search

morningconsult / docker-credential-vault-login

Automatically gets docker credentials from Hashicorp Vault
Apache License 2.0
77 stars 11 forks source link

chore(deps): bump github.com/hashicorp/vault/sdk from 0.5.1 to 0.5.2 #94

Closed dependabot[bot] closed 2 years ago

dependabot[bot] commented 2 years ago

Bumps github.com/hashicorp/vault/sdk from 0.5.1 to 0.5.2.

Changelog

Sourced from github.com/hashicorp/vault/sdk's changelog.

0.5.2 (March 16th, 2016)

FEATURES:

  • MSSQL Backend: Generate dynamic unique MSSQL database credentials based on configured roles GH-998
  • Token Accessors: Vault now provides an accessor with each issued token. This accessor is an identifier that can be used for a limited set of actions, notably for token revocation. This value can be logged in plaintext to audit logs, and in combination with the plaintext metadata logged to audit logs, provides a searchable and straightforward way to revoke particular users' or services' tokens in many cases. To enable plaintext audit logging of these accessors, set hmac_accessor=false when enabling an audit backend.
  • Token Credential Backend Roles: Roles can now be created in the token credential backend that allow modifying token behavior in ways that are not otherwise exposed or easily delegated. This allows creating tokens with a fixed set (or subset) of policies (rather than a subset of the calling token's), periodic tokens with a fixed TTL but no expiration, specified prefixes, and orphans.
  • Listener Certificate Reloading: Vault's configured listeners now reload their TLS certificate and private key when the Vault process receives a SIGHUP.

IMPROVEMENTS:

  • auth/token: Endpoints optionally accept tokens from the HTTP body rather than just from the URLs GH-1211
  • auth/token,sys/capabilities: Added new endpoints auth/token/lookup-accessor, auth/token/revoke-accessor and sys/capabilities-accessor, which enables performing the respective actions with just the accessor of the tokens, without having access to the actual token GH-1188
  • core: Ignore leading / in policy paths GH-1170
  • core: Ignore leading / in mount paths GH-1172
  • command/policy-write: Provided HCL is now validated for format violations and provides helpful information around where the violation occurred GH-1200
  • command/server: The initial root token ID when running in -dev mode can now be specified via -dev-root-token-id or the environment variable VAULT_DEV_ROOT_TOKEN_ID GH-1162
  • command/server: The listen address when running in -dev mode can now be specified via -dev-listen-address or the environment variable VAULT_DEV_LISTEN_ADDRESS GH-1169
  • command/server: The configured listeners now reload their TLS certificates/keys when Vault is SIGHUP'd GH-1196
  • command/step-down: New vault step-down command and API endpoint to force the targeted node to give up active status, but without sealing. The node will wait ten seconds before attempting to grab the lock again. GH-1146
  • command/token-renew: Allow no token to be passed in; use renew-self in

... (truncated)

Commits
  • 77f2b8a Cut version 0.5.2
  • 1a28dc8 Remove us building Solaris binaries for the moment, as they don't build succe...
  • d887ecb Normalize userpass errors around bad user/pass
  • 33c2641 Use 400 instead of 500 for failing to provide a userpass password.
  • 0676a34 No need for the old Dockerfile for patched 1.5.3 anymore; it's in history if ...
  • b9b4f45 Merge pull request #1216 from hashicorp/userpass-update
  • 4ae83b7 Add comments to existence functions
  • 2fc3c23 changelog++
  • daab5d6 Fix SanitizeTTL check
  • 6f2b428 Addessing review comments
  • Additional commits viewable in compare view


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
dependabot[bot] commented 2 years ago

Superseded by #96.