Skip to content

Bump the go_modules group across 1 directory with 15 updates#12

Open
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/go_modules/go_modules-8a9b280986
Open

Bump the go_modules group across 1 directory with 15 updates#12
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/go_modules/go_modules-8a9b280986

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Nov 12, 2024

Bumps the go_modules group with 12 updates in the / directory:

Package From To
github.com/blevesearch/bleve/v2 2.3.5 2.3.7
github.com/golang-jwt/jwt/v4 4.5.0 4.5.1
github.com/nats-io/nats-server/v2 2.9.4 2.9.23
golang.org/x/image 0.5.0 0.18.0
google.golang.org/grpc 1.51.0 1.56.3
github.com/cloudflare/circl 1.2.0 1.3.7
github.com/crewjam/saml 0.4.9 0.4.14
github.com/go-git/go-git/v5 5.4.2 5.11.0
github.com/gookit/goutil 0.5.15 0.6.0
github.com/gorilla/schema 1.2.0 1.4.1
github.com/prometheus/alertmanager 0.24.0 0.25.1
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc 0.36.4 0.46.0

Updates github.com/blevesearch/bleve/v2 from 2.3.5 to 2.3.7

Release notes

Sourced from github.com/blevesearch/bleve/v2's releases.

v2.3.7

Bug Fixes
Enhancements
  • Support for improved rollback behavior by allowing sampling of snapshots based on a time interval with blevesearch/bleve#1776 . Default behavior remains the same
  • Changed the signature of scorch's AsyncErrorCallback with blevesearch/bleve#1800 to provide more context. This is a breaking change.
Milestone

v2.3.6

Bug Fixes
Enhancements
Milestone
Commits

Updates github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1

Release notes

Sourced from github.com/golang-jwt/jwt/v4's releases.

v4.5.1

Security

Unclear documentation of the error behavior in ParseWithClaims in <= 4.5.0 could lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by ParseWithClaims return both error codes. If users only check for the jwt.ErrTokenExpired using error.Is, they will ignore the embedded jwt.ErrTokenSignatureInvalid and thus potentially accept invalid tokens.

This issue was documented in GHSA-29wx-vh33-7x7r and fixed in this release.

Note: v5 was not affected by this issue. So upgrading to this release version is also recommended.

What's Changed

  • Back-ported error-handling logic in ParseWithClaims from v5 branch. This fixes GHSA-29wx-vh33-7x7r.

Full Changelog: golang-jwt/jwt@v4.5.0...v4.5.1

Commits

Updates github.com/nats-io/nats-server/v2 from 2.9.4 to 2.9.23

Release notes

Sourced from github.com/nats-io/nats-server/v2's releases.

Release v2.9.23

Changelog

Go Version

  • 1.20.10

Fixed

Accounts

  • Prevent bypassing authorization block when enabling system account access in accounts block (#4605). Backport from v2.10.2

Leafnodes

  • Prevent a leafnode cluster from receiving a message multiple times in a queue subscription (#4578). Backport from v2.10.2

JetStream

  • Hold lock when calculating the first message for subject in a message block (#4531). Backport from v2.10.0
  • Add self-healing mechanism to detect and delete orphaned Raft groups (#4647). Backport from v2.10.0
  • Prevent forward proposals in consumers after scaling down a stream (#4647). Backport from v2.10.0
  • Fix race condition during leader failover scenarios resulting in potential duplicate messages being sourced (#4592). Backport from v2.10.2

Complete Changes

nats-io/nats-server@v2.9.22...v2.9.23

Release v2.9.22

Changelog

Go Version

  • 1.20.8 (updated out-of-cycle since Go 1.19 is now EOL)

Dependencies

  • github.com/nats-io/jwt/v2 v2.5.0
  • golang.org/x/crypto v0.12.0
  • golang.org/x/sys v0.11.0

Improved

Monitoring

  • CORS Allow-Origin passthrough for monitoring server (#4423) Thanks to @​mdawar for the contribution!

JetStream

  • Improve consumer scaling reliability with filters and cluster restart (#4404)
  • Send event on lame duck mode (LDM) to avoid placing assets on shutting down nodes (#4405)
  • Skip filestore tombstones if downgrade from 2.10 occurs (#4452)
  • Adjust delivered and waiting count when consumer message delivery fails (#4472)

Fixed

Config

  • Allow empty configs and fix JSON compatibility (#4394, #4418)
  • Remove TLS OCSP debug log on reload (#4453)

... (truncated)

Commits
  • 45436e1 Release v2.9.23 (#4652)
  • 72ffa38 Release v2.9.23
  • 05fe77f Backport #4592 to 2.9 (#4651)
  • 6a73e68 [2.9.x] Bump Travis Go version to 1.20.10 (#4650)
  • 8b981a2 Backports from v2.10 for v2.9.23 release (#4647)
  • 28eb7c0 Only setup auto no-auth for $G account iff no authorization block was defined.
  • 9f16edd Make sure to not forward a message across a route for dq sub when we are a sp...
  • 0ac7895 Add in utility to detect and delete any NRG orphans.
  • 50722e9 When scaling a consumer down make sure to pop the loopAndForwardProposals go ...
  • 770cf2e Backport JetStream benchmarks improvements to 2.9.x (#4644)
  • Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.3.0 to 0.12.0

Commits
  • b4ddeed go.mod: update golang.org/x dependencies
  • edc325d ssh: fix call to Fatalf from a non-test goroutine
  • eab9315 ssh: add diffie-hellman-group16-sha512 kex
  • ddfa821 ssh: ignore invalid MACs and KEXs just like we do for ciphers
  • d08e19b x509roots/fallback: update bundle
  • 12e1fcd internal/wycheproof: skip all tests in short test mode
  • 3f8f064 ssh: prefer sha256 based RSA key algorithms
  • 5df3b59 ssh: disable client agent tests on Windows
  • 2e82bdd fix TestValidTerminalMode: missing output from echo SHELL $SHELL
  • 64e0e99 ssh: fix RSA certificate and public key authentication with older clients
  • Additional commits viewable in compare view

Updates golang.org/x/image from 0.5.0 to 0.18.0

Commits
  • 3bbf4a6 tiff: Validate palette indices when parsing palette-color images
  • 6c5fa46 go.mod: update golang.org/x dependencies
  • 55c4ab6 go.mod: update golang.org/x dependencies
  • 0057a93 tiff: fix function name in comment
  • 9e190ae webp: disallow multiple VP8X chunks
  • 445ab0e go.mod: update golang.org/x dependencies
  • 240a51a font/sfnt: support early version 0 OS/2 tables
  • c20bbc3 draw: simplify some calls to fmt.Fprintf
  • 491771c draw: merge draw_go117.go into draw.go
  • 4aa0222 go.mod: update go directive to 1.18
  • Additional commits viewable in compare view

Updates golang.org/x/net from 0.7.0 to 0.25.0

Commits
  • d27919b go.mod: update golang.org/x dependencies
  • e0324fc http2: use net.ErrClosed
  • b20cd59 quic: initiate key rotation earlier in connections
  • f95a3b3 html: fix typo in package doc
  • 0a24555 http/httpguts: speed up ValidHeaderFieldName
  • ec05fdc http2: don't retry the first request on a connection on GOAWAY error
  • b67a0f0 http2: send correct LastStreamID in stream-caused GOAWAY
  • a130fcc quic: don't consider goroutines running when tests start as leaked
  • 7bbe320 go.mod: update golang.org/x dependencies
  • c48da13 http2: fix TestServerContinuationFlood flakes
  • Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.51.0 to 1.56.3

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.56.3

Security

  • server: prohibit more than MaxConcurrentStreams handlers from running at once (CVE-2023-44487)

    In addition to this change, applications should ensure they do not leave running tasks behind related to the RPC before returning from method handlers, or should enforce appropriate limits on any such work.

