open-component-model / ocm

Open Component Model (Software Bill of Delivery) Toolset
https://ocm.software
Apache License 2.0
34 stars 23 forks source link

Bump the go group with 34 updates #662

Closed dependabot[bot] closed 8 months ago

dependabot[bot] commented 8 months ago

Bumps the go group with 34 updates:

Package From To
github.com/go-logr/logr 1.3.0 1.4.1
github.com/hashicorp/vault-client-go 0.4.2 0.4.3
github.com/onsi/gomega 1.27.6 1.31.1
golang.org/x/net 0.17.0 0.19.0
k8s.io/apimachinery 0.28.4 0.29.2
github.com/aws/aws-sdk-go-v2 1.21.2 1.25.0
github.com/aws/aws-sdk-go-v2/config 1.19.1 1.27.0
github.com/aws/aws-sdk-go-v2/credentials 1.13.43 1.17.0
github.com/aws/aws-sdk-go-v2/feature/s3/manager 1.11.33 1.16.0
github.com/aws/aws-sdk-go-v2/service/ecr 1.20.2 1.25.1
github.com/aws/aws-sdk-go-v2/service/s3 1.40.0 1.49.0
github.com/containerd/containerd 1.7.11 1.7.13
github.com/containers/image/v5 5.21.1 5.29.2
github.com/docker/go-connections 0.4.0 0.5.0
github.com/fluxcd/pkg/ssa 0.24.1 0.36.0
github.com/go-openapi/strfmt 0.21.7 0.22.0
github.com/go-openapi/swag 0.22.4 0.22.9
github.com/goccy/go-yaml 1.9.5 1.11.3
github.com/klauspost/compress 1.17.2 1.17.3
github.com/mittwald/go-helm-client 0.12.3 0.12.7
github.com/onsi/ginkgo/v2 2.9.4 2.15.0
github.com/sigstore/cosign/v2 2.2.1 2.2.3
github.com/sigstore/rekor 1.3.3 1.3.4
github.com/sigstore/sigstore 1.7.5 1.8.1
github.com/tonglil/buflogr 1.0.1 1.1.1
golang.org/x/exp 0.0.0-20231006140011-7918f672742d 0.0.0-20240103183307-be819d1f06fc
golang.org/x/oauth2 0.13.0 0.16.0
helm.sh/helm/v3 3.12.2 3.13.3
k8s.io/api 0.28.4 0.29.0
k8s.io/apiextensions-apiserver 0.27.2 0.29.0
k8s.io/cli-runtime 0.27.2 0.29.0
sigs.k8s.io/cli-utils 0.34.0 0.35.0
sigs.k8s.io/controller-runtime 0.14.4 0.16.3
k8s.io/client-go 0.28.4 0.29.0

Updates github.com/go-logr/logr from 1.3.0 to 1.4.1

Release notes

Sourced from github.com/go-logr/logr's releases.

v1.4.1

What's Changed

Full Changelog: https://github.com/go-logr/logr/compare/v1.4.0...v1.4.1

v1.4.0

This release dramatically improves interoperability with Go's log/slog package. In particular, logr.NewContext and logr.NewContextWithSlogLogger use the same context key, which allows logr.FromContext and logr.FromContextAsSlogLogger to return logr.Logger or *slog.Logger respectively, including transparently converting each to the other as needed.

Functions logr/slogr.NewLogr and logr/slogr.ToSlogHandler have been superceded by logr.FromSlogHandler and logr.ToSlogHandler respectively, and type logr/slogr.SlogSink has been superceded by logr.SlogSink. All of the old names in logr/slogr remain, for compatibility.

Package logr/funcr now supports logr.SlogSink, meaning that it's output passes all but one of the Slog conformance tests (that exception being that funcr handles the timestamp itself).

Users who have a logr.Logger and need a *slog.Logger can call slog.New(logr.ToSlogHandler(...)) and all output will go through the same stack.

Users who have a *slog.Logger or slog.Handler can call logr.FromSlogHandler(...) and all output will go through the same stack.

