openshift / openshift-velero-plugin

General Velero plugin for backup and restore of openshift workloads.
Apache License 2.0
47 stars 37 forks source link

Bump github.com/sylabs/sif/v2 from 2.7.0 to 2.8.1 #174

Closed dependabot[bot] closed 8 months ago

dependabot[bot] commented 1 year ago

Bumps github.com/sylabs/sif/v2 from 2.7.0 to 2.8.1.

Release notes

Sourced from github.com/sylabs/sif/v2's releases.

v2.8.1

This security patch release addresses an issue with previous versions of the github.com/sylabs/sif/v2/pkg/integrity package, which did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. Users are encouraged to upgrade. More information is available in GHSA-m5m3-46gj-wch8.

Full Changelog: https://github.com/sylabs/sif/compare/v2.8.0...v2.8.1

v2.8.0

This release adds support for embedded Software Bills of Materials (SBOM) within SIF images.

What's Changed

Full Changelog: https://github.com/sylabs/sif/compare/v2.7.2...v2.8.0

v2.7.2

What's Changed

Full Changelog: https://github.com/sylabs/sif/compare/v2.7.1...v2.7.2

v2.7.1

What's Changed

Full Changelog: https://github.com/sylabs/sif/compare/v2.7.0...v2.7.1

Commits
  • 07fb860 Merge pull request from GHSA-m5m3-46gj-wch8
  • a854038 fix: updated supported digest hash functions
  • 2197285 fix: verify PGP hash algorithms
  • 5f9bee6 Merge pull request #229 from tri-adam/remove-rowserrcheck
  • 4149c90 ci: remove rowserrcheck linter
  • fe08d87 Merge pull request #227 from tri-adam/sbom
  • 0bd6c58 feat: add SBOM support
  • 4d7ab6f Merge pull request #226 from tri-adam/bump-linter
  • 35220ef chore: bump golangci-lint to v1.49
  • 36ed9ec Merge pull request #225 from tri-adam/bump-node
  • Additional commits viewable in compare view


Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.


Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/openshift/openshift-velero-plugin/network/alerts).
> **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days.
openshift-ci[bot] commented 1 year ago

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
kaovilai commented 1 year ago

/ok-to-test

dependabot[bot] commented 1 year ago

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

kaovilai commented 1 year ago

/skip

openshift-bot commented 11 months ago

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale. Stale issues rot after an additional 30d of inactivity and eventually close. Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

kaovilai commented 11 months ago

/remove-lifecycle stale

kaovilai commented 11 months ago

@dependabot rebase

openshift-ci[bot] commented 10 months ago

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dependabot[bot], kaovilai, shubham-pampattiwar, sseago

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/openshift/openshift-velero-plugin/blob/master/OWNERS)~~ [kaovilai,shubham-pampattiwar,sseago] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment
openshift-ci-robot commented 10 months ago

/retest-required

Remaining retests: 0 against base HEAD 5dd4863149fb5e75dec969b90243cd12b4618e47 and 2 for PR HEAD c28e7336185efdfb080fa931e90dfbed7b637e49 in total

openshift-ci[bot] commented 10 months ago

@dependabot[bot]: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/images c28e7336185efdfb080fa931e90dfbed7b637e49 link true /test images

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
kaovilai commented 10 months ago
Use -buildvcs=false to disable VCS stamping.
openshift-ci-robot commented 10 months ago

/retest-required

Remaining retests: 0 against base HEAD 38fd1f4c0b416f622bde9c40a326f6fa0468a411 and 1 for PR HEAD c28e7336185efdfb080fa931e90dfbed7b637e49 in total

openshift-merge-robot commented 10 months ago

rebase

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
kaovilai commented 8 months ago

@dependabot rebase

dependabot[bot] commented 8 months ago

Looks like github.com/sylabs/sif/v2 is up-to-date now, so this is no longer needed.