Release 1.56.2

  • status: To fix a panic, status.FromError now returns an error with codes.Unknown when the error implements the GRPCStatus() method, and calling GRPCStatus() returns nil. (#6374)

Release 1.56.1

  • client: handle empty address lists correctly in addrConn.updateAddrs

Release 1.56.0

New Features

  • client: support channel idleness using WithIdleTimeout dial option (#6263)
    • This feature is currently disabled by default, but will be enabled with a 30 minute default in the future.
  • client: when using pickfirst, keep channel state in TRANSIENT_FAILURE until it becomes READY (gRFC A62) (#6306)
  • xds: Add support for Custom LB Policies (gRFC A52) (#6224)
  • xds: support pick_first Custom LB policy (gRFC A62) (#6314) (#6317)
  • client: add support for pickfirst address shuffling (gRFC A62) (#6311)
  • xds: Add support for String Matcher Header Matcher in RDS (#6313)
  • xds/outlierdetection: Add Channelz Logger to Outlier Detection LB (#6145)
  • xds: enable RLS in xDS by default (#6343)
  • orca: add support for application_utilization field and missing range checks on several metrics setters
  • balancer/weightedroundrobin: add new LB policy for balancing between backends based on their load reports (gRFC A58) (#6241)
  • authz: add conversion of json to RBAC Audit Logging config (#6192)
  • authz: add support for stdout logger (#6230 and #6298)
  • authz: support customizable audit functionality for authorization policy (#6192 #6230 #6298 #6158 #6304 and #6225)

Bug Fixes

  • orca: fix a race at startup of out-of-band metric subscriptions that would cause the report interval to request 0 (#6245)
  • xds/xdsresource: Fix Outlier Detection Config Handling and correctly set xDS Defaults (#6361)
  • xds/outlierdetection: Fix Outlier Detection Config Handling by setting defaults in ParseConfig() (#6361)

API Changes

  • orca: allow a ServerMetricsProvider to be passed to the ORCA service and ServerOption (#6223)

Release 1.55.1

  • status: To fix a panic, status.FromError now returns an error with codes.Unknown when the error implements the GRPCStatus() method, and calling GRPCStatus() returns nil. (#6374)

Release 1.55.0

Behavior Changes

  • xds: enable federation support by default (#6151)
  • status: status.Code and status.FromError handle wrapped errors (#6031 and #6150)

... (truncated)

Commits
  • 1055b48 Update version.go to 1.56.3 (#6713)
  • 5efd7bd server: prohibit more than MaxConcurrentStreams handlers from running at once...
  • bd1f038 Upgrade version.go to 1.56.3-dev (#6434)
  • faab873 Update version.go to v1.56.2 (#6432)
  • 6b0b291 status: fix panic when servers return a wrapped error with status OK (#6374) ...
  • ed56401 [PSM interop] Don't fail target if sub-target already failed (#6390) (#6405)
  • cd6a794 Update version.go to v1.56.2-dev (#6387)
  • 5b67e5e Update version.go to v1.56.1 (#6386)
  • d0f5150 client: handle empty address lists correctly in addrConn.updateAddrs (#6354) ...
  • 997c1ea Change version to 1.56.1-dev (#6345)
  • Additional commits viewable in compare view

Updates google.golang.org/protobuf from 1.28.1 to 1.30.0

Updates github.com/cloudflare/circl from 1.2.0 to 1.3.7

Release notes

Sourced from github.com/cloudflare/circl's releases.

CIRCL v1.3.7

What's Changed

New Contributors

Full Changelog: cloudflare/circl@v1.3.6...v1.3.7

CIRCL v1.3.6

What's Changed

New Contributors

Full Changelog: cloudflare/circl@v1.3.3...v1.3.6

CIRCL v1.3.3

New Features

  • ASCON light-weight authenticated encryption.
  • Hybrid KEM for HPKE based on Kyber and X25519.
  • CIRCL can be compiled both as static and dynamic linking modes.

Security

  • Fixes error-handling on rand readers.

What's Changed

... (truncated)

Commits
  • c48866b Releasing CIRCL v1.3.7
  • 75ef91e kyber: remove division by q in ciphertext compression
  • 899732a build(deps): bump golang.org/x/crypto
  • 99f0f71 Releasing CIRCL v1.3.6
  • e728d0d Apply thibmeu code review suggestions
  • ceb2d90 Updating blindrsa to be compliant with RFC9474.
  • 44133f7 spelling: tripped
  • c2076d6 spelling: transposes
  • dad2166 spelling: title
  • 171c418 spelling: threshold
  • Additional commits viewable in compare view

Updates github.com/crewjam/saml from 0.4.9 to 0.4.14

Commits

Updates github.com/go-git/go-git/v5 from 5.4.2 to 5.11.0

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.11.0

What's Changed

New Contributors

Full Changelog: go-git/go-git@v5.10.1...v5.11.0

v5.10.1

What's Changed

New Contributors

Full Changelog: go-git/go-git@v5.10.0...v5.10.1

v5.10.0

What's Changed

... (truncated)

Commits
  • 5d08d3b Merge pull request #958 from pjbgf/workval
  • 5bd1d8f build: Ensure checkout is the first operation
  • b2c1982 git: worktree, Align validation with upstream rules
  • cec7da6 Merge pull request #953 from pjbgf/alternates
  • 8b47ceb storage: filesystem, Add option to set a specific FS for alternates
  • 4f61489 Merge pull request #941 from djmoch/filestats-rename
  • ae552ce Merge pull request #939 from dhoizner/fix-pull-after-shallow
  • cc1895b Merge pull request #950 from aymanbagabas/validate-ref
  • de1d5a5 git: validate reference names
  • d87110b Merge pull request #948 from go-git/dependabot/go_modules/cli/go-git/github.c...
  • Additional commits viewable in compare view

Updates github.com/gookit/goutil from 0.5.15 to 0.6.0

Release notes

Sourced from github.com/gookit/goutil's releases.

v0.6.0

Change Log

NOTE: since v0.6.0 require go 1.18

Refactor

Feature

Update

Other

... (truncated)

Commits

Updates github.com/gorilla/schema from 1.2.0 to 1.4.1

Release notes

Sourced from github.com/gorilla/schema's releases.

v1.4.1

Security Release

Fixes an issue where sparse slice deserialization can cause memory exhaustion CVE-2024-37298

Thanks to @​AlexVasiluta for the report and following responsible disclosure.

Full Changelog: gorilla/schema@v1.4.0...v1.4.1

v1.4.0

What's Changed

New Contributors

Full Changelog: gorilla/schema@v1.3.0...v1.3.1

v1.3.0

What's Changed

New Contributors

Full Changelog: gorilla/schema@v1.2.1...v1.3.0

Release v1.2.1

What's Changed

@dependabot
Bump the go_modules group across 1 directory with 15 updates
0cef094 
Bumps the go_modules group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/blevesearch/bleve/v2](https://github.com/blevesearch/bleve) | `2.3.5` | `2.3.7` |
| [github.com/golang-jwt/jwt/v4](https://github.com/golang-jwt/jwt) | `4.5.0` | `4.5.1` |
| [github.com/nats-io/nats-server/v2](https://github.com/nats-io/nats-server) | `2.9.4` | `2.9.23` |
| [golang.org/x/image](https://github.com/golang/image) | `0.5.0` | `0.18.0` |
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.51.0` | `1.56.3` |
| [github.com/cloudflare/circl](https://github.com/cloudflare/circl) | `1.2.0` | `1.3.7` |
| [github.com/crewjam/saml](https://github.com/crewjam/saml) | `0.4.9` | `0.4.14` |
| [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `5.4.2` | `5.11.0` |
| [github.com/gookit/goutil](https://github.com/gookit/goutil) | `0.5.15` | `0.6.0` |
| [github.com/gorilla/schema](https://github.com/gorilla/schema) | `1.2.0` | `1.4.1` |
| [github.com/prometheus/alertmanager](https://github.com/prometheus/alertmanager) | `0.24.0` | `0.25.1` |
| [go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.36.4` | `0.46.0` |



Updates `github.com/blevesearch/bleve/v2` from 2.3.5 to 2.3.7
- [Release notes](https://github.com/blevesearch/bleve/releases)
- [Commits](blevesearch/bleve@v2.3.5...v2.3.7)

Updates `github.com/golang-jwt/jwt/v4` from 4.5.0 to 4.5.1
- [Release notes](https://github.com/golang-jwt/jwt/releases)
- [Changelog](https://github.com/golang-jwt/jwt/blob/main/VERSION_HISTORY.md)
- [Commits](golang-jwt/jwt@v4.5.0...v4.5.1)

Updates `github.com/nats-io/nats-server/v2` from 2.9.4 to 2.9.23
- [Release notes](https://github.com/nats-io/nats-server/releases)
- [Changelog](https://github.com/nats-io/nats-server/blob/main/.goreleaser.yml)
- [Commits](nats-io/nats-server@v2.9.4...v2.9.23)

Updates `golang.org/x/crypto` from 0.3.0 to 0.12.0
- [Commits](golang/crypto@v0.3.0...v0.12.0)

Updates `golang.org/x/image` from 0.5.0 to 0.18.0
- [Commits](golang/image@v0.5.0...v0.18.0)

Updates `golang.org/x/net` from 0.7.0 to 0.25.0
- [Commits](golang/net@v0.7.0...v0.25.0)

Updates `google.golang.org/grpc` from 1.51.0 to 1.56.3
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.51.0...v1.56.3)

Updates `google.golang.org/protobuf` from 1.28.1 to 1.30.0

Updates `github.com/cloudflare/circl` from 1.2.0 to 1.3.7
- [Release notes](https://github.com/cloudflare/circl/releases)
- [Commits](cloudflare/circl@v1.2.0...v1.3.7)

Updates `github.com/crewjam/saml` from 0.4.9 to 0.4.14
- [Commits](crewjam/saml@v0.4.9...v0.4.14)

Updates `github.com/go-git/go-git/v5` from 5.4.2 to 5.11.0
- [Release notes](https://github.com/go-git/go-git/releases)
- [Commits](go-git/go-git@v5.4.2...v5.11.0)

Updates `github.com/gookit/goutil` from 0.5.15 to 0.6.0
- [Release notes](https://github.com/gookit/goutil/releases)
- [Commits](gookit/goutil@v0.5.15...v0.6.0)

Updates `github.com/gorilla/schema` from 1.2.0 to 1.4.1
- [Release notes](https://github.com/gorilla/schema/releases)
- [Commits](gorilla/schema@v1.2.0...v1.4.1)

Updates `github.com/prometheus/alertmanager` from 0.24.0 to 0.25.1
- [Release notes](https://github.com/prometheus/alertmanager/releases)
- [Changelog](https://github.com/prometheus/alertmanager/blob/v0.25.1/CHANGELOG.md)
- [Commits](prometheus/alertmanager@v0.24.0...v0.25.1)

Updates `go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc` from 0.36.4 to 0.46.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go-contrib@zpages/v0.36.4...zpages/v0.46.0)

---
updated-dependencies:
- dependency-name: github.com/blevesearch/bleve/v2
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/golang-jwt/jwt/v4
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/nats-io/nats-server/v2
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: golang.org/x/image
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: golang.org/x/net
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: google.golang.org/protobuf
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/cloudflare/circl
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/crewjam/saml
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/go-git/go-git/v5
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/gookit/goutil
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/gorilla/schema
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/prometheus/alertmanager
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Nov 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants