From afbfd7d5b179e791c054337c8e2abe19b5d72d75 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 17:56:36 +0000 Subject: [PATCH 1/2] chore(deps): bump the go-maintenance group in /server-go with 3 updates Bumps the go-maintenance group in /server-go with 3 updates: [github.com/go-chi/chi/v5](https://github.com/go-chi/chi), [github.com/go-chi/cors](https://github.com/go-chi/cors) and [github.com/WebDecoy/web-bot-auth](https://github.com/WebDecoy/web-bot-auth). Updates `github.com/go-chi/chi/v5` from 5.0.11 to 5.3.2 - [Release notes](https://github.com/go-chi/chi/releases) - [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md) - [Commits](https://github.com/go-chi/chi/compare/v5.0.11...v5.3.2) Updates `github.com/go-chi/cors` from 1.2.1 to 1.2.2 - [Release notes](https://github.com/go-chi/cors/releases) - [Commits](https://github.com/go-chi/cors/compare/v1.2.1...v1.2.2) Updates `github.com/WebDecoy/web-bot-auth` from 0.2.0 to 0.4.1 - [Release notes](https://github.com/WebDecoy/web-bot-auth/releases) - [Commits](https://github.com/WebDecoy/web-bot-auth/compare/v0.2.0...v0.4.1) --- updated-dependencies: - dependency-name: github.com/go-chi/chi/v5 dependency-version: 5.3.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-maintenance - dependency-name: github.com/go-chi/cors dependency-version: 1.2.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-maintenance - dependency-name: github.com/WebDecoy/web-bot-auth dependency-version: 0.4.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-maintenance ... Signed-off-by: dependabot[bot] --- server-go/go.mod | 12 +++++++----- server-go/go.sum | 16 ++++++++++------ 2 files changed, 17 insertions(+), 11 deletions(-) diff --git a/server-go/go.mod b/server-go/go.mod index 1ba4182..5a7ddb7 100644 --- a/server-go/go.mod +++ b/server-go/go.mod @@ -3,18 +3,20 @@ module github.com/WebDecoy/FCaptcha/server-go go 1.26.8 require ( - github.com/go-chi/chi/v5 v5.0.11 - github.com/go-chi/cors v1.2.1 + github.com/go-chi/chi/v5 v5.3.2 + github.com/go-chi/cors v1.2.2 ) require github.com/hashicorp/golang-lru/v2 v2.0.7 -require github.com/WebDecoy/web-bot-auth v0.2.0 +require ( + github.com/WebDecoy/web-bot-auth v0.4.1 + github.com/alicebob/miniredis/v2 v2.35.0 + github.com/redis/go-redis/v9 v9.12.1 +) require ( - github.com/alicebob/miniredis/v2 v2.35.0 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect - github.com/redis/go-redis/v9 v9.12.1 // indirect github.com/yuin/gopher-lua v1.1.1 // indirect ) diff --git a/server-go/go.sum b/server-go/go.sum index 0068279..b51a2e2 100644 --- a/server-go/go.sum +++ b/server-go/go.sum @@ -1,15 +1,19 @@ -github.com/WebDecoy/web-bot-auth v0.2.0 h1:0O30qxxYjMTUToSXCMO43gvhLOIB/Mdb2MppSKKs/U8= -github.com/WebDecoy/web-bot-auth v0.2.0/go.mod h1:Vjih4b1Xzxi3whR7J3Fnfy2wBZDytvHLI0H1hqZV1Bo= +github.com/WebDecoy/web-bot-auth v0.4.1 h1:lqFKng5tl58UxReemiHEn/kCjuGrDC9yBjS7Ui5vcr8= +github.com/WebDecoy/web-bot-auth v0.4.1/go.mod h1:Vjih4b1Xzxi3whR7J3Fnfy2wBZDytvHLI0H1hqZV1Bo= github.com/alicebob/miniredis/v2 v2.35.0 h1:QwLphYqCEAo1eu1TqPRN2jgVMPBweeQcR21jeqDCONI= github.com/alicebob/miniredis/v2 v2.35.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM= +github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs= +github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c= +github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA= +github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0= github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78= github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc= -github.com/go-chi/chi/v5 v5.0.11 h1:BnpYbFZ3T3S1WMpD79r7R5ThWX40TaFB7L31Y8xqSwA= -github.com/go-chi/chi/v5 v5.0.11/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8= -github.com/go-chi/cors v1.2.1 h1:xEC8UT3Rlp2QuWNEr4Fs/c2EAGVKBwy/1vHx3bppil4= -github.com/go-chi/cors v1.2.1/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58= +github.com/go-chi/chi/v5 v5.3.2 h1:5YQkICvTCSZ25hoRsyJazN0scjzKGiu4VAUc7H1o1nY= +github.com/go-chi/chi/v5 v5.3.2/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto= +github.com/go-chi/cors v1.2.2 h1:Jmey33TE+b+rB7fT8MUy1u0I4L+NARQlK6LhzKPSyQE= +github.com/go-chi/cors v1.2.2/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58= github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k= github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM= github.com/redis/go-redis/v9 v9.12.1 h1:k5iquqv27aBtnTm2tIkROUDp8JBXhXZIVu1InSgvovg= From 9514456e99fc6d98b2355915e8db03609860ce77 Mon Sep 17 00:00:00 2001 From: Chris Portscheller Date: Mon, 14 Sep 2026 13:05:44 -0500 Subject: [PATCH 2/2] test: sign a protocol-compliant agent identity with the upgraded SDK Keep strict missing-agent rejection and exercise verified, forged, and missing-identity verdicts with real cryptographic signatures. --- server-go/scoring_test.go | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/server-go/scoring_test.go b/server-go/scoring_test.go index 08c5695..fad541a 100644 --- a/server-go/scoring_test.go +++ b/server-go/scoring_test.go @@ -372,7 +372,7 @@ func TestCheckWebBotAuthEndToEnd(t *testing.T) { if err != nil { t.Fatalf("keygen: %v", err) } - signer, err := webbotauth.NewSigner(priv) + signer, err := webbotauth.NewSigner(priv, webbotauth.WithSignatureAgent("https://agent.example")) if err != nil { t.Fatalf("NewSigner: %v", err) } @@ -403,6 +403,21 @@ func TestCheckWebBotAuthEndToEnd(t *testing.T) { if len(forged) != 1 || forged[0].Category != CategoryBot { t.Fatalf("expected forged bot detection on authority mismatch, got %+v", forged) } + + // A signature without an agent identity is not a verified agent claim, + // even when its key is pinned. Keep the upstream strict default. + legacySigner, err := webbotauth.NewSigner(priv) + if err != nil { + t.Fatal(err) + } + missingAgent, _ := http.NewRequest("POST", "https://example.com/api/verify", nil) + if err := legacySigner.SignRequest(missingAgent); err != nil { + t.Fatal(err) + } + presence := e.CheckWebBotAuth(context.Background(), webbotauth.RequestFromHTTP(missingAgent)) + if len(presence) != 1 || presence[0].Category != CategoryDeclaredAI || presence[0].Details["verified"] != false { + t.Fatalf("missing agent must stay unverified, got %+v", presence) + } } // TestVerifyWithHeadersScoresPreDetections guards that caller-supplied