What's Changed

New Contributors

Full Changelog: https://github.com/go-logr/logr/compare/v1.3.0...v1.4.0

Commits
  • dcdc3f2 slogr: fix unintended API break in v0.8.0 (#253)
  • 5d88f52 funcr: Add LogInfoLevel Option to skip logging level in the info log (#240)
  • 177005d build(deps): bump actions/upload-artifact from 3.1.3 to 4.0.0
  • e7f489a build(deps): bump github/codeql-action from 2.22.9 to 3.22.11
  • cf56c3b build(deps): bump actions/setup-go from 4 to 5
  • 2ad296e build(deps): bump github/codeql-action from 2.22.8 to 2.22.9
  • d55b4e2 Merge pull request #241 from thockin/master
  • 98ee9d9 Clean up slog testing and restore coverage
  • b228ba8 Break examples to new file
  • 6432877 Add benchmarks for slogSink
  • Additional commits viewable in compare view


Updates github.com/hashicorp/vault-client-go from 0.4.2 to 0.4.3

Release notes

Sourced from github.com/hashicorp/vault-client-go's releases.

v0.4.3

0.4.3 (diff) - 2023-12-28

Fixed

  • Fixed error parsing for errors with non-standard response bodies (#247).

See the full CHANGELOG.md

Changelog

Sourced from github.com/hashicorp/vault-client-go's changelog.

[0.4.3][] ([diff][0.4.3-diff]) - 2023-12-15

Fixed

  • Fixed error parsing for errors with non-standard response bodies (#247).
Commits


Updates github.com/onsi/gomega from 1.27.6 to 1.31.1

Release notes

Sourced from github.com/onsi/gomega's releases.

v1.31.1

1.31.1

Fixes

  • Inverted arguments order of FailureMessage of BeComparableToMatcher [e0dd999]
  • Update test in case keeping msg is desired [ad1a367]

Maintenance

  • Show how to import the format sub package [24e958d]
  • tidy up go.sum [26661b8]
  • bump dependencies [bde8f7a]

v1.31.0

1.31.0

Features

  • Async assertions include context cancellation cause if present [121c37f]

Maintenance

  • Bump minimum go version [dee1e3c]
  • docs: fix typo in example usage "occured" -> "occurred" [49005fe]
  • Bump actions/setup-go from 4 to 5 (#714) [f1c8757]
  • Bump github/codeql-action from 2 to 3 (#715) [9836e76]
  • Bump github.com/onsi/ginkgo/v2 from 2.13.0 to 2.13.2 (#713) [54726f0]
  • Bump golang.org/x/net from 0.17.0 to 0.19.0 (#711) [df97ecc]
  • docs: fix HaveExactElement typo (#712) [a672c86]

v1.30.0

1.30.0

Features

  • BeTrueBecause and BeFalseBecause allow for better failure messages [4da4c7f]

Maintenance

  • Bump actions/checkout from 3 to 4 (#694) [6ca6e97]
  • doc: fix type on gleak go doc [f1b8343]

v1.29.0

1.29.0

Features

  • MatchError can now take an optional func(error) bool + description [2b39142]

v1.28.1

1.28.1

Maintenance

  • Bump github.com/onsi/ginkgo/v2 from 2.12.0 to 2.13.0 [635d196]
  • Bump github.com/google/go-cmp from 0.5.9 to 0.6.0 [14f8859]
  • Bump golang.org/x/net from 0.14.0 to 0.17.0 [d8a6508]

... (truncated)

Changelog

Sourced from github.com/onsi/gomega's changelog.

