Migrate github.com/golang/protobuf to google.golang.org/protobuf [436a197]
This release drops the deprecated github.com/golang/protobuf and adopts google.golang.org/protobuf. Care was taken to ensure the release is backwards compatible (thanks @jbduncan !). Please open an issue if you run into one.
Migrate github.com/golang/protobuf to google.golang.org/protobuf [436a197]
This release drops the deprecated github.com/golang/protobuf and adopts google.golang.org/protobuf. Care was taken to ensure the release is backwards compatible (thanks @jbduncan !). Please open an issue if you run into one.
Unfortunately, there are also breaking changes in this release:
The type of Metadata.Tools has changed from *[]Tool to *ToolsChoice, to facilitate the deprecation of Tool in the spec
ToolsChoice holds both legacy *[]Tool, as well as the new *[]Component and *[]Service fields
The Tool type, as well as the ToolsChoice.Tools field are marked as deprecated
During encoding and decoding, it is asserted that only one of both options can be present, in accordance with the "One of" constraint of the spec
When encoding to lower spec versions than v1.5 (using EncodeVersion), Components and Services are automatically converted to legacy Tools
It is strongly recommended to use Components and Services. However, when consuming BOMs, applications should still expect legacy Tools to be present, and handle them accordingly.
Changelog
Fixes
64eb0c84b3d909db47c5154c17d075f68b0c85ae: fix: remove format linters that require extra tooling (@nscuro)
Building and Packaging
696aa66151e800a672c9ec860f30d8716ae6a025: build(deps): bump actions/checkout from 3.5.3 to 4.1.0 (@dependabot[bot])
b50b319d1580d5b624cfc866bc108b589b328157: build(deps): bump actions/checkout from 4.1.0 to 4.1.1 (@dependabot[bot])
5cad1b0a7dad106950790fad960be5f7e62b2110: build(deps): bump actions/setup-go from 4.1.0 to 5.0.0 (@dependabot[bot])
b0910619560e5b0b0fae51dc97c4a343983873fb: build(deps): bump gitpod/workspace-go from d3603c7 to 94ae638 (@dependabot[bot])
9e310b6d641245c89aa01f07a21b50c38f04b087: build(deps): bump gitpod/workspace-go from f37c673 to d3603c7 (@dependabot[bot])
89494fd98291ca8115e02cab78e2e47360352f00: build(deps): bump goreleaser/goreleaser-action from 4.4.0 to 5.0.0 (@dependabot[bot])
Others
61dd91e0bbe730454bef42bc0c1b0a3f97411c02: feat(spec1-5): add support for machine learning (@nscuro)
f831960f0887c1f60681924e4d4382cd4bb52ff0: feat(spec1-5): update valid-vulnerability test snapshots (@nscuro)
ffc9a4eb9204f5a31b7fb1d6cd907e6cc3e93578: ci: enable more linters (@mmorel-35)
Bumps the go-modules group with 32 updates:
1.30.0
1.32.0
0.18.0
0.18.2
0.7.2
0.8.0
0.11.4
0.12.1
0.0.0-20230412183729-8602f1afc574
0.0.1
1.0.6
1.1.0
1.7.11
1.7.14
0.8.0
0.8.1
0.4.0
0.5.0
1.5.3
1.5.4
0.17.0
0.19.1
1.4.0
1.6.0
1.17.4
1.17.7
0.0.0-20230301153543-ba94b245509b
0.1.0
4.1.19
4.1.21
0.4.4
0.4.7
0.2.0
0.3.0
3.23.11
3.24.2
1.2.1
1.2.2
2.15.0
2.16.0
0.26.0
0.29.1
0.0.0-20230301185719-21920a456ad5
0.0.0-20230925121702-07e42b3cdba0
1.2.3
1.2.4
0.17.0
0.20.0
0.0.0-20230510235704-dd950f8aeaea
0.0.0-20231006140011-7918f672742d
0.14.0
0.16.0
0.19.0
0.21.0
0.5.0
0.6.0
0.15.0
0.17.0
0.16.0
0.16.1
0.0.0-20231120223509-83a465c0220f
0.0.0-20240123012728-ef4313101c80
1.59.0
1.62.0
Updates
github.com/onsi/gomega
from 1.30.0 to 1.32.0Release notes
Sourced from github.com/onsi/gomega's releases.
Changelog
Sourced from github.com/onsi/gomega's changelog.
Commits
4379951
v1.32.0a350b95
Maintain source backwards compatibilitya6c8875
Fix failing test436a197
Migrate github.com/golang/protobuf to google.golang.org/protobuf32ef35e
chore: test with Go 1.22 (#733)a0d0387
Bump golang.org/x/net from 0.19.0 to 0.20.0 (#717)b71e477
Bump github-pages and jekyll-feed in /docs (#732)f460154
docs: fix typo and broken anchor link to gstructa2862e4
docs: fix HaveEach matcher signature762b171
v1.31.1Updates
github.com/paketo-buildpacks/occam
from 0.18.0 to 0.18.2Release notes
Sourced from github.com/paketo-buildpacks/occam's releases.
Commits
f37d228
Bump github.com/opencontainers/runc from 1.1.5 to 1.1.121d68391
tests: adding tests for NewContainerFromInspectOutput function13e5704
fix: avoid accessing undefined host ports on while creating a new container f...0fb0353
Bump github.com/containerd/containerd from 1.7.7 to 1.7.11Updates
github.com/CycloneDX/cyclonedx-go
from 0.7.2 to 0.8.0Release notes
Sourced from github.com/CycloneDX/cyclonedx-go's releases.
Commits
b9654ae
Merge pull request #90 from CycloneDX/spec-v1.564eb0c8
fix: remove format linters that require extra toolingc7a84ac
feat(spec1-5): handle deprecation of toolsf856daa
feat(spec1-5): add support for formulation2fbde0e
feat(spec1-5): add support for identity, occurrences, and callstack evidence61dd91e
feat(spec1-5): add support for machine learningf831960
feat(spec1-5): updatevalid-vulnerability
test snapshotsfe3a904
feat(spec1-5): add support for ssvc scoring method7d2713f
feat(spec1-5): add support for vulnerability proof of concept2ae5445
feat(spec1-5): add support for additional compositions and composition identityUpdates
github.com/Microsoft/hcsshim
from 0.11.4 to 0.12.1Release notes
Sourced from github.com/Microsoft/hcsshim's releases.
... (truncated)
Commits
ad1ccf5
fix: move permissions to the correct job (#2080) (#2081)6588c1c
Updating permissions and github release action versions (#2078) (#2079)202f90a
Add spans and drop large size high volume trace logsfe8c673
updatenewBinaryCmd
URL path handling (#2041)85086d7
Upgrade to go1.21 + fix lint errors8039310
[deps] Omni-bus dependency update (#2039)7458e58
Update Cmd IO handling (#1937)5f9910a
Fix CodeQL pipeline failure (#2032)c56a09c
Merge pull request #1998 from yyatmsft/removeInternalTests2c767380
Don't create container scratch per base layer (#2002)Updates
github.com/anchore/stereoscope
from 0.0.0-20230412183729-8602f1afc574 to 0.0.1Release notes
Sourced from github.com/anchore/stereoscope's releases.
Commits
Updates
github.com/andybalholm/brotli
from 1.0.6 to 1.1.0Commits
17e5901
Make my matchfinder work more accessible.cf812c0
matchfinder: add M01b6cf36
matchfinder: remove MultiHash265f3af
matchfinder: penalize score for overlapping matchesa8d524a
matchfinder: replace Score function with DistanceBitCost578645e
matchfinder: add MultiHash24b2bfa
matchfinder.M4: add Score function4a024e3
matchfinder.M4: add match chain3a1c5cd
Fix typo in comment.0d2aef3
matchfinder.M4: factor out extendMatch2Updates
github.com/containerd/containerd
from 1.7.11 to 1.7.14Release notes
Sourced from github.com/containerd/containerd's releases.
... (truncated)
Commits
dcf2847
Merge pull request #9953 from dmcgowan/prepare-v1.7.141babe6b
Prepare release notes for v1.7.149138da4
Merge pull request #9951 from austinvazquez/release-1.7-backport-use-matrix-g...a9bbbef
Use the Go toolchain in CI matrix to build binaries17cbd50
Merge pull request #9933 from AkihiroSuda/go-1.21.8-1.74c825b3
Merge pull request #9938 from akhilerm/cherry-pick-9777-1.739caf53
Move inline PS scripts into files5613fae
Merge pull request #9944 from dmcgowan/1.7-skip-oom-test1ca9a64
update to go 1.21.8, 1.22.1630226b
Disable OOM set score unpriv test temporarilyUpdates
github.com/docker/docker-credential-helpers
from 0.8.0 to 0.8.1Release notes
Sourced from github.com/docker/docker-credential-helpers's releases.
Commits
292722b
Merge pull request #308 from thaJeztah/update_golang_1.21.6979dcc4
Merge pull request #309 from thaJeztah/update_golangcif411a65
Dockerfile: update golangci-lint to v1.55.29629bd7
update to go1.21.6f642c26
Merge pull request #306 from thaJeztah/err_checks8fc3306
Merge pull request #307 from thaJeztah/bump_wincred6a3e64c
move trimming whitespace to error-check helpers218f178
vendor: github.com/danieljoos/wincred v1.2.1Updates
github.com/docker/go-connections
from 0.4.0 to 0.5.0Commits
fa09c95
Merge pull request #108 from thaJeztah/carry_67a67a58
Swap CloseRead and CloseWrite481d3d2
Merge pull request #107 from thaJeztah/drop_legacy_go9548f9f
tlsconfig: remove deprecated io/ioutilc564c21
drop support for go1.17 and older7cbebcf
gha: update actions2cf423f
tlsconfig: move allTLSVersions vardca283b
tlsconfig: drop support for go1.12 and older21876c5
tlsconfig: drop support for go1.6 and older4d174db
tlsconfig: drop support for go1.4 and olderUpdates
github.com/golang/protobuf
from 1.5.3 to 1.5.4Release notes
Sourced from github.com/golang/protobuf's releases.
Commits
75de7c0
Merge pull request #1597 from golang/updatedescb7697bb
all: update descriptor.proto to latest versionUpdates
github.com/google/go-containerregistry
from 0.17.0 to 0.19.1Release notes
Sourced from github.com/google/go-containerregistry's releases.
Commits
8b3c303
Bump golang.org/x/ packages (#1892)afec664
Bump golang.org/x/net from 0.10.0 to 0.17.0 in /pkg/authn/k8schain (#1815)8dadbe7
Work around docker v25 tarballs (#1872)a0658aa
Always print pushed digest in crane push (#1860)55ffb00
fix: goreleaser config (#1764)Updates
github.com/google/uuid
from 1.4.0 to 1.6.0Release notes
Sourced from github.com/google/uuid's releases.
Changelog
Sourced from github.com/google/uuid's changelog.
Commits
0f11ee6
chore(master): release 1.6.0 (#151)16939da
chore(tests): add strict monotonicity test case for uuid v7. (#154)016b199
fix: fix typo in version 7 uuid documentation (#153)1d8b6ea
ci: set token permissions to github workflows (#143)a2b2b32
fix: Monotonicity in UUIDv7 (#150)c58770e
feat: add Max UUID constant (#149)4d47f8e
chore(master): release 1.5.0 (#145)9ee7366
feat: Validate UUID without creating new UUID (#141)b35aa6a
add uuid version 6 and 7 (#139)Updates
github.com/klauspost/compress
from 1.17.4 to 1.17.7Release notes
Sourced from github.com/klauspost/compress's releases.
Commits
1e2b275
tests: Rename fuzz helpers back. (#931)68b7039
s2: Fix literal+repeat exceeds dst (#930)5895eb4
s2: Add AsyncFlush method: Complete the block without flushing (#927)4c49017
ci: Build with Go 1.22.x - deprecate 1.19 (#926)8e5ae40
Update README.md255a132
s2: Fix DecodeConcurrent deadlock on errors (#925)e8251aa
build: Remove garble compiler (#924)32f34cf
build(deps): bump the github-actions group with 1 update (#921)aac36dc
zstd: Fix incorrect repeat coding in best mode (#923)9b0f130
Update README.mdUpdates
github.com/knqyf263/go-rpmdb
from 0.0.0-20230301153543-ba94b245509b to 0.1.0Commits
Updates
github.com/pierrec/lz4/v4
from 4.1.19 to 4.1.21Commits
294e765
Merge pull request #216 from evanphx/b-fix-tests6e17a24
Reverts bc1239ba, no longer needed to conform to legacy9542ba5
CI: update go versions to more recent onesd9eb671
cmd/lz4c: update go.mod and fix issue #214219b252
Merge pull request #213 from corneliusroemer/patch-158c6073
Update README.md: add@latest
to cli install commande974631
Merge pull request #211 from oakad/issue_2107613989
CompressingReader: support older Go versions4a80a2f
CompressingReader: account for possible out buffer statef2ece5b
CompressingReader: make sure to clear out bufferUpdates
github.com/rivo/uniseg
from 0.4.4 to 0.4.7Commits
03509a9
Fixed wrong width calculation for variation selectors combined with regular c...601bbb3
Clarified some performance statements.f302f7f
Clarifications and improvements in the package documentation.0b9a924
Improved performance by using switch statements instead of maps for state tra...Looks like these dependencies are updatable in another way, so this is no longer needed.