search

cisco-open / flame

flame is a federated learning system for edge with flexibility and scalability at the core of its design.
Apache License 2.0
56 stars 28 forks source link

chore(deps): bump the go_modules group across 1 directory with 11 updates #572

Closed dependabot[bot] closed 5 months ago

dependabot[bot] commented 5 months ago

Bumps the go_modules group with 3 updates in the / directory: google.golang.org/grpc, helm.sh/helm/v3 and golang.org/x/crypto.

Updates google.golang.org/grpc from 1.45.0 to 1.56.3

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.56.3

Security

  • server: prohibit more than MaxConcurrentStreams handlers from running at once (CVE-2023-44487)

    In addition to this change, applications should ensure they do not leave running tasks behind related to the RPC before returning from method handlers, or should enforce appropriate limits on any such work.

Release 1.56.2

  • status: To fix a panic, status.FromError now returns an error with codes.Unknown when the error implements the GRPCStatus() method, and calling GRPCStatus() returns nil. (#6374)

Release 1.56.1

  • client: handle empty address lists correctly in addrConn.updateAddrs

Release 1.56.0

New Features

  • client: support channel idleness using WithIdleTimeout dial option (#6263)
    • This feature is currently disabled by default, but will be enabled with a 30 minute default in the future.
  • client: when using pickfirst, keep channel state in TRANSIENT_FAILURE until it becomes READY (gRFC A62) (#6306)
  • xds: Add support for Custom LB Policies (gRFC A52) (#6224)
  • xds: support pick_first Custom LB policy (gRFC A62) (#6314) (#6317)
  • client: add support for pickfirst address shuffling (gRFC A62) (#6311)
  • xds: Add support for String Matcher Header Matcher in RDS (#6313)
  • xds/outlierdetection: Add Channelz Logger to Outlier Detection LB (#6145)
  • xds: enable RLS in xDS by default (#6343)
  • orca: add support for application_utilization field and missing range checks on several metrics setters
  • balancer/weightedroundrobin: add new LB policy for balancing between backends based on their load reports (gRFC A58) (#6241)
  • authz: add conversion of json to RBAC Audit Logging config (#6192)
  • authz: add support for stdout logger (#6230 and #6298)
  • authz: support customizable audit functionality for authorization policy (#6192 #6230 #6298 #6158 #6304 and #6225)

Bug Fixes

  • orca: fix a race at startup of out-of-band metric subscriptions that would cause the report interval to request 0 (#6245)
  • xds/xdsresource: Fix Outlier Detection Config Handling and correctly set xDS Defaults (#6361)
  • xds/outlierdetection: Fix Outlier Detection Config Handling by setting defaults in ParseConfig() (#6361)

API Changes

  • orca: allow a ServerMetricsProvider to be passed to the ORCA service and ServerOption (#6223)

Release 1.55.1

  • status: To fix a panic, status.FromError now returns an error with codes.Unknown when the error implements the GRPCStatus() method, and calling GRPCStatus() returns nil. (#6374)

Release 1.55.0

Behavior Changes

  • xds: enable federation support by default (#6151)
  • status: status.Code and status.FromError handle wrapped errors (#6031 and #6150)

... (truncated)

Commits
  • 1055b48 Update version.go to 1.56.3 (#6713)
  • 5efd7bd server: prohibit more than MaxConcurrentStreams handlers from running at once...
  • bd1f038 Upgrade version.go to 1.56.3-dev (#6434)
  • faab873 Update version.go to v1.56.2 (#6432)
  • 6b0b291 status: fix panic when servers return a wrapped error with status OK (#6374) ...
  • ed56401 [PSM interop] Don't fail target if sub-target already failed (#6390) (#6405)
  • cd6a794 Update version.go to v1.56.2-dev (#6387)
  • 5b67e5e Update version.go to v1.56.1 (#6386)
  • d0f5150 client: handle empty address lists correctly in addrConn.updateAddrs (#6354) ...
  • 997c1ea Change version to 1.56.1-dev (#6345)
  • Additional commits viewable in compare view


Updates google.golang.org/protobuf from 1.28.1 to 1.30.0

Updates helm.sh/helm/v3 from 3.8.1 to 3.14.3

Release notes

Sourced from helm.sh/helm/v3's releases.

