search

dapr / go-sdk

Dapr SDK for go
Apache License 2.0
441 stars 170 forks source link

Bump github.com/dapr/dapr from 1.13.0 to 1.13.3 #568

Closed dependabot[bot] closed 1 month ago

dependabot[bot] commented 1 month ago

Bumps github.com/dapr/dapr from 1.13.0 to 1.13.3.

Release notes

Sourced from github.com/dapr/dapr's releases.

Dapr Runtime v1.13.3

Dapr 1.13.3

This update includes bug fixes:

App API token forwarded from caller to receiving app

Problem

The caller sidecar is appending the local app API token to the egress request, thereby leaking the API token protecting the local app to the foreign sidecar.

Impact

Receiving app can have access to the calling app's API token and make unauthorized calls directly to the originating app - in case it is listening on 0.0.0.0 or an accessible IP address.

Root cause

A pull request accidentally added this change.

Solution

Fixed the issue and added integration tests to verify and avoid future regressions.

Upgrade Go version to 1.21.9

Problem

Go version 1.21.8 or older are impacted by CVE-2023-45288.

Impact

See https://nvd.nist.gov/vuln/detail/CVE-2023-45288

Root cause

See https://nvd.nist.gov/vuln/detail/CVE-2023-45288

Solution

Update Go version used to build Dapr.

Placement server fails to disseminate placement tables

Problem

... (truncated)

Commits
  • 4c359b5 Fix MacOS tests. (#7748)
  • e0591e4 Merge pull request from GHSA-284c-x8m7-9w5h
  • 3cc0fc0 update to go 1.21.9 (#7726)
  • afae0ad check for returned error (#7668)
  • 1ac185d Restore legacy dapr_http_server_response_count HTTP metric (#7662)
  • f09b193 Merge pull request #7670 from yaron2/contrib-1
  • 8d24cc5 update to contrib 1.13.1 for kafka avro fix
  • 121f5e4 [1.13] Pubsub: Execute in-flight subscribed messages in background context. (...
  • 5beb6df [1.13] Fix incorrect content-length being sent to HTTP published message (#7661)
  • 1b3c480 [1.13] cherry pick: Fix daprd hotreload operator stream re-establishment caus...
  • See full diff in compare view


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
dependabot[bot] commented 1 month ago

Superseded by #569.