Merge pull request #1584 from cloudxxx8/issue-1583

fix: Bump dependencies to resolve CVEs

Author: cherrycl

app-service-template/Attribution.txt

@@ -192,8 +192,8 @@ https://github.com/grpc/grpc-go/blob/master/LICENSE
 google.golang.org/protobuf (Unspecified) https://github.com/protocolbuffers/protobuf-go
 https://github.com/protocolbuffers/protobuf-go/blob/master/LICENSE
 
-gopkg.in/square/go-jose.v2 (Apache-2.0) https://github.com/square/go-jose/tree/v2.6.0
-https://github.com/square/go-jose/blob/v2.6.0/LICENSE
+github.com/go-jose/go-jose/v4 (Apache-2.0) https://github.com/go-jose/go-jose
+https://github.com/go-jose/go-jose/blob/main/LICENSE
 
 github.com/Microsoft/go-winio (MIT) https://github.com/Microsoft/go-winio
 https://github.com/microsoft/go-winio/blob/master/LICENSE
@@ -216,9 +216,6 @@ https://github.com/golang/tools/blob/master/LICENSE
 golang.org/x/exp (BSD-3) https://github.com/golang/tools
 https://github.com/golang/tools/blob/master/LICENSE
 
-github.com/go-jose/go-jose/v3 (Apache-2.0) https://github.com/go-jose/go-jose
-https://github.com/go-jose/go-jose/blob/v3/LICENSE
-
 github.com/klauspost/compress (Apache-2.0) https://github.com/klauspost/compress
 https://github.com/klauspost/compress/blob/master/LICENSE
 
@@ -238,4 +235,7 @@ github.com/valyala/fasttemplate (MIT) https://github.com/valyala/fasttemplate
 https://github.com/valyala/fasttemplate/blob/master/LICENSE
 
 github.com/valyala/bytebufferpool (MIT) https://github.com/valyala/bytebufferpool
-https://github.com/valyala/bytebufferpool/blob/master/LICENSE
+https://github.com/valyala/bytebufferpool/blob/master/LICENSE
+
+google.golang.org/genproto/googleapis/rpc (Apache 2.0) https://github.com/googleapis/go-genproto
+https://github.com/googleapis/go-genproto/blob/main/LICENSE

app-service-template/go.mod

@@ -11,14 +11,14 @@ replace github.com/edgexfoundry/app-functions-sdk-go/v3 => ../
 require (
 	github.com/edgexfoundry/app-functions-sdk-go/v3 v3.1.0
 	github.com/edgexfoundry/go-mod-core-contracts/v3 v3.1.0
-	github.com/google/uuid v1.3.1
+	github.com/google/uuid v1.6.0
 	github.com/labstack/echo/v4 v4.11.2
 	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475
-	github.com/stretchr/testify v1.8.4
+	github.com/stretchr/testify v1.9.0
 )
 
 require (
-	github.com/Microsoft/go-winio v0.6.0 // indirect
+	github.com/Microsoft/go-winio v0.6.1 // indirect
 	github.com/armon/go-metrics v0.4.1 // indirect
 	github.com/cenkalti/backoff v2.2.1+incompatible // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
@@ -32,15 +32,14 @@ require (
 	github.com/fatih/color v1.14.1 // indirect
 	github.com/fxamacker/cbor/v2 v2.5.0 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.2 // indirect
-	github.com/go-jose/go-jose/v3 v3.0.0 // indirect
+	github.com/go-jose/go-jose/v4 v4.0.1 // indirect
 	github.com/go-kit/log v0.2.1 // indirect
 	github.com/go-logfmt/logfmt v0.5.1 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
 	github.com/go-playground/validator/v10 v10.15.5 // indirect
 	github.com/go-redis/redis/v7 v7.3.0 // indirect
 	github.com/golang-jwt/jwt v3.2.2+incompatible // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/gomodule/redigo v2.0.0+incompatible // indirect
 	github.com/gorilla/websocket v1.5.0 // indirect
 	github.com/hashicorp/consul/api v1.25.1 // indirect
@@ -66,23 +65,23 @@ require (
 	github.com/nats-io/nkeys v0.4.6 // indirect
 	github.com/nats-io/nuid v1.0.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/spiffe/go-spiffe/v2 v2.1.6 // indirect
-	github.com/stretchr/objx v0.5.0 // indirect
+	github.com/spiffe/go-spiffe/v2 v2.2.0 // indirect
+	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/valyala/fasttemplate v1.2.2 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/zeebo/errs v1.3.0 // indirect
-	golang.org/x/crypto v0.14.0 // indirect
-	golang.org/x/exp v0.0.0-20230321023759-10a507213a29 // indirect
-	golang.org/x/mod v0.8.0 // indirect
-	golang.org/x/net v0.17.0 // indirect
-	golang.org/x/sync v0.2.0 // indirect
-	golang.org/x/sys v0.13.0 // indirect
-	golang.org/x/text v0.13.0 // indirect
-	golang.org/x/time v0.3.0 // indirect
-	golang.org/x/tools v0.6.0 // indirect
-	google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 // indirect
-	google.golang.org/grpc v1.56.3 // indirect
-	google.golang.org/protobuf v1.30.0 // indirect
+	golang.org/x/crypto v0.23.0 // indirect
+	golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842 // indirect
+	golang.org/x/mod v0.17.0 // indirect
+	golang.org/x/net v0.25.0 // indirect
+	golang.org/x/sync v0.7.0 // indirect
+	golang.org/x/sys v0.20.0 // indirect
+	golang.org/x/text v0.15.0 // indirect
+	golang.org/x/time v0.5.0 // indirect
+	golang.org/x/tools v0.21.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240509183442-62759503f434 // indirect
+	google.golang.org/grpc v1.63.2 // indirect
+	google.golang.org/protobuf v1.34.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )