[v0.60] Backport pkg/subscriptions: use securejoin for the container path + new 0.60.4 release by @Luap99 in containers/common#2186
Fixes CVE-2024-9341
VirtualMachine.AttachDisk unitNumber param is optional [a316da5c]:
switching from int32 to *int32, otherwise the client must choose a valid unitNumber.
vCenter will choose a unitNumber when not provided.
Most Recent Ignore Conditions Applied to This Pull Request
| Dependency Name | Ignore Conditions |
| --- | --- |
| google.golang.org/api | [>= 0.196.a, < 0.197] |
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Bumps the go-deps group with 6 updates in the / directory:
1.28.01.28.11.43.01.44.01.4.01.4.10.60.20.60.40.42.00.43.00.24.00.25.0Updates
cloud.google.com/go/computefrom 1.28.0 to 1.28.1Changelog
Sourced from cloud.google.com/go/compute's changelog.
Commits
e992f09chore: release main (#10792)22adc9achore(main): release firestore 1.17.0 (#10597)e9a551efeat(firestore): Adding distance threshold and result field (#10802)839f30echore(main): release auth 0.9.4 (#10846)b9dfce5chore: update gapic-generator-go to 0.47.0 (#10848)9b4b2fadocs(pubsub): update documentation for 31 day subscription message retention ...2bdedeffix(compute/metadata): check error chain for retryable error (#10840)2d5a9f9feat(dataproc): add support for new Dataproc features (#10817)f9869f7fix(auth): enable self-signed JWT for non-GDU universe domain (#10831)6720291chore(main): release bigtable 1.32.0 (#10815)Updates
cloud.google.com/go/storagefrom 1.43.0 to 1.44.0Release notes
Sourced from cloud.google.com/go/storage's releases.
Commits
8722d72chore(main): release spanner 1.44.0 (#7311)3f118f9chore(all): auto-regenerate gapics (#7330)48ba16ffeat(spanner): add support for Optimistic Concurrency Control (#7332)cf1332dchore: release main (#7313)45c70e3chore(all): auto-regenerate gapics (#7318)045a8dcchore: add support_request template (#7328)c37f9aerefactor(bigquery/storage/managedwriter): introduce send optimizers (#7323)0bf80d7fix(bigquery): fetch dst table for jobs when readings with Storage API (#7325)2f45776chore(internal/gapicgen): actually freeze cloud dir (#7326)c88fbdffix(pubsub): fix bug with AckWithResult with exactly once disabled (#7319)Updates
github.com/Azure/azure-sdk-for-go/sdk/storage/azblobfrom 1.4.0 to 1.4.1Release notes
Sourced from github.com/Azure/azure-sdk-for-go/sdk/storage/azblob's releases.
Commits
47b7a8achangelog changes for blob and files release (#23452)06f0d9eUpdate installed event processor version for net6 to net8 update (#23451)44cdba7[Release] sdk/resourcemanager/billing/armbilling/1.0.0 (#23450)d5d9188Update CodeownersLinter for net6 to net8 update (#23449)35f9c0fprep for release (#23448)7664dd2Increment package version after release of azidentity (#23447)1d798e7Auto-generated baselines by 1ES Pipeline Templates (#23438)da9c60fSync eng/common directory with azure-sdk-tools for PR 8974 (#23445)500650cPrepare azidentity v1.8.0-beta.3 for release (#23434)3eb3276Update PublishCodeCoverageResults task to v2 (#23437)Updates
github.com/containers/commonfrom 0.60.2 to 0.60.4Release notes
Sourced from github.com/containers/common's releases.
Commits
d31fcd2Bump to v0.60.4e7db065pkg/subscriptions: use securejoin for the container path91f5148Merge pull request #2170 from Luap99/v0.608264002Bump to v0.60.32776f6bpkg/netns: remove NewNSWithName()8a5b951pkg/netns: add NewNSFrom()50870e9pkg/netns: ensure makeNetnsDir is race free322f2c2pkg/netns: split out makeNetnsDir logic52c82b1Merge pull request #2127 from TomSweeneyRedHat/dev/tsweeney/v0.60.2Updates
github.com/vmware/govmomifrom 0.42.0 to 0.43.0Release notes
Sourced from github.com/vmware/govmomi's releases.
... (truncated)
Commits
b17abb2chore: Update version.go for v0.43.0139b19eMerge pull request #3527 from bzed/disk_provbc0c8a0Merge pull request #3544 from akutz/feature/fault476704aapi: Fault helpers0a94649Merge pull request #3546 from yanleizhao-vmware/feature/vcsim-support-placevm...8421b67vcsim: Support PlaceVm with relocate placement typed3cb5c6Merge pull request #3545 from ericvmw/issue-354293b97e1Update library state info to content library APIc1151f8Merge pull request #3543 from yanleizhao-vmware/yanleizhao-vmware/feature/sim...988a047Merge pull request #3539 from dougm/disk-attachUpdates
golang.org/x/toolsfrom 0.24.0 to 0.25.0Commits
7398f36all: fix some symbols error in commentf111c72go/callgraph/rta: skip test on js platform9f9b7e3gopls/internal/settings: add missing deep cloning in Options.Clonece7eed4doc/generate: minor cleanup075ae7dgo/callgraph/vta: add basic tests for range-over-func2c7aaabgo/ssa: skip failing test1b5663fgo/callgraph/vta: perform minor cleanups0a49883gopls/go.mod: update the go directive to 1.23.1ad366a8go.mod: update golang.org/x dependencies4fb36d1go/callgraph/rta: add rta analysis test case for multiple go packagesUpdates
google.golang.org/apifrom 0.195.0 to 0.197.0Release notes
Sourced from google.golang.org/api's releases.
Changelog
Sourced from google.golang.org/api's changelog.
Commits
c5990e2chore(main): release 0.197.0 (#2771)dc3697achore(all): update all (#2777)cedc5b0feat(all): auto-regenerate discovery clients (#2779)72cc5c4feat(all): auto-regenerate discovery clients (#2778)cc62887feat(all): auto-regenerate discovery clients (#2776)11e2ff6feat(all): auto-regenerate discovery clients (#2775)6476dddfeat(all): auto-regenerate discovery clients (#2774)140d0a5fix(transport): set UniverseDomain in http.NewClient for new auth (#2773)0c7c227feat(all): auto-regenerate discovery clients (#2772)07782e2feat(all): auto-regenerate discovery clients (#2770)Most Recent Ignore Conditions Applied to This Pull Request
| Dependency Name | Ignore Conditions | | --- | --- | | google.golang.org/api | [>= 0.196.a, < 0.197] |Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show