search

martinbaillie / vault-plugin-secrets-github

Create ephemeral, finely-scoped @github access tokens using @hashicorp Vault.
https://martin.baillie.id/wrote/ephemeral-github-tokens-via-hashicorp-vault/
Apache License 2.0
269 stars 24 forks source link

Bump github.com/hashicorp/vault/sdk from 0.6.0 to 0.6.2 #105

Closed dependabot[bot] closed 1 year ago

dependabot[bot] commented 1 year ago

Bumps github.com/hashicorp/vault/sdk from 0.6.0 to 0.6.2.

Changelog

Sourced from github.com/hashicorp/vault/sdk's changelog.

0.6.2 (October 5, 2016)

DEPRECATIONS/CHANGES:

  • Convergent Encryption v2: New keys in transit using convergent mode will use a new nonce derivation mechanism rather than require the user to supply a nonce. While not explicitly increasing security, it minimizes the likelihood that a user will use the mode improperly and impact the security of their keys. Keys in convergent mode that were created in v0.6.1 will continue to work with the same mechanism (user-supplied nonce).
  • etcd HA off by default: Following in the footsteps of dynamodb, the etcd storage backend now requires that ha_enabled be explicitly specified in the configuration file. The backend currently has known broken HA behavior, so this flag discourages use by default without explicitly enabling it. If you are using this functionality, when upgrading, you should set ha_enabled to "true" before starting the new versions of Vault.
  • Default/Max lease/token TTLs are now 32 days: In previous versions of Vault the default was 30 days, but moving it to 32 days allows some operations (e.g. reauthenticating, renewing, etc.) to be performed via a monthly cron job.
  • AppRole Secret ID endpoints changed: Secret ID and Secret ID accessors are no longer part of request URLs. The GET and DELETE operations are now moved to new endpoints (/lookup and /destroy) which consumes the input from the body and not the URL.
  • AppRole requires at least one constraint: previously it was sufficient to turn off all AppRole authentication constraints (secret ID, CIDR block) and use the role ID only. It is now required that at least one additional constraint is enabled. Existing roles are unaffected, but any new roles or updated roles will require this.
  • Reading wrapped responses from cubbyhole/response is deprecated. The sys/wrapping/unwrap endpoint should be used instead as it provides additional security, auditing, and other benefits. The ability to read directly will be removed in a future release.
  • Request Forwarding is now on by default: in 0.6.1 this required toggling on, but is now enabled by default. This can be disabled via the "disable_clustering" parameter in Vault's config, or per-request with the X-Vault-No-Request-Forwarding header.
  • In prior versions a bug caused the bound_iam_role_arn value in the aws-ec2 authentication backend to actually use the instance profile ARN. This has been corrected, but as a result there is a behavior change. To match using the instance profile ARN, a new parameter bound_iam_instance_profile_arn has been added. Existing roles will automatically transfer the value over to the correct parameter, but the next time the role is updated, the new meanings will take effect.

FEATURES:

  • Secret ID CIDR Restrictions in AppRole: Secret IDs generated under an approle can now specify a list of CIDR blocks from where the requests to

... (truncated)

Commits


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
codecov-commenter commented 1 year ago

Codecov Report

Merging #105 (3548980) into master (072ee83) will not change coverage. The diff coverage is n/a.

@@           Coverage Diff           @@
##           master     #105   +/-   ##
=======================================
  Coverage   97.06%   97.06%           
=======================================
  Files          12       12           
  Lines         853      853           
=======================================
  Hits          828      828           
  Misses         18       18           
  Partials        7        7

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

dependabot[bot] commented 1 year ago

Superseded by #106.