search

neicnordic / sensitive-data-archive

https://neic-sda.readthedocs.io
3 stars 6 forks source link

Bump the all-modules group in /sda-download with 2 updates #921

Closed dependabot[bot] closed 1 week ago

dependabot[bot] commented 1 week ago

Bumps the all-modules group in /sda-download with 2 updates: github.com/aws/aws-sdk-go and github.com/lestrrat-go/jwx/v2.

Updates github.com/aws/aws-sdk-go from 1.54.3 to 1.54.6

Release notes

Sourced from github.com/aws/aws-sdk-go's releases.

Release v1.54.6 (2024-06-20)

Service Client Updates

  • service/bedrock-runtime: Updates service API and documentation
  • service/codeartifact: Updates service API and documentation
  • service/compute-optimizer: Updates service API and documentation
  • service/cost-optimization-hub: Updates service API, documentation, and waiters
  • service/dynamodb: Updates service API, documentation, waiters, paginators, and examples
    • Doc-only update for DynamoDB. Fixed Important note in 6 Global table APIs - CreateGlobalTable, DescribeGlobalTable, DescribeGlobalTableSettings, ListGlobalTables, UpdateGlobalTable, and UpdateGlobalTableSettings.
  • service/glue: Updates service paginators
    • Fix Glue paginators for Jobs, JobRuns, Triggers, Blueprints and Workflows.
  • service/ivs-realtime: Updates service API, documentation, and waiters
  • service/sagemaker: Updates service API and documentation
    • Adds support for model references in Hub service, and adds support for cross-account access of Hubs
  • service/securityhub: Updates service API and documentation

Release v1.54.5 (2024-06-19)

Service Client Updates

  • service/artifact: Updates service API, documentation, waiters, and examples
  • service/athena: Updates service API
    • Add v2 smoke tests and smithy smokeTests trait for SDK testing.
  • service/cur: Updates service API
    • Add v2 smoke tests and smithy smokeTests trait for SDK testing.
  • service/directconnect: Updates service API
    • Add v2 smoke tests and smithy smokeTests trait for SDK testing.
  • service/elastictranscoder: Updates service API
    • Add v2 smoke tests and smithy smokeTests trait for SDK testing.
  • service/opensearch: Updates service API and documentation

Release v1.54.4 (2024-06-18)

Service Client Updates

  • service/bedrock-runtime: Updates service API and documentation
  • service/cloudtrail: Updates service API
    • Add v2 smoke tests and smithy smokeTests trait for SDK testing.
  • service/config: Updates service API
  • service/eks: Updates service API and documentation
  • service/lightsail: Updates service API
    • Add v2 smoke tests and smithy smokeTests trait for SDK testing.
  • service/polly: Updates service API
    • Add v2 smoke tests and smithy smokeTests trait for SDK testing.
  • service/rekognition: Updates service API
    • Add v2 smoke tests and smithy smokeTests trait for SDK testing.
  • service/sagemaker: Updates service API, documentation, and paginators
    • Launched a new feature in SageMaker to provide managed MLflow Tracking Servers for customers to track ML experiments. This release also adds a new capability of attaching additional storage to SageMaker HyperPod cluster instances.
  • service/shield: Updates service API

... (truncated)

Commits


Updates github.com/lestrrat-go/jwx/v2 from 2.0.21 to 2.1.0

Release notes

Sourced from github.com/lestrrat-go/jwx/v2's releases.

v2.1.0

v2.1.0 18 Jun 2024
[New Features]
  * [jwt] Added `jwt.ParseCookie()` function
  * [jwt] `jwt.ParseRequest()` can now accept a new option, jwt.WithCookieKey() to
    specify a cookie name to extract the token from.
  * [jwt] `jwt.ParseRequest()` and `jwt.ParseCookie()` can accept the `jwt.WithCookie()` option,
    which will, upon successful token parsing, make the functions assign the *http.Cookie
    used to parse the token. This allows users to further inspect the cookie where the
    token came from, should the need arise.
  * [jwt] (BREAKING CHANGE) `jwt.ParseRequest()` no longer automatically looks for "Authorization" header when
    only `jwt.WithFormKey()` is used. This behavior is the same for `jwt.WithCookieKey()` and
    any similar options that may be implemented in the future.

