search

aquasecurity / trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
https://aquasecurity.github.io/trivy
Apache License 2.0
22.14k stars 2.18k forks source link

chore(deps): bump the common group across 1 directory with 20 updates #6985

Closed dependabot[bot] closed 2 weeks ago

dependabot[bot] commented 2 weeks ago

Bumps the common group with 19 updates in the / directory:

Package From To
github.com/Azure/azure-sdk-for-go/sdk/azcore 1.11.1 1.12.0
github.com/Azure/azure-sdk-for-go/sdk/azidentity 1.6.0 1.7.0
github.com/aws/aws-sdk-go-v2 1.27.2 1.30.0
github.com/aws/aws-sdk-go-v2/config 1.27.18 1.27.21
github.com/aws/aws-sdk-go-v2/service/ec2 1.163.1 1.165.1
github.com/aws/aws-sdk-go-v2/service/ecr 1.28.5 1.29.1
github.com/aws/aws-sdk-go-v2/service/s3 1.55.1 1.56.1
github.com/containerd/containerd 1.7.17 1.7.18
github.com/docker/docker 26.1.3+incompatible 27.0.0+incompatible
github.com/google/go-containerregistry 0.19.1 0.19.2
github.com/hashicorp/hcl/v2 2.20.1 2.21.0
github.com/moby/buildkit 0.13.2 0.14.1
github.com/spf13/cobra 1.8.0 1.8.1
github.com/tetratelabs/wazero 1.7.2 1.7.3
golang.org/x/mod 0.17.0 0.18.0
google.golang.org/protobuf 1.34.1 1.34.2
helm.sh/helm/v3 3.15.1 3.15.2
k8s.io/api 0.30.1 0.30.2
modernc.org/sqlite 1.30.0 1.30.1

Updates github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.11.1 to 1.12.0

Release notes

Sourced from github.com/Azure/azure-sdk-for-go/sdk/azcore's releases.

sdk/azcore/v1.12.0

1.12.0 (2024-06-06)

Features Added

  • Added field StatusCodes to runtime.FetcherForNextLinkOptions allowing for additional HTTP status codes indicating success.
  • Added func NewUUID to the runtime package for generating UUIDs.

Bugs Fixed

  • Fixed an issue that prevented pollers using the Operation-Location strategy from unmarshaling the final result in some cases.

Other Changes

  • Updated dependencies.
Commits


Updates github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.6.0 to 1.7.0

Release notes

Sourced from github.com/Azure/azure-sdk-for-go/sdk/azidentity's releases.

sdk/messaging/azservicebus/v1.7.0

1.7.0 (2024-04-02)

Features Added

  • Add in ability to handle emulator connection strings. (PR#22663)

sdk/internal/v1.7.0

1.7.0 (2024-05-01)

Features Added

  • Support for local repo override (via presence of eng/target_proxy_version.txt) of invoked test-proxy version.

  • RemoveRegisteredSanitizers selectively disables sanitizers the test proxy enables by default since version 1.0.0-dev.20240422.1

Breaking Changes

  • Deprecated the go-vcr based test recording API. Its methods now return errors or panic.
  • Changed value of recording.SanitizedValue from "sanitized" to "Sanitized" to match the test proxy

sdk/azidentity/v1.7.0

1.7.0 (2024-06-20)

Features Added

  • AzurePipelinesCredential authenticates an Azure Pipelines service connection with workload identity federation

Breaking Changes

These changes affect only code written against a beta version such as v1.7.0-beta.1

  • Removed the persistent token caching API. It will return in v1.8.0-beta.1

sdk/azidentity/v1.7.0-beta.1

1.7.0-beta.1 (2024-06-10)

Features Added

  • Restored AzurePipelinesCredential and persistent token caching API

Breaking Changes

These changes affect only code written against a beta version such as v1.6.0-beta.4

  • Values which NewAzurePipelinesCredential read from environment variables in prior versions are now parameters
  • Renamed AzurePipelinesServiceConnectionCredentialOptions to AzurePipelinesCredentialOptions

Bugs Fixed

  • Managed identity bug fixes
Commits


Updates github.com/aws/aws-sdk-go-v2 from 1.27.2 to 1.30.0

Commits


Updates github.com/aws/aws-sdk-go-v2/config from 1.27.18 to 1.27.21

Commits


Updates github.com/aws/aws-sdk-go-v2/credentials from 1.17.18 to 1.17.21

Commits


Updates github.com/aws/aws-sdk-go-v2/service/ec2 from 1.163.1 to 1.165.1

Commits


Updates github.com/aws/aws-sdk-go-v2/service/ecr from 1.28.5 to 1.29.1

Commits


Updates github.com/aws/aws-sdk-go-v2/service/s3 from 1.55.1 to 1.56.1

Commits


Updates github.com/containerd/containerd from 1.7.17 to 1.7.18

Release notes

Sourced from github.com/containerd/containerd's releases.

containerd 1.7.18

Welcome to the v1.7.18 release of containerd!

The eighteenth patch release for containerd 1.7 contains various updates along with an updated version of Go. Go 1.22.4 and 1.21.11 include a fix for a symlink time of check to time of use race condition during directory removal.

Highlights

  • Update Go version to 1.21.11 (#10298)
  • Remove uses of platforms.Platform alias (#10277)
  • Migrate log imports to github.com/containerd/log (#10269)
  • Migrate errdefs package to github.com/containerd/errdefs (#10266)
  • Fix usage of "unknown" platform (#10261)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

  • Derek McGowan
  • Sebastiaan van Stijn
  • Akhil Mohan
  • Austin Vazquez
  • Phil Estes

Changes

  • Prepare release notes for v1.7.18 (#10301)
    • 9426aab62 Prepare release notes for v1.7.18
  • Update Go version to 1.21.11 (#10298)
  • Remove uses of platforms.Platform alias (#10277)
    • 1e3c662d6 [release/1.7] remove uses of platforms.Platform alias
  • Migrate log imports to github.com/containerd/log (#10269)
    • 0af6825b1 migrate logs imports to github.com/containerd/log module
  • Migrate errdefs package to github.com/containerd/errdefs (#10266)
    • 308341a44 replace uses of github.com/containerd/containerd/errdefs
    • 47ff8cfce migrate errdefs package to github.com/containerd/errdefs module
  • Fix usage of "unknown" platform (#10261)
    • f4d11912a core/image: fix usage of "unknown" platform
  • Explicitly set release latest to true (#10265)
    • 5b0480009 Explicitly set release latest to true
    • d669b100d build(deps): bump softprops/action-gh-release from 1 to 2

Changes from containerd/errdefs

... (truncated)

Commits
  • ae71819 Merge pull request #10301 from dmcgowan/prepare-v1.7.18
  • 9426aab Prepare release notes for v1.7.18
  • 1d324db Merge pull request #10298 from dmcgowan/1.7-update-go
  • cdd3ea9 Update Go version to 1.21.11
  • 0a137f0 Merge pull request #10277 from thaJeztah/1.7_backport_remove_use_of_platform_...
  • 1e3c662 [release/1.7] remove uses of platforms.Platform alias
  • 300a6de Merge pull request #10269 from thaJeztah/1.7_migrate_containerd_log
  • 0af6825 migrate logs imports to github.com/containerd/log module
  • be820ac Merge pull request #10266 from thaJeztah/1.7_migrate_to_errdefs_module
  • 566c535 Merge pull request #10261 from k8s-infra-cherrypick-robot/cherry-pick-10257-t...
  • Additional commits viewable in compare view


Updates github.com/docker/docker from 26.1.3+incompatible to 27.0.0+incompatible

Release notes

Sourced from github.com/docker/docker's releases.

v27.0.0-rc.2

27.0.0-rc.2

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

New

  • In port mappings with no host port specified, and with host port ranges, allocate the same port for IPv4 and IPv6. Add bridge driver option com.docker.network.bridge.gateway_mode_ipv6=<nat|routed>, when set to routed no NAT or masquerading rules are configured for port mappings. This enables direct IPv6 access to the container, if the host's network can route packets for the container's address to the host. Mapped ports will be opened in the containers firewall. For example, docker network create --ipv6 -o com.docker.network.bridge.gateway_mode_ipv6=routed mynet. Option com.docker.network.bridge.gateway_mode_ipv4=<nat|routed> is also available. moby/moby#47871

Bug fixes and enhancements

  • Fix a goroutine and file-descriptor leak on container attach. moby/moby#45052
  • Clear the networking state of all stopped or dead containers during daemon start-up. moby/moby#47984
  • Environment variable DOCKER_ALLOW_IPV6_ON_IPV4_INTERFACE, introduced in release 26.1.1, no longer has any effect. If IPv6 could not be disabled on an interface because of a read-only /proc/sys/net, the environment variable allowed the container to start anyway. IPv6 can now be explicitly enabled simply by using --ipv6 when creating the network, it is no longer necessary to allocate a subnet as a unique-local prefix will be selected by default. Other workarounds are to configure the OS to disable IPv6 by default on new interfaces, mount /proc/sys/net read-write, or use a kernel with no IPv6 support. moby/moby#47963

Removed

  • pkg/archive: deprecate NewTempArchive, TempArchive. These types were only used in tests and will be removed in the next release. moby/moby#48002
  • pkg/archive: deprecate CanonicalTarNameForPath moby/moby#48001
  • Deprecate pkg/dmesg. This package was no longer used, and will be removed in the next release. moby/moby#47999
  • Deprecate pkg/stringid.ValidateID and pkg/stringid.IsShortID moby/moby#47995
  • runconfig: deprecate SetDefaultNetModeIfBlank and move ContainerConfigWrapper to api/types/container moby/moby#48007

API

  • POST /containers/create and POST /services/create now take Options as part of HostConfig.Mounts.TmpfsOptions allowing to set options for tmpfs mounts. moby/moby#46809
  • The Healthcheck.StartInterval property is now correctly ignored when updating a Swarm service using API versions less than v1.44. moby/moby#47991
  • GET /events now supports image create event that is emitted when a new image is built regardless if it was tagged or not. moby/moby#47929
  • GET /info now includes a Containerd field containing information about the location of the containerd API socket and containerd namespaces used by the daemon to run containers and plugins. moby/moby#47239

Packaging updates

v27.0.0-rc.1

27.0.0-rc.1

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

... (truncated)

Commits


Updates github.com/google/go-containerregistry from 0.19.1 to 0.19.2

Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.19.2

What's Changed

New Contributors

Full Changelog: https://github.com/google/go-containerregistry/compare/v0.19.1...v0.19.2

Commits


Updates github.com/hashicorp/hcl/v2 from 2.20.1 to 2.21.0

Release notes

Sourced from github.com/hashicorp/hcl/v2's releases.

v2.21.0

Enhancements

  • Introduce ParseTraversalPartial, which allows traversals that include the splat ([*]) index operator. (#673)
  • ext/dynblock: Now accepts marked values in for_each, and will transfer those marks (as much as technically possible) to values in the generated blocks. (#679)

Bugs Fixed

  • Expression evaluation will no longer panic if the splat operator is applied to an unknown value that has cty marks. (#678)
Changelog

Sourced from github.com/hashicorp/hcl/v2's changelog.

v2.21.0 (June 19, 2024)

Enhancements

  • Introduce ParseTraversalPartial, which allows traversals that include the splat ([*]) index operator. (#673)
  • ext/dynblock: Now accepts marked values in for_each, and will transfer those marks (as much as technically possible) to values in the generated blocks. (#679)

Bugs Fixed

  • Expression evaluation will no longer panic if the splat operator is applied to an unknown value that has cty marks. (#678)
Commits
  • 360ae57 prepare for v2.21.0 release
  • f7e093a github: Pin action refs to latest trusted by TSCCR (#683)
  • 212a40e Update CHANGELOG.md
  • 318bbfe hcldec: Allow body-derived values to be marked
  • 9a64c17 dynblock: Preserve marks from for_each expression into result
  • bc75765 hclsyntax: Don't panic if splat operand is unknown and marked
  • bf54697 github: Set up Dependabot to manage HashiCorp-owned Actions versioning
  • 4521ae9 github: Pin action refs to latest trusted by TSCCR (#677)
  • 1c5ae8f Update CHANGELOG.md
  • f7cd61a Add additional function for parsing traversals with [*] keys (#673)
  • See full diff in compare view


Updates github.com/moby/buildkit from 0.13.2 to 0.14.1

Release notes

Sourced from github.com/moby/buildkit's releases.

v0.14.1

Welcome to the 0.14.1 release of buildkit!

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Contributors

  • Talon Bowler
  • Akihiro Suda
  • Tõnis Tiigi
  • Paweł Gronowski

Notable Changes

  • Builtin Dockerfile frontend has been updated to v1.8.1 changelog
  • Fix possible issue on pushing blobs with rewrite-timestamp=true option #5040
  • Fix possible concurrency issue on handling HTTPS to HTTP fallbacks for insecure registries #5044

Dependency Changes

This release has no dependency changes

Previous release can be found at v0.14.0

v0.14.0

Welcome to the 0.14.0 release of buildkit!

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Contributors

  • Tõnis Tiigi
  • CrazyMax
  • Talon James Bowler
  • Akihiro Suda
  • Jonathan A. Sternberg
  • Justin Chadwell
  • David Karlsson
  • Sebastiaan van Stijn
  • Anthony Nandaa
  • Erik Sipsma
  • Aleksa Sarai
  • Adam Perlin
  • Shaun Thompson

... (truncated)

Commits
  • eb864a8 Merge pull request #5053 from tonistiigi/v0.14.1-cherry-picks
  • dedaef0 shell: handle empty string for var replacements
  • b45ab30 Initialize build args from stage base
  • e34c21a Consolidate instruction casing lint rules
  • 050e3b6 Updates lint output to print detail instead of description
  • 2bf5cbf util/resolver: Make httpFallback concurrent safe
  • 49dd5f4 Adds 'WARNING' prefix to the rule check output and update lint
  • 05bd56b Merge pull request #5040 from AkihiroSuda/cherrypick-5008-0.14
  • 5a7352c Fix content not found with push=true,rewrite-timestamp=true
  • 4d9a4e5 Merge pull request #5017 from crazy-max/fix-history-exporters
  • Additional commits viewable in compare view


Updates github.com/spf13/cobra from 1.8.0 to 1.8.1

Release notes

Sourced from github.com/spf13/cobra's releases.

v1.8.1

✨ Features

🐛 Bug fixes

🔧 Maintenance

🧪 Testing & CI/CD

✏️ Documentation

... (truncated)

Commits


Updates github.com/tetratelabs/wazero from 1.7.2 to 1.7.3

Release notes

Sourced from github.com/tetratelabs/wazero's releases.

v1.7.3

Time to celebrate the new wazero release! This time has not only the important bugs fixes just like before, but more importantly comes with the drastic "compilation time" performance improvements!

Bug fixes

Compilation perf improvements

@​mathetake worked so hard to improve the compilation performance which some users had raised issue about since the release of the optimizing compiler in 1.7.0. The idea is that even though this is partly because it is "optimizing", there are still rooms for improvements in its codebase to use less CPU/memory.

The below is the compilation time benchmark on the various standard library tests for Zig, Go and TinyGo compared to the previous v1.7.2. You can see the huge results up to like 50% faster and ~50% less memory usage. Note that this doesn't affect any runtime performance -- that means your code runs just exactly like before while having faster compilation!😎

goos: darwin
goarch: arm64
pkg: github.com/tetratelabs/wazero/internal/integration_test/stdlibs
                                                   │   old.txt    │              new.txt               │
                                                   │    sec/op    │   sec/op     vs base               │
Zig/Compile/test-opt.wasm-10                           4.872 ± 2%    3.389 ± 3%  -30.44% (p=0.001 n=7)
Zig/Compile/test.wasm-10                               5.926 ± 2%    4.162 ± 1%  -29.76% (p=0.001 n=7)
TinyGo/Compile/container_heap.test-10                 677.2m ± 0%   306.3m ± 1%  -54.76% (p=0.001 n=7)
TinyGo/Compile/container_list.test-10                 673.2m ± 1%   309.3m ± 8%  -54.05% (p=0.001 n=7)
TinyGo/Compile/container_ring.test-10                 665.1m ± 1%   299.5m ± 0%  -54.97% (p=0.001 n=7)
TinyGo/Compile/crypto_des.test-10                     686.4m ± 0%   311.6m ± 0%  -54.61% (p=0.001 n=7)
TinyGo/Compile/crypto_md5.test-10                     685.5m ± 1%   312.7m ± 4%  -54.38% (p=0.001 n=7)
TinyGo/Compile/crypto_rc4.test-10                     666.5m ± 0%   297.9m ± 0%  -55.31% (p=0.001 n=7)
TinyGo/Compile/crypto_sha1.test-10                    683.7m ± 0%   310.1m ± 0%  -54.65% (p=0.001 n=7)
TinyGo/Compile/crypto_sha256.test-10                  692.0m ± 1%   315.0m ± 2%  -54.48% (p=0.001 n=7)
TinyGo/Compile/crypto_sha512.test-10                  692.7m ± 0%   316.6m ± 1%  -54.29% (p=0.001 n=7)
TinyGo/Compile/encoding_ascii85.test-10               680.6m ± 1%   309.3m ± 1%  -54.55% (p=0.001 n=7)
TinyGo/Compile/encoding_base32.test-10               1637.6m ± 1%   650.8m ± 0%  -60.26% (p=0.001 n=7)
TinyGo/Compile/encoding_csv.test-10                   740.0m ± 1%   333.5m ± 0%  -54.92% (p=0.001 n=7)
TinyGo/Compile/encoding_hex.test-10                   708.7m ± 3%   320.9m ± 0%  -54.72% (p=0.001 n=7)
TinyGo/Compile/go_scanner.test-10                     773.2m ± 1%   347.1m ± 6%  -55.11% (p=0.001 n=7)
TinyGo/Compile/hash.test-10                           951.8m ± 1%   410.8m ± 0%  -56.84% (p=0.001 n=7)
TinyGo/Compile/hash_adler32.test-10                   665.8m ± 1%   297.5m ± 0%  -55.32% (p=0.001 n=7)
TinyGo/Compile/hash_crc64.test-10                     893.9m ± 1%   385.1m ± 1%  -56.92% (p=0.001 n=7)
TinyGo/Compile/hash_fnv.test-10                       695.8m ± 2%   312.4m ± 0%  -55.10% (p=0.001 n=7)
TinyGo/Compile/html.test-10                            2.426 ± 1%    2.012 ± 1%  -17.07% (p=0.001 n=7)
TinyGo/Compile/internal_itoa.test-10                  662.5m ± 1%   296.0m ± 1%  -55.32% (p=0.001 n=7)
TinyGo/Compile/internal_profile.test-10               893.6m ± 1%   417.9m ± 0%  -53.24% (p=0.001 n=7)
TinyGo/Compile/math.test-10                           821.1m ± 0%   398.4m ± 0%  -51.48% (p=0.001 n=7)
TinyGo/Compile/math_cmplx.test-10                     701.7m ± 0%   338.8m ± 1%  -51.71% (p=0.001 n=7)
TinyGo/Compile/net.test-10                            755.4m ± 1%   356.5m ± 3%  -52.81% (p=0.001 n=7)
TinyGo/Compile/net_http_internal_ascii.test-10        661.5m ± 1%   296.8m ± 2%  -55.14% (p=0.001 n=7)
TinyGo/Compile/net_mail.test-10                       927.1m ± 2%   398.9m ± 2%  -56.97% (p=0.001 n=7)
TinyGo/Compile/os.test-10                             754.9m ± 0%   370.5m ± 0%  -50.92% (p=0.001 n=7)
</tr></table>

... (truncated)

Commits


Updates golang.org/x/mod from 0.17.0 to 0.18.0

Commits


Updates google.golang.org/protobuf from 1.34.1 to 1.34.2

Updates helm.sh/helm/v3 from 3.15.1 to 3.15.2

Release notes

Sourced from helm.sh/helm/v3's releases.

Helm v3.15.2 is a security (patch) release. Users are strongly recommended to update to this release.

The com... _Description has been truncated_

knqyf263 commented 2 weeks ago

Now, github.com/aws/aws-sdk-go-v2 is also included...

dependabot[bot] commented 2 weeks ago

Looks like these dependencies are updatable in another way, so this is no longer needed.