Goose security updates (#3579)

Co-authored-by: Douwe Osinga <douwe@squareup.com>
2025-12-17 06:04:23 +01:00 · 2025-07-24 03:09:26 +02:00
parent ed282ba63f
commit eef72f8a6f
12 changed files with 26 additions and 32 deletions
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2740,12 +2740,6 @@ dependencies = [
 "zip 0.6.6",
 ]

-[[package]]
-name = "dotenv"
-version = "0.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77c90badedccf4105eca100756a0b1289e191f6fcbdadd3cee1d2f614f97da8f"
-
 [[package]]
 name = "dotenvy"
 version = "0.15.7"
@@ -2819,7 +2813,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33d852cb9b869c2a9b3df2f71a3074817f01e1844f839a144f5fcef059a4eb5d"
 dependencies = [
 "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.52.0",
 ]

 [[package]]
@@ -3453,7 +3447,7 @@ dependencies = [
 "ctor",
 "dashmap 6.1.0",
 "dirs 5.0.1",
- "dotenv",
+ "dotenvy",
 "etcetera",
 "fs2",
 "futures",
@@ -3601,7 +3595,7 @@ dependencies = [
 "chrono",
 "criterion",
 "ctor",
- "dotenv",
+ "dotenvy",
 "goose",
 "include_dir",
 "indoc 1.0.9",
@@ -4455,7 +4449,7 @@ checksum = "e19b23d53f35ce9f56aebc7d1bb4e6ac1e9c0db7ac85c8d1760c04379edced37"
 dependencies = [
 "hermit-abi 0.4.0",
 "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.52.0",
 ]

 [[package]]
@@ -5194,7 +5188,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc2f4eb4bc735547cfed7c0a4922cbd04a4655978c09b54f1f7b228750664c34"
 dependencies = [
 "cfg-if",
- "windows-targets 0.52.6",
+ "windows-targets 0.48.5",
 ]

 [[package]]
@@ -5995,9 +5989,9 @@ checksum = "b410bbe7e14ab526a0e86877eb47c6996a2bd7746f027ba551028c925390e4e9"

 [[package]]
 name = "openssl"
-version = "0.10.71"
+version = "0.10.73"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e14130c6a98cd258fdcb0fb6d744152343ff729cbfcb28c656a9d12b999fbcd"
+checksum = "8505734d46c8ab1e19a1dce3aef597ad87dcb4c37e7188231769bd6bd51cebf8"
 dependencies = [
 "bitflags 2.9.0",
 "cfg-if",
@@ -6036,9 +6030,9 @@ dependencies = [

 [[package]]
 name = "openssl-sys"
-version = "0.9.106"
+version = "0.9.109"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bb61ea9811cc39e3c2069f40b8b8e2e70d8569b361f879786cc7ed48b777cdd"
+checksum = "90096e2e47630d78b7d1c20952dc621f957103f8bc2c8359ec81290d75238571"
 dependencies = [
 "cc",
 "libc",
@@ -6688,7 +6682,7 @@ dependencies = [
 "once_cell",
 "socket2 0.5.8",
 "tracing",
- "windows-sys 0.59.0",
+ "windows-sys 0.52.0",
 ]

 [[package]]
@@ -7237,7 +7231,7 @@ dependencies = [
 "errno",
 "libc",
 "linux-raw-sys 0.4.15",
- "windows-sys 0.59.0",
+ "windows-sys 0.52.0",
 ]

 [[package]]
@@ -7250,7 +7244,7 @@ dependencies = [
 "errno",
 "libc",
 "linux-raw-sys 0.9.4",
- "windows-sys 0.59.0",
+ "windows-sys 0.52.0",
 ]

 [[package]]
@@ -8297,7 +8291,7 @@ dependencies = [
 "getrandom 0.3.1",
 "once_cell",
 "rustix 0.38.44",
- "windows-sys 0.59.0",
+ "windows-sys 0.52.0",
 ]

 [[package]]
@@ -9487,7 +9481,7 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.48.0",
 ]

 [[package]]
--- a/crates/goose-llm/Cargo.toml
+++ b/crates/goose-llm/Cargo.toml
@@ -50,7 +50,7 @@ tokio = { version = "1.43", features = ["time", "sync"] }
 [dev-dependencies]
 criterion = "0.5"
 tempfile = "3.15.0"
-dotenv = "0.15"
+dotenvy = "0.15.7"
 lazy_static = "1.5"
 ctor = "0.2.7"
 tokio = { version = "1.43", features = ["full"] }
--- a/crates/goose-llm/tests/extract_session_name.rs
+++ b/crates/goose-llm/tests/extract_session_name.rs
@@ -1,5 +1,5 @@
 use anyhow::Result;
-use dotenv::dotenv;
+use dotenvy::dotenv;
 use goose_llm::extractors::generate_session_name;
 use goose_llm::message::Message;
 use goose_llm::providers::errors::ProviderError;
--- a/crates/goose-llm/tests/extract_tooltip.rs
+++ b/crates/goose-llm/tests/extract_tooltip.rs
@@ -1,5 +1,5 @@
 use anyhow::Result;
-use dotenv::dotenv;
+use dotenvy::dotenv;
 use goose_llm::extractors::generate_tooltip;
 use goose_llm::message::{Message, MessageContent, ToolRequest};
 use goose_llm::providers::errors::ProviderError;
--- a/crates/goose-llm/tests/providers_complete.rs
+++ b/crates/goose-llm/tests/providers_complete.rs
@@ -1,5 +1,5 @@
 use anyhow::Result;
-use dotenv::dotenv;
+use dotenvy::dotenv;
 use goose_llm::message::{Message, MessageContent};
 use goose_llm::providers::base::Provider;
 use goose_llm::providers::errors::ProviderError;
--- a/crates/goose-llm/tests/providers_extract.rs
+++ b/crates/goose-llm/tests/providers_extract.rs
@@ -1,7 +1,7 @@
 // tests/providers_extract.rs

 use anyhow::Result;
-use dotenv::dotenv;
+use dotenvy::dotenv;
 use goose_llm::message::Message;
 use goose_llm::providers::base::Provider;
 use goose_llm::providers::{databricks::DatabricksProvider, openai::OpenAiProvider};
--- a/crates/goose-mcp/Cargo.toml
+++ b/crates/goose-mcp/Cargo.toml
@@ -51,7 +51,7 @@ lopdf = "0.35.0"
 docx-rs = "0.4.7"
 image = "0.24.9"
 umya-spreadsheet = "2.2.3"
-keyring = { version = "3.6.1", features = [
+keyring = { version = "3.6.2", features = [
    "apple-native",
    "windows-native",
    "sync-secret-service",
--- a/crates/goose/Cargo.toml
+++ b/crates/goose/Cargo.toml
@@ -59,7 +59,7 @@ webbrowser = "0.8"
 lazy_static = "1.5.0"
 tracing = "0.1"
 tracing-subscriber = "0.3"
-keyring = { version = "3.6.1", features = ["apple-native", "windows-native", "sync-secret-service", "vendored"] }
+keyring = { version = "3.6.2", features = ["apple-native", "windows-native", "sync-secret-service", "vendored"] }
 serde_yaml = "0.9.34"
 once_cell = "1.20.2"
 etcetera = "0.8.0"
@@ -100,7 +100,7 @@ mockall = "0.13.1"
 wiremock = "0.6.0"
 tokio = { version = "1.43", features = ["full"] }
 temp-env = "0.3.6"
-dotenv = "0.15.0"
+dotenvy = "0.15.7"
 ctor = "0.2.9"

 [[example]]
--- a/crates/goose/examples/agent.rs
+++ b/crates/goose/examples/agent.rs
@@ -1,6 +1,6 @@
 use std::sync::Arc;

-use dotenv::dotenv;
+use dotenvy::dotenv;
 use futures::StreamExt;
 use goose::agents::{Agent, AgentEvent, ExtensionConfig};
 use goose::config::{DEFAULT_EXTENSION_DESCRIPTION, DEFAULT_EXTENSION_TIMEOUT};
--- a/crates/goose/examples/databricks_oauth.rs
+++ b/crates/goose/examples/databricks_oauth.rs
@@ -1,5 +1,5 @@
 use anyhow::Result;
-use dotenv::dotenv;
+use dotenvy::dotenv;
 use goose::{
    message::Message,
    providers::{
--- a/crates/goose/examples/image_tool.rs
+++ b/crates/goose/examples/image_tool.rs
@@ -1,6 +1,6 @@
 use anyhow::Result;
 use base64::{engine::general_purpose::STANDARD as BASE64, Engine as _};
-use dotenv::dotenv;
+use dotenvy::dotenv;
 use goose::{
    message::Message,
    providers::{bedrock::BedrockProvider, databricks::DatabricksProvider, openai::OpenAiProvider},
--- a/crates/goose/tests/providers.rs
+++ b/crates/goose/tests/providers.rs
@@ -1,5 +1,5 @@
 use anyhow::Result;
-use dotenv::dotenv;
+use dotenvy::dotenv;
 use goose::message::{Message, MessageContent};
 use goose::providers::base::Provider;
 use goose::providers::errors::ProviderError;