search

hashicorp / terraform-exec

Terraform CLI commands via Go.
https://pkg.go.dev/github.com/hashicorp/terraform-exec
Mozilla Public License 2.0
661 stars 111 forks source link

build(deps): bump github.com/cloudflare/circl from 1.3.3 to 1.3.7 #433

Closed dependabot[bot] closed 8 months ago

dependabot[bot] commented 8 months ago

Bumps github.com/cloudflare/circl from 1.3.3 to 1.3.7.

Release notes

Sourced from github.com/cloudflare/circl's releases.

CIRCL v1.3.7

What's Changed

New Contributors

Full Changelog: https://github.com/cloudflare/circl/compare/v1.3.6...v1.3.7

CIRCL v1.3.6

What's Changed

New Contributors

Full Changelog: https://github.com/cloudflare/circl/compare/v1.3.3...v1.3.6

Commits
  • c48866b Releasing CIRCL v1.3.7
  • 75ef91e kyber: remove division by q in ciphertext compression
  • 899732a build(deps): bump golang.org/x/crypto
  • 99f0f71 Releasing CIRCL v1.3.6
  • e728d0d Apply thibmeu code review suggestions
  • ceb2d90 Updating blindrsa to be compliant with RFC9474.
  • 44133f7 spelling: tripped
  • c2076d6 spelling: transposes
  • dad2166 spelling: title
  • 171c418 spelling: threshold
  • Additional commits viewable in compare view


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/hashicorp/terraform-exec/network/alerts).
radeksimko commented 8 months ago

I do not see an angle in which the vulnerability https://github.com/hashicorp/terraform-exec/security/dependabot/8 could impact this project (we don't use the impacted part of the library AFAICT) and so it would be more reasonable to wait for hc-install update, which bring this dependency through github.com/ProtonMail/go-crypto, i.e. wait until ProtonMail decides to update their own dependency chain first.

https://github.com/ProtonMail/go-crypto

dependabot[bot] commented 8 months ago

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

kmoe commented 8 months ago

Agree, this project does not use Kyber.

radeksimko commented 8 months ago

A PR updating the dependency was raised upstream https://github.com/ProtonMail/go-crypto/pull/194