search

paketo-buildpacks / npm-install

A Cloud Native Buildpack for npm
Apache License 2.0
10 stars 17 forks source link

Bump the go-modules group with 8 updates #597

Closed dependabot[bot] closed 11 months ago

dependabot[bot] commented 11 months ago

Bumps the go-modules group with 8 updates:

Package From To
github.com/CycloneDX/cyclonedx-go 0.7.2 0.8.0
github.com/containerd/containerd 1.7.10 1.7.11
github.com/google/uuid 1.4.0 1.5.0
github.com/sylabs/sif/v2 2.15.0 2.15.1
github.com/testcontainers/testcontainers-go 0.26.0 0.27.0
golang.org/x/tools 0.16.0 0.16.1
google.golang.org/grpc 1.59.0 1.60.1
google.golang.org/protobuf 1.31.0 1.32.0

Updates github.com/CycloneDX/cyclonedx-go from 0.7.2 to 0.8.0

Release notes

Sourced from github.com/CycloneDX/cyclonedx-go's releases.

v0.8.0

This release ships with almost complete support for v1.5 of the CycloneDX specification.

The only exception being the extended data flow support, as used in SaaS BOMs.

Unfortunately, there are also breaking changes in this release:

  • The type of Metadata.Tools has changed from *[]Tool to *ToolsChoice, to facilitate the deprecation of Tool in the spec
    • ToolsChoice holds both legacy *[]Tool, as well as the new *[]Component and *[]Service fields
    • The Tool type, as well as the ToolsChoice.Tools field are marked as deprecated
    • During encoding and decoding, it is asserted that only one of both options can be present, in accordance with the "One of" constraint of the spec
    • When encoding to lower spec versions than v1.5 (using EncodeVersion), Components and Services are automatically converted to legacy Tools
    • It is strongly recommended to use Components and Services. However, when consuming BOMs, applications should still expect legacy Tools to be present, and handle them accordingly.

Changelog

Fixes

  • 64eb0c84b3d909db47c5154c17d075f68b0c85ae: fix: remove format linters that require extra tooling (@​nscuro)

Building and Packaging

  • 696aa66151e800a672c9ec860f30d8716ae6a025: build(deps): bump actions/checkout from 3.5.3 to 4.1.0 (@​dependabot[bot])
  • b50b319d1580d5b624cfc866bc108b589b328157: build(deps): bump actions/checkout from 4.1.0 to 4.1.1 (@​dependabot[bot])
  • 5cad1b0a7dad106950790fad960be5f7e62b2110: build(deps): bump actions/setup-go from 4.1.0 to 5.0.0 (@​dependabot[bot])
  • b0910619560e5b0b0fae51dc97c4a343983873fb: build(deps): bump gitpod/workspace-go from d3603c7 to 94ae638 (@​dependabot[bot])
  • 9e310b6d641245c89aa01f07a21b50c38f04b087: build(deps): bump gitpod/workspace-go from f37c673 to d3603c7 (@​dependabot[bot])
  • 89494fd98291ca8115e02cab78e2e47360352f00: build(deps): bump goreleaser/goreleaser-action from 4.4.0 to 5.0.0 (@​dependabot[bot])

Others

  • 61dd91e0bbe730454bef42bc0c1b0a3f97411c02: feat(spec1-5): add support for machine learning (@​nscuro)
  • f831960f0887c1f60681924e4d4382cd4bb52ff0: feat(spec1-5): update valid-vulnerability test snapshots (@​nscuro)
  • ffc9a4eb9204f5a31b7fb1d6cd907e6cc3e93578: ci: enable more linters (@​mmorel-35)
  • 3feda7530db8c959381261e44a96b201f79f908c: feat(spec1-5): add additional external reference types (@​nscuro)
  • bd66a368c5116c0420f49157a217e71cde1544be: feat(spec1-5): add support for CVSSv4 scoring method (@​nscuro)
  • d597bb9076e1856b9f2d3bb9d420728df8d43d9a: feat(spec1-5): add support for firstIssued and lastUpdated in vuln analysis (@​nscuro)
  • 2ae5445d02b8e6e7391a8a0eb4d1a5bb8a6f377c: feat(spec1-5): add support for additional compositions and composition identity (@​nscuro)
  • f856daa3212521eaf5f1dd69424b9c98eee2db52: feat(spec1-5): add support for formulation (@​nscuro)
  • 2fbde0e17ac5876ff525ccdc9d1eebf90918d306: feat(spec1-5): add support for identity, occurrences, and callstack evidence (@​nscuro)
  • 745a35a73d395923303817de650a60fe82cf8ec8: feat(spec1-5): add support for licensing (@​nscuro)
  • b02255f3784c608100b2ae3d1123e41500a50ff3: feat(spec1-5): add support for lifecycles (@​nscuro)
  • fe3a9040862e5fa088e84efb004fd9e338a783d7: feat(spec1-5): add support for ssvc scoring method (@​nscuro)
  • 7d2713f4459184df4628b839e4c01bae7fd6abcf: feat(spec1-5): add support for vulnerability proof of concept (@​nscuro)
  • 25b250ac0efea93283362584394a16ca602e260f: feat(spec1-5): add support for vulnerability rejected timestamps (@​nscuro)
  • c7a84ac4ba209f5860b1aedffa2f1e71414e4508: feat(spec1-5): handle deprecation of tools (@​nscuro)
Commits
  • b9654ae Merge pull request #90 from CycloneDX/spec-v1.5
  • 64eb0c8 fix: remove format linters that require extra tooling
  • c7a84ac feat(spec1-5): handle deprecation of tools
  • f856daa feat(spec1-5): add support for formulation
  • 2fbde0e feat(spec1-5): add support for identity, occurrences, and callstack evidence
  • 61dd91e feat(spec1-5): add support for machine learning
  • f831960 feat(spec1-5): update valid-vulnerability test snapshots
  • fe3a904 feat(spec1-5): add support for ssvc scoring method
  • 7d2713f feat(spec1-5): add support for vulnerability proof of concept
  • 2ae5445 feat(spec1-5): add support for additional compositions and composition identity
  • Additional commits viewable in compare view


Updates github.com/containerd/containerd from 1.7.10 to 1.7.11

Release notes

Sourced from github.com/containerd/containerd's releases.

containerd 1.7.11

Welcome to the v1.7.11 release of containerd!

The eleventh patch release for containerd 1.7 contains various fixes and updates including one security issue.

Notable Updates

  • Fix Windows default path overwrite issue (#9440)
  • Update push to always inherit distribution sources from parent (#9452)
  • Update shim to use net dial for gRPC shim sockets (#9458)
  • Fix otel version incompatibility (#9483)
  • Fix Windows snapshotter blocking snapshot GC on remove failure (#9482)
  • Mask /sys/devices/virtual/powercap path in runtime spec and deny in default apparmor profile (GHSA-7ww5-4wqc-m92c)

Deprecation Warnings

  • Emit deprecation warning for AUFS snapshotter (#9436)
  • Emit deprecation warning for v1 runtime (#9450)
  • Emit deprecation warning for deprecated CRI configs (#9469)
  • Emit deprecation warning for CRI v1alpha1 usage (#9479)
  • Emit deprecation warning for CRIU config in CRI (#9481)

See the changelog for complete list of changes

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

  • Samuel Karp
  • Derek McGowan
  • Phil Estes
  • Bjorn Neergaard
  • Danny Canter
  • Sebastiaan van Stijn
  • ruiwen-zhao
  • Akihiro Suda
  • Amit Barve
  • Charity Kathure
  • Maksym Pavlenko
  • Milas Bowman
  • Paweł Gronowski
  • Wei Fu

Changes

  • [release/1.7] Prepare release notes for v1.7.11 (#9491)

... (truncated)

Commits
  • 64b8a81 Merge pull request #9491 from dmcgowan/prepare-1.7.11
  • ea5a477 Merge pull request #9352 from thaJeztah/1.7_update_golang_1.20.11
  • 67d356c Merge pull request from GHSA-7ww5-4wqc-m92c
  • dfae68b Prepare release notes for v1.7.11
  • de6d8a8 Merge pull request #9482 from ambarve/sn_cleanup_1.7
  • ed7c689 Don't block snapshot garbage collection on Remove failures
  • 467de56 Merge pull request #9481 from ruiwen-zhao/cri-u
  • d94f8ff Merge pull request #9483 from dmcgowan/backport-1.7-fix-otel-http
  • 1fdefdd Add warning for CRIU config usage
  • 8e06899 Merge pull request #9479 from ruiwen-zhao/cri-api-warning
  • Additional commits viewable in compare view


Updates github.com/google/uuid from 1.4.0 to 1.5.0

Release notes

Sourced from github.com/google/uuid's releases.

v1.5.0

1.5.0 (2023-12-12)

Features

  • Validate UUID without creating new UUID (#141) (9ee7366)
Changelog

Sourced from github.com/google/uuid's changelog.

1.5.0 (2023-12-12)

Features

  • Validate UUID without creating new UUID (#141) (9ee7366)
Commits


Updates github.com/sylabs/sif/v2 from 2.15.0 to 2.15.1

Release notes

Sourced from github.com/sylabs/sif/v2's releases.

v2.15.1

What's Changed

Full Changelog: https://github.com/sylabs/sif/compare/v2.15.0...v2.15.1

Commits
  • c428dc6 Merge pull request #341 from tri-adam/bump-crypto
  • 3af14f4 build(deps): bump github.com/ProtonMail/go-crypto from v0.0.0-20230717121422-...
  • 4fa5c1d Merge pull request #339 from sylabs/dependabot/go_modules/main/github.com/sec...
  • cb18ad9 refactor: adapt to breaking change in dsse package
  • 702020f build(deps): bump github.com/secure-systems-lab/go-securesystemslib
  • bb85aa2 build(deps): bump golang.org/x/crypto from 0.15.0 to 0.17.0 (#338)
  • 3685695 build(deps): bump github.com/google/uuid from 1.4.0 to 1.5.0 (#337)
  • 252b6fb build(deps): bump github.com/sigstore/sigstore from 1.7.5 to 1.7.6 (#336)
  • 85920b1 build(deps): bump github.com/google/go-containerregistry (#335)
  • a8b0ecf build(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (#334)
  • Additional commits viewable in compare view


Updates github.com/testcontainers/testcontainers-go from 0.26.0 to 0.27.0

Release notes

Sourced from github.com/testcontainers/testcontainers-go's releases.

v0.27.0

What's Changed

⚠️ Breaking Changes

Building images with FromDockerfile

The ImageBuildInfo interface now includes a new method: BuildOptions, which is used to configure the build process. This method returns the image build options when building a Docker image from a Dockerfile, and it will apply some defaults and finally call the new BuildOptionsModifier method from the FromDockerfile struct, if set. This way it's possible to access Docker's types.ImageBuildOptions type and modify it before the build process starts.

Executing commands using the Executable interface

It now includes an Options method that needs to be implemented. This method will allow configuring the exec options added in this PR for the WithStartupCommand functional option. If your code is implementing Executable, you can embed the ExecOptions struct in your own struct in order to satisfy the interface. Please take a look at the RabbitMQ test types to see examples on how to do it.

  • feat: support for executing commands in a container with user, workDir and env (#1914) @​mdelapenya

🔒 Security

🚀 Features

🐛 Bug Fixes

📖 Documentation

... (truncated)

Commits
  • 8d0f53a chore: use new version (v0.27.0) in modules and examples
  • c3a1834 chore: do not read config but instead pass the hub prefix to the prependHub m...
  • 1bac302 fix: remove docker.io from Ryuk image name (#2046)
  • 61a37cb adds gotestsum to install tools (#2043)
  • 1c45958 Add neo4j license agreement customization options (#2036)
  • 974afd9 chore: bump Ryuk to 0.6.0 (#2040)
  • cb51b9b chore(deps): bump github.com/containerd/containerd from 1.7.7 to 1.7.11 (#2011)
  • 9f68760 feat: support configuring Ryuk verbose mode at config level (#2038)
  • 5faf6f4 chore: lookup exposed ports in the image from Config, not from ContainerConfi...
  • a9f0ac8 chore(deps): bump golang.org/x/crypto to 0.17.0 in /modules (#2006)
  • Additional commits viewable in compare view


Updates golang.org/x/tools from 0.16.0 to 0.16.1

Commits
  • 2acb2e6 gopls/internal/test/marker: minor clean up of marker test doc
  • 28b92af internal/typeparams: eliminate remainining compatibility shims
  • ee35f8e gopls/internal/lsp/source: hovering over broken packages is not an error
  • 67611a1 internal/typeparams: eliminate type aliases
  • 23c86e8 internal/typeparams: delete const Enabled=true and simplify
  • e46688f gopls/internal/analysis/fillstruct: don't panic with invalid fields
  • 8bd7553 gopls/internal/util/goversion: warn about EOL for Go 1.18
  • bc9cd15 gopls/internal/settings: remove MemoryMode option
  • bbc30f1 gopls/protocol: Allow AnnotatedTextEdits
  • f40889d gopls/internal/analysis/stubmethods: fix OOB panic in fromValueSpec
  • Additional commits viewable in compare view


Updates google.golang.org/grpc from 1.59.0 to 1.60.1

Release notes

Sourced from google.golang.org/grpc's releases.

Release v1.60.1

Bug Fixes

  • server: fix two bugs that could lead to panics at shutdown when using NumStreamWorkers (experimental feature).

Release 1.60.0

Security

  • credentials/tls: if not set, set TLS MinVersion to 1.2 and CipherSuites according to supported suites not forbidden by RFC7540.
    • This is a behavior change to bring us into better alignment with RFC 7540.

API Changes

  • resolver: remove deprecated and experimental ClientConn.NewServiceConfig (#6784)
  • client: remove deprecated grpc.WithServiceConfig DialOption (#6800)

Bug Fixes

  • client: fix race that could cause a deadlock while entering idle mode and receiving a name resolver update (#6804)
  • client: always enable TCP keepalives with OS defaults (#6834)
  • credentials/alts: fix a bug preventing ALTS from connecting to the metadata server if the default scheme is overridden (#6686)

Behavior Changes

  • server: Do not return from Stop() or GracefulStop() until all resources are released (#6489)

Documentation

  • codes: clarify that only codes defined by this package are valid and that users should not cast other values to codes.Code (#6701)
Commits


Updates google.golang.org/protobuf from 1.31.0 to 1.32.0

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
dependabot[bot] commented 11 months ago

Looks like these dependencies are updatable in another way, so this is no longer needed.