1.31.1

Fixes

  • Inverted arguments order of FailureMessage of BeComparableToMatcher [e0dd999]
  • Update test in case keeping msg is desired [ad1a367]

Maintenance

  • Show how to import the format sub package [24e958d]
  • tidy up go.sum [26661b8]
  • bump dependencies [bde8f7a]

1.31.0

Features

  • Async assertions include context cancellation cause if present [121c37f]

Maintenance

  • Bump minimum go version [dee1e3c]
  • docs: fix typo in example usage "occured" -> "occurred" [49005fe]
  • Bump actions/setup-go from 4 to 5 (#714) [f1c8757]
  • Bump github/codeql-action from 2 to 3 (#715) [9836e76]
  • Bump github.com/onsi/ginkgo/v2 from 2.13.0 to 2.13.2 (#713) [54726f0]
  • Bump golang.org/x/net from 0.17.0 to 0.19.0 (#711) [df97ecc]
  • docs: fix HaveExactElement typo (#712) [a672c86]

1.30.0

Features

  • BeTrueBecause and BeFalseBecause allow for better failure messages [4da4c7f]

Maintenance

  • Bump actions/checkout from 3 to 4 (#694) [6ca6e97]
  • doc: fix type on gleak go doc [f1b8343]

1.29.0

Features

  • MatchError can now take an optional func(error) bool + description [2b39142]

1.28.1

Maintenance

  • Bump github.com/onsi/ginkgo/v2 from 2.12.0 to 2.13.0 [635d196]
  • Bump github.com/google/go-cmp from 0.5.9 to 0.6.0 [14f8859]
  • Bump golang.org/x/net from 0.14.0 to 0.17.0 [d8a6508]
  • #703 doc(matchers): HaveEach() doc comment updated [2705bdb]
  • Minor typos (#699) [375648c]

1.28.0

... (truncated)

Commits
  • 762b171 v1.31.1
  • 26661b8 tidy up go.sum
  • bde8f7a bump dependencies
  • 24e958d Show how to import the format sub package
  • ad1a367 Update test in case keeping msg is desired
  • e0dd999 Inverted arguments order of FailureMessage of BeComparableToMatcher
  • ba8bba2 v1.31.0
  • 121c37f Async assertions include context cancellation cause if present
  • dee1e3c Bump minimum go version
  • 49005fe docs: fix typo in example usage "occured" -> "occurred"
  • Additional commits viewable in compare view


Updates golang.org/x/net from 0.17.0 to 0.19.0

Commits
  • a8e0109 go.mod: update golang.org/x dependencies
  • 13e88dd quic: rename listener{_test}.go to endpoint{_test}.go
  • e26b9a4 quic: rename Listener to Endpoint
  • 399218d quic: implement stream flush
  • d87f99b quic: idle timeouts, handshake timeouts, and keepalive
  • 7b5abfa quic: basic qlog support
  • fbaf412 go.mod: update golang.org/x dependencies
  • cc6f4d1 http2: remove ancient build-tagged files for unsupported Go versions
  • a720b30 http2: allocate buffer pools using pointers to arrays
  • a7ef1a2 internal/quic/cmd/interop: don't t.Log after test finishes
  • Additional commits viewable in compare view


Updates k8s.io/apimachinery from 0.28.4 to 0.29.2

Commits


Updates github.com/aws/aws-sdk-go-v2 from 1.21.2 to 1.25.0

Commits


Updates github.com/aws/aws-sdk-go-v2/config from 1.19.1 to 1.27.0

Commits


Updates github.com/aws/aws-sdk-go-v2/credentials from 1.13.43 to 1.17.0

Changelog

Sourced from github.com/aws/aws-sdk-go-v2/credentials's changelog.

Release (2022-10-21)

