diff --git a/docs/deployment.md b/docs/deployment.md index aa61b9bd..960c0b2d 100644 --- a/docs/deployment.md +++ b/docs/deployment.md @@ -39,9 +39,12 @@ those gates. The R2 `whatsapp-media` bucket is private. Browser access uses API-authorized, short-lived R2 signatures; neither `r2.dev` nor a public bucket/custom domain is -permitted. The legacy MinIO origin was decommissioned after the rollback window -closed; see -[the copy, verify, cutover, and rollback runbook](../../docs/operations/media-r2-migration.md). +permitted. The legacy MinIO origin was decommissioned after its rollback window +closed and is not part of this public deployment. Existing installations moving +media from another object store must independently plan and verify a +non-destructive copy, inventory reconciliation, cutover, rollback window, and +credential separation before changing `S3_ENDPOINT`; this repository does not +include a provider- or deployment-specific migration runbook. ## Host and DNS prerequisites diff --git a/docs/public-release-checklist.md b/docs/public-release-checklist.md index e2001798..db4d8341 100644 --- a/docs/public-release-checklist.md +++ b/docs/public-release-checklist.md @@ -7,7 +7,8 @@ Use this checklist before changing GitHub visibility. It covers repository expos - [ ] Decide whether historical generated binaries, build reports, screenshots, workstation paths, and commit-author email metadata are acceptable to publish. If not, rewrite history while the repository is private, then rescan a fresh clone. - [ ] Verify production credentials through provider metadata only (never retrieve or print values), and rotate any credential that was ever committed or copied into an unsafe location. - [ ] Use GitHub-hosted runners for untrusted pull-request code. Review Actions permissions, fork-approval policy, branch protection/rulesets, required reviews/checks, and dependency update policy. -- [ ] Enable GitHub private vulnerability reporting and verify the link in `SECURITY.md`; configure issue/PR templates if public contribution volume warrants them. +- [ ] Enable GitHub secret scanning and push protection, then review existing alerts without exposing matched values. Verify Dependabot alerts/security updates and private vulnerability reporting are enabled, and verify the reporting link in `SECURITY.md`. - [ ] Confirm the MPL-2.0 whatsmeow submodule source and license remain available and review the complete dependency license inventory for the shipped artifacts. -- [ ] Run lint, typecheck, tests, build, documentation/link checks, and a production Compose configuration validation from a clean checkout with placeholders or isolated test secrets. +- [ ] Run lint, typecheck, tests, build, vulnerability/race checks, documentation/link checks, and a production Compose configuration validation from a clean checkout with placeholders or isolated test secrets. +- [ ] Create release tags only from the reviewed commit after required checks pass. Protect release tag patterns and use immutable application/worker image tags and recorded digests; never repoint a published release tag. - [ ] Confirm README and docs do not imply that a managed Cloud product, SLA, or support entitlement ships with this repository. diff --git a/services/orchestrator/go.mod b/services/orchestrator/go.mod index 9b2c238d..a9201b6a 100644 --- a/services/orchestrator/go.mod +++ b/services/orchestrator/go.mod @@ -1,8 +1,8 @@ module github.com/ygncode-lab/whatsapp-web/services/orchestrator -go 1.24.0 +go 1.25.0 -toolchain go1.24.2 +toolchain go1.25.13 require ( github.com/DATA-DOG/go-sqlmock v1.5.2 @@ -14,12 +14,12 @@ require ( require ( github.com/davecgh/go-spew v1.1.1 // indirect - github.com/klauspost/compress v1.17.0 // indirect - github.com/nats-io/nkeys v0.4.5 // indirect + github.com/klauspost/compress v1.18.7 // indirect + github.com/nats-io/nkeys v0.4.6 // indirect github.com/nats-io/nuid v1.0.1 // indirect github.com/pmezard/go-difflib v1.0.0 // indirect - golang.org/x/crypto v0.6.0 // indirect - golang.org/x/sys v0.5.0 // indirect + golang.org/x/crypto v0.52.0 // indirect + golang.org/x/sys v0.45.0 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect ) diff --git a/services/orchestrator/go.sum b/services/orchestrator/go.sum index 4700b4c8..0eed1bba 100644 --- a/services/orchestrator/go.sum +++ b/services/orchestrator/go.sum @@ -3,24 +3,24 @@ github.com/DATA-DOG/go-sqlmock v1.5.2/go.mod h1:88MAG/4G7SMwSE3CeA0ZKzrT5CiOU3OJ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/kisielk/sqlstruct v0.0.0-20201105191214-5f3e10d3ab46/go.mod h1:yyMNCyc/Ib3bDTKd379tNMpB/7/H5TjM2Y9QJ5THLbE= -github.com/klauspost/compress v1.17.0 