livekit / protocol

LiveKit protocol. Protobuf definitions for LiveKit's signaling protocol
https://docs.livekit.io
Apache License 2.0
73 stars 62 forks source link

Update module github.com/hashicorp/go-retryablehttp to v0.7.7 [SECURITY] - autoclosed #748

Closed renovate[bot] closed 3 months ago

renovate[bot] commented 3 months ago

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
github.com/hashicorp/go-retryablehttp v0.7.5 -> v0.7.7 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-6104

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.


Release Notes

hashicorp/go-retryablehttp (github.com/hashicorp/go-retryablehttp) ### [`v0.7.7`](https://togithub.com/hashicorp/go-retryablehttp/compare/v0.7.6...v0.7.7) [Compare Source](https://togithub.com/hashicorp/go-retryablehttp/compare/v0.7.6...v0.7.7) ### [`v0.7.6`](https://togithub.com/hashicorp/go-retryablehttp/compare/v0.7.5...v0.7.6) [Compare Source](https://togithub.com/hashicorp/go-retryablehttp/compare/v0.7.5...v0.7.6)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.



This PR has been generated by Mend Renovate. View repository job log here.

renovate[bot] commented 3 months ago

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

Details:

Package Change
golang.org/x/sys v0.18.0 -> v0.20.0
changeset-bot[bot] commented 3 months ago

⚠️ No Changeset found

Latest commit: 51449350bdd0efa3c638469dae6206b6dea52384

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

💥 An error occurred when fetching the changed packages and changesets in this PR ``` Some errors occurred when validating the changesets config: The package or glob expression "github.com/livekit/protocol" specified in the `fixed` option does not match any package in the project. You may have misspelled the package name or provided an invalid glob expression. Note that glob expressions must be defined according to https://www.npmjs.com/package/micromatch. ```