Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

build(deps): bump github.com/openfga/openfga from 1.5.1 to 1.5.3 #3122

Merged

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Apr 17, 2024

Bumps github.com/openfga/openfga from 1.5.1 to 1.5.3.

Release notes

Sourced from github.com/openfga/openfga's releases.

v1.5.3

Added

  • Apply tags to requests that have been intentionally throttled (openfga/openfga#1531). This will add a new log field titled "throttled" to such requests.

Fixed

Changed

Security

  • Patch CVE-2024-31452 - a critical issue where Check and ListObjects APIs returns incorrect results for some models and tuples. See the CVE report for more details.

v1.5.2

Fixed

  • Fix the count of datastore reads in the Check API (#1452)
  • Fix the correct default used for dispatch throttling (#1479)

Security

  • Bumped up the grpc-health-probe dependency in the published Docker image to the latest release which fixes some vulnerabilities (#1507)

Contributions

Changelog

Sourced from github.com/openfga/openfga's changelog.

[1.5.3] - 2024-04-16

Full changelog

Added

  • Apply tags to requests that have been intentionally throttled (openfga/openfga#1531). This will add a new log field titled "throttled" to such requests.

Fixed

Changed

Security

  • Patch CVE-2024-31452 - a critical issue where Check and ListObjects APIs returns incorrect results for some models and tuples. See the CVE report for more details.

[1.5.2] - 2024-04-03

Full changelog

Fixed

  • Fix the count of datastore reads in the Check API (#1452)
  • Fix the correct default used for dispatch throttling (#1479)

Security

  • Bumped up the grpc-health-probe dependency in the published Docker image to the latest release which fixes some vulnerabilities (#1507)

Contributions

Commits
  • ebf3998 docs(v1.5.3): add v1.5.3 release notes to CHANGELOG (#1540)
  • b2fdf4b fix: CachedCheckResolver data race issues (#1541)
  • b6a6d99 Merge pull request from GHSA-8cph-m685-6v6r
  • 6829520 feat: add grpc tag to indicate request had been throttled (#1531)
  • d12d58b chore(deps): bump the dependencies group with 6 updates (#1536)
  • b1e42ef chore(deps): bump chainguard/static from 8665c8a to dea7cbb in the depend...
  • b1511b2 chore: bump to go 1.21.9 and update deps (#1523)
  • 2cdbb76 test: add Expand tests (#1522)
  • 332db55 chore: move MustDefaultConfigWithRandomPorts and TCPRandomPort to `testut...
  • 48b5992 feat: remove experimentals for modular models/schema 1.2 (#1520)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot dependabot bot requested a review from a team as a code owner April 17, 2024 06:33
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Apr 17, 2024
@coveralls
Copy link

coveralls commented Apr 17, 2024

Coverage Status

coverage: 48.181%. remained the same
when pulling d3d068c on dependabot/go_modules/github.com/openfga/openfga-1.5.3
into fc3afce on main.

Copy link
Contributor

@eleftherias eleftherias left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Some lint errors

internal/authz/authz_test.go Outdated Show resolved Hide resolved
internal/authz/authz_test.go Outdated Show resolved Hide resolved
eleftherias
eleftherias previously approved these changes Apr 17, 2024
dependabot bot and others added 3 commits April 17, 2024 11:17
Bumps [github.com/openfga/openfga](https://github.com/openfga/openfga) from 1.5.1 to 1.5.3.
- [Release notes](https://github.com/openfga/openfga/releases)
- [Changelog](https://github.com/openfga/openfga/blob/main/CHANGELOG.md)
- [Commits](openfga/openfga@v1.5.1...v1.5.3)

---
updated-dependencies:
- dependency-name: github.com/openfga/openfga
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Juan Antonio Osorio <ozz@stacklok.com>
Signed-off-by: Juan Antonio Osorio <ozz@stacklok.com>
@JAORMX JAORMX force-pushed the dependabot/go_modules/github.com/openfga/openfga-1.5.3 branch 2 times, most recently from 9743f7e to c977fb2 Compare April 17, 2024 08:22
Signed-off-by: Juan Antonio Osorio <ozz@stacklok.com>
@JAORMX JAORMX merged commit a42230b into main Apr 17, 2024
20 checks passed
@JAORMX JAORMX deleted the dependabot/go_modules/github.com/openfga/openfga-1.5.3 branch April 17, 2024 08:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file go Pull requests that update Go code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants