search

hashicorp / hcat

Hashicorp Configuration and Templating library (hcat, pronounced hashicat)
Mozilla Public License 2.0
95 stars 12 forks source link

Bump github.com/hashicorp/consul/api from 1.4.0 to 1.15.2 #117

Closed dependabot[bot] closed 1 year ago

dependabot[bot] commented 1 year ago

Bumps github.com/hashicorp/consul/api from 1.4.0 to 1.15.2.

Release notes

Sourced from github.com/hashicorp/consul/api's releases.

v1.14.0-beta1

1.14.0-beta1 (September 29, 2022)

BREAKING CHANGES:

  • config: Add new ports.grpc_tls configuration option. Introduce a new port to better separate TLS config from the existing ports.grpc config. The new ports.grpc_tls only supports TLS encrypted communication. The existing ports.grpc currently supports both plain-text and tls communication, but tls support will be removed in a future release. [GH-14294]
  • xds: Convert service mesh failover to use Envoy's aggregate clusters. This changes the names of some Envoy dynamic HTTP metrics. [GH-14178]

FEATURES:

  • http: Add new get-or-empty operation to the txn api. Refer to the API docs for more information. [GH-14474]
  • peering: Add support to failover to services running on cluster peers. [GH-14396]
  • peering: Add support to redirect to services running on cluster peers with service resolvers. [GH-14445]
  • ui: Added support for central config merging [GH-14604]
  • ui: Detect a TokenSecretID cookie and passthrough to localStorage [GH-14495]
  • ui: Use withCredentials for all HTTP API requests [GH-14343]
  • xds: servers will limit the number of concurrent xDS streams they can handle to balance the load across all servers [GH-14397]

IMPROVEMENTS:

  • agent/hcp: add initial HashiCorp Cloud Platform integration [GH-14723]
  • api: Add filtering support to Catalog's List Services (v1/catalog/services) [GH-11742]
  • api: Increase max number of operations inside a transaction for requests to /v1/txn (128) [GH-14599]
  • config-entry: Validate that service-resolver Failovers and Redirects only specify Partition and Namespace on Consul Enterprise. This prevents scenarios where OSS Consul would save service-resolvers that require Consul Enterprise. [GH-14162]
  • dns: (Enterprise Only) All enterprise locality labels are now optional in DNS lookups. For example, service lookups support the following format: .].service[..ns][..ap][..dc]`. [GH-14679]
  • metrics: Service RPC calls less than 1ms are now emitted as a decimal number. [GH-12905]
  • peering: adds an internally managed server certificate for automatic TLS between servers in peer clusters. [GH-14556]
  • xds: Set max_ejection_percent on Envoy's outlier detection to 100% for peered services. [GH-14373]

BUG FIXES:

  • checks: Do not set interval as timeout value [GH-14619]
  • checks: If set, use proxy address for automatically added sidecar check instead of service address. [GH-14433]
  • cli: Fix Consul kv CLI 'GET' flags 'keys' and 'recurse' to be set together [GH-13493]
  • metrics: Add duplicate metrics that have only a single "consul_" prefix for all existing metrics with double ("consul_consul_") prefix, with the intent to standardize on single prefixes. [GH-14475]
  • snapshot-agent: (Enterprise only) Fix a bug when a session is not found in Consul, which leads the agent to panic.

v1.13.2

1.13.2 (September 20, 2022)

SECURITY:

  • auto-config: Added input validation for auto-config JWT authorization checks. Prior to this change, it was possible for malicious actors to construct requests which incorrectly pass custom JWT claim validation for the AutoConfig.InitialConfiguration endpoint. Now, only a subset of characters are allowed for the input before evaluating the bexpr. [GH-14577]
  • connect: Added URI length checks to ConnectCA CSR requests. Prior to this change, it was possible for a malicious actor to designate multiple SAN URI values in a call to the ConnectCA.Sign endpoint. The endpoint now only allows for exactly one SAN URI to be specified. [GH-14579]

... (truncated)

Changelog

Sourced from github.com/hashicorp/consul/api's changelog.

1.11.10 (September 22, 2022)

BUG FIXES:

  • kvs: Fixed a bug where query options were not being applied to KVS.Get RPC operations. [GH-13344]

1.13.2 (September 20, 2022)

BREAKING CHANGES:

  • ca: If using Vault as the service mesh CA provider, the Vault policy used by Consul now requires the update capability on the intermediate PKI's tune mount configuration endpoint, such as /sys/mounts/connect_inter/tune. The breaking nature of this change will be resolved in an upcoming 1.13 patch release. Refer to upgrade guidance for more information.

SECURITY:

  • auto-config: Added input validation for auto-config JWT authorization checks. Prior to this change, it was possible for malicious actors to construct requests which incorrectly pass custom JWT claim validation for the AutoConfig.InitialConfiguration endpoint. Now, only a subset of characters are allowed for the input before evaluating the bexpr. [GH-14577]
  • connect: Added URI length checks to ConnectCA CSR requests. Prior to this change, it was possible for a malicious actor to designate multiple SAN URI values in a call to the ConnectCA.Sign endpoint. The endpoint now only allows for exactly one SAN URI to be specified. [GH-14579]

FEATURES:

  • cli: Adds new subcommands for peering workflows. Refer to the CLI docs for more information. [GH-14423]
  • connect: Server address changes are streamed to peers [GH-14285]
  • service-defaults: Added support for local_request_timeout_ms and local_connect_timeout_ms in servicedefaults config entry [GH-14395]

IMPROVEMENTS:

  • connect: Bump latest Envoy to 1.23.1 in test matrix [GH-14573]
  • connect: expose new tracing configuration on envoy [GH-13998]
  • envoy: adds additional Envoy outlier ejection parameters to passive health check configurations. [GH-14238]
  • metrics: add labels of segment, partition, network area, network (lan or wan) to serf and memberlist metrics [GH-14161]
  • peering: Validate peering tokens for server name conflicts [GH-14563]
  • snapshot agent: (Enterprise only) Add support for path-based addressing when using s3 backend.
  • ui: Reuse connections for requests to /v1/internal/ui/metrics-proxy/ [GH-14521]

BUG FIXES:

  • agent: Fixes an issue where an agent that fails to start due to bad addresses won't clean up any existing listeners [GH-14081]
  • api: Fix a breaking change caused by renaming QueryDatacenterOptions to QueryFailoverOptions. This adds QueryDatacenterOptions back as an alias to QueryFailoverOptions and marks it as deprecated. [GH-14378]
  • ca: Fixed a bug with the Vault CA provider where the intermediate PKI mount and leaf cert role were not being updated when the CA configuration was changed. [GH-14516]
  • cli: When launching a sidecar proxy with consul connect envoy or consul connect proxy, the -sidecar-for service ID argument is now treated as case-insensitive. [GH-14034]
  • connect: Fix issue where auto_config and auto_encrypt could unintentionally enable TLS for gRPC xDS connections. [GH-14269]
  • connect: Fixed a bug where old root CAs would be removed from the primary datacenter after switching providers and restarting the cluster. [GH-14598]
  • connect: Fixed an issue where intermediate certificates could build up in the root CA because they were never being pruned after expiring. [GH-14429]
  • connect: Fixed some spurious issues during peering establishment when a follower is dialed [GH-14119]
  • envoy: validate name before deleting proxy default configurations. [GH-14290]
  • peering: Fix issue preventing deletion and recreation of peerings in TERMINATED state. [GH-14364]
  • rpc: Adds max jitter to client deadlines to prevent i/o deadline errors on blocking queries [GH-14233]
  • tls: undo breaking change that prevented setting TLS for gRPC when using config flags available in Consul v1.11. [GH-14668]

... (truncated)

Commits
  • 54c05c9 api: update sdk version
  • 767a604 backport of commit 8be23dd6ffef72a5143bbf7d74246808aca00aec (#14683)
  • 6fbe899 Backport of ui: Completely remove the Overview routes when running the UI in ...
  • 3c321b6 Backport of doc(peering): missing network requirement for peering and the par...
  • 15d9715 Allow setting TLS for gRPC with deprecated options [1.13.x] (#14668)
  • 05a1747 backport of commit 546f1ec634297d1453c37118654a449ce97992db (#14666)
  • 7d250aa Backport of docs: Search Refresh Fixes into release/1.13.x (#14662)
  • 2866390 Backport of docs: Search Refresh Fixes into release/1.13.x (#14659)
  • 4087241 docs: Fix spelling errors on website (#14634)
  • 82023b0 Merge pull request #14647 from hashicorp/backport/docs/search-metadata-header...
  • Additional commits viewable in compare view


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
dependabot[bot] commented 1 year ago

Looks like github.com/hashicorp/consul/api is up-to-date now, so this is no longer needed.