General Highlights

  • Dependency Update: Updated to the latest SDK module versions

Module Highlights

  • github.com/aws/aws-sdk-go-v2: v1.17.0
    • Feature: Adds aws.IsCredentialsProvider for inspecting CredentialProvider types when needing to determine if the underlying implementation type matches a target type. This resolves an issue where CredentialsCache could mask AnonymousCredentials providers, breaking downstream detection logic.
  • github.com/aws/aws-sdk-go-v2/service/cognitoidentityprovider: v1.21.0
    • Feature: This release adds a new "DeletionProtection" field to the UserPool in Cognito. Application admins can configure this value with either ACTIVE or INACTIVE value. Setting this field to ACTIVE will prevent a user pool from accidental deletion.
  • github.com/aws/aws-sdk-go-v2/service/eventbridge: v1.16.16
    • Bug Fix: The SDK client has been updated to utilize the aws.IsCredentialsProvider function for determining if aws.AnonymousCredentials has been configured for the CredentialProvider.
  • github.com/aws/aws-sdk-go-v2/service/s3: v1.29.0
    • Feature: S3 on Outposts launches support for automatic bucket-style alias. You can use the automatic access point alias instead of an access point ARN for any object-level operation in an Outposts bucket.
    • Bug Fix: The SDK client has been updated to utilize the aws.IsCredentialsProvider function for determining if aws.AnonymousCredentials has been configured for the CredentialProvider.
  • github.com/aws/aws-sdk-go-v2/service/sagemaker: v1.49.0
    • Feature: CreateInferenceRecommenderjob API now supports passing endpoint details directly, that will help customers to identify the max invocation and max latency they can achieve for their model and the associated endpoint along with getting recommendations on other instances.
  • github.com/aws/aws-sdk-go-v2/service/sts: v1.17.0
    • Feature: Add presign functionality for sts:AssumeRole operation

Release (2022-10-20)

Module Highlights

  • github.com/aws/aws-sdk-go-v2/service/devopsguru: v1.20.0
    • Feature: This release adds information about the resources DevOps Guru is analyzing.
  • github.com/aws/aws-sdk-go-v2/service/globalaccelerator: v1.15.0
    • Feature: Global Accelerator now supports AddEndpoints and RemoveEndpoints operations for standard endpoint groups.
  • github.com/aws/aws-sdk-go-v2/service/resiliencehub: v1.7.0
    • Feature: In this release, we are introducing support for regional optimization for AWS Resilience Hub applications. It also includes a few documentation updates to improve clarity.
  • github.com/aws/aws-sdk-go-v2/service/rum: v1.7.0
    • Feature: CloudWatch RUM now supports Extended CloudWatch Metrics with Additional Dimensions

Release (2022-10-19)

General Highlights

  • Dependency Update: Updated to the latest SDK module versions

Module Highlights

  • github.com/aws/aws-sdk-go-v2/service/chimesdkmessaging: v1.11.6
    • Documentation: Documentation updates for Chime Messaging SDK
  • github.com/aws/aws-sdk-go-v2/service/cloudtrail: v1.19.0
    • Feature: This release includes support for exporting CloudTrail Lake query results to an Amazon S3 bucket.
  • github.com/aws/aws-sdk-go-v2/service/configservice: v1.27.0
    • Feature: This release adds resourceType enums for AppConfig, AppSync, DataSync, EC2, EKS, Glue, GuardDuty, SageMaker, ServiceDiscovery, SES, Route53 types.
  • github.com/aws/aws-sdk-go-v2/service/connect: v1.33.0
    • Feature: This release adds API support for managing phone numbers that can be used across multiple AWS regions through telephony traffic distribution.
  • github.com/aws/aws-sdk-go-v2/service/managedblockchain: v1.13.0
    • Feature: Adding new Accessor APIs for Amazon Managed Blockchain
  • github.com/aws/aws-sdk-go-v2/service/s3: v1.28.0
    • Feature: Updates internal logic for constructing API endpoints. We have added rule-based endpoints and internal model parameters.

... (truncated)

Commits


Updates github.com/aws/aws-sdk-go-v2/feature/s3/manager from 1.11.33 to 1.16.0

Changelog

Sourced from github.com/aws/aws-sdk-go-v2/feature/s3/manager's changelog.

Release (2022-03-23)

General Highlights

  • Dependency Update: Updated to the latest SDK module versions

Module Highlights

  • github.com/aws/aws-sdk-go-v2: v1.16.0
    • Feature: Update CredentialsCache to make use of two new optional CredentialsProvider interfaces to give the cache, per provider, behavior how the cache handles credentials that fail to refresh, and adjusting expires time. See aws.CredentialsCache for more details.
    • Feature: Update ec2rolecreds package's Provider to implememnt support for CredentialsCache new optional caching strategy interfaces, HandleFailRefreshCredentialsCacheStrategy and AdjustExpiresByCredentialsCacheStrategy.
  • github.com/aws/aws-sdk-go-v2/credentials: v1.11.0
    • Feature: Update ec2rolecreds package's Provider to implememnt support for CredentialsCache new optional caching strategy interfaces, HandleFailRefreshCredentialsCacheStrategy and AdjustExpiresByCredentialsCacheStrategy.
  • github.com/aws/aws-sdk-go-v2/service/auditmanager: v1.18.0
    • Feature: This release updates 1 API parameter, the SnsArn attribute. The character length and regex pattern for the SnsArn attribute have been updated, which enables you to deselect an SNS topic when using the UpdateSettings operation.
  • github.com/aws/aws-sdk-go-v2/service/ebs: v1.15.0
    • Feature: Increased the maximum supported value for the Timeout parameter of the StartSnapshot API from 60 minutes to 4320 minutes. Changed the HTTP error code for ConflictException from 503 to 409.
  • github.com/aws/aws-sdk-go-v2/service/elasticache: v1.20.2
    • Documentation: Doc only update for ElastiCache
  • github.com/aws/aws-sdk-go-v2/service/gamesparks: v1.0.0
    • Release: New AWS service client module
    • Feature: Released the preview of Amazon GameSparks, a fully managed AWS service that provides a multi-service backend for game developers.
  • github.com/aws/aws-sdk-go-v2/service/redshift: v1.22.0
    • Feature: This release adds a new [--encrypted | --no-encrypted] field in restore-from-cluster-snapshot API. Customers can now restore an unencrypted snapshot to a cluster encrypted with AWS Managed Key or their own KMS key.
  • github.com/aws/aws-sdk-go-v2/service/ssm: v1.23.0
    • Feature: Update AddTagsToResource, ListTagsForResource, and RemoveTagsFromResource APIs to reflect the support for tagging Automation resources. Includes other minor documentation updates.
  • github.com/aws/aws-sdk-go-v2/service/transfer: v1.18.1
    • Documentation: Documentation updates for AWS Transfer Family to describe how to remove an associated workflow from a server.

Release (2022-03-22)

Module Highlights

  • github.com/aws/aws-sdk-go-v2/service/costexplorer: v1.18.0
    • Feature: Added three new APIs to support tagging and resource-level authorization on Cost Explorer resources: TagResource, UntagResource, ListTagsForResource. Added optional parameters to CreateCostCategoryDefinition, CreateAnomalySubscription and CreateAnomalyMonitor APIs to support Tag On Create.
  • github.com/aws/aws-sdk-go-v2/service/ecs: v1.18.2
    • Documentation: Documentation only update to address tickets
  • github.com/aws/aws-sdk-go-v2/service/lakeformation: v1.16.0
    • Feature: The release fixes the incorrect permissions called out in the documentation - DESCRIBE_TAG, ASSOCIATE_TAG, DELETE_TAG, ALTER_TAG. This trebuchet release fixes the corresponding SDK and documentation.
  • github.com/aws/aws-sdk-go-v2/service/location: v1.16.0
    • Feature: Amazon Location Service now includes a MaxResults parameter for GetDevicePositionHistory requests.
  • github.com/aws/aws-sdk-go-v2/service/polly: v1.14.0
    • Feature: Amazon Polly adds new Catalan voice - Arlet. Arlet is available as Neural voice only.

Release (2022-03-21)

Module Highlights

  • github.com/aws/aws-sdk-go-v2/service/chimesdkmeetings: v1.8.0
    • Feature: Add support for media replication to link multiple WebRTC media sessions together to reach larger and global audiences. Participants connected to a replica session can be granted access to join the primary session and can switch sessions with their existing WebRTC connection
  • github.com/aws/aws-sdk-go-v2/service/ecr: v1.17.0
    • Feature: This release includes a fix in the DescribeImageScanFindings paginated output.
  • github.com/aws/aws-sdk-go-v2/service/mediaconnect: v1.16.0
    • Feature: This release adds support for selecting a maintenance window.

... (truncated)

Commits


Updates github.com/aws/aws-sdk-go-v2/service/ecr from 1.20.2 to 1.25.1

Commits


Updates github.com/aws/aws-sdk-go-v2/service/s3 from 1.40.0 to 1.49.0

Commits


Updates github.com/containerd/containerd from 1.7.11 to 1.7.13

Release notes

Sourced from github.com/containerd/containerd's releases.

containerd 1.7.13

Welcome to the v1.7.13 release of containerd!

The thirteenth patch release for containerd 1.7 updates the runc binary in the release builds to address CVE-2024-21626

Notable Updates

  • Update runc binary to v1.1.12 (GHSA-xr7r-f8xq-vfvv)
  • Update seccomp profile for new syscalls added since Linux 5.16 (#9693)

See the changelog for complete list of changes

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

  • Derek McGowan
  • Akihiro Suda
  • Evan Lezar
  • Paweł Gronowski
  • Phil Estes
  • Wei Fu

Changes

  • Prepare v1.7.13 and update runc to v1.1.12 (#9724)
  • [release/1.7] seccomp: kernel 6.7 (#9693)
  • [release/1.7] Update container-device-interface to v0.6.2 (#9685)
    • 14628d4aa Update container-device-interface to v0.6.2
  • [release/1.7] content: Add InfoReaderProvider (#9658)

Dependency Changes

  • tags.cncf.io/container-device-interface v0.6.2 new
  • tags.cncf.io/container-device-interface/specs-go v0.6.0 new

Previous release can be found at v1.7.12

containerd 1.7.12

Welcome to the v1.7.12 release of containerd!

... (truncated)

Commits
  • 7c3aca7 Merge pull request #9724 from dmcgowan/prepare-v1.7.13
  • b97e611 Prepare release notes for v1.7.13
  • 2e7fa14 Update runc binary to v1.1.12
  • cbda56b Merge pull request #9693 from k8s-infra-cherrypick-robot/cherry-pick-9684-to-...
  • 1bed378 seccomp: kernel 6.7
  • 1944259 Merge pull request #9685 from elezar/dependency-update-container-device-inter...
  • 14628d4 Update container-device-interface to v0.6.2
  • 8c780b7 Merge pull request #9658 from vvoland/contentprovider-1.7
  • 8364779 content: Add InfoReaderProvider
  • 71909c1 Merge pull request #9632 from dmcgowan/prepare-v1.7.12
  • Additional commits viewable in compare view


Updates github.com/containers/image/v5 from 5.21.1 to 5.29.2

Release notes

Sourced from github.com/containers/image/v5's releases.

v5.29.2

What's Changed

Full Changelog: https://github.com/containers/image/compare/v5.29.1...v5.29.2

v5.29.1

  • Add support for pushing an image with unknown digest

v5.29.0

What's Changed

... (truncated)

Commits
  • b799d82 [release-5.29] Bump to v5.29.2
  • 6cbd4f4 [release-5.29] backport Docker Daemon fix #2260
  • 2f0d9ae Merge pull request #2262 from mtrmac/5.29-skopeo-reverse
  • ef8a7a5 Use a stable Skopeo branch for testing the stable c/image branch
  • d8bbff8 Merge pull request #2253 from mtrmac/releasing-5.29.1
  • 540136f Bump to v5.29.2-dev
  • github-actions[bot] commented 8 months ago

    Mend Scan Summary: :x:

    Repository: open-component-model/ocm

    VIOLATION DESCRIPTION NUMBER OF VIOLATIONS
    HIGH/CRITICAL SECURITY VULNERABILITIES 0
    MAJOR UPDATES AVAILABLE 0
    LICENSE REQUIRES REVIEW 0
    HIGH RISK LICENSES 9
    RESTRICTIED LICENSE FOR ON-PREMISE DELIVERY 1

    Detailed Logs: mend-scan-> Generate Report Mend UI

ocmbot[bot] commented 8 months ago

Integration Tests for ed906a3f1e720679ccf850ad39f595fe752f9ccf run with result: Success ✅!

dependabot[bot] commented 8 months ago

Superseded by #664.