Bump the go_modules group across 4 directories with 4 updates by dependabot[bot] · Pull Request #22 · klarrio-oss/koperator

dependabot · 2025-01-16T09:49:42Z

Bumps the go_modules group with 1 update in the / directory: github.com/cert-manager/cert-manager.
Bumps the go_modules group with 1 update in the /api directory: github.com/cert-manager/cert-manager.
Bumps the go_modules group with 1 update in the /properties directory: golang.org/x/net.
Bumps the go_modules group with 1 update in the /tests/e2e directory: github.com/cert-manager/cert-manager.

Updates github.com/cert-manager/cert-manager from 1.12.2 to 1.12.14

Release notes

Sourced from github.com/cert-manager/cert-manager's releases.

v1.12.14

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

This patch release of cert-manager 1.12 makes several changes to how PEM input is validated, adding maximum sizes appropriate to the type of PEM data which is being parsed.

This is to prevent an unacceptable slow-down in parsing specially crafted PEM data. The issue was found by Google's OSS-Fuzz project.

The issue is low severity; to exploit the PEM issue would require privileged access which would likely allow Denial-of-Service through other methods.

Note also that since most PEM data parsed by cert-manager comes from ConfigMap or Secret resources which have a max size limit of approximately 1MB, it's difficult to force cert-manager to parse large amounts of PEM data.

Further information is available in GHSA-r4pg-vg54-wxx4

This patch release also fix an issue reported by Trivy, although that issue is low severity and is not expected to be relevant to cert-manager.

Bug Fixes

Set a maximum size for PEM inputs which cert-manager will accept to remove possibility of taking a long time to process an input (#7403, @SgtCoDFish)

Fix CVE-2024-5174 in github.com/golang-jwt/jwt/v4 (#7407, @SgtCoDFish)

v1.12.13

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

📖 Read the release documentation to learn more more about the features introduced in 1.12.

📜 Changes since v1.12.12

This patch release fixes the following vulnerabilities: CVE-2024-6104, CVE-2024-24791, CVE-2024-25620, CVE-2024-26147, and CVE-2024-41110.

ℹ️ This version contains an unusually large number of Go dependency changes for a patch release. The cert-manager maintainers are confident that it is stable because it has passed the same extensive suite of tests as previous 1.12 releases. But if you are importing cert-manager 1.12 as a Go module you will notice that the minimum Go version is 1.21, and the k8s.io modules are now updated to 0.29.

This reason for the large number of Go dependency changes is that the Helm SDK has been updated to fix security vulnerabilities in cmctl. This required the k8s.io modules to be updated from 0.27 to 0.29 in all components. Those newer minor versions of the Kubernetes modules pulled in new transitive dependencies, and incremented the minimum Go version from 1.20 to 1.21.

Bugfixes

Bump the go-retryablehttp dependency to fix CVE-2024-6104 (#7128, @SgtCoDFish)

Updated Helm dependency to resolve CVE-2024-25620 and CVE-2024-26147 and Docker dependency to resolve CVE-2024-41110 (#7214, @ThatsMrTalbot)

Updates Go to 1.21.13 to resolve CVE-2024-24791 (#7216, @ThatsMrTalbot)

... (truncated)

Commits

70a0309 Merge pull request #7403 from SgtCoDFish/release-1.12-pem-inputs
9f006c1 Merge pull request #7407 from SgtCoDFish/release-1.12-jwtfix
ec1d2b4 fix CVE-2024-5174 in jwt dependency
a197d8f [release-1.12] security: remove calls to pem.Decode in non-test code
52cb2e7 security: Add functions to limit max PEM sizes allowable
961e195 Merge pull request #7372 from SgtCoDFish/release-1.12-ipv6-dns
104b743 [release-1.12] add ipv6 example for DNS arg
231a4bd Merge pull request #7224 from wallrj/update-cmd/ctl/v1.12.13
32acef6 Update cmd/ctl's go.mod to v1.12.13
a4704b2 Merge pull request #7223 from cert-manager-bot/cherry-pick-7199-to-release-1.12
Additional commits viewable in compare view

Updates google.golang.org/protobuf from 1.30.0 to 1.33.0

Updates golang.org/x/crypto from 0.7.0 to 0.24.0

Commits

332fd65 go.mod: update golang.org/x dependencies
0b431c7 x509roots/fallback: update bundle
349231f ssh: implement CryptoPublicKey on sk keys
44c9b0f ssh: allow server auth callbacks to send additional banners
67b1361 sha3: reenable s390x assembly
477a5b4 sha3: make APIs usable with zero allocations
59b5a86 sha3: disable s390x assembly
10f366e sha3: simplify XOR functions
905d78a go.mod: update golang.org/x dependencies
ebb717d ssh: validate key type in SSH_MSG_USERAUTH_PK_OK response
Additional commits viewable in compare view

Updates golang.org/x/net from 0.10.0 to 0.26.0

Commits

dfc720d go.mod: update golang.org/x dependencies
8e66b04 html: use strings.EqualFold instead of lowering ourselves
b935f7b html: avoid endless loop on error token
9af49ef route: remove unused sizeof* consts
6705db9 quic: clean up crypto streams when dropping packet protection keys
4ef7588 quic: handle ACK frame in packet which drops number space
552d8ac Revert "route: change from syscall to x/sys/unix"
13a7c01 Revert "route: remove unused sizeof* consts on freebsd"
285e1cf go.mod: update golang.org/x dependencies
d0a1049 route: remove unused sizeof* consts on freebsd
Additional commits viewable in compare view

Updates github.com/cert-manager/cert-manager from 1.12.2 to 1.12.14

Release notes

Sourced from github.com/cert-manager/cert-manager's releases.

v1.12.14

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

This patch release of cert-manager 1.12 makes several changes to how PEM input is validated, adding maximum sizes appropriate to the type of PEM data which is being parsed.

This is to prevent an unacceptable slow-down in parsing specially crafted PEM data. The issue was found by Google's OSS-Fuzz project.

The issue is low severity; to exploit the PEM issue would require privileged access which would likely allow Denial-of-Service through other methods.

Note also that since most PEM data parsed by cert-manager comes from ConfigMap or Secret resources which have a max size limit of approximately 1MB, it's difficult to force cert-manager to parse large amounts of PEM data.

Further information is available in GHSA-r4pg-vg54-wxx4

This patch release also fix an issue reported by Trivy, although that issue is low severity and is not expected to be relevant to cert-manager.

Bug Fixes

Set a maximum size for PEM inputs which cert-manager will accept to remove possibility of taking a long time to process an input (#7403, @SgtCoDFish)

Fix CVE-2024-5174 in github.com/golang-jwt/jwt/v4 (#7407, @SgtCoDFish)

v1.12.13

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

📖 Read the release documentation to learn more more about the features introduced in 1.12.

📜 Changes since v1.12.12

This patch release fixes the following vulnerabilities: CVE-2024-6104, CVE-2024-24791, CVE-2024-25620, CVE-2024-26147, and CVE-2024-41110.

ℹ️ This version contains an unusually large number of Go dependency changes for a patch release. The cert-manager maintainers are confident that it is stable because it has passed the same extensive suite of tests as previous 1.12 releases. But if you are importing cert-manager 1.12 as a Go module you will notice that the minimum Go version is 1.21, and the k8s.io modules are now updated to 0.29.

This reason for the large number of Go dependency changes is that the Helm SDK has been updated to fix security vulnerabilities in cmctl. This required the k8s.io modules to be updated from 0.27 to 0.29 in all components. Those newer minor versions of the Kubernetes modules pulled in new transitive dependencies, and incremented the minimum Go version from 1.20 to 1.21.

Bugfixes

Bump the go-retryablehttp dependency to fix CVE-2024-6104 (#7128, @SgtCoDFish)

Updated Helm dependency to resolve CVE-2024-25620 and CVE-2024-26147 and Docker dependency to resolve CVE-2024-41110 (#7214, @ThatsMrTalbot)

Updates Go to 1.21.13 to resolve CVE-2024-24791 (#7216, @ThatsMrTalbot)

... (truncated)

Commits

70a0309 Merge pull request #7403 from SgtCoDFish/release-1.12-pem-inputs
9f006c1 Merge pull request #7407 from SgtCoDFish/release-1.12-jwtfix
ec1d2b4 fix CVE-2024-5174 in jwt dependency
a197d8f [release-1.12] security: remove calls to pem.Decode in non-test code
52cb2e7 security: Add functions to limit max PEM sizes allowable
961e195 Merge pull request #7372 from SgtCoDFish/release-1.12-ipv6-dns
104b743 [release-1.12] add ipv6 example for DNS arg
231a4bd Merge pull request #7224 from wallrj/update-cmd/ctl/v1.12.13
32acef6 Update cmd/ctl's go.mod to v1.12.13
a4704b2 Merge pull request #7223 from cert-manager-bot/cherry-pick-7199-to-release-1.12
Additional commits viewable in compare view

Updates golang.org/x/net from 0.10.0 to 0.26.0

Commits

dfc720d go.mod: update golang.org/x dependencies
8e66b04 html: use strings.EqualFold instead of lowering ourselves
b935f7b html: avoid endless loop on error token
9af49ef route: remove unused sizeof* consts
6705db9 quic: clean up crypto streams when dropping packet protection keys
4ef7588 quic: handle ACK frame in packet which drops number space
552d8ac Revert "route: change from syscall to x/sys/unix"
13a7c01 Revert "route: remove unused sizeof* consts on freebsd"
285e1cf go.mod: update golang.org/x dependencies
d0a1049 route: remove unused sizeof* consts on freebsd
Additional commits viewable in compare view

Updates golang.org/x/net from 0.10.0 to 0.33.0

Commits

dfc720d go.mod: update golang.org/x dependencies
8e66b04 html: use strings.EqualFold instead of lowering ourselves
b935f7b html: avoid endless loop on error token
9af49ef route: remove unused sizeof* consts
6705db9 quic: clean up crypto streams when dropping packet protection keys
4ef7588 quic: handle ACK frame in packet which drops number space
552d8ac Revert "route: change from syscall to x/sys/unix"
13a7c01 Revert "route: remove unused sizeof* consts on freebsd"
285e1cf go.mod: update golang.org/x dependencies
d0a1049 route: remove unused sizeof* consts on freebsd
Additional commits viewable in compare view

Updates github.com/cert-manager/cert-manager from 1.12.2 to 1.12.14

Release notes

Sourced from github.com/cert-manager/cert-manager's releases.

v1.12.14

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

This patch release of cert-manager 1.12 makes several changes to how PEM input is validated, adding maximum sizes appropriate to the type of PEM data which is being parsed.

This is to prevent an unacceptable slow-down in parsing specially crafted PEM data. The issue was found by Google's OSS-Fuzz project.

The issue is low severity; to exploit the PEM issue would require privileged access which would likely allow Denial-of-Service through other methods.

Note also that since most PEM data parsed by cert-manager comes from ConfigMap or Secret resources which have a max size limit of approximately 1MB, it's difficult to force cert-manager to parse large amounts of PEM data.

Further information is available in GHSA-r4pg-vg54-wxx4

This patch release also fix an issue reported by Trivy, although that issue is low severity and is not expected to be relevant to cert-manager.

Bug Fixes

Set a maximum size for PEM inputs which cert-manager will accept to remove possibility of taking a long time to process an input (#7403, @SgtCoDFish)

Fix CVE-2024-5174 in github.com/golang-jwt/jwt/v4 (#7407, @SgtCoDFish)

v1.12.13

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

📖 Read the release documentation to learn more more about the features introduced in 1.12.

📜 Changes since v1.12.12

This patch release fixes the following vulnerabilities: CVE-2024-6104, CVE-2024-24791, CVE-2024-25620, CVE-2024-26147, and CVE-2024-41110.

ℹ️ This version contains an unusually large number of Go dependency changes for a patch release. The cert-manager maintainers are confident that it is stable because it has passed the same extensive suite of tests as previous 1.12 releases. But if you are importing cert-manager 1.12 as a Go module you will notice that the minimum Go version is 1.21, and the k8s.io modules are now updated to 0.29.

This reason for the large number of Go dependency changes is that the Helm SDK has been updated to fix security vulnerabilities in cmctl. This required the k8s.io modules to be updated from 0.27 to 0.29 in all components. Those newer minor versions of the Kubernetes modules pulled in new transitive dependencies, and incremented the minimum Go version from 1.20 to 1.21.

Bugfixes

Bump the go-retryablehttp dependency to fix CVE-2024-6104 (#7128, @SgtCoDFish)

Updated Helm dependency to resolve CVE-2024-25620 and CVE-2024-26147 and Docker dependency to resolve CVE-2024-41110 (#7214, @ThatsMrTalbot)

Updates Go to 1.21.13 to resolve CVE-2024-24791 (#7216, @ThatsMrTalbot)

... (truncated)

Commits

70a0309 Merge pull request #7403 from SgtCoDFish/release-1.12-pem-inputs
9f006c1 Merge pull request #7407 from SgtCoDFish/release-1.12-jwtfix
ec1d2b4 fix CVE-2024-5174 in jwt dependency
a197d8f [release-1.12] security: remove calls to pem.Decode in non-test code
52cb2e7 security: Add functions to limit max PEM sizes allowable
961e195 Merge pull request #7372 from SgtCoDFish/release-1.12-ipv6-dns
104b743 [release-1.12] add ipv6 example for DNS arg
231a4bd Merge pull request #7224 from wallrj/update-cmd/ctl/v1.12.13
32acef6 Update cmd/ctl's go.mod to v1.12.13
a4704b2 Merge pull request #7223 from cert-manager-bot/cherry-pick-7199-to-release-1.12
Additional commits viewable in compare view

Updates google.golang.org/protobuf from 1.30.0 to 1.33.0

Updates golang.org/x/crypto from 0.7.0 to 0.24.0

Commits

332fd65 go.mod: update golang.org/x dependencies
0b431c7 x509roots/fallback: update bundle
349231f ssh: implement CryptoPublicKey on sk keys
44c9b0f ssh: allow server auth callbacks to send additional banners
67b1361 sha3: reenable s390x assembly
477a5b4 sha3: make APIs usable with zero allocations
59b5a86 sha3: disable s390x assembly
10f366e sha3: simplify XOR functions
905d78a go.mod: update golang.org/x dependencies
ebb717d ssh: validate key type in SSH_MSG_USERAUTH_PK_OK response
Additional commits viewable in compare view

Updates golang.org/x/net from 0.10.0 to 0.26.0

Commits

dfc720d go.mod: update golang.org/x dependencies
8e66b04 html: use strings.EqualFold instead of lowering ourselves
b935f7b html: avoid endless loop on error token
9af49ef route: remove unused sizeof* consts
6705db9 quic: clean up crypto streams when dropping packet protection keys
4ef7588 quic: handle ACK frame in packet which drops number space
552d8ac Revert "route: change from syscall to x/sys/unix"
13a7c01 Revert "route: remove unused sizeof* consts on freebsd"
285e1cf go.mod: update golang.org/x dependencies
d0a1049 route: remove unused sizeof* consts on freebsd
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the go_modules group with 1 update in the / directory: [github.com/cert-manager/cert-manager](https://github.com/cert-manager/cert-manager). Bumps the go_modules group with 1 update in the /api directory: [github.com/cert-manager/cert-manager](https://github.com/cert-manager/cert-manager). Bumps the go_modules group with 1 update in the /properties directory: [golang.org/x/net](https://github.com/golang/net). Bumps the go_modules group with 1 update in the /tests/e2e directory: [github.com/cert-manager/cert-manager](https://github.com/cert-manager/cert-manager). Updates `github.com/cert-manager/cert-manager` from 1.12.2 to 1.12.14 - [Release notes](https://github.com/cert-manager/cert-manager/releases) - [Changelog](https://github.com/cert-manager/cert-manager/blob/master/RELEASE.md) - [Commits](cert-manager/cert-manager@v1.12.2...v1.12.14) Updates `google.golang.org/protobuf` from 1.30.0 to 1.33.0 Updates `golang.org/x/crypto` from 0.7.0 to 0.24.0 - [Commits](golang/crypto@v0.7.0...v0.24.0) Updates `golang.org/x/net` from 0.10.0 to 0.26.0 - [Commits](golang/net@v0.10.0...v0.33.0) Updates `github.com/cert-manager/cert-manager` from 1.12.2 to 1.12.14 - [Release notes](https://github.com/cert-manager/cert-manager/releases) - [Changelog](https://github.com/cert-manager/cert-manager/blob/master/RELEASE.md) - [Commits](cert-manager/cert-manager@v1.12.2...v1.12.14) Updates `golang.org/x/net` from 0.10.0 to 0.26.0 - [Commits](golang/net@v0.10.0...v0.33.0) Updates `golang.org/x/net` from 0.10.0 to 0.33.0 - [Commits](golang/net@v0.10.0...v0.33.0) Updates `github.com/cert-manager/cert-manager` from 1.12.2 to 1.12.14 - [Release notes](https://github.com/cert-manager/cert-manager/releases) - [Changelog](https://github.com/cert-manager/cert-manager/blob/master/RELEASE.md) - [Commits](cert-manager/cert-manager@v1.12.2...v1.12.14) Updates `google.golang.org/protobuf` from 1.30.0 to 1.33.0 Updates `golang.org/x/crypto` from 0.7.0 to 0.24.0 - [Commits](golang/crypto@v0.7.0...v0.24.0) Updates `golang.org/x/net` from 0.10.0 to 0.26.0 - [Commits](golang/net@v0.10.0...v0.33.0) --- updated-dependencies: - dependency-name: github.com/cert-manager/cert-manager dependency-type: direct:production dependency-group: go_modules - dependency-name: google.golang.org/protobuf dependency-type: direct:production dependency-group: go_modules - dependency-name: golang.org/x/crypto dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/net dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/cert-manager/cert-manager dependency-type: direct:production dependency-group: go_modules - dependency-name: golang.org/x/net dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/net dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/cert-manager/cert-manager dependency-type: indirect dependency-group: go_modules - dependency-name: google.golang.org/protobuf dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/crypto dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/net dependency-type: indirect dependency-group: go_modules ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added the dependencies Pull requests that update a dependency file label Jan 16, 2025

go mod tidy

2b5ae0b

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the go_modules group across 4 directories with 4 updates#22

Bump the go_modules group across 4 directories with 4 updates#22
dependabot[bot] wants to merge 2 commits intomasterfrom
dependabot/go_modules/go_modules-1b2ac38e2c

dependabot bot commented on behalf of github Jan 16, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot bot commented on behalf of github Jan 16, 2025

v1.12.14

Bug Fixes

v1.12.13

📜 Changes since v1.12.12

Bugfixes

v1.12.14

Bug Fixes

v1.12.13

📜 Changes since v1.12.12

Bugfixes

v1.12.14

Bug Fixes

v1.12.13

📜 Changes since v1.12.12

Bugfixes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant