deps: upgraded dependency

[ramisback]

There were vulernabilities in older dependencies so I have upgraded it

(GO-2020-0036)
(GO-2021-0061)
(GO-2022-0956)

[dgoldstein0]

have you run the tests? https://github.com/ua-parser/uap-go?tab=readme-ov-file#testing unfortunately these aren't automated yet.

Also should mention, I took a look at the mentioned vulnerabilities. Practically they aren't interesting for this package - they are all about DOS against the yaml parser, but we don't parse user-supplied yaml. I think we actually just parse the uap-core yaml at build time. That said upgrading is probably a good idea so happy to accept the upgrades, provided the tests pass.

[pior]

What's the policy regarding Go version support?

I guess we don't want to force everyone to use the latest Go version?

[ramisback]

I've updated the go directive in go.mod to specify a lower, stable Go version. This change is backward-compatible, as go.mod ensures dependencies are tied to specific commits. However, to enhance backward compatibility and provide a clearer upgrade path, we should consider implementing semantic versioning for the library

[pior]

have you run the tests? https://github.com/ua-parser/uap-go?tab=readme-ov-file#testing unfortunately these aren't automated yet.

Would you accept a PR to setup test in CI using Github Actions?

[dgoldstein0]

have you run the tests? https://github.com/ua-parser/uap-go?tab=readme-ov-file#testing unfortunately these aren't automated yet.

Would you accept a PR to setup test in CI using Github Actions?

sure, please send one!

[ramisback]

have you run the tests? https://github.com/ua-parser/uap-go?tab=readme-ov-file#testing unfortunately these aren't automated yet.

Also should mention, I took a look at the mentioned vulnerabilities. Practically they aren't interesting for this package - they are all about DOS against the yaml parser, but we don't parse user-supplied yaml. I think we actually just parse the uap-core yaml at build time. That said upgrading is probably a good idea so happy to accept the upgrades, provided the tests pass.

Yes, all tests are passing, I have also replaced deprecated ioutil with os package
It can be seen here reference

[pior]

1.22.11 is the last 1.22 release 👍
Maintaining the two last Go versions looks good to me 👍

Changes look good as well.

(I'm not a maintainer of this package, we just use this lib)

[dgoldstein0]

so we just added github actions to automate the tests. is there an easy way to see that in action here? if not I can just merge it and hope for the best but it'd be nice to see it passing on this first

[pior]

The author of the PR needs to rebase their branch on master, the CI will kick in then