Skip to content
This repository has been archived by the owner on Oct 29, 2024. It is now read-only.

Bump the go_modules group group with 8 updates #10

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Mar 1, 2024

Bumps the go_modules group group with 8 updates:

Package From To
github.com/snowflakedb/gosnowflake 1.6.6 1.6.19
golang.org/x/crypto 0.0.0-20220817201139-bc19a97f63c8 0.7.0
golang.org/x/net 0.0.0-20220927171203-f486391704dc 0.8.0
google.golang.org/grpc 1.49.0 1.56.3
github.com/docker/docker 20.10.12+incompatible 20.10.27+incompatible
github.com/dvsekhvalnov/jose2go 1.5.0 1.6.0
github.com/nats-io/nats-server/v2 2.8.4 2.9.23
github.com/opencontainers/runc 1.0.3 1.1.12

Updates github.com/snowflakedb/gosnowflake from 1.6.6 to 1.6.19

Release notes

Sourced from github.com/snowflakedb/gosnowflake's releases.

Release

Release

Production Release

Production Release

Bug Fixes

  • Fixed an issue where file decryption was causing a panic.
  • Reverted the go-ieproxy library back to version 0.0.1.

Production Release

  • Add MultiFactor Authentication mechanism and caching for MFA/Id token.
  • Fix issue where 405 error is thrown when S3 bucket acceleration is disabled.

Production Release

Updates

  • Removed support for Go 1.7 and added support fro Go 1.17.
  • Changed the format for float and numeric values when converting arrow types.
  • Added the following functions to access data in arrow.Record format directly from queries:
    • GetArrowBatches(), which is a blocking call
    • GetQueryID()
    • GetStatus()
  • Updated Go vendors

Production Release

  • Fixed the “Failed to decrypt. Check file key and master key” error that occurred when binding large data files via array binding.
  • Updated the following:
  • Added an example to show how to use key-pair authentication.
  • Added the tracing connection parameter to enable logging in the connection string and DSN.
  • Improved log details for chunk downloads.
  • Added support for using interface slice []interface{} to insert NULL values via array binding for the time.Time types.

Production Release

  • Fixed an issue where setting DisableTelemetry to TRUE did not disable telemetry.
  • Fixed an issue with encrypted SAML assertions when authenticating with an external browser.
  • Added support for using interface slice []interface{} to insert NULL values via array binding. Note that interface slices are not supported for the following data types: DATE, TIME, TIMESTAMP_LTZ, TIMESTAMP_NTZ, and TIMESTAMP_TZ

Production Release

  • Created a temporary workaround to avoid the “Failed to decrypt. Check file key and master key” error that occurred when binding large data files via array binding. Determining the root cause of the issue is currently under investigation.

Production Release

  • Removed redundant calls that impacted performance for PrepareContext().

Production Release

  • Dropped support for Go 1.16 and added support for version 1.18.
  • Fixed a bug that caused the driver to close a channel twice in asynchronous mode and throw a closed channel panic error.

... (truncated)

Commits
  • d04e9aa SNOW-762042: Bumped up GoLang connector PATCH version from 1.6.18 to 1.6.19 (...
  • 976d9cd SNOW-755844: Pointer datatype *time.Time returns <nil> value (#761)
  • e11a2a5 SNOW-761744 Added URL Validator and URL Encoder (#757)
  • 72ad913 replace golang.org/x/text and gopkg.in/yaml.v3 with latest (#760)
  • 99ac214 Revert "Add support for new OKTA OIE and retry 429 error code (#731)" (#744)
  • bd12fc7 replace vulnerable dependencys (#745)
  • 7d267da migrate from azure-storage-blob-go to azure-sdk-for-go (#740)
  • 95699ce Merge pull request #739 from snowflakedb/sfc-gh-igarish-patch-1
  • 613dc3d Create CODEOWNERS
  • 7c7d86c Add support for new OKTA OIE and retry 429 error code (#731)
  • Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.0.0-20220817201139-bc19a97f63c8 to 0.7.0

Commits

Updates golang.org/x/net from 0.0.0-20220927171203-f486391704dc to 0.8.0

Commits

Updates google.golang.org/grpc from 1.49.0 to 1.56.3

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.56.3

Security

  • server: prohibit more than MaxConcurrentStreams handlers from running at once (CVE-2023-44487)

    In addition to this change, applications should ensure they do not leave running tasks behind related to the RPC before returning from method handlers, or should enforce appropriate limits on any such work.

Release 1.56.2

  • status: To fix a panic, status.FromError now returns an error with codes.Unknown when the error implements the GRPCStatus() method, and calling GRPCStatus() returns nil. (#6374)

Release 1.56.1

  • client: handle empty address lists correctly in addrConn.updateAddrs

Release 1.56.0

New Features

  • client: support channel idleness using WithIdleTimeout dial option (#6263)
    • This feature is currently disabled by default, but will be enabled with a 30 minute default in the future.
  • client: when using pickfirst, keep channel state in TRANSIENT_FAILURE until it becomes READY (gRFC A62) (#6306)
  • xds: Add support for Custom LB Policies (gRFC A52) (#6224)
  • xds: support pick_first Custom LB policy (gRFC A62) (#6314) (#6317)
  • client: add support for pickfirst address shuffling (gRFC A62) (#6311)
  • xds: Add support for String Matcher Header Matcher in RDS (#6313)
  • xds/outlierdetection: Add Channelz Logger to Outlier Detection LB (#6145)
  • xds: enable RLS in xDS by default (#6343)
  • orca: add support for application_utilization field and missing range checks on several metrics setters
  • balancer/weightedroundrobin: add new LB policy for balancing between backends based on their load reports (gRFC A58) (#6241)
  • authz: add conversion of json to RBAC Audit Logging config (#6192)
  • authz: add support for stdout logger (#6230 and #6298)
  • authz: support customizable audit functionality for authorization policy (#6192 #6230 #6298 #6158 #6304 and #6225)

Bug Fixes

  • orca: fix a race at startup of out-of-band metric subscriptions that would cause the report interval to request 0 (#6245)
  • xds/xdsresource: Fix Outlier Detection Config Handling and correctly set xDS Defaults (#6361)
  • xds/outlierdetection: Fix Outlier Detection Config Handling by setting defaults in ParseConfig() (#6361)

API Changes

  • orca: allow a ServerMetricsProvider to be passed to the ORCA service and ServerOption (#6223)

Release 1.55.1

  • status: To fix a panic, status.FromError now returns an error with codes.Unknown when the error implements the GRPCStatus() method, and calling GRPCStatus() returns nil. (#6374)

Release 1.55.0

Behavior Changes

  • xds: enable federation support by default (#6151)
  • status: status.Code and status.FromError handle wrapped errors (#6031 and #6150)

... (truncated)

Commits
  • 1055b48 Update version.go to 1.56.3 (#6713)
  • 5efd7bd server: prohibit more than MaxConcurrentStreams handlers from running at once...
  • bd1f038 Upgrade version.go to 1.56.3-dev (#6434)
  • faab873 Update version.go to v1.56.2 (#6432)
  • 6b0b291 status: fix panic when servers return a wrapped error with status OK (#6374) ...
  • ed56401 [PSM interop] Don't fail target if sub-target already failed (#6390) (#6405)
  • cd6a794 Update version.go to v1.56.2-dev (#6387)
  • 5b67e5e Update version.go to v1.56.1 (#6386)
  • d0f5150 client: handle empty address lists correctly in addrConn.updateAddrs (#6354) ...
  • 997c1ea Change version to 1.56.1-dev (#6345)
  • Additional commits viewable in compare view

Updates github.com/docker/docker from 20.10.12+incompatible to 20.10.27+incompatible

Release notes

Sourced from github.com/docker/docker's releases.

v20.10.27

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Bug Fixes and Enhancements

Packaging Updates

Security

v20.10.26

20.10.26

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Bug Fixes and Enhancements

  • Support filesystems which do not support extended file attributes with the VFS graph driver. moby/moby#45466
  • Fix AppArmor profile docker-default /proc/sys rule. moby/moby#45716
  • seccomp: always allow name_to_handle_at(2). moby/moby#45835
  • Fix an issue which prevented volumes mounted to a live-restored container from being removed. moby/moby#45840
  • client: resolve an incompatibility with Go 1.20.6, Go 1.20.7, Go 1.19.11 and Go 1.19.12. moby/moby#45972
  • windows: fix --register-service when executed from within binary directory. moby/moby#46217

Packaging Updates

v20.10.25

Bug fixes and enhancements

... (truncated)

Commits
  • 81ebe71 Merge pull request from GHSA-jq35-85cj-fj4p
  • fb63665 Merge pull request #46705 from thaJeztah/20.10_backport_atomic-layer-data-write
  • b967d89 Merge pull request #46692 from corhere/backport-20.10/update-x-net-v0.17
  • 2c22bd5 vendor: golang.org/x/net v0.17.0
  • d862c21 Update to go1.20.10
  • cb47414 Merge pull request #46696 from corhere/backport-20.10/go1.20-enablement
  • ea4eb73 Merge pull request #46695 from corhere/backport-20.10/safer-fileinfo
  • 6c523aa hack: fix suppressing Xattrs lint errors
  • 31b8374 pkg/archive: audit gosec file-traversal lints
  • 8e44855 Remove local fork of archive/tar package
  • Additional commits viewable in compare view

Updates github.com/dvsekhvalnov/jose2go from 1.5.0 to 1.6.0

Commits

Updates github.com/nats-io/nats-server/v2 from 2.8.4 to 2.9.23

Release notes

Sourced from github.com/nats-io/nats-server/v2's releases.

Release v2.9.23

Changelog

Go Version

  • 1.20.10

Fixed

Accounts

  • Prevent bypassing authorization block when enabling system account access in accounts block (#4605). Backport from v2.10.2

Leafnodes

  • Prevent a leafnode cluster from receiving a message multiple times in a queue subscription (#4578). Backport from v2.10.2

JetStream

  • Hold lock when calculating the first message for subject in a message block (#4531). Backport from v2.10.0
  • Add self-healing mechanism to detect and delete orphaned Raft groups (#4647). Backport from v2.10.0
  • Prevent forward proposals in consumers after scaling down a stream (#4647). Backport from v2.10.0
  • Fix race condition during leader failover scenarios resulting in potential duplicate messages being sourced (#4592). Backport from v2.10.2

Complete Changes

nats-io/nats-server@v2.9.22...v2.9.23

Release v2.9.22

Changelog

Go Version

  • 1.20.8 (updated out-of-cycle since Go 1.19 is now EOL)

Dependencies

  • github.com/nats-io/jwt/v2 v2.5.0
  • golang.org/x/crypto v0.12.0
  • golang.org/x/sys v0.11.0

Improved

Monitoring

  • CORS Allow-Origin passthrough for monitoring server (#4423) Thanks to @​mdawar for the contribution!

JetStream

  • Improve consumer scaling reliability with filters and cluster restart (#4404)
  • Send event on lame duck mode (LDM) to avoid placing assets on shutting down nodes (#4405)
  • Skip filestore tombstones if downgrade from 2.10 occurs (#4452)
  • Adjust delivered and waiting count when consumer message delivery fails (#4472)

Fixed

Config

  • Allow empty configs and fix JSON compatibility (#4394, #4418)
  • Remove TLS OCSP debug log on reload (#4453)

... (truncated)

Commits
  • 45436e1 Release v2.9.23 (#4652)
  • 72ffa38 Release v2.9.23
  • 05fe77f Backport #4592 to 2.9 (#4651)
  • 6a73e68 [2.9.x] Bump Travis Go version to 1.20.10 (#4650)
  • 8b981a2 Backports from v2.10 for v2.9.23 release (#4647)
  • 28eb7c0 Only setup auto no-auth for $G account iff no authorization block was defined.
  • 9f16edd Make sure to not forward a message across a route for dq sub when we are a sp...
  • 0ac7895 Add in utility to detect and delete any NRG orphans.
  • 50722e9 When scaling a consumer down make sure to pop the loopAndForwardProposals go ...
  • 770cf2e Backport JetStream benchmarks improvements to 2.9.x (#4644)
  • Additional commits viewable in compare view

Updates github.com/opencontainers/runc from 1.0.3 to 1.1.12

Release notes

Sourced from github.com/opencontainers/runc's releases.

runc 1.1.12 -- "Now you're thinking with Portals™!"

This is the twelfth patch release in the 1.1.z release branch of runc. It fixes a high-severity container breakout vulnerability involving leaked file descriptors, and users are strongly encouraged to update as soon as possible.

  • Fix CVE-2024-21626, a container breakout attack that took advantage of a file descriptor that was leaked internally within runc (but never leaked to the container process).

    In addition to fixing the leak, several strict hardening measures were added to ensure that future internal leaks could not be used to break out in this manner again.

    Based on our research, while no other container runtime had a similar leak, none had any of the hardening steps we've introduced (and some runtimes would not check for any file descriptors that a calling process may have leaked to them, allowing for container breakouts due to basic user error).

Static Linking Notices

The runc binary distributed with this release are statically linked with the following GNU LGPL-2.1 licensed libraries, with runc acting as a "work that uses the Library":

The versions of these libraries were not modified from their upstream versions, but in order to comply with the LGPL-2.1 (§6(a)), we have attached the complete source code for those libraries which (when combined with the attached runc source code) may be used to exercise your rights under the LGPL-2.1.

However we strongly suggest that you make use of your distribution's packages or download them from the authoritative upstream sources, especially since these libraries are related to the security of your containers.

Thanks to all of the contributors who made this release possible:

Signed-off-by: Aleksa Sarai cyphar@cyphar.com

... (truncated)

Changelog

Sourced from github.com/opencontainers/runc's changelog.

[1.1.12] - 2024-01-31

Now you're thinking with Portals™!

Security

  • Fix CVE-2024-21626, a container breakout attack that took advantage of a file descriptor that was leaked internally within runc (but never leaked to the container process). In addition to fixing the leak, several strict hardening measures were added to ensure that future internal leaks could not be used to break out in this manner again. Based on our research, while no other container runtime had a similar leak, none had any of the hardening steps we've introduced (and some runtimes would not check for any file descriptors that a calling process may have leaked to them, allowing for container breakouts due to basic user error).

[1.1.11] - 2024-01-01

Happy New Year!

Fixed

Changed

  • Support memory.peak and memory.swap.peak in cgroups v2. Add swapOnlyUsage in MemoryStats. This field reports swap-only usage. For cgroupv1, Usage and Failcnt are set by subtracting memory usage from memory+swap usage. For cgroupv2, Usage, Limit, and MaxUsage are set. (#4000, #4010, #4131)
  • build(deps): bump github.com/cyphar/filepath-securejoin. (#4140)

[1.1.10] - 2023-10-31

Śruba, przykręcona we śnie, nie zmieni sytuacji, jaka panuje na jawie.

Added

  • Support for hugetlb.<pagesize>.rsvd limiting and accounting. Fixes the issue of postres failing when hugepage limits are set. (#3859, #4077)

Fixed

  • Fixed permissions of a newly created directories to not depend on the value of umask in tmpcopyup feature implementation. (#3991, #4060)
  • libcontainer: cgroup v1 GetStats now ignores missing kmem.limit_in_bytes (fixes the compatibility with Linux kernel 6.1+). (#4028)

... (truncated)

Commits
  • 51d5e94 VERSION: release 1.1.12
  • 2a4ed3e merge 1.1-GHSA-xr7r-f8xq-vfvv into release-1.1
  • e9665f4 init: don't special-case logrus fds
  • 683ad2f libcontainer: mark all non-stdio fds O_CLOEXEC before spawning init
  • b6633f4 cgroup: plug leaks of /sys/fs/cgroup handle
  • 284ba30 init: close internal fds before execve
  • fbe3eed setns init: do explicit lookup of execve argument early
  • 0994249 init: verify after chdir that cwd is inside the container
  • 506552a Fix File to Close
  • 099ff69 merge #4177 into opencontainers/runc:release-1.1
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the go_modules group group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/snowflakedb/gosnowflake](https://github.com/snowflakedb/gosnowflake) | `1.6.6` | `1.6.19` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.0.0-20220817201139-bc19a97f63c8` | `0.7.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.0.0-20220927171203-f486391704dc` | `0.8.0` |
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.49.0` | `1.56.3` |
| [github.com/docker/docker](https://github.com/docker/docker) | `20.10.12+incompatible` | `20.10.27+incompatible` |
| [github.com/dvsekhvalnov/jose2go](https://github.com/dvsekhvalnov/jose2go) | `1.5.0` | `1.6.0` |
| [github.com/nats-io/nats-server/v2](https://github.com/nats-io/nats-server) | `2.8.4` | `2.9.23` |
| [github.com/opencontainers/runc](https://github.com/opencontainers/runc) | `1.0.3` | `1.1.12` |


Updates `github.com/snowflakedb/gosnowflake` from 1.6.6 to 1.6.19
- [Release notes](https://github.com/snowflakedb/gosnowflake/releases)
- [Changelog](https://github.com/snowflakedb/gosnowflake/blob/master/release.go)
- [Commits](snowflakedb/gosnowflake@v1.6.6...v1.6.19)

Updates `golang.org/x/crypto` from 0.0.0-20220817201139-bc19a97f63c8 to 0.7.0
- [Commits](https://github.com/golang/crypto/commits/v0.7.0)

Updates `golang.org/x/net` from 0.0.0-20220927171203-f486391704dc to 0.8.0
- [Commits](https://github.com/golang/net/commits/v0.8.0)

Updates `google.golang.org/grpc` from 1.49.0 to 1.56.3
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.49.0...v1.56.3)

Updates `github.com/docker/docker` from 20.10.12+incompatible to 20.10.27+incompatible
- [Release notes](https://github.com/docker/docker/releases)
- [Commits](moby/moby@v20.10.12...v20.10.27)

Updates `github.com/dvsekhvalnov/jose2go` from 1.5.0 to 1.6.0
- [Commits](dvsekhvalnov/jose2go@v1.5...v1.6.0)

Updates `github.com/nats-io/nats-server/v2` from 2.8.4 to 2.9.23
- [Release notes](https://github.com/nats-io/nats-server/releases)
- [Changelog](https://github.com/nats-io/nats-server/blob/main/.goreleaser.yml)
- [Commits](nats-io/nats-server@v2.8.4...v2.9.23)

Updates `github.com/opencontainers/runc` from 1.0.3 to 1.1.12
- [Release notes](https://github.com/opencontainers/runc/releases)
- [Changelog](https://github.com/opencontainers/runc/blob/v1.1.12/CHANGELOG.md)
- [Commits](opencontainers/runc@v1.0.3...v1.1.12)

---
updated-dependencies:
- dependency-name: github.com/snowflakedb/gosnowflake
  dependency-type: direct:production
  dependency-group: go_modules-security-group
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  dependency-group: go_modules-security-group
- dependency-name: golang.org/x/net
  dependency-type: direct:production
  dependency-group: go_modules-security-group
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
  dependency-group: go_modules-security-group
- dependency-name: github.com/docker/docker
  dependency-type: indirect
  dependency-group: go_modules-security-group
- dependency-name: github.com/dvsekhvalnov/jose2go
  dependency-type: indirect
  dependency-group: go_modules-security-group
- dependency-name: github.com/nats-io/nats-server/v2
  dependency-type: indirect
  dependency-group: go_modules-security-group
- dependency-name: github.com/opencontainers/runc
  dependency-type: indirect
  dependency-group: go_modules-security-group
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Mar 1, 2024
Copy link
Author

dependabot bot commented on behalf of github Apr 19, 2024

Superseded by #13.

@dependabot dependabot bot closed this Apr 19, 2024
@dependabot dependabot bot deleted the dependabot/go_modules/go_modules-security-group-e00ae121a2 branch April 19, 2024 11:15
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
dependencies Pull requests that update a dependency file go Pull requests that update Go code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants