Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): bump the go_modules group group with 8 updates #190

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 14, 2024

Bumps the go_modules group group with 8 updates:

Package From To
github.com/jackc/pgx/v5 5.4.3 5.5.4
github.com/labstack/echo/v4 4.6.3 4.9.0
github.com/cloudflare/circl 1.3.3 1.3.7
github.com/go-git/go-git/v5 5.6.1 5.11.0
golang.org/x/crypto 0.9.0 0.17.0
golang.org/x/net 0.10.0 0.19.0
google.golang.org/grpc 1.55.0 1.56.3
google.golang.org/protobuf 1.30.0 1.33.0

Updates github.com/jackc/pgx/v5 from 5.4.3 to 5.5.4

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.5.4 (March 4, 2024)

Fix CVE-2024-27304

SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control.

Thanks to Paul Gerste for reporting this issue.

  • Fix behavior of CollectRows to return empty slice if Rows are empty (Felix)
  • Fix simple protocol encoding of json.RawMessage
  • Fix *Pipeline.getResults should close pipeline on error
  • Fix panic in TryFindUnderlyingTypeScanPlan (David Kurman)
  • Fix deallocation of invalidated cached statements in a transaction
  • Handle invalid sslkey file
  • Fix scan float4 into sql.Scanner
  • Fix pgtype.Bits not making copy of data from read buffer. This would cause the data to be corrupted by future reads.

5.5.3 (February 3, 2024)

  • Fix: prepared statement already exists
  • Improve CopyFrom auto-conversion of text-ish values
  • Add ltree type support (Florent Viel)
  • Make some properties of Batch and QueuedQuery public (Pavlo Golub)
  • Add AppendRows function (Edoardo Spadolini)
  • Optimize convert UUID [16]byte to string (Kirill Malikov)
  • Fix: LargeObject Read and Write of more than ~1GB at a time (Mitar)

5.5.2 (January 13, 2024)

  • Allow NamedArgs to start with underscore
  • pgproto3: Maximum message body length support (jeremy.spriet)
  • Upgrade golang.org/x/crypto to v0.17.0
  • Add snake_case support to RowToStructByName (Tikhon Fedulov)
  • Fix: update description cache after exec prepare (James Hartig)
  • Fix: pipeline checks if it is closed (James Hartig and Ryan Fowler)
  • Fix: normalize timeout / context errors during TLS startup (Samuel Stauffer)
  • Add OnPgError for easier centralized error handling (James Hartig)

5.5.1 (December 9, 2023)

  • Add CopyFromFunc helper function. (robford)
  • Add PgConn.Deallocate method that uses PostgreSQL protocol Close message.
  • pgx uses new PgConn.Deallocate method. This allows deallocating statements to work in a failed transaction. This fixes a case where the prepared statement map could become invalid.
  • Fix: Prefer driver.Valuer over json.Marshaler for json fields. (Jacopo)
  • Fix: simple protocol SQL sanitizer previously panicked if an invalid $0 placeholder was used. This now returns an error instead. (maksymnevajdev)
  • Add pgtype.Numeric.ScanScientific (Eshton Robateau)

5.5.0 (November 4, 2023)

... (truncated)

Commits
  • da6f2c9 Update changelog
  • c543134 SQL sanitizer wraps arguments in parentheses
  • 20344df Check for overflow on uint16 sizes in pgproto3
  • adbb38f Do not allow protocol messages larger than ~1GB
  • c1b0a01 Fix behavior of CollectRows to return empty slice if Rows are empty
  • 88dfc22 Fix simple protocol encoding of json.RawMessage
  • 2e84dcc *Pipeline.getResults should close pipeline on error
  • d149d3f Fix panic in TryFindUnderlyingTypeScanPlan
  • 046f497 deallocateInvalidatedCachedStatements now runs in transactions
  • 8896bd6 Handle invalid sslkey file
  • Additional commits viewable in compare view

Updates github.com/labstack/echo/v4 from 4.6.3 to 4.9.0

Release notes

Sourced from github.com/labstack/echo/v4's releases.

v4.9.0

Security

  • Fix open redirect vulnerability in handlers serving static directories (e.Static, e.StaticFs, echo.StaticDirectoryHandler) #2260

Enhancements

  • Allow configuring ErrorHandler in CSRF middleware #2257
  • Replace HTTP method constants in tests with stdlib constants #2247

v4.8.0

Most notable things

You can now add any arbitrary HTTP method type as a route #2237

e.Add("COPY", "/*", func(c echo.Context) error 
  return c.String(http.StatusOK, "OK COPY")
})

You can add custom 404 handler for specific paths #2217

e.RouteNotFound("/*", func(c echo.Context) error { return c.NoContent(http.StatusNotFound) })
g := e.Group("/images")
g.RouteNotFound("/*", func(c echo.Context) error { return c.NoContent(http.StatusNotFound) })

Enhancements

  • Add new value binding methods (UnixTimeMilli,TextUnmarshaler,JSONUnmarshaler) to Valuebinder #2127
  • Refactor: body_limit middleware unit test #2145
  • Refactor: Timeout mw: rework how test waits for timeout. #2187
  • BasicAuth middleware returns 500 InternalServerError on invalid base64 strings but should return 400 #2191
  • Refactor: duplicated findStaticChild process at findChildWithLabel #2176
  • Allow different param names in different methods with same path scheme #2209
  • Add support for registering handlers for different 404 routes #2217
  • Middlewares should use errors.As() instead of type assertion on HTTPError #2227
  • Allow arbitrary HTTP method types to be added as routes #2237

v4.7.2

Fixes

  • Fix nil pointer exception when calling Start again after address binding error #2131
  • Fix CSRF middleware not being able to extract token from multipart/form-data form #2136
  • Fix Timeout middleware write race #2126

Enhancements

... (truncated)

Changelog

Sourced from github.com/labstack/echo/v4's changelog.

v4.9.0 - 2022-09-04

Security

  • Fix open redirect vulnerability in handlers serving static directories (e.Static, e.StaticFs, echo.StaticDirectoryHandler) #2260

Enhancements

  • Allow configuring ErrorHandler in CSRF middleware #2257
  • Replace HTTP method constants in tests with stdlib constants #2247

v4.8.0 - 2022-08-10

Most notable things

You can now add any arbitrary HTTP method type as a route #2237

e.Add("COPY", "/*", func(c echo.Context) error 
  return c.String(http.StatusOK, "OK COPY")
})

You can add custom 404 handler for specific paths #2217

e.RouteNotFound("/*", func(c echo.Context) error { return c.NoContent(http.StatusNotFound) })
g := e.Group("/images")
g.RouteNotFound("/*", func(c echo.Context) error { return c.NoContent(http.StatusNotFound) })

Enhancements

  • Add new value binding methods (UnixTimeMilli,TextUnmarshaler,JSONUnmarshaler) to Valuebinder #2127
  • Refactor: body_limit middleware unit test #2145
  • Refactor: Timeout mw: rework how test waits for timeout. #2187
  • BasicAuth middleware returns 500 InternalServerError on invalid base64 strings but should return 400 #2191
  • Refactor: duplicated findStaticChild process at findChildWithLabel #2176
  • Allow different param names in different methods with same path scheme #2209
  • Add support for registering handlers for different 404 routes #2217
  • Middlewares should use errors.As() instead of type assertion on HTTPError #2227
  • Allow arbitrary HTTP method types to be added as routes #2237

v4.7.2 - 2022-03-16

Fixes

  • Fix nil pointer exception when calling Start again after address binding error #2131
  • Fix CSRF middleware not being able to extract token from multipart/form-data form #2136
  • Fix Timeout middleware write race #2126

... (truncated)

Commits
  • 16d3b65 Changelog for 4.9.0
  • 0ac4d74 Fix #2259 open redirect vulnerability in echo.StaticDirectoryHandler (used by...
  • d77e8c0 Added ErrorHandler and ErrorHandlerWithContext in CSRF middleware (#2257)
  • 534bbb8 replace POST constance with stdlib constance
  • fb57d96 replace GET constance with stdlib constance
  • d48197d Changelog for 4.8.0
  • cba12a5 Allow arbitrary HTTP method types to be added as routes
  • a327884 add:README.md-Third-party middlewares-git.luolix.top/go-woo/protoc-gen-echo
  • 61422dd Update CI-flow (Go 1.19 +deps)
  • a9879ff Middlewares should use errors.As() instead of type assertion on HTTPError
  • Additional commits viewable in compare view

Updates github.com/cloudflare/circl from 1.3.3 to 1.3.7

Release notes

Sourced from github.com/cloudflare/circl's releases.

