // indirect
|
|
github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 // indirect
|
|
github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 // indirect
|
|
github.com/lestrrat-go/blackmagic v1.0.4 // indirect
|
|
github.com/lestrrat-go/dsig v1.4.0 // indirect
|
|
github.com/lestrrat-go/dsig-secp256k1 v1.0.0 // indirect
|
|
github.com/lestrrat-go/httpcc v1.0.1 // indirect
|
|
github.com/lestrrat-go/httprc/v3 v3.0.6 // indirect
|
|
github.com/lestrrat-go/option/v2 v2.0.0 // indirect
|
|
github.com/maruel/natural v1.3.0 // indirect
|
|
github.com/mfridman/interpolate v0.0.2 // indirect
|
|
github.com/mitchellh/go-wordwrap v1.0.1 // indirect
|
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
|
github.com/ogier/pflag v0.0.1 // indirect
|
|
github.com/pkg/errors v0.9.1 // indirect
|
|
github.com/prometheus/client_model v0.6.2 // indirect
|
|
github.com/prometheus/common v0.70.1 // indirect
|
|
github.com/prometheus/procfs v0.22.0 // indirect
|
|
github.com/rogpeppe/go-internal v1.16.0 // indirect
|
|
github.com/sagikazarmark/locafero v0.12.0 // indirect
|
|
github.com/sanity-io/litter v1.5.8 // indirect
|
|
github.com/segmentio/asm v1.2.1 // indirect
|
|
github.com/sethvargo/go-retry v0.4.0 // indirect
|
|
github.com/sosodev/duration v1.3.1 // indirect
|
|
github.com/spf13/afero v1.15.0 // indirect
|
|
github.com/spf13/cast v1.10.0 // indirect
|
|
github.com/spf13/pflag v1.0.10 // indirect
|
|
github.com/stretchr/objx v0.5.3 // indirect
|
|
github.com/subosito/gotenv v1.6.0 // indirect
|
|
github.com/tetratelabs/wabin v0.0.0-20230304001439-f6f874872834 // indirect
|
|
github.com/valyala/fastjson v1.6.10 // indirect
|
|
go.opentelemetry.io/proto/otlp v1.11.0 // indirect
|
|
go.uber.org/multierr v1.11.0 // indirect
|
|
go.yaml.in/yaml/v3 v3.0.5 // indirect
|
|
golang.org/x/crypto v0.57.0 // indirect
|
|
golang.org/x/mod v0.41.0 // indirect
|
|
golang.org/x/telemetry v0.0.0-20260811182544-a038080d80e5 // indirect
|
|
golang.org/x/tools v0.49.0 // indirect
|
|
google.golang.org/protobuf v1.36.12 // indirect
|
|
gopkg.in/ini.v1 v1.67.3 // indirect
|
|
gopkg.in/natefinch/npipe.v2 v2.0.0-20160621034901-c1b8fa8bdcce // indirect
|
|
)
|
|
|
|
tool (
|
|
github.com/atombender/go-jsonschema
|
|
github.com/cespare/reflex
|
|
github.com/google/wire/cmd/wire
|
|
github.com/onsi/ginkgo/v2/ginkgo
|
|
golang.org/x/tools/cmd/goimports
|
|
)
|