Helm v3.14.3 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v3.14.3. The common platform binaries are here:

This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @​mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.14.4 will contain only bug fixes and be released on April 10, 2024.
  • 3.15.0 is the next feature release and will be on May 08, 2024.

Changelog

  • Add a note about --dry-run displaying secrets f03cc04caaa8f6d7c3e67cf918929150cf6f3f12 (Matt Farina)
  • add error messages 1a7330fe3802beeb3f897a1c701d8a4b9c1316c5 (George Jenkins)
  • Fix: Ignore alias validation error for index load d6acc0027dca47dec40ccdd66febd0c8bcf4813f (George Jenkins)
  • chore(deps): bump github.com/containerd/containerd from 1.7.11 to 1.7.12 b2738fb782d149ffa4748cb0ee78d674986d04b0 (dependabot[bot])
  • chore(deps): bump github.com/DATA-DOG/go-sqlmock from 1.5.0 to 1.5.2 5b0847e0e763e98bcbf8a12e8f9c5f7c11d123a1 (dependabot[bot])
  • Update architecture detection method 7e18c39f0753c73e4660f3796f01f5b33f2552b5 (weidongkl)

Helm v3.14.2 is a security (patch) release. Users are strongly recommended to update to this release.

A Helm contributor discovered uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content.

Jakub Ciolek with AlphaSense discovered the vulnerability.

Installation and Upgrading

... (truncated)

Commits
  • f03cc04 Add a note about --dry-run displaying secrets
  • 1a7330f add error messages
  • d6acc00 Fix: Ignore alias validation error for index load
  • b2738fb chore(deps): bump github.com/containerd/containerd from 1.7.11 to 1.7.12
  • 5b0847e chore(deps): bump github.com/DATA-DOG/go-sqlmock from 1.5.0 to 1.5.2
  • 7e18c39 Update architecture detection method
  • c309b6f Some fixes
  • e8858f8 validation fix
  • 3fc9f4b Improve release action
  • 69dcc92 bump version to
  • Additional commits viewable in compare view


Updates k8s.io/apimachinery from 0.23.4 to 0.29.0

Commits
  • 3c8c1f2 update go.mod
  • 12dc3f8 Merge pull request #113374 from ahmedtd/kep-3257-projected-types
  • 03a1b4b LRUExpireCache: Allow removing multiple keys under lock
  • bc0a03b Merge pull request #119762 from AxeZhan/PollUntilContextCancel
  • 16d50e6 Merge pull request #121552 from pohly/klog-update
  • 6b13b03 dependencies: klog v2.110.1
  • 96ae302 Merge pull request #121575 from apelisse/update-smd
  • 458fd90 Merge pull request #120707 from Jefftree/csa-openapiv3
  • 850727f Merge pull request #120592 from AxeZhan/validation_sets
  • 8dbf841 managedfields: Allow duplicates for built-in updates associative lists
  • Additional commits viewable in compare view


Updates github.com/containerd/containerd from 1.5.9 to 1.7.12

Release notes

Sourced from github.com/containerd/containerd's releases.

containerd 1.7.12

Welcome to the v1.7.12 release of containerd!

The twelfth patch release for containerd 1.7 contains various fixes and updates.

Notable Updates

  • Fix on dialer function for Windows (#9501)
  • Improve /etc/group handling when appending groups (#9544)
  • Update shim pidfile permissions to 0644 (#9548)
  • Update runc binary to v1.1.11 (#9596)
  • Allow import and export to reference missing content (#9600)
  • Remove runc import (#9605)
  • Update Go version to 1.20.13 (#9624)

Deprecation Warnings

  • Emit deprecation warning for containerd.io/restart.logpath label usage (#9567)

See the changelog for complete list of changes

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

  • Akihiro Suda
  • Sebastiaan van Stijn
  • Wei Fu
  • Derek McGowan
  • Paweł Gronowski
  • Jaroslav Jindrak
  • Maksym Pavlenko
  • Samuel Karp
  • Anthony Nandaa
  • Bjorn Neergaard
  • Djordje Lukic
  • Kay Yan