  # previously
  jwt.ParseRequest(req) // looks under Authorization
  jwt.ParseReuqest(req, jwt.WithFormKey("foo")) // looks under foo AND Authorization
  jwt.ParseReuqest(req, jwt.WithHeaderKey("Authorization"), jwt.WithFormKey("foo")) // looks under foo AND Authorization

  # since this release
  jwt.ParseRequest(req) // same as before
  jwt.ParseRequest(req, jwt.WithFormKey("foo")) // looks under foo
  jwt.ParseReuqest(req, jwt.WithHeaderKey("Authorization"), jwt.WithFormKey("foo")) // looks under foo AND Authorization



    

  • 

    [jwt] Add jwt.WithResetValidators() option to jwt.Validate(). This option
will allow you to tell jwt.Validate() to NOT automatically check the
default validators (iat, exp, and nbf), so that you can completely customize
the validation with the validators you specify using jwt.WithValidator().
    

    This sort of behavior is useful for special cases such as
https://openid.net/specs/openid-connect-rpinitiated-1_0.html. However, you SHOULD NOT
use this option unless you know exactly what you are doing, as this will pose
significant security issues when used incorrectly.
    

    • 

  • 

    [jwk] Provide a stop-gap measure to work with PEM format ASN.1 DER encoded secp256k1 keys.
    

    • 



In order to enable this feature, you must compile jwx with TWO build tags:
`jwx_es256k` to enable ES256K/secp256k1, and `jwx_secp256k1_pem` to enable PEM handling.
Not one, but BOTH tags need to be present.

With this change, by suppliying the `WithPEM(true)` option, `jwk.Parse()` is now
able to read sep256k1 keys. Also, `jwk.Pem()` should be able to handle `jwk.Key` objects
that represent a secp256k1 key.

Please do note that the implementation of this feature is dodgy at best. Currently
Go's crypto/x509 does not allow handling additional EC curves, and thus in order to
accomodate secp256k1 keys in PEM/ASN.1 DER format we need to "patch" the stdlib.
We do this by copy-and-pasting relevant parts of go 1.22.2's crypto/x509 code and
adding the minimum required code to make secp256k1 keys work.



</tr></table>

... (truncated)

Changelog

Sourced from github.com/lestrrat-go/jwx/v2's changelog.

v2.1.0 18 Jun 2024 [New Features]

  • [jwt] Added jwt.ParseCookie() function

  • [jwt] jwt.ParseRequest() can now accept a new option, jwt.WithCookieKey() to specify a cookie name to extract the token from.

  • [jwt] jwt.ParseRequest() and jwt.ParseCookie() can accept the jwt.WithCookie() option, which will, upon successful token parsing, make the functions assign the *http.Cookie used to parse the token. This allows users to further inspect the cookie where the token came from, should the need arise.

  • [jwt] (BREAKING CHANGE) jwt.ParseRequest() no longer automatically looks for "Authorization" header when only jwt.WithFormKey() is used. This behavior is the same for jwt.WithCookieKey() and any similar options that may be implemented in the future.

    previously

    jwt.ParseRequest(req) // looks under Authorization jwt.ParseReuqest(req, jwt.WithFormKey("foo")) // looks under foo AND Authorization jwt.ParseReuqest(req, jwt.WithHeaderKey("Authorization"), jwt.WithFormKey("foo")) // looks under foo AND Authorization

    since this release

    jwt.ParseRequest(req) // same as before jwt.ParseRequest(req, jwt.WithFormKey("foo")) // looks under foo jwt.ParseReuqest(req, jwt.WithHeaderKey("Authorization"), jwt.WithFormKey("foo")) // looks under foo AND Authorization

  • [jwt] Add jwt.WithResetValidators() option to jwt.Validate(). This option will allow you to tell jwt.Validate() to NOT automatically check the default validators (iat, exp, and nbf), so that you can completely customize the validation with the validators you specify using jwt.WithValidator().

    This sort of behavior is useful for special cases such as https://openid.net/specs/openid-connect-rpinitiated-1_0.html. However, you SHOULD NOT use this option unless you know exactly what you are doing, as this will pose significant security issues when used incorrectly.

  • [jwk] Provide a stop-gap measure to work with PEM format ASN.1 DER encoded secp256k1 keys.

    In order to enable this feature, you must compile jwx with TWO build tags: jwx_es256k to enable ES256K/secp256k1, and jwx_secp256k1_pem to enable PEM handling. Not one, but BOTH tags need to be present.

    With this change, by suppliying the WithPEM(true) option, jwk.Parse() is now able to read sep256k1 keys. Also, jwk.Pem() should be able to handle jwk.Key objects that represent a secp256k1 key.

    Please do note that the implementation of this feature is dodgy at best. Currently Go's crypto/x509 does not allow handling additional EC curves, and thus in order to accomodate secp256k1 keys in PEM/ASN.1 DER format we need to "patch" the stdlib. We do this by copy-and-pasting relevant parts of go 1.22.2's crypto/x509 code and adding the minimum required code to make secp256k1 keys work.

    Because of the above, there are several important caveats for this feature:

... (truncated)

Commits


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions