Update dependencies for 3.1.0

buildscripts/update-jfrog-deps.sh

@@ -0,0 +1,172 @@
+#!/bin/bash
+set -euo pipefail
+
+BOLD="\033[1m"
+GREEN="\033[0;32m"
+YELLOW="\033[0;33m"
+CYAN="\033[0;36m"
+RED="\033[0;31m"
+RESET="\033[0m"
+
+GOMOD="go.mod"
+COMMENT_REPLACE=true
+# Used for go get / go mod tidy when resolving modules (override e.g. for a corporate proxy).
+JFROG_DEPS_GOPROXY="${JFROG_DEPS_GOPROXY:-direct}"
+
+usage() {
+    echo -e "${BOLD}Usage:${RESET} $0 [OPTIONS] [dep1 dep2 ...]"
+    echo
+    echo "Update JFrog Go dependencies to their latest versions."
+    echo "With no dependency names, updates all known JFrog modules; otherwise only those listed."
+    echo
+    echo -e "${BOLD}Options:${RESET}"
+    echo "  -a, --all            Explicitly update all JFrog dependencies (same as passing no names)"
+    echo "  --keep-replace       Don't comment out active 'replace' directives (default: comment them out)"
+    echo "  -h, --help           Show this help message"
+    echo
+    echo -e "${BOLD}Environment:${RESET}"
+    echo "  JFROG_DEPS_GOPROXY   GOPROXY for go get / go mod tidy (default: direct)"
+    echo
+    echo -e "${BOLD}Individual dependencies (pass one or more):${RESET}"
+    echo "  client-go        github.com/jfrog/jfrog-client-go        @master"
+    echo "  cli-core         github.com/jfrog/jfrog-cli-core/v2      @master"
+    echo "  cli-artifactory  github.com/jfrog/jfrog-cli-artifactory  @main"
+    echo "  build-info-go    github.com/jfrog/build-info-go          @main"
+    echo "  cli-security     github.com/jfrog/jfrog-cli-security      @latest (tag)"
+    echo "  froggit-go       github.com/jfrog/froggit-go             @latest (tag)"
+    echo "  gofrog           github.com/jfrog/gofrog                 @latest (tag)"
+    echo
+    echo -e "${BOLD}Examples:${RESET}"
+    echo "  $0                                # Update all JFrog deps"
+    echo "  $0 --all                          # Same as no arguments"
+    echo "  $0 client-go cli-core             # Update only those"
+    echo "  $0 --keep-replace                 # Update all, leave replace directives as-is"
+    echo "  JFROG_DEPS_GOPROXY=https://proxy.golang.org $0   # Use a different GOPROXY"
+}
+
+log_info()  { echo -e "${CYAN}[INFO]${RESET}  $*"; }
+log_ok()    { echo -e "${GREEN}[OK]${RESET}    $*"; }
+log_warn()  { echo -e "${YELLOW}[WARN]${RESET}  $*"; }
+log_error() { echo -e "${RED}[ERROR]${RESET} $*"; }
+
+ALL_KEYS="client-go cli-core cli-artifactory cli-security build-info-go froggit-go gofrog"
+
+resolve_dep() {
+    case "$1" in
+        client-go)       echo "github.com/jfrog/jfrog-client-go|master" ;;
+        cli-core)        echo "github.com/jfrog/jfrog-cli-core/v2|master" ;;
+        cli-artifactory) echo "github.com/jfrog/jfrog-cli-artifactory|main" ;;
+        build-info-go)   echo "github.com/jfrog/build-info-go|main" ;;
+        cli-security)    echo "github.com/jfrog/jfrog-cli-security|latest" ;;
+        froggit-go)      echo "github.com/jfrog/froggit-go|latest" ;;
+        gofrog)          echo "github.com/jfrog/gofrog|latest" ;;
+        *)               return 1 ;;
+    esac
+}
+
+comment_out_jfrog_replaces() {
+    if [[ ! -f "$GOMOD" ]]; then
+        log_error "Cannot find $GOMOD"
+        return 1
+    fi
+
+    local count
+    count=$(grep -cE '^[[:space:]]*replace[[:space:]]+github\.com/jfrog/' "$GOMOD" 2>/dev/null || true)
+
+    if [[ "$count" -eq 0 ]]; then
+        log_info "No active jfrog replace directives found"
+        return 0
+    fi
+
+    log_warn "Found ${BOLD}${count}${RESET} active jfrog replace directive(s) — commenting out"
+
+    # macOS sed requires '' after -i; use a temp file for portability
+    local tmp
+    tmp=$(mktemp)
+    while IFS= read -r line; do
+        if echo "$line" | grep -qE '^[[:space:]]*replace[[:space:]]+github\.com/jfrog/'; then
+            log_info "  Commenting: ${line}"
+            echo "// ${line}" >> "$tmp"
+        else
+            echo "$line" >> "$tmp"
+        fi
+    done < "$GOMOD"
+    mv "$tmp" "$GOMOD"
+    log_ok "Replace directives commented out"
+}
+
+update_dep() {
+    local key="$1"
+    local entry
+    entry=$(resolve_dep "$key") || { log_error "Unknown dependency: ${key} (known: ${ALL_KEYS})"; return 1; }
+    local module="${entry%%|*}"
+    local ref="${entry##*|}"
+    log_info "Updating ${BOLD}${key}${RESET} → ${module}@${ref}"
+    if GOPROXY="$JFROG_DEPS_GOPROXY" go get "${module}@${ref}"; then
+        log_ok "${key} updated"
+    else
+        log_error "Failed to update ${key}"
+        return 1
+    fi
+}
+
+# --- Main ---
+
+explicit_all=false
+specific_deps=()
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        -a|--all)           explicit_all=true; shift ;;
+        --keep-replace)     COMMENT_REPLACE=false; shift ;;
+        -h|--help)          usage; exit 0 ;;
+        -*)                 log_error "Unknown option: $1"; usage; exit 1 ;;
+        *)                  specific_deps+=("$1"); shift ;;
+    esac
+done
+
+# Comment out active replace directives before updating
+if [[ "$COMMENT_REPLACE" == true ]]; then
+    comment_out_jfrog_replaces
+    echo
+fi
+
+failed=0
+keys_to_update=""
+
+if ((${#specific_deps[@]} > 0)); then
+    if [[ "$explicit_all" == true ]]; then
+        log_warn "${BOLD}--all${RESET} is ignored when dependency names are listed"
+    fi
+    log_info "Updating ${BOLD}${specific_deps[*]}${RESET}…"
+    echo
+    keys_to_update="${specific_deps[*]}"
+else
+    log_info "Updating ${BOLD}all${RESET} JFrog dependencies…"
+    echo
+    keys_to_update="$ALL_KEYS"
+fi
+
+for dep in $keys_to_update; do
+    update_dep "$dep" || ((failed++)) || true
+done
+
+echo
+if [[ $failed -gt 0 ]]; then
+    log_warn "${failed} update(s) failed"
+else
+    log_ok "All updates succeeded"
+fi
+
+log_info "Running go mod tidy…"
+GOPROXY="$JFROG_DEPS_GOPROXY" go mod tidy
+log_ok "go mod tidy done"
+
+log_info "Running go vet ./…"
+if ! go vet ./...; then
+    log_error "go vet failed"
+    exit 1
+fi
+log_ok "go vet passed"
+
+exit "$failed"

go.mod

@@ -11,8 +11,8 @@ require (
 	github.com/jfrog/froggit-go v1.22.0
 	github.com/jfrog/gofrog v1.7.6
 	github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260504054219-ba16d20c7b0f
-	github.com/jfrog/jfrog-cli-security v1.28.0
-	github.com/jfrog/jfrog-client-go v1.55.1-0.20260505115216-b6c67f807bc3
+	github.com/jfrog/jfrog-cli-security v1.29.0
+	github.com/jfrog/jfrog-client-go v1.55.1-0.20260508101905-a17af78a38d7
 	github.com/owenrumney/go-sarif/v3 v3.2.3
 	github.com/stretchr/testify v1.11.1
 	github.com/tidwall/gjson v1.18.0
@@ -63,7 +63,7 @@ require (
 	github.com/jedib0t/go-pretty/v6 v6.7.8 // indirect
 	github.com/jfrog/archiver/v3 v3.6.3 // indirect
 	github.com/jfrog/jfrog-apps-config v1.0.1 // indirect
-	github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260501071051-3c8035fc662b // indirect
+	github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260508123058-25d218a0eca9 // indirect
 	github.com/kevinburke/ssh_config v1.6.0 // indirect
 	github.com/klauspost/compress v1.18.5 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
@@ -127,7 +127,7 @@ require (
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
 
-replace github.com/jfrog/jfrog-cli-security => github.com/jfrog/jfrog-cli-security v1.28.1-0.20260505135007-a2c39d56de78
+// replace github.com/jfrog/jfrog-cli-security => github.com/jfrog/jfrog-cli-security v1.28.1-0.20260505135007-a2c39d56de78
 
 // replace github.com/jfrog/jfrog-cli-core/v2 => github.com/jfrog/jfrog-cli-core/v2 dev
 

go.sum

@@ -146,14 +146,14 @@ github.com/jfrog/gofrog v1.7.6 h1:QmfAiRzVyaI7JYGsB7cxfAJePAZTzFz0gRWZSE27c6s=
 github.com/jfrog/gofrog v1.7.6/go.mod h1:ntr1txqNOZtHplmaNd7rS4f8jpA5Apx8em70oYEe7+4=
 github.com/jfrog/jfrog-apps-config v1.0.1 h1:mtv6k7g8A8BVhlHGlSveapqf4mJfonwvXYLipdsOFMY=
 github.com/jfrog/jfrog-apps-config v1.0.1/go.mod h1:8AIIr1oY9JuH5dylz2S6f8Ym2MaadPLR6noCBO4C22w=
-github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260501071051-3c8035fc662b h1:FthglG4ivcUSQLNPWWdKzbBHR9FCCG1WJSO5fpbLkY4=
-github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260501071051-3c8035fc662b/go.mod h1:teaYcsWBYyYa0mhofzOJkEqWRMZ/1gS7uhy6HT64XXg=
+github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260508123058-25d218a0eca9 h1:UsdbnrhIVDSoKtM07RAnQxiX4+/XstAwRdBQHh8NlVU=
+github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260508123058-25d218a0eca9/go.mod h1:7d1o1iidDBY9cFf0S9818JMu1zn/lXoW4hf5SfDEd6s=
 github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260504054219-ba16d20c7b0f h1:l5BPLF8GYBSvXmNqurqAP291lVHr1iCo4nwc5xe7KNM=
 github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260504054219-ba16d20c7b0f/go.mod h1:bjAkVD8c2W+jg4whqy10bSXDC/c+Se8/ll/GPp5F/+0=
-github.com/jfrog/jfrog-cli-security v1.28.1-0.20260505135007-a2c39d56de78 h1:NAvhctthunYAUCDHlUlIk0wzkRJG/Ds8aTndlo+Lcs8=
-github.com/jfrog/jfrog-cli-security v1.28.1-0.20260505135007-a2c39d56de78/go.mod h1:8dIzcSzO553Q/feb9XXNE9uNAWLa98D+XjXZScd/MbM=
-github.com/jfrog/jfrog-client-go v1.55.1-0.20260505115216-b6c67f807bc3 h1:yjPAmowZM/2yDpgYVwWBuFFm8IETnYkCe5OLp6zFsQA=
-github.com/jfrog/jfrog-client-go v1.55.1-0.20260505115216-b6c67f807bc3/go.mod h1:sCE06+GngPoyrGO0c+vmhgMoVSP83UMNiZnIuNPzU8U=
+github.com/jfrog/jfrog-cli-security v1.29.0 h1:TN2OCA5i/iPbikQWzSwVqGvySvIvw1P6rPga+DbVBOI=
+github.com/jfrog/jfrog-cli-security v1.29.0/go.mod h1:q38TPlxortIJvbyD3u9P9UhHwyx007tEb9WbXlXw2E0=
+github.com/jfrog/jfrog-client-go v1.55.1-0.20260508101905-a17af78a38d7 h1:o8fk4yWLqNMldarXyh/4NbmdbYbuM+lKYobdJK7shqM=
+github.com/jfrog/jfrog-client-go v1.55.1-0.20260508101905-a17af78a38d7/go.mod h1:sCE06+GngPoyrGO0c+vmhgMoVSP83UMNiZnIuNPzU8U=
 github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c=
 github.com/jhump/protoreflect v1.15.1/go.mod h1:jD/2GMKKE6OqX8qTjhADU1e6DShO+gavG9e0Q693nKo=
 github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY=