Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bump the go_modules group across 3 directories with 5 updates #295

Closed
wants to merge 1 commit into from
Closed

Bump the go_modules group across 3 directories with 5 updates #295

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Nov 7, 2024 •
edited
Loading

Bumps the go_modules group with 3 updates in the / directory: github.com/cometbft/cometbft, github.com/golang-jwt/jwt/v4 and github.com/quic-go/quic-go.
Bumps the go_modules group with 1 update in the /cmd/monogen directory: github.com/cometbft/cometbft.
Bumps the go_modules group with 3 updates in the /cmd/monogen/testapp directory: github.com/cometbft/cometbft, github.com/golang-jwt/jwt/v4 and github.com/docker/docker.

Updates github.com/cometbft/cometbft from 0.38.10 to 0.38.15

Release notes

Sourced from github.com/cometbft/cometbft's releases.

v0.38.15

See the CHANGELOG for this release.

v0.38.13

See the CHANGELOG for this release.

v0.38.12

See the CHANGELOG for this release.

v0.38.11

CHANGELOG

Changelog

Sourced from github.com/cometbft/cometbft's changelog.

v0.38.15

November 6, 2024

This release supersedes v0.38.14, which mistakenly updated the Go version to 1.23, introducing an unintended breaking change. It sets the Go version back to 1.22.7 by reverting #4297.

The release includes the bug fixes, performance improvements, and importantly, the fix for the security vulnerability in the vote extensions (VE) validation logic that were part of v0.38.14. For more details, please refer to ASA-2024-011.

v0.38.14

November 6, 2024

This release fixes a security vulnerability in the vote extensions (VE) validation logic. For more details, please refer to ASA-2024-011.

We recommend upgrading ASAP if you’re using vote extensions (VE).

BUG FIXES

  • [consensus] Do not panic if the validator index of a Vote message is out of bounds, when vote extensions are enabled (#ABC-0021)

DEPENDENCIES

  • Bump cometbft-db version to v0.15.0 (#4297)
  • [go/runtime] Bump Go version to 1.23 (#4297)

IMPROVEMENTS

  • [p2p] fix exponential backoff logic to increase reconnect retries close to 24 hours (#3519)

v0.38.13

October 24, 2024

This patch release addresses the issue where tx_search was not returning all results, which only arises when upgrading to CometBFT-DB version 0.13 or later. It includes a fix in the state indexer to resolve this problem. We recommend upgrading to this patch release if you are affected by this issue.

BUG FIXES

... (truncated)

Commits

Updates github.com/btcsuite/btcd from 0.24.0 to 0.24.2

Release notes

Sourced from github.com/btcsuite/btcd's releases.

v0.24.2

This release includes important bug fixes related to subtle interactions related to re-orgs and the UTXO set cache. These fixed are considered security critical.

This release also includes implementations of invalidateblock and reconsiderblock which can be useful in helping nodes that were afflicted by the aforementioned bugs to recover without needing to resync the entire chain.

WIth this release, btcd now also implements the testmempoolaccept RPC which can be useful to check a transaction candidate for validity from a policy and conflict perspective before broadcasting. Along the way, we've added some additional policy checks that exist in other Bitcoin full node implementations.

This release also contains fixes to some parsing issues discovered via fuzz testing.

Finally, as mentioned above release includes important security fixes, with full details to be disclosed in 90 days.

What's Changed

... (truncated)

Commits

Updates github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1

Release notes

Sourced from github.com/golang-jwt/jwt/v4's releases.

v4.5.1

Security

Unclear documentation of the error behavior in ParseWithClaims in <= 4.5.0 could lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by ParseWithClaims return both error codes. If users only check for the jwt.ErrTokenExpired using error.Is, they will ignore the embedded jwt.ErrTokenSignatureInvalid and thus potentially accept invalid tokens.

This issue was documented in GHSA-29wx-vh33-7x7r and fixed in this release.

Note: v5 was not affected by this issue. So upgrading to this release version is also recommended.

What's Changed

  • Back-ported error-handling logic in ParseWithClaims from v5 branch. This fixes GHSA-29wx-vh33-7x7r.

Full Changelog: golang-jwt/jwt@v4.5.0...v4.5.1

Commits

Updates github.com/quic-go/quic-go from 0.39.4 to 0.42.0

Release notes

Sourced from github.com/quic-go/quic-go's releases.

v0.42.0

New Features

  • added a qlog tracer for events that happen before / outside of established connection: #4305

Notable Changes

  • added a ClientHelloInfo.AddrVerified field: #4360
  • move callback controlling address verification (VerifySourceAddress) to the Transport: #4253 and #4362
  • connections that are closed before being accepted are not removed from the server's accept queue: #4245
  • http3: added a RoundTripOpt.CheckSettings callback to check the server's SETTINGS: #4355
  • http3: send the HTTP/3 settings value for Extended CONNECT (RFC 9220): #4341
  • http3: don't modify the user's quic.Config to enable QUIC datagram support: #4340

Fixes

  • mitigate a memory exhaustion attack against QUIC's connection ID mechanism: #4369
  • don't delay acknowledgments for packets during the handshake: #4279
  • fix deadlock when closing both Listener and Transport: #4332
  • fix handling of IPv4-mapped IPv6 addresses: #4309
  • fix duplicate logging of the key_discarded event for Handshake packets: #4274
  • send CONNECTION_REFUSED when refusing connections: #4250
  • http3: tighten validation logic for the :protocol pseudo header: #4261

What's Changed

... (truncated)

Commits
  • 4a99b81 close connection when an abnormally large number of frames are queued (#4369)
  • 9971fed use Transport.VerifySourceAddress to control the Retry Mechanism (#4362)
  • 497d3f5 http3: add a RoundTripOpt to check the server's SETTINGS frame (#4355)
  • ca787d6 add an AddrVerified field to the ClientHelloInfo (#4360)
  • f147639 update gomock to v0.4.0 (#4361)
  • 06b4214 remove unused ReceiveStream.CloseRemote method (#4357)
  • 5fd5d77 Merge pull request #4305 from quic-go/qlog-tracer
  • 30e01b9 use the transport tracer in integration tests
  • 55c05ac qlog: log sent packets outside of a QUIC connection
  • aff90a6 qlog: log sent Version Negotiation packets
  • Additional commits viewable in compare view

Updates github.com/cometbft/cometbft from 0.38.10 to 0.38.15

Release notes

Sourced from github.com/cometbft/cometbft's releases.

v0.38.15

See the CHANGELOG for this release.

v0.38.13

See the CHANGELOG for this release.

v0.38.12

See the CHANGELOG for this release.

v0.38.11

CHANGELOG

Changelog

Sourced from github.com/cometbft/cometbft's changelog.

v0.38.15

November 6, 2024

This release supersedes v0.38.14, which mistakenly updated the Go version to 1.23, introducing an unintended breaking change. It sets the Go version back to 1.22.7 by reverting #4297.

The release includes the bug fixes, performance improvements, and importantly, the fix for the security vulnerability in the vote extensions (VE) validation logic that were part of v0.38.14. For more details, please refer to ASA-2024-011.

v0.38.14

November 6, 2024

This release fixes a security vulnerability in the vote extensions (VE) validation logic. For more details, please refer to ASA-2024-011.

We recommend upgrading ASAP if you’re using vote extensions (VE).

BUG FIXES

  • [consensus] Do not panic if the validator index of a Vote message is out of bounds, when vote extensions are enabled (#ABC-0021)

DEPENDENCIES

  • Bump cometbft-db version to v0.15.0 (#4297)
  • [go/runtime] Bump Go version to 1.23 (#4297)

IMPROVEMENTS

  • [p2p] fix exponential backoff logic to increase reconnect retries close to 24 hours (#3519)

v0.38.13

October 24, 2024

This patch release addresses the issue where tx_search was not returning all results, which only arises when upgrading to CometBFT-DB version 0.13 or later. It includes a fix in the state indexer to resolve this problem. We recommend upgrading to this patch release if you are affected by this issue.

BUG FIXES

... (truncated)

Commits

Updates github.com/cometbft/cometbft from 0.38.10 to 0.38.15

Release notes

Sourced from github.com/cometbft/cometbft's releases.

v0.38.15

See the CHANGELOG for this release.

v0.38.13

See the CHANGELOG for this release.

v0.38.12

See the CHANGELOG for this release.

v0.38.11

CHANGELOG

Changelog

Sourced from github.com/cometbft/cometbft's changelog.

v0.38.15

November 6, 2024

This release supersedes v0.38.14, which mistakenly updated the Go version to 1.23, introducing an unintended breaking change. It sets the Go version back to 1.22.7 by reverting #4297.

The release includes the bug fixes, performance improvements, and importantly, the fix for the security vulnerability in the vote extensions (VE) validation logic that were part of v0.38.14. For more details, please refer to ASA-2024-011.

v0.38.14

November 6, 2024

This release fixes a security vulnerability in the vote extensions (VE) validation logic. For more details, please refer to ASA-2024-011.

We recommend upgrading ASAP if you’re using vote extensions (VE).

BUG FIXES

  • [consensus] Do not panic if the validator index of a Vote message is out of bounds, when vote extensions are enabled (#ABC-0021)

DEPENDENCIES

  • Bump cometbft-db version to v0.15.0 (#4297)
  • [go/runtime] Bump Go version to 1.23 (#4297)

IMPROVEMENTS

  • [p2p] fix exponential backoff logic to increase reconnect retries close to 24 hours (#3519)

v0.38.13

October 24, 2024

This patch release addresses the issue where tx_search was not returning all results, which only arises when upgrading to CometBFT-DB version 0.13 or later. It includes a fix in the state indexer to resolve this problem. We recommend upgrading to this patch release if you are affected by this issue.

BUG FIXES

... (truncated)

Commits

Updates github.com/btcsuite/btcd from 0.24.0 to 0.24.2

Release notes

Sourced from github.com/btcsuite/btcd's releases.

v0.24.2

This release includes important bug fixes related to subtle interactions related to re-orgs and the UTXO set cache. These fixed are considered security critical.

This release also includes implementations of invalidateblock and reconsiderblock which can be useful in helping nodes that were afflicted by the aforementioned bugs to recover without needing to resync the entire chain.

WIth this release, btcd now also implements the testmempoolaccept RPC which can be useful to check a transaction candidate for validity from a policy and conflict perspective before broadcasting. Along the way, we've added some additional policy checks that exist in other Bitcoin full node implementations.

This release also contains fixes to some parsing issues discovered via fuzz testing.

Finally, as mentioned above release includes important security fixes, with full details to be disclosed in 90 days.

What's Changed

... (truncated)

Commits

Updates github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1

Release notes

Sourced from github.com/golang-jwt/jwt/v4's releases.

v4.5.1

Security

Unclear documentation of the error behavior in ParseWithClaims in <= 4.5.0 could lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by ParseWithClaims return both error codes. If users only check for the jwt.ErrTokenExpired using error.Is, they will ignore the embedded jwt.ErrTokenSignatureInvalid and thus potentially accept invalid tokens.

This issue was documented in GHSA-29wx-vh33-7x7r and fixed in this release.

Note: v5 was not affected by this issue. So upgrading to this release version is also recommended.

What's Changed

  • Back-ported error-handling logic in ParseWithClaims from v5 branch. This fixes GHSA-29wx-vh33-7x7r.

Full Changelog: golang-jwt/jwt@v4.5.0...v4.5.1

Commits

Updates github.com/docker/docker from 27.0.0+incompatible to 27.1.1+incompatible

Release notes

Sourced from github.com/docker/docker's releases.

v27.1.1

27.1.1

Security

This release contains a fix for CVE-2024-41110 / GHSA-v23v-6jw2-98fq that impacted setups using authorization plugins (AuthZ) for access control. No other changes are included in this release, and this release is otherwise identical for users not using AuthZ plugins.

Packaging updates

Full Changelog: moby/moby@v27.1.0...v27.1.1

v27.1.0

27.1.0

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Bug fixes and enhancements

  • rootless: add Requires=dbus.socket to prevent errors when starting the daemon on a cgroup v2 host with systemd moby/moby#48141
  • containerd integration: image tag event is now properly emitted when building images with BuildKit moby/moby#48182
  • CLI: enable shell completion for docker image rm, docker image history, and docker image inspect moby/moby#5261
  • CLI: add and improve shell completions for various flags moby/moby#5261
  • CLI: add OOMScoreAdj to docker service create and docker stack docker/cli#5274
  • CLI: add support for DOCKER_CUSTOM_HEADERS environment variable (experimental) docker/cli#5271
  • CLI: containerd-integration: Fix docker push defaulting the --platform flag to a value of DOCKER_DEFAULT_PLATFORM environment variable on unsupported API versions docker/cli#5248
  • CLI: fix: context cancellation on login prompt docker/cli#5260
  • CLI: fix: wait for the container to exit before closing the stream when sending a termination request to the CLI while attached to a container docker/cli#5250

Deprecated

  • The pkg/rootless/specconv package is deprecated, and will be removed in the next release moby/moby#48185
  • The pkg/containerfs package is deprecated, and will be removed in the next release moby/moby#48185
  • The pkg/directory package is deprecated, and will be removed in the next release moby/moby#48185
  • api/types/system: remove deprecated Info.ExecutionDriver moby/moby#48184

Packaging updates

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's...

Description has been truncated

@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Nov 7, 2024
@coderabbitai coderabbitai
Copy link
Contributor

coderabbitai bot commented Nov 7, 2024

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>, please review it.
    • Generate unit testing code for this file.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
    • @coderabbitai generate unit testing code for this file.
    • @coderabbitai modularize this function.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
    • @coderabbitai read src/utils.ts and generate unit testing code.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
    • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

  • @coderabbitai pause to pause the reviews on a PR.
  • @coderabbitai resume to resume the paused reviews.
  • @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
  • @coderabbitai full review to do a full review from scratch and review all the files again.
  • @coderabbitai summary to regenerate the summary of the PR.
  • @coderabbitai resolve resolve all the CodeRabbit review comments.
  • @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
  • @coderabbitai help to get help.

Other keywords and placeholders

  • Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
  • Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
  • Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

  • You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
  • Please see the configuration documentation for more information.
  • If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

  • Visit our Documentation for detailed information on how to use CodeRabbit.
  • Join our Discord Community to get help, request features, and share feedback.
  • Follow us on X/Twitter for updates and announcements.

@dependabot
Bump the go_modules group across 3 directories with 5 updates
0e88876 
Bumps the go_modules group with 3 updates in the / directory: [github.com/cometbft/cometbft](https://github.com/cometbft/cometbft), [github.com/golang-jwt/jwt/v4](https://github.com/golang-jwt/jwt) and [github.com/quic-go/quic-go](https://github.com/quic-go/quic-go).
Bumps the go_modules group with 1 update in the /cmd/monogen directory: [github.com/cometbft/cometbft](https://github.com/cometbft/cometbft).
Bumps the go_modules group with 3 updates in the /cmd/monogen/testapp directory: [github.com/cometbft/cometbft](https://github.com/cometbft/cometbft), [github.com/golang-jwt/jwt/v4](https://github.com/golang-jwt/jwt) and [github.com/docker/docker](https://github.com/docker/docker).


Updates `github.com/cometbft/cometbft` from 0.38.10 to 0.38.15
- [Release notes](https://github.com/cometbft/cometbft/releases)
- [Changelog](https://github.com/cometbft/cometbft/blob/v0.38.15/CHANGELOG.md)
- [Commits](cometbft/cometbft@v0.38.10...v0.38.15)

Updates `github.com/btcsuite/btcd` from 0.24.0 to 0.24.2
- [Release notes](https://github.com/btcsuite/btcd/releases)
- [Changelog](https://github.com/btcsuite/btcd/blob/master/CHANGES)
- [Commits](btcsuite/btcd@v0.24.0...v0.24.2)

Updates `github.com/golang-jwt/jwt/v4` from 4.5.0 to 4.5.1
- [Release notes](https://github.com/golang-jwt/jwt/releases)
- [Changelog](https://github.com/golang-jwt/jwt/blob/main/VERSION_HISTORY.md)
- [Commits](golang-jwt/jwt@v4.5.0...v4.5.1)

Updates `github.com/quic-go/quic-go` from 0.39.4 to 0.42.0
- [Release notes](https://github.com/quic-go/quic-go/releases)
- [Changelog](https://github.com/quic-go/quic-go/blob/master/Changelog.md)
- [Commits](quic-go/quic-go@v0.39.4...v0.42.0)

Updates `github.com/cometbft/cometbft` from 0.38.10 to 0.38.15
- [Release notes](https://github.com/cometbft/cometbft/releases)
- [Changelog](https://github.com/cometbft/cometbft/blob/v0.38.15/CHANGELOG.md)
- [Commits](cometbft/cometbft@v0.38.10...v0.38.15)

Updates `github.com/cometbft/cometbft` from 0.38.10 to 0.38.15
- [Release notes](https://github.com/cometbft/cometbft/releases)
- [Changelog](https://github.com/cometbft/cometbft/blob/v0.38.15/CHANGELOG.md)
- [Commits](cometbft/cometbft@v0.38.10...v0.38.15)

Updates `github.com/btcsuite/btcd` from 0.24.0 to 0.24.2
- [Release notes](https://github.com/btcsuite/btcd/releases)
- [Changelog](https://github.com/btcsuite/btcd/blob/master/CHANGES)
- [Commits](btcsuite/btcd@v0.24.0...v0.24.2)

Updates `github.com/golang-jwt/jwt/v4` from 4.5.0 to 4.5.1
- [Release notes](https://github.com/golang-jwt/jwt/releases)
- [Changelog](https://github.com/golang-jwt/jwt/blob/main/VERSION_HISTORY.md)
- [Commits](golang-jwt/jwt@v4.5.0...v4.5.1)

Updates `github.com/docker/docker` from 27.0.0+incompatible to 27.1.1+incompatible
- [Release notes](https://github.com/docker/docker/releases)
- [Commits](https://github.com/docker/docker/commits/v27.1.1)

---
updated-dependencies:
- dependency-name: github.com/cometbft/cometbft
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/btcsuite/btcd
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/golang-jwt/jwt/v4
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/quic-go/quic-go
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/cometbft/cometbft
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/cometbft/cometbft
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/btcsuite/btcd
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/golang-jwt/jwt/v4
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/docker/docker
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/go_modules/go_modules-b18be24617 branch from b86b7b0 to 0e88876 Compare November 7, 2024 20:27
@joshklop joshklop closed this Nov 7, 2024
@dependabot Dependabot
Copy link
Contributor Author

dependabot bot commented on behalf of github Nov 7, 2024

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot dependabot bot deleted the dependabot/go_modules/go_modules-b18be24617 branch November 7, 2024 21:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file go Pull requests that update Go code
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@joshklop