Changes

  • [release/1.7] Prepare release notes for v1.7.12 (#9632)
    • 775d544fe Prepare release notes for v1.7.12
  • [release/1.7] update to go1.20.13, test go1.21.6 (#9624)
    • a5dc5b894 update to go1.20.13, test go1.21.6
  • [release/1.7] shim: Create pid-file and address with 0644 permissions (#9548)
    • 8d82242eb shim: Create address file with 0644 permissions
    • 260963a35 shim: Create pid-file with 0644 permissions

... (truncated)

Commits
  • 71909c1 Merge pull request #9632 from dmcgowan/prepare-v1.7.12
  • 775d544 Prepare release notes for v1.7.12
  • 4ebe8e2 Merge pull request #9624 from thaJeztah/1.7_update_golang_1.20.13
  • a5dc5b8 update to go1.20.13, test go1.21.6
  • 50e7359 Merge pull request #9548 from Dzejrou/1.7_fix_ignoring_umask
  • 5a675f2 Merge pull request #9602 from thaJeztah/1.7_backport_no_execabs
  • ccca466 Merge pull request #9605 from thaJeztah/1.7_backport_switch_moby_user
  • 9251072 remove github.com/opencontainers/runc dependency
  • 4e67213 vendor: github.com/cncf-tags/container-device-interface v0.6.1
  • e0ee0be go.mod: github.com/opencontainers/runtime-spec v1.1.0
  • Additional commits viewable in compare view


Updates github.com/cyphar/filepath-securejoin from 0.2.3 to 0.2.4

Release notes

Sourced from github.com/cyphar/filepath-securejoin's releases.

v0.2.4

This release fixes a potential security issue in filepath-securejoin when used on Windows (GHSA-6xv5-86q9-7xr8, which could be used to generate paths outside of the provided rootfs in certain cases), as well as improving the overall behaviour of filepath-securejoin when dealing with Windows paths that contain volume names. Thanks to Paulo Gomes for discovering and fixing these issues.

In addition, we've switched (at long last) to GitHub Actions and have continuous integration testing on Linux, MacOS, and Windows.

Thanks to the following contributors for making this release possible:

Signed-off-by: Aleksa Sarai cyphar@cyphar.com

Commits


Updates github.com/docker/distribution from 2.7.1+incompatible to 2.8.2+incompatible

Release notes

Sourced from github.com/docker/distribution's releases.

v2.8.2

What's Changed

Full Changelog: https://github.com/distribution/distribution/compare/v2.8.1...v2.8.2

v2.8.2-beta.2

What's Changed

Full Changelog: https://github.com/distribution/distribution/compare/v2.8.1...v2.8.2-beta.2

v2.8.2-beta.1

NOTE: This is a pre-release that does not contain any artifacts!

What's Changed

Full Changelog: https://github.com/distribution/distribution/compare/v2.8.1...v2.8.2-beta.1

v2.8.1

Welcome to the v2.8.1 release of registry!

The 2.8.1 registry release fixes the Go module issues that have popped up in the v2.8.0

... (truncated)

Commits
  • 7c354a4 Merge pull request #3915 from distribution/2.8.2-release-notes
  • a173a9c Add v2.8.2 release notes
  • 4894d35 Merge pull request #3914 from vvoland/handle-forbidden-28
  • f067f66 Merge pull request #3783 from ndeloof/accept-encoding-28
  • 483ad69 registry/errors: Parse http forbidden as denied
  • 2b0f84d Revert "registry/client: set Accept: identity header when getting layers"
  • 320d6a1 Merge pull request #3912 from distribution/2.8.2-beta.2-release-notes
  • 5f3ca1b Add release notes for 2.8.2-beta.2 release
  • cb840f6 Merge pull request #3911 from thaJeztah/2.8_backport_fix_releaser_filenames
  • e884644 Dockerfile: fix filenames of artifacts
  • Additional commits viewable in compare view


Updates github.com/docker/docker from 20.10.12+incompatible to 24.0.7+incompatible

Release notes

Sourced from github.com/docker/docker's releases.

