Fix CI for 0.48.2-RC2: x/net CVEs, publish --editor, and runner-specific test failures

changelog.md

@@ -36,6 +36,11 @@ and this project adheres to
   latest version.
 - `state export ingredient-meta` now writes plain YAML without help comments or line wrapping, so its output can be
   passed back with `--meta` as is.
+- `state publish` of a new ingredient without a namespace (such as with `--editor` outside a project) no longer searches
+  every namespace for its name, which could time out with "Could not search for ingredient" before the editor opened.
+- `state publish --editor` no longer fails with "Could not publish ingredient. Error received: <no value>" when no editor
+  can be opened (no `EDITOR` set and no `xdg-open`, as on many headless machines). It says so and waits for the file to
+  be edited by hand instead.
 - Dependencies and conditions without a version range (such as a bare `requests` in `pyproject.toml`) are now published
   as accepting any version instead of failing with "Expecting an OBJECT with a field named 'versionRequirements'".
 - Fields removed in the `state publish --editor` file are now removed from the publish instead of keeping their
@@ -45,6 +50,7 @@ and this project adheres to
 
 - Updated `github.com/klauspost/compress` to v1.18.7 to remediate CVE-2026-63209 (GHSA-259r-337f-4rfw).
 - Updated to Go 1.26.10 and `golang.org/x/net` v0.60.0 to remediate 14 CVEs in the Go standard library and HTTP/2 handling.
+- Updated `golang.org/x/net` to v0.62.0 to remediate CVE-2026-78661 and CVE-2026-97045.
 - Updated `github.com/labstack/echo/v4` to v4.16.1 to remediate GHSA-cxf3-9h37-7rr8, GHSA-9969-6676-49h5,
   GHSA-f48p-c9v4-h7xv and GHSA-h7wr-284f-5qvc.
 

go.mod

@@ -51,11 +51,11 @@ require (
 	github.com/thoas/go-funk v0.8.0
 	github.com/vbauerster/mpb/v7 v7.1.5
 	github.com/vektah/gqlparser/v2 v2.5.16
-	golang.org/x/crypto v0.57.0 // indirect
-	golang.org/x/net v0.60.0
-	golang.org/x/sys v0.48.0
-	golang.org/x/term v0.46.0
-	golang.org/x/text v0.42.0
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/net v0.62.0
+	golang.org/x/sys v0.49.0
+	golang.org/x/term v0.47.0
+	golang.org/x/text v0.43.0
 	gopkg.in/AlecAivazis/survey.v1 v1.8.8
 	gopkg.in/toast.v1 v1.0.0-20180812000517-0a84660828b2
 	gopkg.in/yaml.v2 v2.4.0
@@ -136,7 +136,7 @@ require (
 	github.com/spf13/afero v1.15.0 // indirect
 	github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
 	go4.org v0.0.0-20230225012048-214862532bf5 // indirect
-	golang.org/x/sync v0.23.0 // indirect
+	golang.org/x/sync v0.24.0 // indirect
 )
 
 require (
@@ -191,7 +191,7 @@ require (
 	go.mongodb.org/mongo-driver v1.17.7 // indirect
 	golang.org/x/mod v0.41.0
 	golang.org/x/time v0.15.0 // indirect
-	golang.org/x/tools v0.49.0 // indirect
+	golang.org/x/tools v0.51.0 // indirect
 	gopkg.in/fsnotify.v1 v1.4.7 // indirect
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect

go.sum

@@ -784,8 +784,8 @@ golang.org/x/crypto v0.0.0-20200302210943-78000ba7a073/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
-golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -850,8 +850,8 @@ golang.org/x/net v0.0.0-20210421230115-4e50805a0758/go.mod h1:72T/g9IO56b78aLF+1
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
-golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY=
+golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -866,8 +866,8 @@ golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
-golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
+golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -914,13 +914,13 @@ golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
-golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
-golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -931,8 +931,8 @@ golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
-golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
@@ -974,8 +974,8 @@ golang.org/x/tools v0.0.0-20200207183749-b753a1ba74fa/go.mod h1:TB2adYChydJhpapK
 golang.org/x/tools v0.0.0-20200212150539-ea181f53ac56/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20201124115921-2c860bdd6e78/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
-golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
+golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI=
+golang.org/x/tools v0.51.0/go.mod h1:9eEncMayCV6zRMGhR5eZEC2iBx98qWcF1HZ9Z7wJOoA=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

internal/runners/publish/confirm_test.go

@@ -106,6 +106,23 @@ func TestConfirmRequestFillsVersionRequirements(t *testing.T) {
 	}
 }
 
+func TestOpenInEditorWithoutEditor(t *testing.T) {
+	t.Setenv("EDITOR", filepath.Join(t.TempDir(), "no-such-editor"))
+	out := outputhelper.NewCatcher()
+	r := &Runner{out: out, prompt: &fakePrompter{}}
+	reqVars := newRequest()
+
+	if err := r.OpenInEditor(reqVars); err != nil {
+		t.Fatalf("OpenInEditor failed without an editor instead of waiting for the file to be edited: %v", err)
+	}
+	if reqVars.Name != newRequest().Name {
+		t.Errorf("name = %q, want it unchanged", reqVars.Name)
+	}
+	if !strings.Contains(out.CombinedOutput(), "Could not open an editor") {
+		t.Errorf("output does not say the editor could not be opened:\n%s", out.CombinedOutput())
+	}
+}
+
 func TestConfirmRequestEditor(t *testing.T) {
 	t.Run("removed fields are removed", func(t *testing.T) {
 		useTestEditor(t, "name: mypkg\nnamespace: private/org/python\nversion: 1.0.0\n")

internal/runners/publish/publish.go

@@ -171,6 +171,10 @@ func (r *Runner) Run(params *Params) error {
 		reqVars.Name = name
 	}
 
+	// A new ingredient without a namespace yet has nothing to look up: a search across every namespace can time out,
+	// and its first match could be any ingredient with this name. The namespace is checked once it is filled in.
+	lookup := reqVars.Namespace != "" || params.Edit
+
 	var ingredient *ParentIngredient
 
 	latestRevisionTime, err := model.FetchLatestRevisionTimeStamp(r.auth)
@@ -179,7 +183,7 @@ func (r *Runner) Run(params *Params) error {
 	}
 
 	isRevision := false
-	if params.Version != "" {
+	if lookup && params.Version != "" {
 		// Attempt to get the version if it already exists, it not existing is not an error though
 		i, err := model.GetIngredientByNameAndVersion(reqVars.Namespace, reqVars.Name, params.Version, &latestRevisionTime, r.auth)
 		if err != nil {
@@ -193,7 +197,7 @@ func (r *Runner) Run(params *Params) error {
 		}
 	}
 
-	if ingredient == nil {
+	if lookup && ingredient == nil {
 		// Attempt to find the existing ingredient, if we didn't already get it from the version specific call above
 		ingredients, err := model.SearchIngredientsStrict(reqVars.Namespace, reqVars.Name, true, false, &latestRevisionTime, r.auth)
 		var errSearch404 *model.ErrSearch404
@@ -658,9 +662,12 @@ func (r *Runner) OpenInEditor(pr *request.PublishVariables) error {
 
 	r.out.Notice(locale.Tr("uploadingredient_editor_opening", fn))
 
-	// Open file
+	// Open file. Without an editor (no $EDITOR and no xdg-open, as on many headless machines), the file can still be
+	// edited by hand, as the notice above says, so carry on to the confirmation instead of failing.
 	if err := osutils.OpenEditor(fn); err != nil {
-		return locale.WrapError(err, "err_uploadingredient_publish", "Could not open publish request file")
+		logging.Debug("Could not open editor: %v", errs.JoinMessage(err))
+		r.out.Notice(locale.Tl("uploadingredient_editor_open_failed",
+			"Could not open an editor, so edit the file above yourself, or set [ACTIONABLE]EDITOR[/RESET] to the editor to use."))
 	}
 
 	// Wait for confirmation

internal/testhelpers/tagsuite/tagsuite.go

@@ -95,21 +95,27 @@ type Suite struct {
 	suite.Suite
 }
 
-// OnlyRunForTags skips a test unless one of the given tags is asked for.
-func (suite *Suite) OnlyRunForTags(tags ...string) {
+// RunsForTags reports whether tests for one of the given tags are asked for.
+func RunsForTags(tags ...string) bool {
 	setTagsString, _ := os.LookupEnv("TEST_SUITE_TAGS")
 
 	setTags := strings.Split(strings.ToLower(setTagsString), ":")
 	// if no tags are defined and we're not on CI; run the test
 	if funk.Contains(setTags, "all") || (setTagsString == "" && !condition.OnCI()) {
-		return
+		return true
 	}
 
 	for _, tag := range tags {
 		if funk.Contains(setTags, strings.ToLower(tag)) {
-			return
+			return true
 		}
 	}
+	return false
+}
 
-	suite.T().Skipf("Run only if any of the following tags are set: %s", strings.Join(tags, ", "))
+// OnlyRunForTags skips a test unless one of the given tags is asked for.
+func (suite *Suite) OnlyRunForTags(tags ...string) {
+	if !RunsForTags(tags...) {
+		suite.T().Skipf("Run only if any of the following tags are set: %s", strings.Join(tags, ", "))
+	}
 }

test/integration/performance_svc_int_test.go

@@ -29,6 +29,9 @@ type PerformanceSvcIntegrationTestSuite struct {
 }
 
 func (suite *PerformanceIntegrationTestSuite) TearDownSuite() {
+	if !tagsuite.RunsForTags(tagsuite.Performance) {
+		return // no test started a service; a long branch channel's socket path can't even be dialed on macOS
+	}
 	ipcClient := svcctl.NewDefaultIPCClient()
 	err := svcctl.StopServer(ipcClient)
 	suite.Require().NoError(err)

test/integration/publish_int_test.go

@@ -7,6 +7,7 @@ import (
 	"os"
 	"path/filepath"
 	"regexp"
+	"runtime"
 	"testing"
 	"time"
 
@@ -24,7 +25,7 @@ import (
 	"github.com/ActiveState/cli/pkg/platform/api/graphql/request"
 )
 
-var editorFileRx = regexp.MustCompile(`file:\s*?(.*?)\.\s`)
+var editorFileRx = regexp.MustCompile(`file:\s*(.*?)\.\s`)
 
 type PublishIntegrationTestSuite struct {
 	tagsuite.Suite
@@ -388,8 +389,11 @@ authors:
 						args[k] = vp
 					}
 
+					// The test edits the file itself, so make sure no real editor is opened: otherwise `open` or
+					// `xdg-open` hands it to whatever app the runner has registered, if any.
 					cp := ts.SpawnWithOpts(
 						e2e.OptArgs(append([]string{"publish"}, args...)...),
+						e2e.OptAppendEnv("EDITOR=state-test-no-editor"),
 					)
 
 					if inv.expect.immediateOutput != "" {
@@ -491,6 +495,9 @@ authors:
 // The ingredient is published under a unique, random name. Published private
 // ingredients cannot be deleted, so the name must never collide across runs.
 func (suite *PublishIntegrationTestSuite) TestPublishBuildEncrypted() {
+	if runtime.GOOS == "linux" && runtime.GOARCH == "arm64" {
+		suite.T().Skip("The Python project this installs into has no Linux/arm64 platform")
+	}
 	suite.OnlyRunForTags(tagsuite.Publish)
 
 	ts := e2e.New(suite.T(), false)