Skip to content

chore(deps): bump the common group across 1 directory with 10 updates #8817

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
May 5, 2025
Merged

chore(deps): bump the common group across 1 directory with 10 updates #8817

merged 1 commit into from
May 5, 2025

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github May 5, 2025

Bumps the common group with 10 updates in the / directory:

Package From To
github.com/aquasecurity/table 1.8.0 1.10.0
github.com/aws/aws-sdk-go-v2/service/ec2 1.211.3 1.213.0
github.com/aws/aws-sdk-go-v2/service/ecr 1.43.3 1.44.0
github.com/aws/aws-sdk-go-v2/service/s3 1.79.2 1.79.3
github.com/containerd/containerd/v2 2.0.4 2.0.5
github.com/go-git/go-git/v5 5.15.0 5.16.0
github.com/moby/buildkit 0.21.0 0.21.1
github.com/open-policy-agent/opa 1.3.0 1.4.2
github.com/spf13/cast 1.7.1 1.8.0
github.com/testcontainers/testcontainers-go/modules/localstack 0.36.0 0.37.0

Updates github.com/aquasecurity/table from 1.8.0 to 1.10.0

Release notes

Sourced from github.com/aquasecurity/table's releases.

v1.10.0

What's Changed

Full Changelog: aquasecurity/table@v1.9.0...v1.10.0

v1.9.0

What's Changed

New Contributors

Full Changelog: aquasecurity/table@v1.8.0...v1.9.0

Commits

Updates github.com/aws/aws-sdk-go-v2/service/ec2 from 1.211.3 to 1.213.0

Commits

Updates github.com/aws/aws-sdk-go-v2/service/ecr from 1.43.3 to 1.44.0

Commits

Updates github.com/aws/aws-sdk-go-v2/service/s3 from 1.79.2 to 1.79.3

Commits

Updates github.com/containerd/containerd/v2 from 2.0.4 to 2.0.5

Release notes

Sourced from github.com/containerd/containerd/v2's releases.

containerd 2.0.5

Welcome to the v2.0.5 release of containerd!

The fifth patch release for containerd 2.0 includes various bug fixes and updates.

Highlights

Build and Release Toolchain

  • Update go to 1.23.8 (#11717)

Container Runtime Interface (CRI)

  • Update ImageService to delete images synchronously (#11599)

Image Distribution

  • Prevent panic on zero length push (#11698)
  • Set default differ for the default unpack config of transfer service (#11688)

Runtime

  • Remove invalid error log when stopping container after containerd restart (#11621)
  • Update taskOptions based on runtimeOptions when creating a task (#11618)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

  • Akihiro Suda
  • Akhil Mohan
  • Derek McGowan
  • Phil Estes
  • Wei Fu
  • Iceber Gu
  • Austin Vazquez
  • Maksym Pavlenko
  • Cesar Talledo
  • Henry Wang
  • Jin Dong
  • Krisztian Litkey
  • Yang Yang

Changes

  • Update go to 1.23.8 (#11717)
    • 5bcf0a95e use go1.23.8 as the default go version

... (truncated)

Commits
  • fb4c30d Merge pull request #11717 from dmcgowan/backport-go-1.23.8
  • d60230c Merge pull request #11713 from dmcgowan/prepare-v2.0.5
  • 5bcf0a9 use go1.23.8 as the default go version
  • 4838f33 update to go 1.24.2, 1.23.8
  • a8082cd Prepare release notes for v2.0.5
  • ab513cd Merge pull request #11710 from dmcgowan/backport-11707
  • 58b715a Disable arm64 criu testing in GH Actions
  • b4a53e8 disable portmap test in ubuntu-22 to make CI happy
  • 4bcf472 add option to skip tests in critest
  • ea7be04 Merge pull request #11698 from k8s-infra-cherrypick-robot/cherry-pick-11670-t...
  • Additional commits viewable in compare view

Updates github.com/go-git/go-git/v5 from 5.15.0 to 5.16.0

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.16.0

What's Changed

Full Changelog: go-git/go-git@v5.15.0...v5.16.0

Commits
  • 6d4a5c6 Merge pull request #1515 from pjbgf/regre
  • beedd6b plumbing: transport, Reintroduce SetHostKeyCallback. Fix #1514
  • 763ce2e Merge pull request #1510 from hiddeco/mtls-support
  • 5320e1b plumbing: surface transport configuration errors
  • 9bbc93b plumbing: fix unintended pointer mutation in test
  • f3783f4 plumbing: support mTLS for HTTPS protocol
  • See full diff in compare view

Updates github.com/moby/buildkit from 0.21.0 to 0.21.1

Release notes

Sourced from github.com/moby/buildkit's releases.

v0.21.1

Welcome to the v0.21.1 release of buildkit!

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Contributors

  • Tõnis Tiigi
  • Akihiro Suda
  • Gleb Nebolyubov

Notable Changes

  • Builtin Dockerfile frontend has been updated to v1.15.1.
  • Fix buildctl --tlsdir for non-cert-manager.io tls certificate naming. #5950
  • Fix panic when null cache options were sent using solve grpc API. #5925

Dependency Changes

This release has no dependency changes

Previous release can be found at v0.21.0

Commits
  • 66735c6 Merge pull request #5952 from jsternberg/v0.21.1-picks
  • 73bda6d buildctl: fix tlsdir handling logic for cert-manager.io
  • f0c85bf dockerui: update platforms key calculation
  • 869d97b frontend/dockerui/build: fix "no scan targets for linux/arm64/v8"
  • ebd9734 frontend/dockerui/build.go: split normalizePlatform()
  • 0ded51e control: make sure sending nil cache options does not panic
  • See full diff in compare view

Updates github.com/open-policy-agent/opa from 1.3.0 to 1.4.2

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v1.4.2

This is a bug fix release addressing the missing capabilities/v1.4.1.json in the v1.4.1 release.

v1.4.1

⚠️ Please skip this release and go straight to v1.4.2 ⚠️ This release is broken due to a mistake during the release process and the artifacts are missing a crucial capabilities file. Sorry for any inconvenience.

This is a security fix release for the fixes published in Go 1.24.1 and 1.24.2

  • build: bump go to 1.24.2 (#7544) (authored by @​sspaink) Addressing CVE-2025-22870 and CVE-2025-22871 vulnerabilities in the Go runtime.

v1.4.0

This release contains a security fix addressing CVE-2025-46569. It also includes a mix of new features, bugfixes, and dependency updates.

Security Fix: CVE-2025-46569 - OPA server Data API HTTP path injection of Rego (GHSA-6m8w-jc87-6cr7)

A vulnerability in the OPA server's Data API allows an attacker to craft the HTTP path in a way that injects Rego code into the query that is evaluated.
The evaluation result cannot be made to return any other data than what is generated by the requested path, but this path can be misdirected, and the injected Rego code can be crafted to make the query succeed or fail; opening up for oracle attacks or, given the right circumstances, erroneous policy decision results. Furthermore, the injected code can be crafted to be computationally expensive, resulting in a Denial Of Service (DoS) attack.

Users are only impacted if all of the following apply:

  • OPA is deployed as a standalone server (rather than being used as a Go library)
  • The OPA server is exposed outside of the local host in an untrusted environment.
  • The configured authorization policy does not do exact matching of the input.path attribute when deciding if the request should be allowed.

or, if all of the following apply:

  • OPA is deployed as a standalone server.
  • The service connecting to OPA allows 3rd parties to insert unsanitised text into the path of the HTTP request to OPA’s Data API.

Note: With no Authorization Policy configured for restricting API access (the default configuration), the RESTful Data API provides access for managing Rego policies; and the RESTful Query API facilitates advanced queries. Full access to these APIs provides both simpler, and broader access than what the security issue describes here can facilitate. As such, OPA servers exposed to a network are not considered affected by the attack described here if they are knowingly not restricting access through an Authorization Policy.

This issue affects all versions of OPA prior to 1.4.0.

See the Security Advisory for more details.

Reported by @​GamrayW, @​HyouKash, @​AdrienIT, authored by @​johanfylling

Runtime, Tooling, SDK

... (truncated)

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

1.4.2

This is a bug fix release addressing the missing capabilities/v1.4.1.json in the v1.4.1 release.

1.4.1

This is a security fix release for the fixes published in Go 1.24.1 and 1.24.2

  • build: bump go to 1.24.2 (#7544) (authored by @​sspaink) Addressing CVE-2025-22870 and CVE-2025-22871 vulnerabilities in the Go runtime.

1.4.0

This release contains a security fix addressing CVE-2025-46569. It also includes a mix of new features, bugfixes, and dependency updates.

Security Fix: CVE-2025-46569 - OPA server Data API HTTP path injection of Rego (GHSA-6m8w-jc87-6cr7)

A vulnerability in the OPA server's Data API allows an attacker to craft the HTTP path in a way that injects Rego code into the query that is evaluated.
The evaluation result cannot be made to return any other data than what is generated by the requested path, but this path can be misdirected, and the injected Rego code can be crafted to make the query succeed or fail; opening up for oracle attacks or, given the right circumstances, erroneous policy decision results. Furthermore, the injected code can be crafted to be computationally expensive, resulting in a Denial Of Service (DoS) attack.

Users are only impacted if all of the following apply:

  • OPA is deployed as a standalone server (rather than being used as a Go library)
  • The OPA server is exposed outside of the local host in an untrusted environment.
  • The configured authorization policy does not do exact matching of the input.path attribute when deciding if the request should be allowed.

or, if all of the following apply:

  • OPA is deployed as a standalone server.
  • The service connecting to OPA allows 3rd parties to insert unsanitised text into the path of the HTTP request to OPA’s Data API.

Note: With no Authorization Policy configured for restricting API access (the default configuration), the RESTful Data API provides access for managing Rego policies; and the RESTful Query API facilitates advanced queries. Full access to these APIs provides both simpler, and broader access than what the security issue describes here can facilitate. As such, OPA servers exposed to a network are not considered affected by the attack described here if they are knowingly not restricting access through an Authorization Policy.

This issue affects all versions of OPA prior to 1.4.0.

See the Security Advisory for more details.

Reported by @​GamrayW, @​HyouKash, @​AdrienIT, authored by @​johanfylling

Runtime, Tooling, SDK

... (truncated)

Commits
  • 5e4582b Prepare v1.4.2 release (#7547)
  • 3b64aff Patch release v1.4.1 (#7545)
  • 8b07202 Prepare v1.4.0 release (#7541)
  • ad20632 Merge commit from fork
  • 24ff9cf fix: return the raw strings when formatting (#7525)
  • 254f3bf fix(status plugin): make sure the latest status is read before manually trigg...
  • 9b5f601 docs: fix post merge badge (#7532)
  • e490277 docs: Point path versioned requests to new sites (#7531)
  • d65888c plugins/status: FIFO buffer channel for status events to prevent slow status ...
  • eb77d10 docs: update edge links to use /docs/edge/ path (#7529)
  • Additional commits viewable in compare view

Updates github.com/spf13/cast from 1.7.1 to 1.8.0

Release notes

Sourced from github.com/spf13/cast's releases.

v1.8.0

What's Changed

New Contributors

Full Changelog: spf13/cast@v1.7.1...v1.8.0

Commits
  • 01004f2 Merge pull request #234 from arui1628/master
  • 4f997d9 refactor: use generic toSlice for ToInt64SliceE
  • 76b8370 Merge pull request #242 from spf13/dependabot/github_actions/github/codeql-ac...
  • 0af7fb9 build(deps): bump github/codeql-action from 3.28.15 to 3.28.17
  • 929f138 Add ToInt64Slice() and ToInt64SliceE()
  • ac031ef Merge pull request #239 from spf13/dependabot/github_actions/github/codeql-ac...
  • 79b62f3 Merge pull request #240 from spf13/dependabot/github_actions/actions/dependen...
  • 1bd7e4f build(deps): bump actions/dependency-review-action from 4.5.0 to 4.6.0
  • 0c806f9 build(deps): bump github/codeql-action from 2.13.4 to 3.28.15
  • e929a71 Merge pull request #236 from nmvalera/master
  • Additional commits viewable in compare view

Updates github.com/testcontainers/testcontainers-go/modules/localstack from 0.36.0 to 0.37.0

Release notes

Sourced from github.com/testcontainers/testcontainers-go/modules/localstack's releases.

v0.37.0

What's Changed

🔒 Security

  • chore(deps): bump golang.org/x/crypto from 0.31.0 to 0.35.0 in /modules/aerospike (#3105) @dependabot[bot]
  • chore(pulsar): bump github.com/apache/pulsar-client-go from 0.10.0 to 0.14.0 in /modules/pulsar (#3100) @​mdelapenya
  • chore(clickhouse): bump github.com/ClickHouse/clickhouse-go/v2 from 2.20.0 to 2.34.0 in /modules/clickhouse (#3099) @dependabot[bot]
  • security(compose): upgrade github.com/docker/compose/v2 to fix security vulnerability (#3095) @​sigi-glovebox

🚀 Features

🐛 Bug Fixes

📖 Documentation

🧹 Housekeeping

... (truncated)

Commits
  • 08e7b58 chore: use new version (v0.37.0) in modules and examples
  • 9da8340 fix: handle stopped containers more gracefully when reuse is enabled (#3062)
  • 37ce316 feat(gcloud): add option to run firestore in datastore mode (#3009)
  • 224da6d feat: support for mounting images (#3044)
  • 92b9255 chore(ci): close PR if it was sent from main (#3123)
  • 8a498b7 feat: add WithReuseByName for modifying Generic Container Requests (#3064)
  • 1c9b01b chore(deps): bump github/codeql-action from 3.28.15 to 3.28.16 (#3120)
  • d7c1a2f chore(deps): bump mkdocs-include-markdown-plugin from 6.2.2 to 7.1.5 (#3119)
  • c71d5c9 chore(deps): bump github.com/magiconair/properties from 1.8.9 to 1.8.10 (#3118)
  • 7c6278f chore(ci): exclude more files for a full-blown build (#3122)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the common group across 1 directory with 10 updates
ad6fb84 
Bumps the common group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/aquasecurity/table](https://github.com/aquasecurity/table) | `1.8.0` | `1.10.0` |
| [github.com/aws/aws-sdk-go-v2/service/ec2](https://github.com/aws/aws-sdk-go-v2) | `1.211.3` | `1.213.0` |
| [github.com/aws/aws-sdk-go-v2/service/ecr](https://github.com/aws/aws-sdk-go-v2) | `1.43.3` | `1.44.0` |
| [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2) | `1.79.2` | `1.79.3` |
| [github.com/containerd/containerd/v2](https://github.com/containerd/containerd) | `2.0.4` | `2.0.5` |
| [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `5.15.0` | `5.16.0` |
| [github.com/moby/buildkit](https://github.com/moby/buildkit) | `0.21.0` | `0.21.1` |
| [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) | `1.3.0` | `1.4.2` |
| [github.com/spf13/cast](https://github.com/spf13/cast) | `1.7.1` | `1.8.0` |
| [github.com/testcontainers/testcontainers-go/modules/localstack](https://github.com/testcontainers/testcontainers-go) | `0.36.0` | `0.37.0` |



Updates `github.com/aquasecurity/table` from 1.8.0 to 1.10.0
- [Release notes](https://github.com/aquasecurity/table/releases)
- [Commits](aquasecurity/table@v1.8.0...v1.10.0)

Updates `github.com/aws/aws-sdk-go-v2/service/ec2` from 1.211.3 to 1.213.0
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json)
- [Commits](aws/aws-sdk-go-v2@service/ec2/v1.211.3...service/ec2/v1.213.0)

Updates `github.com/aws/aws-sdk-go-v2/service/ecr` from 1.43.3 to 1.44.0
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json)
- [Commits](aws/aws-sdk-go-v2@service/ssm/v1.43.3...service/s3/v1.44.0)

Updates `github.com/aws/aws-sdk-go-v2/service/s3` from 1.79.2 to 1.79.3
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json)
- [Commits](aws/aws-sdk-go-v2@service/s3/v1.79.2...service/s3/v1.79.3)

Updates `github.com/containerd/containerd/v2` from 2.0.4 to 2.0.5
- [Release notes](https://github.com/containerd/containerd/releases)
- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md)
- [Commits](containerd/containerd@v2.0.4...v2.0.5)

Updates `github.com/go-git/go-git/v5` from 5.15.0 to 5.16.0
- [Release notes](https://github.com/go-git/go-git/releases)
- [Commits](go-git/go-git@v5.15.0...v5.16.0)

Updates `github.com/moby/buildkit` from 0.21.0 to 0.21.1
- [Release notes](https://github.com/moby/buildkit/releases)
- [Commits](moby/buildkit@v0.21.0...v0.21.1)

Updates `github.com/open-policy-agent/opa` from 1.3.0 to 1.4.2
- [Release notes](https://github.com/open-policy-agent/opa/releases)
- [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md)
- [Commits](open-policy-agent/opa@v1.3.0...v1.4.2)

Updates `github.com/spf13/cast` from 1.7.1 to 1.8.0
- [Release notes](https://github.com/spf13/cast/releases)
- [Commits](spf13/cast@v1.7.1...v1.8.0)

Updates `github.com/testcontainers/testcontainers-go/modules/localstack` from 0.36.0 to 0.37.0
- [Release notes](https://github.com/testcontainers/testcontainers-go/releases)
- [Commits](testcontainers/testcontainers-go@v0.36.0...v0.37.0)

---
updated-dependencies:
- dependency-name: github.com/aquasecurity/table
  dependency-version: 1.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: common
- dependency-name: github.com/aws/aws-sdk-go-v2/service/ec2
  dependency-version: 1.213.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: common
- dependency-name: github.com/aws/aws-sdk-go-v2/service/ecr
  dependency-version: 1.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: common
- dependency-name: github.com/aws/aws-sdk-go-v2/service/s3
  dependency-version: 1.79.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: common
- dependency-name: github.com/containerd/containerd/v2
  dependency-version: 2.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: common
- dependency-name: github.com/go-git/go-git/v5
  dependency-version: 5.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: common
- dependency-name: github.com/moby/buildkit
  dependency-version: 0.21.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: common
- dependency-name: github.com/open-policy-agent/opa
  dependency-version: 1.4.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: common
- dependency-name: github.com/spf13/cast
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: common
- dependency-name: github.com/testcontainers/testcontainers-go/modules/localstack
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: common
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot requested a review from knqyf263 as a code owner May 5, 2025 06:35
@knqyf263 knqyf263 added this pull request to the merge queue May 5, 2025
Merged via the queue into main with commit e322f21 May 5, 2025
12 checks passed
@knqyf263 knqyf263 deleted the dependabot/go_modules/common-cbf714fe27 branch May 5, 2025 07:19
@candrews
Copy link
Contributor

candrews commented May 6, 2025

@knqyf263 Since this addresses CVE-2025-46569, is Trivy planning to make a release soon?

@knqyf263 knqyf263 mentioned this pull request May 6, 2025
Merged
@knqyf263
Copy link
Collaborator

knqyf263 commented May 6, 2025

@aqua-bot backport release/v0.62

@aqua-bot aqua-bot mentioned this pull request May 6, 2025
Merged
@aqua-bot
Copy link
Contributor

aqua-bot commented May 6, 2025

Backport PR created: #8831

@knqyf263
Copy link
Collaborator

knqyf263 commented May 7, 2025

@candrews Released
https://github.com/aquasecurity/trivy/releases/tag/v0.62.1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@knqyf263 knqyf263 knqyf263 approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@candrews @knqyf263 @aqua-bot