CIRCL v1.3.7

What's Changed

New Contributors

Full Changelog: cloudflare/circl@v1.3.6...v1.3.7

CIRCL v1.3.6

What's Changed

New Contributors

Full Changelog: cloudflare/circl@v1.3.3...v1.3.6

Commits
  • c48866b Releasing CIRCL v1.3.7
  • 75ef91e kyber: remove division by q in ciphertext compression
  • 899732a build(deps): bump golang.org/x/crypto
  • 99f0f71 Releasing CIRCL v1.3.6
  • e728d0d Apply thibmeu code review suggestions
  • ceb2d90 Updating blindrsa to be compliant with RFC9474.
  • 44133f7 spelling: tripped
  • c2076d6 spelling: transposes
  • dad2166 spelling: title
  • 171c418 spelling: threshold
  • Additional commits viewable in compare view

Updates github.com/go-git/go-git/v5 from 5.6.1 to 5.11.0

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.11.0

What's Changed

New Contributors

Full Changelog: go-git/go-git@v5.10.1...v5.11.0

v5.10.1

What's Changed

New Contributors

Full Changelog: go-git/go-git@v5.10.0...v5.10.1

v5.10.0

What's Changed

... (truncated)

Commits
  • 5d08d3b Merge pull request #958 from pjbgf/workval
  • 5bd1d8f build: Ensure checkout is the first operation
  • b2c1982 git: worktree, Align validation with upstream rules
  • cec7da6 Merge pull request #953 from pjbgf/alternates
  • 8b47ceb storage: filesystem, Add option to set a specific FS for alternates
  • 4f61489 Merge pull request #941 from djmoch/filestats-rename
  • ae552ce Merge pull request #939 from dhoizner/fix-pull-after-shallow
  • cc1895b Merge pull request #950 from aymanbagabas/validate-ref
  • de1d5a5 git: validate reference names
  • d87110b Merge pull request #948 from go-git/dependabot/go_modules/cli/go-git/github.c...
  • Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.9.0 to 0.17.0

Commits
  • 9d2ee97 ssh: implement strict KEX protocol changes
  • 4e5a261 ssh: close net.Conn on all NewServerConn errors
  • 152cdb1 x509roots/fallback: update bundle
  • fdfe1f8 ssh: defer channel window adjustment
  • b8ffc16 blake2b: drop Go 1.6, Go 1.8 compatibility
  • 7e6fbd8 ssh: wrap errors from client handshake
  • bda2f3f argon2: avoid clobbering BP
  • 325b735 ssh/test: skip TestSSHCLIAuth on Windows
  • 1eadac5 go.mod: update golang.org/x dependencies
  • b2d7c26 ssh: add (*Client).DialContext method
  • Additional commits viewable in compare view

Updates golang.org/x/net from 0.10.0 to 0.19.0

Commits
  • a8e0109 go.mod: update golang.org/x dependencies
  • 13e88dd quic: rename listener{_test}.go to endpoint{_test}.go
  • e26b9a4 quic: rename Listener to Endpoint
  • 399218d quic: implement stream flush
  • d87f99b quic: idle timeouts, handshake timeouts, and keepalive
  • 7b5abfa quic: basic qlog support
  • fbaf412 go.mod: update golang.org/x dependencies
  • cc6f4d1 http2: remove ancient build-tagged files for unsupported Go versions
  • a720b30 http2: allocate buffer pools using pointers to arrays
  • a7ef1a2 internal/quic/cmd/interop: don't t.Log after test finishes
  • Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.55.0 to 1.56.3

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.56.3

Security

  • server: prohibit more than MaxConcurrentStreams handlers from running at once (CVE-2023-44487)

    In addition to this change, applications should ensure they do not leave running tasks behind related to the RPC before returning from method handlers, or should enforce appropriate limits on any such work.

Release 1.56.2

  • status: To fix a panic, status.FromError now returns an error with codes.Unknown when the error implements the GRPCStatus() method, and calling GRPCStatus() returns nil. (#6374)

Release 1.56.1

  • client: handle empty address lists correctly in addrConn.updateAddrs

Release 1.56.0

New Features

  • client: support channel idleness using WithIdleTimeout dial option (#6263)
    • This feature is currently disabled by default, but will be enabled with a 30 minute default in the future.
  • client: when using pickfirst, keep channel state in TRANSIENT_FAILURE until it becomes READY (gRFC A62) (#6306)
  • xds: Add support for Custom LB Policies (gRFC A52) (#6224)
  • xds: support pick_first Custom LB policy (gRFC A62) (#6314) (#6317)
  • client: add support for pickfirst address shuffling (gRFC A62) (#6311)
  • xds: Add support for String Matcher Header Matcher in RDS (#6313)
  • xds/outlierdetection: Add Channelz Logger to Outlier Detection LB (#6145)
  • xds: enable RLS in xDS by default (#6343)
  • orca: add support for application_utilization field and missing range checks on several metrics setters
  • balancer/weightedroundrobin: add new LB policy for balancing between backends based on their load reports (gRFC A58) (#6241)
  • authz: add conversion of json to RBAC Audit Logging config (#6192)
  • authz: add support for stdout logger (#6230 and #6298)
  • authz: support customizable audit functionality for authorization policy (#6192 #6230 #6298 #6158 #6304 and #6225)

Bug Fixes

  • orca: fix a race at startup of out-of-band metric subscriptions that would cause the report interval to request 0 (#6245)
  • xds/xdsresource: Fix Outlier Detection Config Handling and correctly set xDS Defaults (#6361)
  • xds/outlierdetection: Fix Outlier Detection Config Handling by setting defaults in ParseConfig() (#6361)

API Changes

  • orca: allow a ServerMetricsProvider to be passed to the ORCA service and ServerOption (#6223)

Release 1.55.1

  • status: To fix a panic, status.FromError now returns an error with codes.Unknown when the error implements the GRPCStatus() method, and calling GRPCStatus() returns nil. (#6374)
Commits
  • 1055b48 Update version.go to 1.56.3 (#6713)
  • 5efd7bd server: prohibit more than MaxConcurrentStreams handlers from running at once...
  • bd1f038 Upgrade version.go to 1.56.3-dev (#6434)
  • faab873 Update version.go to v1.56.2 (#6432)
  • 6b0b291 status: fix panic when servers return a wrapped error with status OK (#6374) ...
  • ed56401 [PSM interop] Don't fail target if sub-target already failed (#6390) (#6405)
  • cd6a794 Update version.go to v1.56.2-dev (#6387)
  • 5b67e5e Update version.go to v1.56.1 (#6386)
  • d0f5150 client: handle empty address lists correctly in addrConn.updateAddrs (#6354) ...
  • 997c1ea Change version to 1.56.1-dev (#6345)
  • Additional commits viewable in compare view

Updates google.golang.org/protobuf from 1.30.0 to 1.33.0

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the go_modules group group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) | `5.4.3` | `5.5.4` |
| [github.com/labstack/echo/v4](https://github.com/labstack/echo) | `4.6.3` | `4.9.0` |
| [github.com/cloudflare/circl](https://github.com/cloudflare/circl) | `1.3.3` | `1.3.7` |
| [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `5.6.1` | `5.11.0` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.9.0` | `0.17.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.10.0` | `0.19.0` |
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.55.0` | `1.56.3` |
| google.golang.org/protobuf | `1.30.0` | `1.33.0` |


Updates `github.com/jackc/pgx/v5` from 5.4.3 to 5.5.4
- [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md)
- [Commits](jackc/pgx@v5.4.3...v5.5.4)

Updates `github.com/labstack/echo/v4` from 4.6.3 to 4.9.0
- [Release notes](https://github.com/labstack/echo/releases)
- [Changelog](https://github.com/labstack/echo/blob/master/CHANGELOG.md)
- [Commits](labstack/echo@v4.6.3...v4.9.0)

Updates `github.com/cloudflare/circl` from 1.3.3 to 1.3.7
- [Release notes](https://github.com/cloudflare/circl/releases)
- [Commits](cloudflare/circl@v1.3.3...v1.3.7)

Updates `github.com/go-git/go-git/v5` from 5.6.1 to 5.11.0
- [Release notes](https://github.com/go-git/go-git/releases)
- [Commits](go-git/go-git@v5.6.1...v5.11.0)

Updates `golang.org/x/crypto` from 0.9.0 to 0.17.0
- [Commits](golang/crypto@v0.9.0...v0.17.0)

Updates `golang.org/x/net` from 0.10.0 to 0.19.0
- [Commits](golang/net@v0.10.0...v0.19.0)

Updates `google.golang.org/grpc` from 1.55.0 to 1.56.3
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.55.0...v1.56.3)

Updates `google.golang.org/protobuf` from 1.30.0 to 1.33.0

---
updated-dependencies:
- dependency-name: github.com/jackc/pgx/v5
  dependency-type: direct:production
  dependency-group: go_modules-security-group
- dependency-name: github.com/labstack/echo/v4
  dependency-type: direct:production
  dependency-group: go_modules-security-group
- dependency-name: github.com/cloudflare/circl
  dependency-type: indirect
  dependency-group: go_modules-security-group
- dependency-name: github.com/go-git/go-git/v5
  dependency-type: indirect
  dependency-group: go_modules-security-group
- dependency-name: golang.org/x/crypto
  dependency-type: indirect
  dependency-group: go_modules-security-group
- dependency-name: golang.org/x/net
  dependency-type: indirect
  dependency-group: go_modules-security-group
- dependency-name: google.golang.org/grpc
  dependency-type: indirect
  dependency-group: go_modules-security-group
- dependency-name: google.golang.org/protobuf
  dependency-type: indirect
  dependency-group: go_modules-security-group
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies go Pull requests that update Go code labels Mar 14, 2024
Copy link

E2E -

0 tests   0 ✔️  0s ⏱️
0 suites  0 💤
0 files    0

Results for commit 94efbab.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies go Pull requests that update Go code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants