This release includes breaking changes such as the removal of the user_settings module and changes to exceptions raised during artifact recording. Additionally, it incorporates changes for issues captured in security advisories GHSA-p86f-xmg6-9q4x, GHSA-jjgp-whrp-gq8m, and GHSA-wc64-c5rv-32pf, the last of which has been assigned CVE-2023-32076.
This release includes breaking changes such as the removal of the user_settings
module and changes to exceptions raised during artifact recording. Additionally,
it incorporates changes for issues captured in security advisories
GHSA-p86f-xmg6-9q4x,
GHSA-jjgp-whrp-gq8m,
and
GHSA-wc64-c5rv-32pf,
the last of which has been assigned
CVE-2023-32076.
You can trigger a rebase of this PR by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
> **Note**
> Automatic rebases have been disabled on this pull request as it has been open for over 30 days.
dependabot[bot]
commented
1 year ago
Bumps in-toto from 1.4.0 to 2.0.0.
Release notes
Sourced from in-toto's releases.
Changelog
Sourced from in-toto's changelog.
Commits
3467cd9Merge pull request #596 from adityasaky/prepare-v2.0.0f650734Prepare v2.0.0e1aec8aMerge pull request from GHSA-jjgp-whrp-gq8m3a21d84Merge pull request from GHSA-wc64-c5rv-32pf9835aaeClarify settings docsf88138cDrop user_settings module3555a80Update verification documentation3989c84Merge pull request #594 from adityasaky/add-py3117a9a970Add Python 3.11 to test matrixca32f6dRemove extra " from test descriptionYou can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)