fix(deps): update all non-major dependencies #61
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![red-hat-konflux[bot]](https://avatars.githubusercontent.com/in/296509?s=60&v=4){kind=small}
ℹ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
red-hat-konflux
bot
force-pushed
the
konflux/mintmaker/main/all-minor-patch
branch
from
a30477b to
f634bb7
Compare
red-hat-konflux
bot
force-pushed
the
konflux/mintmaker/main/all-minor-patch
branch
4 times, most recently
from
bf1563a to
6e9c106
Compare
red-hat-konflux
bot
force-pushed
the
konflux/mintmaker/main/all-minor-patch
branch
3 times, most recently
from
4f24e75 to
b8e9edf
Compare
red-hat-konflux
bot
force-pushed
the
konflux/mintmaker/main/all-minor-patch
branch
4 times, most recently
from
923b65e to
cca1793
Compare
red-hat-konflux
bot
force-pushed
the
konflux/mintmaker/main/all-minor-patch
branch
4 times, most recently
from
a9ea0f9 to
e3b86f3
Compare
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
red-hat-konflux
bot
force-pushed
the
konflux/mintmaker/main/all-minor-patch
branch
from
e3b86f3 to
667d5a8
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.1.0-beta.0-proton->v1.1.6v1.3.7->v1.6.0v0.3.4->v0.4.1v5.6.0->v5.6.2v5.12.0->v5.14.0v4.0.4->v4.1.0v0.1.8->v0.2.0v0.21.0->v0.22.0v0.23.0->v0.24.0v0.3.0->v0.3.2v1.3.0->v1.3.1v1.9.0->v1.10.0v1.15.0->v1.16.21.21.13->1.24.2v0.32.0->v0.37.0v0.34.0->v0.39.0v0.29.0->v0.32.0v0.21.0->v0.24.0v0.7.0->v0.11.09.5-1739751568->9.5-17441014669.5-1739420147->9.5-17429142121.21.13-2.1729776560->1.22.9-1743582279Release Notes
ProtonMail/go-crypto (github.com/ProtonMail/go-crypto)
v1.1.6Compare Source
What's Changed
PublicKey.KeyIdStringto return a valid key id by @lubux in https://github.com/ProtonMail/go-crypto/pull/269Full Changelog: ProtonMail/go-crypto@v1.1.5...v1.1.6
v1.1.5Compare Source
What's Changed
Full Changelog: ProtonMail/go-crypto@v1.1.4...v1.1.5
v1.1.4Compare Source
What's Changed
Full Changelog: ProtonMail/go-crypto@v1.1.3...v1.1.4
v1.1.3Compare Source
What's Changed
Full Changelog: ProtonMail/go-crypto@v1.1.2...v1.1.3
v1.1.2Compare Source
What's Changed
Full Changelog: ProtonMail/go-crypto@v1.1.1...v1.1.2
v1.1.1Compare Source
What's Changed
clearsign.Encodebackwards compatibility #239 by @mdosch in https://github.com/ProtonMail/go-crypto/pull/240Full Changelog: ProtonMail/go-crypto@v1.1.0...v1.1.1
v1.1.0Compare Source
What's Changed
This release adds full support for the new version of the OpenPGP standard, RFC 9580. In addition, the release introduces an improved non-backwards compatible v2 API. The API in the
openpgppackage remains fully backwards compatible while the new v2 API is located in a separatev2package inopenpgp.For the full changes since
v1.0.0, see the previous release notes. For the full changelog, see ProtonMail/go-crypto@v1.0.0...v1.1.0.Changes since
v1.1.0-beta.0:Changelog since
v1.1.0-beta.0: ProtonMail/go-crypto@v1.1.0-beta.0...v1.1.0.v1.1.0-protonCompare Source
What's Changed
This release is v1.1.0 with support for symmetric keys and automatic forwarding, both of which are not standardized yet.
cloudflare/circl (github.com/cloudflare/circl)
v1.6.0: CIRCL v1.6.0Compare Source
CIRCL v1.6.0
New!
What's Changed
New Contributors
Full Changelog: cloudflare/circl@v1.5.0...v1.6.0
v1.5.0: CIRCL v1.5.0Compare Source
CIRCL v1.5.0
New: ML-DSA, Module-Lattice-based Digital Signature Algorithm.
What's Changed
New Contributors
Full Changelog: cloudflare/circl@v1.4.0...v1.5.0
v1.4.0: CIRCL v1.4.0Compare Source
CIRCL v1.4.0
Changes
New: ML-KEM compatible with FIPS-203.
Commit History
Full Changelog: cloudflare/circl@v1.3.9...v1.4.0
v1.3.9: CIRCL v1.3.9Compare Source
CIRCL v1.3.9
Changes:
Commit History
Full Changelog: cloudflare/circl@v1.3.8...v1.3.9
v1.3.8: CIRCL v1.3.8Compare Source
CIRCL v1.3.8
New
Notice
What's Changed
puregobuild tag, removingnoasmbuild tag by @mattyclarkson in https://github.com/cloudflare/circl/pull/492New Contributors
Full Changelog: cloudflare/circl@v1.3.7...v1.3.8
cyphar/filepath-securejoin (github.com/cyphar/filepath-securejoin)
v0.4.1Compare Source
This release fixes a regression introduced in one of the hardening
features added to filepath-securejoin 0.4.0.
rootpaths passed toSecureJoinin 0.4.0 wasfound to be too strict and caused some regressions when folks tried to
update, so this restriction has been relaxed to only return an error if the
path contains a
..component. We still recommend users usefilepath.Clean(and even
filepath.EvalSymlinks) on therootpath they are using, but atleast you will no longer be punished for "trivial" unclean paths. (#46)
Signed-off-by: Aleksa Sarai [email protected]
v0.4.0Compare Source
This release primarily includes a few minor breaking changes to make the
MkdirAll and SecureJoin interfaces more robust against accidental
misuse.
SecureJoin(VFS)will now return an error if the providedrootis not afilepath.Clean'd path.While it is ultimately the responsibility of the caller to ensure the root is
a safe path to use, passing a path like
/symlink/..as a root would resultin the
SecureJoin'd path being placed in/even though/symlink/..might be a different directory, and so we should more strongly discourage
such usage.
All major users of
securejoin.SecureJoinalready ensure that the paths theyprovide are safe (and this is ultimately a question of user error), but
removing this foot-gun is probably a good idea. Of course, this is
necessarily a breaking API change (though we expect no real users to be
affected by it).
Thanks to Erik Sjölund, who initially
reported this issue as a possible security issue.
MkdirAllandMkdirHandlenow take anos.FileMode-style mode argumentinstead of a raw
unix.S_*-style mode argument, which may cause compile-timetype errors depending on how you use
filepath-securejoin. For most users,there will be no change in behaviour aside from the type change (as the
bottom
0o777bits are the same in both formats, and most users are probablyonly using those bits).
However, if you were using
unix.S_ISVTXto set the sticky bit withMkdirAll(Handle)you will need to switch toos.ModeStickyotherwise youwill get a runtime error with this update. In addition, the error message you
will get from passing
unix.S_ISUIDandunix.S_ISGIDwill be different asthey are treated as invalid bits now (note that previously passing said bits
was also an error).
Thanks to the following contributors for helping make this release
possible:
Signed-off-by: Aleksa Sarai [email protected]
v0.3.6Compare Source
This release lowers the minimum Go version to Go 1.18 as well as some
library dependencies, in order to make it easier for folks that need to
backport patches using the new filepath-securejoin API onto branches
that are stuck using old Go compilers. For users using Go >= 1.21, this
release contains no functional changes.
The minimum Go version requirement for
filepath-securejoinis now Go 1.18(we use generics internally).
For reference,
[email protected]somewhat-arbitrarily bumped theGo version requirement to 1.21.
While we did make some use of Go 1.21 stdlib features (and in principle Go
versions <= 1.21 are no longer even supported by upstream anymore), some
downstreams have complained that the version bump has meant that they have to
do workarounds when backporting fixes that use the new
filepath-securejoinAPI onto old branches. This is not an ideal situation, but since using this
library is probably better for most downstreams than a hand-rolled
workaround, we now have compatibility shims that allow us to build on older
Go versions.
Lower minimum version requirement for
golang.org/x/systov0.18.0(weneed the wrappers for
fsconfig(2)), which should also make backportingpatches to older branches easier.
Signed-off-by: Aleksa Sarai [email protected]
v0.3.5Compare Source
This release primarily includes a fix for an issue involving two
programs racing to MkdirAll the same directory, which caused a
regression with BuildKit.
MkdirAllwill now no longer return anEEXISTerror if two racingprocesses are creating the same directory. We will still verify that the path
is a directory, but this will avoid spurious errors when multiple threads or
programs are trying to
MkdirAllthe same path. opencontainers/runc#4543Signed-off-by: Aleksa Sarai [email protected]
go-git/go-billy (github.com/go-git/go-billy/v5)
v5.6.2Compare Source
What's Changed
iofsadapter to also return other interfaces fromio/fsby @JAORMX in https://github.com/go-git/go-billy/pull/102New Contributors
Full Changelog: go-git/go-billy@v5.6.1...v5.6.2
v5.6.1Compare Source
What's Changed
Full Changelog: go-git/go-billy@v5.6.0...v5.6.1
go-git/go-git (github.com/go-git/go-git/v5)
v5.14.0Compare Source
What's Changed
golang.org/x/[email protected]which mitigates the CVE above. User's that can't bump to Go 1.23 will need to remain on the previous v5.13.x release.Full Changelog: go-git/go-git@v5.13.2...v5.14.0
v5.13.2Compare Source
What's Changed
Full Changelog: go-git/go-git@v5.13.1...v5.13.2
v5.13.1Compare Source
What's Changed
Full Changelog: go-git/go-git@v5.13.0...v5.13.1
v5.13.0Compare Source
What's Changed
git clean -xflag. by @msuozzo in https://github.com/go-git/go-git/pull/995git clean -xflag." by @pjbgf in https://github.com/go-git/go-git/pull/1129Untrackedwhile it is committed by @rodrigocam in https://github.com/go-git/go-git/pull/1023New Contributors
Full Changelog: go-git/go-git@v5.12.0...v5.13.0
go-jose/go-jose (github.com/go-jose/go-jose/v4)
v4.1.0Compare Source
What's Changed
signatureAlgorithmsargument by @tgeoghegan in https://github.com/go-jose/go-jose/pull/163New Contributors
Full Changelog: go-jose/go-jose@v4.0.5...v4.1.0
v4.0.5Compare Source
What's Changed
Fixes GHSA-c6gw-w398-hv78
Various other dependency updates, small fixes, and documentation updates in the full changelog
New Contributors
Full Changelog: go-jose/go-jose@v4.0.4...v4.0.5
hashicorp/terraform-exec (github.com/hashicorp/terraform-exec)
v0.22.0[Compare Source](https://redirect.github.com/hashicorp/terraform-exec/compare/v0
Configuration
📅 Schedule: Branch creation - "after 5am on sunday" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
To execute skipped test pipelines write comment
/ok-to-test.This PR has been generated by MintMaker (powered by Renovate Bot).