chore: eradicate all CVEs

.docker/Dockerfile-alpine

@@ -1,4 +1,4 @@
-FROM alpine:3.20
+FROM alpine:3.22
 
 RUN apk add -U --no-cache ca-certificates libssl3 libcrypto3 bash
 

.docker/Dockerfile-build

@@ -1,4 +1,4 @@
-FROM golang:1.23-alpine3.20 AS builder
+FROM golang:1.24-alpine3.22 AS builder
 
 RUN apk -U --no-cache add build-base git gcc bash
 
@@ -7,16 +7,16 @@ WORKDIR /go/src/github.com/ory/cli
 ADD ./go.mod go.mod
 ADD ./go.sum go.sum
 
-ENV GO111MODULE on
-ENV CGO_ENABLED 1
+ENV GO111MODULE=on
+ENV CGO_ENABLED=1
 
 RUN go mod download
 
 ADD . .
 
 RUN CGO_CFLAGS="-D_LARGEFILE64_SOURCE" go build -tags sqlite,json1 -o /usr/bin/ory
 
-FROM alpine:3.20
+FROM alpine:3.22
 
 RUN apk add -U --no-cache ca-certificates bash
 RUN apk upgrade --no-cache libssl3 libcrypto3

.github/workflows/ci.yaml

@@ -16,7 +16,7 @@ jobs:
       - uses: ory/ci/checkout@master
       - uses: actions/setup-go@v5
         with:
-          go-version: "1.23"
+          go-version: "1.24"
       - uses: actions/cache@v4
         with:
           path: |

.github/workflows/format.yml

@@ -11,7 +11,7 @@ jobs:
       - uses: actions/checkout@v3
       - uses: actions/setup-go@v3
         with:
-          go-version: "1.23"
+          go-version: "1.24"
       - run: make format
       - name: Indicate formatting issues
         run: git diff HEAD --exit-code --color

.github/workflows/test-e2e.yml

@@ -14,7 +14,7 @@ jobs:
       - uses: actions/checkout@v2
       - uses: actions/setup-go@v2
         with:
-          go-version: "1.23"
+          go-version: "1.24"
       - uses: actions/setup-node@v2
         with:
           node-version: "16"
@@ -53,7 +53,7 @@ jobs:
       - uses: actions/checkout@v2
       - uses: actions/setup-go@v2
         with:
-          go-version: "1.23"
+          go-version: "1.24"
       - uses: actions/setup-node@v2
         with:
           node-version: "16"

.golangci.yml

@@ -1,7 +1,26 @@
+version: "2"
 linters:
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
   enable:
     - goimports
-
-linters-settings:
-  goimports:
-    local-prefixes: github.com/ory
+  settings:
+    goimports:
+      local-prefixes:
+        - github.com/ory
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

Makefile

@@ -8,7 +8,7 @@ export GO111MODULE := on
 export PATH := .bin:${PATH}
 export PWD := $(shell pwd)
 
-GOLANGCI_LINT_VERSION = 1.61.0
+GOLANGCI_LINT_VERSION = 2.3.1
 
 GO_DEPENDENCIES = github.com/ory/go-acc \
 				  github.com/golang/mock/mockgen \

cmd/cloudx/testhelpers/testhelpers.go

@@ -26,7 +26,7 @@ import (
 	"github.com/ory/cli/cmd/cloudx/client"
 
 	"github.com/ory/x/cmdx"
-	. "github.com/ory/x/pointerx"
+	"github.com/ory/x/pointerx"
 	"github.com/ory/x/randx"
 )
 
@@ -234,8 +234,8 @@ func SetupPlaywright(t testing.TB) (playwright.Browser, playwright.Page, func())
 	pw, err := playwright.Run()
 	require.NoError(t, err)
 	browser, err := pw.Chromium.Launch(playwright.BrowserTypeLaunchOptions{
-		Headless:  Ptr(true),
-		TracesDir: Ptr(tracesDir),
+		Headless:  pointerx.Ptr(true),
+		TracesDir: pointerx.Ptr(tracesDir),
 	})
 	require.NoError(t, err)
 
@@ -250,7 +250,7 @@ func SetupPlaywright(t testing.TB) (playwright.Browser, playwright.Page, func())
 
 func NewPage(t testing.TB, browser playwright.Browser) playwright.Page {
 	page, err := browser.NewPage(playwright.BrowserNewPageOptions{
-		BaseURL: Ptr(client.CloudConsoleURL("").String()),
+		BaseURL: pointerx.Ptr(client.CloudConsoleURL("").String()),
 	})
 	require.NoError(t, err)
 
@@ -290,8 +290,8 @@ func PlaywrightAcceptConsentBrowserHook(t testing.TB, page playwright.Page, emai
 		t.Logf("open browser with %s", uri)
 
 		require.NoError(t, page.Context().Tracing().Start(playwright.TracingStartOptions{
-			Screenshots: Ptr(true),
-			Snapshots:   Ptr(true),
+			Screenshots: pointerx.Ptr(true),
+			Snapshots:   pointerx.Ptr(true),
 		}))
 		defer func() {
 			r := recover()

cmd/dev/ci/monorepo/changes.go

@@ -59,7 +59,7 @@ func getGitDefaults() string {
 func getChangedFiles(rootDirectory string, revisionRange string, gitOpts string) (string, error) {
 	changeLog, err := getRepositoryChangeLog(rootDirectory, revisionRange, gitOpts)
 	if err != nil {
-		return "", fmt.Errorf("Error getting changes from Git: %v", err)
+		return "", fmt.Errorf("error getting changes from Git: %v", err)
 	}
 	cleansedChangeLogArray := strings.Split(removeCommitMessages(changeLog), "\n")
 	cleanseRepositoryChanges(&cleansedChangeLogArray, true, true)
@@ -75,7 +75,7 @@ func getChangedFiles(rootDirectory string, revisionRange string, gitOpts string)
 func getChangedDirectories(rootDirectory string, revisionRange string, gitOpts string) (string, error) {
 	changeLog, err := getRepositoryChangeLog(rootDirectory, revisionRange, gitOpts)
 	if err != nil {
-		return "", fmt.Errorf("Error getting changes from Git: %v", err)
+		return "", fmt.Errorf("error getting changes from Git: %v", err)
 	}
 	cleansedChangeLogArray := strings.Split(removeCommitMessages(changeLog), "\n")
 	cleanseRepositoryChanges(&cleansedChangeLogArray, false, true)
@@ -90,7 +90,7 @@ func getChangedDirectories(rootDirectory string, revisionRange string, gitOpts s
 func getChangeLog(rootDirectory string, revisionRange string, gitOpts string) (string, error) {
 	repoChanges, err := getRepositoryChangeLog(rootDirectory, revisionRange, gitOpts)
 	if err != nil {
-		return "", fmt.Errorf("Error getting changes from Git: %v", err)
+		return "", fmt.Errorf("error getting changes from Git: %v", err)
 	}
 
 	return repoChanges, nil

cmd/dev/ci/monorepo/depgraph.go

@@ -49,7 +49,7 @@ func (graph *ComponentGraph) getComponentGraph(rootDirectory string) (*Component
 		return nil, err
 	}
 	if !isDirectory {
-		return nil, fmt.Errorf("Provided path '%s' is not a directory", rootDirectory)
+		return nil, fmt.Errorf("provided path '%s' is not a directory", rootDirectory)
 	}
 	if err := filepath.Walk(rootDirectory, func(path string, fi os.FileInfo, err error) error {
 		if err != nil {
@@ -92,20 +92,20 @@ func isDirectory(path string) (bool, error) {
 func (component *Component) getComponentFromConfig(configFilePath, rootDir string) (*Component, error) {
 	yamlFile, err := os.ReadFile(configFilePath)
 	if err != nil {
-		return nil, fmt.Errorf("Config file not found: '%s'", configFilePath)
+		return nil, fmt.Errorf("config file not found: '%s'", configFilePath)
 	}
 	err = yaml.Unmarshal(yamlFile, component)
 	if err != nil {
-		return nil, fmt.Errorf("Error reading config file '%s', invalid format: %v", configFilePath, err)
+		return nil, fmt.Errorf("error reading config file '%s', invalid format: %v", configFilePath, err)
 	}
 
 	configFilePath, err = filepath.Abs(configFilePath)
 	if err != nil {
-		return nil, fmt.Errorf("Error determining absolute config file path '%s': %v", configFilePath, err)
+		return nil, fmt.Errorf("error determining absolute config file path '%s': %v", configFilePath, err)
 	}
 	rootDir, err = filepath.Abs(rootDir)
 	if err != nil {
-		return nil, fmt.Errorf("Error determining absolute root directory path '%s': %v", rootDir, err)
+		return nil, fmt.Errorf("error determining absolute root directory path '%s': %v", rootDir, err)
 	}
 	rootDir = rootDir + "/"
 	component.Path = strings.TrimSuffix(strings.TrimPrefix(configFilePath, rootDir), "/"+configFile)
@@ -146,7 +146,7 @@ func (graph *ComponentGraph) resolveGraph() (ComponentGraph, error) {
 				g.addComponent(graph.componentIDs[id])
 			}
 
-			return g, errors.New("Circular dependency found")
+			return g, errors.New("circular dependency found")
 		}
 
 		// remove ready components (without dependencies) from the

cmd/dev/headers/copyright.go

@@ -113,11 +113,12 @@ Does not add the header to files listed in .gitignore and .prettierignore.`,
 	RunE: func(cmd *cobra.Command, args []string) error {
 		year, _, _ := time.Now().Date()
 		var template string
-		if headerType == headerTypeProprietary {
+		switch headerType {
+		case headerTypeProprietary:
 			template = HEADER_TEMPLATE_PROPRIETARY
-		} else if headerType == headerTypeOpenSource {
+		case headerTypeOpenSource:
 			template = HEADER_TEMPLATE_OPEN_SOURCE
-		} else {
+		default:
 			return fmt.Errorf("unknown value for type, expected one of %q or %q", headerTypeOpenSource, headerTypeProprietary)
 		}
 		return AddHeaders(".", fmt.Sprintf(template, year), exclude, regexp.MustCompile(HEADER_REGEXP))

go.mod

@@ -1,8 +1,8 @@
 module github.com/ory/cli
 
-go 1.23
+go 1.24
 
-toolchain go1.23.2
+toolchain go1.24.0
 
 replace (
 	github.com/gorilla/sessions => github.com/ory/sessions v1.2.2-0.20220110165800-b09c17334dc2
@@ -16,9 +16,9 @@ require (
 	github.com/Masterminds/semver/v3 v3.3.0
 	github.com/deckarep/golang-set v1.8.0
 	github.com/evanphx/json-patch v5.9.0+incompatible
-	github.com/getkin/kin-openapi v0.128.0
+	github.com/getkin/kin-openapi v0.131.0
 	github.com/ghodss/yaml v1.0.0
-	github.com/go-jose/go-jose/v3 v3.0.3
+	github.com/go-jose/go-jose/v3 v3.0.4
 	github.com/gofrs/uuid v4.4.0+incompatible
 	github.com/gofrs/uuid/v3 v3.1.2
 	github.com/gomarkdown/markdown v0.0.0-20240730141124-034f12af3bf6
@@ -40,12 +40,12 @@ require (
 	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06
 	github.com/spf13/cobra v1.8.1
 	github.com/spf13/pflag v1.0.5
-	github.com/stretchr/testify v1.9.0
+	github.com/stretchr/testify v1.10.0
 	github.com/tidwall/gjson v1.18.0
 	github.com/tidwall/sjson v1.2.5
 	github.com/urfave/negroni v1.0.0
-	golang.org/x/oauth2 v0.24.0
-	golang.org/x/text v0.20.0
+	golang.org/x/oauth2 v0.27.0
+	golang.org/x/text v0.23.0
 	gopkg.in/yaml.v2 v2.4.0
 )
 
@@ -74,7 +74,7 @@ require (
 	github.com/cenkalti/backoff/v3 v3.2.2 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/cloudflare/circl v1.3.7 // indirect
+	github.com/cloudflare/circl v1.6.1 // indirect
 	github.com/cockroachdb/cockroach-go/v2 v2.3.5 // indirect
 	github.com/containerd/continuity v0.4.3 // indirect
 	github.com/coreos/go-oidc/v3 v3.11.0 // indirect
@@ -101,7 +101,7 @@ require (
 	github.com/go-crypt/crypt v0.2.25 // indirect
 	github.com/go-crypt/x v0.2.18 // indirect
 	github.com/go-faker/faker/v4 v4.4.2 // indirect
-	github.com/go-jose/go-jose/v4 v4.0.2 // indirect
+	github.com/go-jose/go-jose/v4 v4.0.5 // indirect
 	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/errors v0.22.0 // indirect
@@ -113,7 +113,7 @@ require (
 	github.com/go-playground/validator/v10 v10.22.0 // indirect
 	github.com/go-sql-driver/mysql v1.8.1 // indirect
 	github.com/go-stack/stack v1.8.1 // indirect
-	github.com/go-viper/mapstructure/v2 v2.0.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.3.0 // indirect
 	github.com/go-webauthn/webauthn v0.11.0 // indirect
 	github.com/go-webauthn/x v0.1.12 // indirect
 	github.com/gobuffalo/envy v1.10.2 // indirect
@@ -131,8 +131,8 @@ require (
 	github.com/goccy/go-yaml v1.11.3 // indirect
 	github.com/gofrs/flock v0.8.1 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang-jwt/jwt/v4 v4.5.1 // indirect
-	github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
+	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
+	github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
 	github.com/golang/gddo v0.0.0-20190904175337-72a348e765d2 // indirect
 	github.com/golang/mock v1.6.0 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
@@ -158,7 +158,6 @@ require (
 	github.com/imdario/mergo v0.3.16 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf // indirect
-	github.com/invopop/yaml v0.3.1 // indirect
 	github.com/jackc/chunkreader/v2 v2.0.1 // indirect
 	github.com/jackc/pgconn v1.14.3 // indirect
 	github.com/jackc/pgio v1.0.0 // indirect
@@ -207,6 +206,8 @@ require (
 	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/nyaruka/phonenumbers v1.3.6 // indirect
+	github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 // indirect
+	github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 // indirect
 	github.com/oklog/ulid v1.3.1 // indirect
 	github.com/oleiade/reflections v1.0.1 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
@@ -286,12 +287,12 @@ require (
 	go.opentelemetry.io/proto/otlp v1.3.1 // indirect
 	go.uber.org/automaxprocs v1.5.3 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/crypto v0.28.0 // indirect
+	golang.org/x/crypto v0.36.0 // indirect
 	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
 	golang.org/x/mod v0.19.0 // indirect
-	golang.org/x/net v0.30.0 // indirect
-	golang.org/x/sync v0.9.0 // indirect
-	golang.org/x/sys v0.26.0 // indirect
+	golang.org/x/net v0.38.0 // indirect
+	golang.org/x/sync v0.12.0 // indirect
+	golang.org/x/sys v0.31.0 // indirect
 	golang.org/x/tools v0.23.0 // indirect
 	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20240814211410-ddb44dafa142 // indirect