v24.0.7

24.0.7

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Bug fixes and enhancements

  • Write overlay2 layer metadata atomically. moby/moby#46703
  • Fix "Rootful-in-Rootless" Docker-in-Docker on systemd version 250 and later. moby/moby#46626
  • Fix dockerd-rootless-setuptools.sh when username contains a backslash. moby/moby#46407
  • Fix a bug that would prevent network sandboxes to be fully deleted when stopping containers with no network attachments and when dockerd --bridge=none is used. moby/moby#46702
  • Fix a bug where cancelling an API request could interrupt container restart. moby/moby#46697
  • Fix an issue where containers would fail to start when providing --ip-range with a range larger than the subnet. docker/for-mac#6870
  • Fix data corruption with zstd output. moby/moby#46709
  • Fix the conditions under which the container's MAC address is applied. moby/moby#46478
  • Improve the performance of the stats collector. moby/moby#46448
  • Fix an issue with source policy rules ending up in the wrong order. moby/moby#46441

Packaging updates

Security

v24.0.6

24.0.6

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Bug fixes and enhancements

  • containerd storage backend: Fix docker ps failing when a container image is no longer present in the content store. moby/moby#46095
  • containerd storage backend: Fix docker ps -s -a and docker container prune failing when a container image config is no longer present in the content store. moby/moby#46097
  • containerd storage backend: Fix docker inspect failing when a container image config is no longer (or was never) present in the content store. moby/moby#46244
  • containerd storage backend: Fix diff and export with the overlayfs snapshotter by using reference-counted rootfs mounts. moby/moby#46266
  • containerd storage backend: Fix a misleading error message when the image platforms available locally do not match the desired platform. moby/moby#46300
  • containerd storage backend: Fix the FROM scratch Dockerfile instruction with the classic builder. moby/moby#46302
  • containerd storage backend: Fix mismatched image rootfs and manifest layers errors with the classic builder. moby/moby#46310

... (truncated)

Commits
  • 311b9ff Merge pull request #46697 from thaJeztah/24.0_backport_restart_nocancel
  • af60804 Merge pull request from GHSA-jq35-85cj-fj4p
  • 3cf363e Merge pull request #46709 from thaJeztah/24.0_backport_bump_compress
  • 05d7386 daemon: daemon.containerRestart: don't cancel restart on context cancel
  • 649c944 Merge pull request #46703 from thaJeztah/24.0_backport_atomic-layer-data-write
  • 9b20b1a Merge pull request #46702 from thaJeztah/24.0_backport_releaseNetwork_Network...
  • dd37b0b vendor: github.com/klauspost/compress v1.17.2
  • 7058c0d vendor: github.com/klauspost/compress v1.16.5
  • 57bd388 daemon: overlay2: Write layer metadata atomically
  • 05d95fd daemon: release sandbox even when NetworkDisabled
  • Additional commits viewable in compare view


Updates github.com/prometheus/client_golang from 1.11.0 to 1.16.0

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.16.0

What's Changed

  • [BUGFIX] api: Switch to POST for LabelNames, Series, and QueryExemplars. #1252
  • [BUGFIX] api: Fix undefined execution order in return statements. #1260
  • [BUGFIX] native histograms: Fix bug in bucket key calculation. #1279
  • [ENHANCEMENT] Reduce constrainLabels allocations for all metrics. #1272
  • [ENHANCEMENT] promhttp: Add process start time header for scrape efficiency. #1278
  • [ENHANCEMENT] promlint: Improve metricUnits runtime. #1286

New Contributors

Full Changelog: https://github.com/prometheus/client_golang/compare/v1.15.1...v1.16.0

v1.15.1

Changes

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.16.0 / 2023-06-15

  • [BUGFIX] api: Switch to POST for LabelNames, Series, and QueryExemplars. #1252
  • [BUGFIX] api: Fix undefined execution order in return statements. #1260
  • [BUGFIX] native histograms: Fix bug in bucket key calculation. #1279
  • [ENHANCEMENT] Reduce constrainLabels allocations for all metrics. #1272
  • [ENHANCEMENT] promhttp: Add process start time header for scrape efficiency. #1278
  • [ENHANCEMENT] promlint: Improve metricUnits runtime. #1286

1.15.1 / 2023-05-3

  • [BUGFIX] Fixed promhttp.Instrument* handlers wrongly trying to attach exemplar to unsupported metrics (e.g. summary),
    causing panics. #1253

1.15.0 / 2023-04-13

  • [BUGFIX] Fix issue with atomic variables on ppc64le. #1171
  • [BUGFIX] Support for multiple samples within same metric. #1181
  • [BUGFIX] Bump golang.org/x/text to v0.3.8 to mitigate CVE-2022-32149. #1187
  • [ENHANCEMENT] Add exemplars and middleware examples. #1173
  • [ENHANCEMENT] Add more context to "duplicate label names" error to enable debugging. #1177
  • [ENHANCEMENT] Add constrained labels and constrained variant for all MetricVecs. #1151
  • [ENHANCEMENT] Moved away from deprecated github.com/golang/protobuf package. #1183
  • [ENHANCEMENT] Add possibility to dynamically get label values for http instrumentation. #1066
  • [ENHANCEMENT] Add ability to Pusher to add custom headers. #1218
  • [ENHANCEMENT] api: Extend and improve efficiency of json-iterator usage. #1225
  • [ENHANCEMENT] Added (official) support for go 1.20. #1234
  • [ENHANCEMENT] timer: Added support for exemplars. #1233
  • [ENHANCEMENT] Filter expected metrics as well in CollectAndCompare. #1143
  • [ENHANCEMENT] :warning: Only set start/end if time is not Zero. This breaks compatibility in experimental api package. If you strictly depend on empty time.Time as actual value, the behavior is now changed. #1238

1.14.0 / 2022-11-08

  • [FEATURE] Add Support for Native Histograms. #1150
  • [CHANGE] Extend prometheus.Registry to implement prometheus.Collector interface. #1103

1.13.1 / 2022-11-01

  • [BUGFIX] Fix race condition with Exemplar in Counter. #1146
  • [BUGFIX] Fix CumulativeCount value of +Inf bucket created from exemplar. #1148
  • [BUGFIX] Fix double-counting bug in promhttp.InstrumentRoundTripperCounter. #1118

1.13.0 / 2022-08-05

  • [CHANGE] Minimum required Go version is now 1.17 (we also test client_golang against new 1.19 version).
  • [ENHANCEMENT] Added prometheus.TransactionalGatherer interface for promhttp.Handler use which allows using low allocation update techniques for custom collectors. #989
  • [ENHANCEMENT] Added exemplar support to prometheus.NewConstHistogram. See ExampleNewConstHistogram_WithExemplar example on how to use it. #986
  • [ENHANCEMENT] prometheus/push.Pusher has now context aware methods that pass context to HTTP request. #1028
  • [ENHANCEMENT] prometheus/push.Pusher has now Error method that retrieve last error. #1075
  • [ENHANCEMENT] testutil.GatherAndCompare provides now readable diff on failed comparisons. #998

... (truncated)

Commits
  • 3583c1e Cut v1.16.0 (#1292)
  • 2feda42 Fixed README & CHANGELOG; Added fmt makefile command (+bingo) for easier cont...
  • 5b9cf9c Merge pull request #1290 from prometheus/fix-nh-docstring-refs
  • 1b19d5f Fix docstring references to renamed native histogram fields / functions.
  • 7352ab7 Moving fully to GH actions. (#1288)
  • e4ff34d Improve metricUnits runtime (#1286)
  • 781ea28 added circleci as gh action YAML (#1281)
  • a09a1d3 Reduce constrainLabels allocations (#1272)
  • 8840afc Bump github.com/prometheus/procfs from 0.9.0 to 0.10.1 (#1283)
  • 5e78d5f Merge pull request #1279 from prometheus/beorn7/histogram
  • Additional commits viewable in compare view


Updates golang.org/x/crypto from 0.17.0 to 0.23.0

Commits
  • 905d78a go.mod: update golang.org/x dependencies
  • ebb717d ssh: validate key type in SSH_MSG_USERAUTH_PK_OK response
  • 0da2a6a openpgp: fix function name in comment
  • 5defcc1 sha3: fix Sum results for SHAKE functions on s390x
  • d042a39 go.mod: update golang.org/x dependencies
  • b92bf94 ssh: respect MaxAuthTries also for "none" auth attempts
  • 6f79b5a ssh: add server side multi-step authentication
  • 8d0d405 x/crypto/chacha20: cleanup chacha_ppc64le.s
  • b91329d all: remove redundant words in comments and fix some typos
  • 7067223 go.mod: update golang.org/x dependencies
  • Additional commits viewable in compare view


Updates golang.org/x/net from 0.10.0 to 0.21.0

Commits
myungjin commented 5 months ago

handled by #574

dependabot[bot] commented 5 months ago

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml