From ed52ec03fc86806389deaf551500e7a48214ca62 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 23 Apr 2024 11:12:04 -0700
Subject: [PATCH] build(deps): bump golang.org/x/vuln from 1.0.1 to 1.1.0 in
 /tools (#1432)

Bumps [golang.org/x/vuln](https://github.com/golang/vuln) from 1.0.1 to
1.1.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/golang/vuln/releases">golang.org/x/vuln's
releases</a>.</em></p>
<blockquote>
<h2>v1.1.0</h2>
<p>This release brings minor improvements to govulncheck inner workings
and a few bug fixes (<a
href="https://redirect.github.com/golang/go/issues/65590">#66139</a>, <a
href="https://redirect.github.com/golang/go/issues/65590">#65590</a>).</p>
<h2>Integration</h2>
<p>Govulncheck JSON now also contains scan mode as part of the <a
href="https://github.com/golang/vuln/blob/a7188c690e1dbf65a6b855e74618821c711ea516/internal/govulncheck/govulncheck.go#L49"><code>Config</code></a>
message.</p>
<p>Further, the <a
href="https://github.com/golang/vuln/blob/a7188c690e1dbf65a6b855e74618821c711ea516/internal/govulncheck/govulncheck.go#L172"><code>Position</code></a>
in trace frames now contains only paths relative to their enclosing
module. This could potentially break some existing clients, hence the
bump of the minor version.</p>
<p>Note that this change is made to allow for easier preservation of
privacy by the clients as now the file positions do not contain
information about the local machine. This is also a portable solution.
Clients can reconstruct full paths for their local machine by joining
the <code>Position</code> relative paths with paths of the enclosing
modules on the local machine.</p>
<h2>v1.0.4</h2>
<p>This release brings an improved overhaul of the govulncheck textual
output. Findings at each detected level of precision (<code>symbol,
package, or module</code>) are communicated in their own section.</p>
<p>By default, only the section with the user-specified precision mode
is shown followed by a summary of other sections. A detailed description
with all of the sections can be obtained using a newly introduced
<code>-show verbose</code> option.</p>
<p>This release also brings improvements and fixes for error messages
and binaries (<a
href="https://redirect.github.com/golang/go/issues/59731">#59731</a>).</p>
<h2>Integration</h2>
<p>govulncheck (streaming) JSON now includes the code position of the
vulnerable symbol. Where applicable, the <code>.Position</code> of the
last entry of a finding's trace is the code location defining the
<code>.Function</code>.</p>
<h2>v1.0.3</h2>
<p>The major feature brought by this release is govulncheck <code>-mode
extract</code> option. It enables users to extract a blob abstraction of
a binary whose size is typically much smaller than the binary itself.
The blob can be passed to govulncheck for analysis with the <code>-mode
binary</code> option. The users should not rely on the contents or the
representation of the blob.</p>
<p>This release also brings several bug fixes (<a
href="https://redirect.github.com/golang/go/issues/65124">#65124</a>, <a
href="https://redirect.github.com/golang/go/issues/65155">#65155</a>,
and <a
href="https://redirect.github.com/golang/go/issues/65130">#65130</a>).</p>
<h2>v1.0.2</h2>
<p>This release brings minor improvements to the govulncheck textual
output and fixes for error messages (<a
href="https://redirect.github.com/golang/go/issues/59623">#59623</a>, <a
href="https://redirect.github.com/golang/go/issues/64681">#64681</a>),
fixed version suggestion (<a
href="https://redirect.github.com/golang/go/issues/62276">#62276</a>),
documentation (e.g., <a
href="https://redirect.github.com/golang/go/issues/60166">#60166</a>),
and issues in dependencies (e.g., <a
href="https://redirect.github.com/golang/go/issues/64112">#64112</a>).</p>
<p>Support for analyzing stripped darwin binaries in govulncheck is
added as well (<a
href="https://redirect.github.com/golang/go/issues/61051">#61051</a>).</p>
<h2>Integration</h2>
<p>govulncheck (streaming) JSON now emits an OSV message for each
vulnerability associated with user modules and its transitive
dependencies, regardless of the module version.</p>
<p>As usual, govulncheck emits a module-level Finding if a vulnerability
for a module applies to the current module version.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/vuln/commit/a7188c690e1dbf65a6b855e74618821c711ea516"><code>a7188c6</code></a>
internal/openvex: add vex types</li>
<li><a
href="https://github.com/golang/vuln/commit/4b737a97851cc7a7f9b87cf5d123960d55e50006"><code>4b737a9</code></a>
internal/sarif: compute relative paths for findings</li>
<li><a
href="https://github.com/golang/vuln/commit/7bf0c05f14670d9de8f2881314dd3e7dabb4a14c"><code>7bf0c05</code></a>
internal/sarif: remove unused field</li>
<li><a
href="https://github.com/golang/vuln/commit/7b0e650379b05ed4e8106ef4874492f25ec05fe5"><code>7b0e650</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/vuln/commit/f1b1098b221539291c214e17e263e7d014a9761f"><code>f1b1098</code></a>
internal/sarif,internal/scan,internal/traces: clean up tests</li>
<li><a
href="https://github.com/golang/vuln/commit/33791bcb641951845fcda445b39dd58c870b9330"><code>33791bc</code></a>
internal/sarif: add region part of the physical location</li>
<li><a
href="https://github.com/golang/vuln/commit/d00c170d001daeff7d121991f4d994c1ad259b40"><code>d00c170</code></a>
internal/sarif: add code flows</li>
<li><a
href="https://github.com/golang/vuln/commit/9fbf042ea52d082b8757c09220a2e259d6928239"><code>9fbf042</code></a>
cmd/govulncheck: clean up test</li>
<li><a
href="https://github.com/golang/vuln/commit/efaa3cef72f7613a1c46ab7fd132de0dee77dcca"><code>efaa3ce</code></a>
cmd/govulncheck: make test case config data</li>
<li><a
href="https://github.com/golang/vuln/commit/7838670b334c6ba85440789f2f3172612cc7154b"><code>7838670</code></a>
cmd/govulncheck: add comment capability to fixups</li>
<li>Additional commits viewable in <a
href="https://github.com/golang/vuln/compare/v1.0.1...v1.1.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/vuln&package-manager=go_modules&previous-version=1.0.1&new-version=1.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 tools/go.mod |  9 ++++-----
 tools/go.sum | 18 ++++++++----------
 2 files changed, 12 insertions(+), 15 deletions(-)

diff --git a/tools/go.mod b/tools/go.mod
index bf851e386..7d872f522 100644
--- a/tools/go.mod
+++ b/tools/go.mod
@@ -1,12 +1,11 @@
 module go.uber.org/zap/tools
 
-require golang.org/x/vuln v1.0.1
+require golang.org/x/vuln v1.1.0
 
 require (
-	golang.org/x/mod v0.12.0 // indirect
-	golang.org/x/sync v0.3.0 // indirect
-	golang.org/x/sys v0.11.0 // indirect
-	golang.org/x/tools v0.12.1-0.20230815132531-74c255bcf846 // indirect
+	golang.org/x/mod v0.17.0 // indirect
+	golang.org/x/sync v0.7.0 // indirect
+	golang.org/x/tools v0.20.0 // indirect
 )
 
 go 1.20
diff --git a/tools/go.sum b/tools/go.sum
index ce16f0521..f44b2746a 100644
--- a/tools/go.sum
+++ b/tools/go.sum
@@ -1,13 +1,11 @@
 github.com/google/go-cmdtest v0.4.1-0.20220921163831-55ab3332a786 h1:rcv+Ippz6RAtvaGgKxc+8FQIpxHgsF+HBzPyYL2cyVU=
 github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
 github.com/google/renameio v0.1.0 h1:GOZbcHa3HfsPKPlmyPyN2KEohoMXOhdMbHrvbpl2QaA=
-golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc=
-golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/sync v0.3.0 h1:ftCYgMx6zT/asHUrPw8BLLscYtGznsLAnjq5RH9P66E=
-golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
-golang.org/x/sys v0.11.0 h1:eG7RXZHdqOJ1i+0lgLgCpSXAp6M3LYlAo6osgSi0xOM=
-golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/tools v0.12.1-0.20230815132531-74c255bcf846 h1:Vve/L0v7CXXuxUmaMGIEK/dEeq7uiqb5qBgQrZzIE7E=
-golang.org/x/tools v0.12.1-0.20230815132531-74c255bcf846/go.mod h1:Sc0INKfu04TlqNoRA1hgpFZbhYXHPr4V5DzpSBTPqQM=
-golang.org/x/vuln v1.0.1 h1:KUas02EjQK5LTuIx1OylBQdKKZ9jeugs+HiqO5HormU=
-golang.org/x/vuln v1.0.1/go.mod h1:bb2hMwln/tqxg32BNY4CcxHWtHXuYa3SbIBmtsyjxtM=
+golang.org/x/mod v0.17.0 h1:zY54UmvipHiNd+pm+m0x9KhZ9hl1/7QNMyxXbc6ICqA=
+golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M=
+golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/tools v0.20.0 h1:hz/CVckiOxybQvFw6h7b/q80NTr9IUQb4s1IIzW7KNY=
+golang.org/x/tools v0.20.0/go.mod h1:WvitBU7JJf6A4jOdg4S1tviW9bhUxkgeCui/0JHctQg=
+golang.org/x/vuln v1.1.0 h1:ECEdI+aEtjpF90eqEcDL5Q11DWSZAw5PJQWlp0+gWqc=
+golang.org/x/vuln v1.1.0/go.mod h1:HT/Ar8fE34tbxWG2s7PYjVl+iIE4Er36/940Z+K540Y=