Skip to content

fix(deps): update all dependencies #8985

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Dec 16, 2024
Merged

fix(deps): update all dependencies #8985

merged 1 commit into from
Dec 16, 2024

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Jul 23, 2024 •
edited
Loading

This PR contains the following updates:

Package Type Update Change Age Adoption Passing Confidence
code.cloudfoundry.org/credhub-cli require digest eb4bf81 -> b24ee2a age adoption passing confidence
github.com/caarlos0/env/v11 require minor v11.2.2 -> v11.3.0 age adoption passing confidence
github.com/containerd/containerd require patch v1.7.23 -> v1.7.24 age adoption passing confidence
github.com/containerd/containerd/v2 require patch v2.0.0 -> v2.0.1 age adoption passing confidence
github.com/cyberark/conjur-api-go require patch v0.12.7 -> v0.12.9 age adoption passing confidence
github.com/go-jose/go-jose/v3 require major v3.0.3 -> v4.0.4 age adoption passing confidence
github.com/goccy/go-yaml require patch v1.15.8 -> v1.15.10 age adoption passing confidence
github.com/opencontainers/runc require patch v1.2.2 -> v1.2.3 age adoption passing confidence
go.opentelemetry.io/otel require minor v1.32.0 -> v1.33.0 age adoption passing confidence
go.opentelemetry.io/otel/exporters/otlp/otlptrace require minor v1.32.0 -> v1.33.0 age adoption passing confidence
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc require minor v1.32.0 -> v1.33.0 age adoption passing confidence
go.opentelemetry.io/otel/sdk require minor v1.32.0 -> v1.33.0 age adoption passing confidence
go.opentelemetry.io/otel/trace require minor v1.32.0 -> v1.33.0 age adoption passing confidence
google.golang.org/grpc require minor v1.68.1 -> v1.69.0 age adoption passing confidence
k8s.io/api require minor v0.31.3 -> v0.32.0 age adoption passing confidence
k8s.io/apimachinery require minor v0.31.3 -> v0.32.0 age adoption passing confidence
k8s.io/client-go require minor v0.31.3 -> v0.32.0 age adoption passing confidence

Release Notes

caarlos0/env (github.com/caarlos0/env/v11)

v11.3.0

Compare Source

Changelog

New Features
Bug fixes
Documentation updates
Other work

Released with GoReleaser Pro!

containerd/containerd (github.com/containerd/containerd)

v1.7.24: containerd 1.7.24

Compare Source

Welcome to the v1.7.24 release of containerd!

The twenty-fourth patch release for containerd 1.7 contains various fixes
and updates.

Highlights
  • Update runc binary to 1.2.2 (#​11027)
  • Fix "invalid metric type" error message for cgroup v1 (#​10814)
Container Runtime Interface (CRI)
  • Update the container exit log to info level (#​11007)
Image Distribution
  • Fix retry logic and concurrency issue with http fallback (#​11032)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors
  • Derek McGowan
  • Phil Estes
  • Akhil Mohan
  • Akihiro Suda
  • Maksym Pavlenko
  • Austin Vazquez
  • Samuel Karp
  • Benjamin Peterson
  • Davanum Srinivas
  • Iceber Gu
  • Mike Brown
  • Sebastiaan van Stijn
  • Tõnis Tiigi
  • ningmingxiao
Changes
36 commits

  • Prepare release notes for v1.7.24 (#​11036)
    • 936f8e2de Prepare release notes for v1.7.24
  • Update the container exit log to info level (#​11007)
  • Fix retry logic and concurrency issue with http fallback (#​11032)
    • 10af0d60f Adds a mutex to protect fallback host
    • e426ec51b Use unix and windows specific connection error checks
    • 49c9f303b Allow fallback across default ports
  • local: avoid writing to content root on readonly store (#​10913)
    • ddf2b03ed local: avoid writing to content root on readonly store
  • Update runc binary to 1.2.2 (#​11027)
  • Revert "Disable vagrant strict dependency checking" (#​11011)
    • 23a31ce63 Revert "Disable vagrant strict dependency checking"
  • testutil: avoid conflict with continuity/testutil (#​10956)
    • 4bd411f8c testutil: avoid conflict with continuity/testutil
  • update cri-tools to v1.29.0 (#​10969)
  • update build to go1.22.9, test go1.23.3 (#​10974)
    • 56a7d31cb update build to go1.22.9, test go1.23.3
  • ci: disable marking 1.7 releases as latest (#​10962)
    • 205940716 ci: disable marking 1.7 releases as latest
  • Avoid arch info in the sed/replace when building cri-cni-containerd.tar.gz (#​10976)
    • b7bb8d515 Avoid arch info in the sed/replace when building cri-cni-containerd.tar.gz
  • backport: Disable vagrant strict dependency checking (#​10965)
    • 860a51384 Disable vagrant strict dependency checking
  • Update runc binary to 1.2.1 (#​10940)
  • services/snapshots: include name of snapshotter in debug logs (#​10931)
    • 5bd0834ce services/snapshots: include name of snapshotter in debug logs
  • Make TestContainerPids more resilient (#​10936)
    • 455787bf8 Make TestContainerPids more resilient
  • Add After=dbus.service to containerd.service (#​10859)
    • cb82e52a4 Add After=dbus.service to containerd.service
  • Fix "invalid metric type" error message for cgroup v1 (#​10814)
    • d6f577843 metrics: Use UnmarshalTo instead of UnmarshalAny

Dependency Changes

This release has no dependency changes

Previous release can be found at v1.7.23

cyberark/conjur-api-go (github.com/cyberark/conjur-api-go)

v0.12.9

Compare Source

[0.12.9] - 2024-12-13

Added
go-jose/go-jose (github.com/go-jose/go-jose/v3)

v4.0.4

Compare Source

Fixed

  • Reverted "Allow unmarshalling JSONWebKeySets with unsupported key types" as a
    breaking change. See #​136 / #​137.

v4.0.3

Compare Source

Changed

  • Allow unmarshalling JSONWebKeySets with unsupported key types (#​130)
  • Document that OpaqueKeyEncrypter can't be implemented (for now) (#​129)
  • Dependency updates

v4.0.2

Compare Source

Changed

  • Improved documentation of Verify() to note that JSONWebKeySet is a supported
    argument type (#​104)
  • Defined exported error values for missing x5c header and unsupported elliptic
    curves error cases (#​117)

v4.0.1

Compare Source

Fixed

  • An attacker could send a JWE containing compressed data that used large
    amounts of memory and CPU when decompressed by Decrypt or DecryptMulti.
    Those functions now return an error if the decompressed data would exceed
    250kB or 10x the compressed size (whichever is larger). Thanks to
    Enze Wang@Alioth and Jianjun Chen@Zhongguancun Lab (@​zer0yu and @​chenjj)
    for reporting.

v4.0.0

Compare Source

This release makes some breaking changes in order to more thoroughly
address the vulnerabilities discussed in Three New Attacks Against JSON Web
Tokens, "Sign/encrypt confusion", "Billion hash attack", and "Polyglot
token".

Changed

  • Limit JWT encryption types (exclude password or public key types) (#​78)
  • Enforce minimum length for HMAC keys (#​85)
  • jwt: match any audience in a list, rather than requiring all audiences (#​81)
  • jwt: accept only Compact Serialization (#​75)
  • jws: Add expected algorithms for signatures (#​74)
  • Require specifying expected algorithms for ParseEncrypted,
    ParseSigned, ParseDetached, jwt.ParseEncrypted, jwt.ParseSigned,
    jwt.ParseSignedAndEncrypted (#​69, #​74)
    • Usually there is a small, known set of appropriate algorithms for a program
      to use and it's a mistake to allow unexpected algorithms. For instance the
      "billion hash attack" relies in part on programs accepting the PBES2
      encryption algorithm and doing the necessary work even if they weren't
      specifically configured to allow PBES2.
  • Revert "Strip padding off base64 strings" (#​82)
  • The specs require base64url encoding without padding.
  • Minimum supported Go version is now 1.21

Added

  • ParseSignedCompact, ParseSignedJSON, ParseEncryptedCompact, ParseEncryptedJSON.
    • These allow parsing a specific serialization, as opposed to ParseSigned and
      ParseEncrypted, which try to automatically detect which serialization was
      provided. It's common to require a specific serialization for a specific
      protocol - for instance JWT requires Compact serialization.
goccy/go-yaml (github.com/goccy/go-yaml)

v1.15.10: 1.15.10

Compare Source

What's Changed

New Contributors

Full Changelog: goccy/go-yaml@v1.15.9...v1.15.10

v1.15.9: 1.15.9

Compare Source

What's Changed

New Contributors

Full Changelog: goccy/go-yaml@v1.15.8...v1.15.9

opencontainers/runc (github.com/opencontainers/runc)

v1.2.3: runc v1.2.3 -- "Winter is not a season, it's a celebration."

Compare Source

This is the third patch release of the 1.2.z release branch of runc. It
primarily fixes some minor regressions introduced in 1.2.0.

  • Fixed a regression in use of securejoin.MkdirAll, where multiple
    runc processes racing to create the same mountpoint in a shared rootfs
    would result in spurious EEXIST errors. In particular, this regression
    caused issues with BuildKit. (#​4543, #​4550)
  • Fixed a regression in eBPF support for pre-5.6 kernels after upgrading
    Cilium's eBPF library version to 0.16 in runc. (#​3008, #​4551)
Static Linking Notices

The runc binary distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.

However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to all of the contributors who made this release possible:

Signed-off-by: Aleksa Sarai cyphar@cyphar.com

open-telemetry/opentelemetry-go (go.opentelemetry.io/otel)

v1.33.0: /v0.55.0/v0.9.0/v0.0.12

Compare Source

Overview
Added
  • Add Reset method to SpanRecorder in go.opentelemetry.io/otel/sdk/trace/tracetest. (#​5994)
  • Add EnabledInstrument interface in go.opentelemetry.io/otel/sdk/metric/internal/x. This is an experimental interface that is implemented by synchronous instruments provided by go.opentelemetry.io/otel/sdk/metric. Users can use it to avoid performing computationally expensive operations when recording measurements. It does not fall within the scope of the OpenTelemetry Go versioning and stability policy and it may be changed in backwards incompatible ways or removed in feature releases. (#​6016)
Changed
  • The default global API now supports full auto-instrumentation from the go.opentelemetry.io/auto package. See that package for more information. (#​5920)
  • Propagate non-retryable error messages to client in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#​5929)
  • Propagate non-retryable error messages to client in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#​5929)
  • Propagate non-retryable error messages to client in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#​5929)
  • Performance improvements for attribute value AsStringSlice, AsFloat64Slice, AsInt64Slice, AsBoolSlice. (#​6011)
  • Change EnabledParameters to have a Severity field instead of a getter and setter in go.opentelemetry.io/otel/log. (#​6009)
Fixed
  • Fix inconsistent request body closing in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#​5954)
  • Fix inconsistent request body closing in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#​5954)
  • Fix inconsistent request body closing in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#​5954)
  • Fix invalid exemplar keys in go.opentelemetry.io/otel/exporters/prometheus. (#​5995)
  • Fix attribute value truncation in go.opentelemetry.io/otel/sdk/trace. (#​5997)
  • Fix attribute value truncation in go.opentelemetry.io/otel/sdk/log. (#​6032)
What's Changed
New Contributors

Full Changelog: open-telemetry/opentelemetry-go@v1.32.0...v1.33.0

grpc/grpc-go (google.golang.org/grpc)

v1.69.0: Release 1.69.0

Compare Source

Known Issues

  • The recently added grpc.NewClient function is incompatible with forward proxies, because it resolves the target hostname on the client instead of passing the hostname to the proxy. A fix is expected to be a part of grpc-go v1.70. (#​7556)

New Features

  • stats/opentelemetry: Introduce new APIs to enable OpenTelemetry instrumentation for metrics on servers and clients (#​7874)
  • xdsclient: add support to fallback to lower priority servers when higher priority ones are down (#​7701)
  • dns: Add support for link local IPv6 addresses (#​7889)
  • The new experimental pickfirst LB policy (disabled by default) supports Happy Eyeballs, interleaving IPv4 and IPv6 address as described in RFC-8305 section 4, to attempt connections to multiple backends concurrently. The experimental pickfirst policy can be enabled by setting the environment variable GRPC_EXPERIMENTAL_ENABLE_NEW_PICK_FIRST to true. (#​7725, #​7742)
  • balancer/pickfirst: Emit metrics from the pick_first load balancing policy (#​7839)
  • grpc: export MethodHandler, which is the type of an already-exported field in MethodDesc (#​7796)

Bug Fixes

  • credentials/google: set scope for application default credentials (#​7887)
    • Special Thanks: [@​halvards]

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from a team as a code owner July 23, 2024 14:18
@renovate renovate bot added dependencies misc release/undocumented This didn't warrant being documented or put in release notes. labels Jul 23, 2024
@renovate renovate bot force-pushed the renovate/all branch 15 times, most recently from 99d742e to 0fa8b94 Compare July 30, 2024 19:08
@renovate renovate bot force-pushed the renovate/all branch 8 times, most recently from 34598fd to f2d1fb4 Compare August 6, 2024 19:10
@renovate renovate bot force-pushed the renovate/all branch 3 times, most recently from d48d098 to 1d70a69 Compare August 7, 2024 22:19
@renovate renovate bot force-pushed the renovate/all branch 10 times, most recently from b0879cd to e9d6737 Compare December 9, 2024 14:58
@renovate renovate bot force-pushed the renovate/all branch 16 times, most recently from 67945eb to ce7bf55 Compare December 16, 2024 14:52
@drich10 drich10 merged commit b661e76 into master Dec 16, 2024
11 checks passed
@drich10 drich10 deleted the renovate/all branch December 16, 2024 20:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies misc release/undocumented This didn't warrant being documented or put in release notes.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@drich10