h1:Rnbp4K9EjcDuVuHtd0dgA4qNuv9yKDYKK1ulpJwgrqM= -github.com/klauspost/compress v1.17.0/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw= github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o= github.com/nats-io/nats.go v1.31.0 h1:/WFBHEc/dOKBF6qf1TZhrdEfTmOZ5JzdJ+Y3m6Y/p7E= github.com/nats-io/nats.go v1.31.0/go.mod h1:di3Bm5MLsoB4Bx61CBTsxuarI36WbhAwOm8QrW39+i8= -github.com/nats-io/nkeys v0.4.5 h1:Zdz2BUlFm4fJlierwvGK+yl20IAKUm7eV6AAZXEhkPk= -github.com/nats-io/nkeys v0.4.5/go.mod h1:XUkxdLPTufzlihbamfzQ7mw/VGx6ObUs+0bN5sNvt64= +github.com/nats-io/nkeys v0.4.6 h1:IzVe95ru2CT6ta874rt9saQRkWfe2nFj1NtvYSLqMzY= +github.com/nats-io/nkeys v0.4.6/go.mod h1:4DxZNzenSVd1cYQoAa8948QY3QDjrHfcfVADymtkpts= github.com/nats-io/nuid v1.0.1 h1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw= github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= -golang.org/x/crypto v0.6.0 h1:qfktjS5LUO+fFKeJXZ+ikTRijMmljikvG68fpMMruSc= -golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58= -golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU= -golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988= +golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc= +golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY= +golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= diff --git a/services/shared/go.mod b/services/shared/go.mod index 758214f7..c54991f8 100644 --- a/services/shared/go.mod +++ b/services/shared/go.mod @@ -1,15 +1,15 @@ module github.com/ygncode-lab/whatsapp-web/services/shared -go 1.24.0 +go 1.25.0 -toolchain go1.24.2 +toolchain go1.25.13 require github.com/nats-io/nats.go v1.31.0 require ( - github.com/klauspost/compress v1.17.0 // indirect - github.com/nats-io/nkeys v0.4.5 // indirect + github.com/klauspost/compress v1.18.7 // indirect + github.com/nats-io/nkeys v0.4.6 // indirect github.com/nats-io/nuid v1.0.1 // indirect - golang.org/x/crypto v0.6.0 // indirect - golang.org/x/sys v0.5.0 // indirect + golang.org/x/crypto v0.52.0 // indirect + golang.org/x/sys v0.45.0 // indirect ) diff --git a/services/shared/go.sum b/services/shared/go.sum index 318abae6..4dd25916 100644 --- a/services/shared/go.sum +++ b/services/shared/go.sum @@ -1,12 +1,12 @@ -github.com/klauspost/compress v1.17.0 h1:Rnbp4K9EjcDuVuHtd0dgA4qNuv9yKDYKK1ulpJwgrqM= -github.com/klauspost/compress v1.17.0/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/nats-io/nats.go v1.31.0 h1:/WFBHEc/dOKBF6qf1TZhrdEfTmOZ5JzdJ+Y3m6Y/p7E= github.com/nats-io/nats.go v1.31.0/go.mod h1:di3Bm5MLsoB4Bx61CBTsxuarI36WbhAwOm8QrW39+i8= -github.com/nats-io/nkeys v0.4.5 h1:Zdz2BUlFm4fJlierwvGK+yl20IAKUm7eV6AAZXEhkPk= -github.com/nats-io/nkeys v0.4.5/go.mod h1:XUkxdLPTufzlihbamfzQ7mw/VGx6ObUs+0bN5sNvt64= +github.com/nats-io/nkeys v0.4.6 h1:IzVe95ru2CT6ta874rt9saQRkWfe2nFj1NtvYSLqMzY= +github.com/nats-io/nkeys v0.4.6/go.mod h1:4DxZNzenSVd1cYQoAa8948QY3QDjrHfcfVADymtkpts= github.com/nats-io/nuid v1.0.1 h1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw= github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c= -golang.org/x/crypto v0.6.0 h1:qfktjS5LUO+fFKeJXZ+ikTRijMmljikvG68fpMMruSc= -golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58= -golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU= -golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988= +golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc= +golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY= +golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= diff --git a/services/whatsapp/go.mod b/services/whatsapp/go.mod index b0f3c740..703a9584 100644 --- a/services/whatsapp/go.mod +++ b/services/whatsapp/go.mod @@ -39,7 +39,7 @@ require ( github.com/coder/websocket v1.8.15 // indirect github.com/davecgh/go-spew v1.1.1 // indirect github.com/elliotchance/orderedmap/v3 v3.1.0 // indirect - github.com/klauspost/compress v1.17.2 // indirect + github.com/klauspost/compress v1.18.7 // indirect github.com/mattn/go-colorable v0.1.14 // indirect github.com/mattn/go-isatty v0.0.20 // indirect github.com/nats-io/nkeys v0.4.7 // indirect diff --git a/services/whatsapp/go.sum b/services/whatsapp/go.sum index 8a6abcc1..d8601321 100644 --- a/services/whatsapp/go.sum +++ b/services/whatsapp/go.sum @@ -57,8 +57,8 @@ github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/kisielk/sqlstruct v0.0.0-20201105191214-5f3e10d3ab46/go.mod h1:yyMNCyc/Ib3bDTKd379tNMpB/7/H5TjM2Y9QJ5THLbE= -github.com/klauspost/compress v1.17.2 h1:RlWWUY/Dr4fL8qk9YG7DTZ7PDgME2V4csBXA8L/ixi4= -github.com/klauspost/compress v1.17.2/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw= github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o= github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=