martinbaillie / vault-plugin-secrets-github

Create ephemeral, finely-scoped @github access tokens using @hashicorp Vault.
https://martin.baillie.id/wrote/ephemeral-github-tokens-via-hashicorp-vault/
Apache License 2.0
269 stars 24 forks source link

Bump github.com/hashicorp/vault/sdk from 0.6.0 to 0.6.1 #99

Closed dependabot[bot] closed 1 year ago

dependabot[bot] commented 1 year ago

Bumps github.com/hashicorp/vault/sdk from 0.6.0 to 0.6.1.

Changelog

Sourced from github.com/hashicorp/vault/sdk's changelog.

0.6.1 (August 22, 2016)

DEPRECATIONS/CHANGES:

  • Once the active node is 0.6.1, standby nodes must also be 0.6.1 in order to connect to the HA cluster. We recommend following our general upgrade instructions in addition to 0.6.1-specific upgrade instructions to ensure that this is not an issue.
  • Status codes for sealed/uninitialized Vaults have changed to 503/501 respectively. See the version-specific upgrade guide for more details.
  • Root tokens (tokens with the root policy) can no longer be created except by another root token or the generate-root endpoint.
  • Issued certificates from the pki backend against new roles created or modified after upgrading will contain a set of default key usages.
  • The dynamodb physical data store no longer supports HA by default. It has some non-ideal behavior around failover that was causing confusion. See the documentation for information on enabling HA mode. It is very important that this configuration is added before upgrading.
  • The ldap backend no longer searches for memberOf groups as part of its normal flow. Instead, the desired group filter must be specified. This fixes some errors and increases speed for directories with different structures, but if this behavior has been relied upon, ensure that you see the upgrade notes before upgrading.
  • app-id is now deprecated with the addition of the new AppRole backend. There are no plans to remove it, but we encourage using AppRole whenever possible, as it offers enhanced functionality and can accommodate many more types of authentication paradigms.

FEATURES:

  • AppRole Authentication Backend: The approle backend is a machine-oriented authentication backend that provides a similar concept to App-ID while adding many missing features, including a pull model that allows for the backend to generate authentication credentials rather than requiring operators or other systems to push credentials in. It should be useful in many more situations than App-ID. The inclusion of this backend deprecates App-ID. GH-1426
  • Request Forwarding: Vault servers can now forward requests to each other rather than redirecting clients. This feature is off by default in 0.6.1 but will be on by default in the next release. See the HA concepts page for information on enabling and configuring it. GH-443
  • Convergent Encryption in Transit: The transit backend now supports a convergent encryption mode where the same plaintext will produce the same ciphertext. Although very useful in some situations, this has potential security implications, which are mostly mitigated by requiring the use of

... (truncated)

Commits


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
codecov-commenter commented 1 year ago

Codecov Report

Merging #99 (2a61a3f) into master (072ee83) will not change coverage. The diff coverage is n/a.

@@           Coverage Diff           @@
##           master      #99   +/-   ##
=======================================
  Coverage   97.06%   97.06%           
=======================================
  Files          12       12           
  Lines         853      853           
=======================================
  Hits          828      828           
  Misses         18       18           
  Partials        7        7           

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

dependabot[bot] commented 1 year ago

Superseded by #105.