search

paketo-buildpacks / npm-install

A Cloud Native Buildpack for npm
Apache License 2.0
10 stars 17 forks source link

Bump the go-modules group with 15 updates #604

Closed dependabot[bot] closed 10 months ago

dependabot[bot] commented 10 months ago

Bumps the go-modules group with 15 updates:

Package From To
github.com/CycloneDX/cyclonedx-go 0.7.2 0.8.0
github.com/containerd/containerd 1.7.10 1.7.11
github.com/docker/go-connections 0.4.0 0.5.0
github.com/google/uuid 1.4.0 1.5.0
github.com/opencontainers/runc 1.1.10 1.1.11
github.com/pierrec/lz4/v4 4.1.19 4.1.21
github.com/shirou/gopsutil/v3 3.23.11 3.23.12
github.com/sylabs/sif/v2 2.15.0 2.15.1
github.com/testcontainers/testcontainers-go 0.26.0 0.27.0
golang.org/x/crypto 0.17.0 0.18.0
golang.org/x/net 0.19.0 0.20.0
golang.org/x/sync 0.5.0 0.6.0
golang.org/x/tools 0.16.0 0.16.1
google.golang.org/grpc 1.59.0 1.60.1
google.golang.org/protobuf 1.31.0 1.32.0

Updates github.com/CycloneDX/cyclonedx-go from 0.7.2 to 0.8.0

Release notes

Sourced from github.com/CycloneDX/cyclonedx-go's releases.

v0.8.0

This release ships with almost complete support for v1.5 of the CycloneDX specification.

The only exception being the extended data flow support, as used in SaaS BOMs.

Unfortunately, there are also breaking changes in this release:

  • The type of Metadata.Tools has changed from *[]Tool to *ToolsChoice, to facilitate the deprecation of Tool in the spec
    • ToolsChoice holds both legacy *[]Tool, as well as the new *[]Component and *[]Service fields
    • The Tool type, as well as the ToolsChoice.Tools field are marked as deprecated
    • During encoding and decoding, it is asserted that only one of both options can be present, in accordance with the "One of" constraint of the spec
    • When encoding to lower spec versions than v1.5 (using EncodeVersion), Components and Services are automatically converted to legacy Tools
    • It is strongly recommended to use Components and Services. However, when consuming BOMs, applications should still expect legacy Tools to be present, and handle them accordingly.

Changelog

Fixes

  • 64eb0c84b3d909db47c5154c17d075f68b0c85ae: fix: remove format linters that require extra tooling (@​nscuro)

Building and Packaging

  • 696aa66151e800a672c9ec860f30d8716ae6a025: build(deps): bump actions/checkout from 3.5.3 to 4.1.0 (@​dependabot[bot])
  • b50b319d1580d5b624cfc866bc108b589b328157: build(deps): bump actions/checkout from 4.1.0 to 4.1.1 (@​dependabot[bot])
  • 5cad1b0a7dad106950790fad960be5f7e62b2110: build(deps): bump actions/setup-go from 4.1.0 to 5.0.0 (@​dependabot[bot])
  • b0910619560e5b0b0fae51dc97c4a343983873fb: build(deps): bump gitpod/workspace-go from d3603c7 to 94ae638 (@​dependabot[bot])
  • 9e310b6d641245c89aa01f07a21b50c38f04b087: build(deps): bump gitpod/workspace-go from f37c673 to d3603c7 (@​dependabot[bot])
  • 89494fd98291ca8115e02cab78e2e47360352f00: build(deps): bump goreleaser/goreleaser-action from 4.4.0 to 5.0.0 (@​dependabot[bot])

Others

  • 61dd91e0bbe730454bef42bc0c1b0a3f97411c02: feat(spec1-5): add support for machine learning (@​nscuro)
  • f831960f0887c1f60681924e4d4382cd4bb52ff0: feat(spec1-5): update valid-vulnerability test snapshots (@​nscuro)
  • ffc9a4eb9204f5a31b7fb1d6cd907e6cc3e93578: ci: enable more linters (@​mmorel-35)
  • 3feda7530db8c959381261e44a96b201f79f908c: feat(spec1-5): add additional external reference types (@​nscuro)
  • bd66a368c5116c0420f49157a217e71cde1544be: feat(spec1-5): add support for CVSSv4 scoring method (@​nscuro)
  • d597bb9076e1856b9f2d3bb9d420728df8d43d9a: feat(spec1-5): add support for firstIssued and lastUpdated in vuln analysis (@​nscuro)
  • 2ae5445d02b8e6e7391a8a0eb4d1a5bb8a6f377c: feat(spec1-5): add support for additional compositions and composition identity (@​nscuro)
  • f856daa3212521eaf5f1dd69424b9c98eee2db52: feat(spec1-5): add support for formulation (@​nscuro)
  • 2fbde0e17ac5876ff525ccdc9d1eebf90918d306: feat(spec1-5): add support for identity, occurrences, and callstack evidence (@​nscuro)
  • 745a35a73d395923303817de650a60fe82cf8ec8: feat(spec1-5): add support for licensing (@​nscuro)
  • b02255f3784c608100b2ae3d1123e41500a50ff3: feat(spec1-5): add support for lifecycles (@​nscuro)
  • fe3a9040862e5fa088e84efb004fd9e338a783d7: feat(spec1-5): add support for ssvc scoring method (@​nscuro)
  • 7d2713f4459184df4628b839e4c01bae7fd6abcf: feat(spec1-5): add support for vulnerability proof of concept (@​nscuro)
  • 25b250ac0efea93283362584394a16ca602e260f: feat(spec1-5): add support for vulnerability rejected timestamps (@​nscuro)
  • c7a84ac4ba209f5860b1aedffa2f1e71414e4508: feat(spec1-5): handle deprecation of tools (@​nscuro)
Commits
  • b9654ae Merge pull request #90 from CycloneDX/spec-v1.5
  • 64eb0c8 fix: remove format linters that require extra tooling
  • c7a84ac feat(spec1-5): handle deprecation of tools
  • f856daa feat(spec1-5): add support for formulation
  • 2fbde0e feat(spec1-5): add support for identity, occurrences, and callstack evidence
  • 61dd91e feat(spec1-5): add support for machine learning
  • f831960 feat(spec1-5): update valid-vulnerability test snapshots
  • fe3a904 feat(spec1-5): add support for ssvc scoring method
  • 7d2713f feat(spec1-5): add support for vulnerability proof of concept
  • 2ae5445 feat(spec1-5): add support for additional compositions and composition identity
  • Additional commits viewable in compare view


Updates github.com/containerd/containerd from 1.7.10 to 1.7.11

Release notes

Sourced from github.com/containerd/containerd's releases.

containerd 1.7.11

Welcome to the v1.7.11 release of containerd!

The eleventh patch release for containerd 1.7 contains various fixes and updates including one security issue.

Notable Updates

  • Fix Windows default path overwrite issue (#9440)
  • Update push to always inherit distribution sources from parent (#9452)
  • Update shim to use net dial for gRPC shim sockets (#9458)
  • Fix otel version incompatibility (#9483)
  • Fix Windows snapshotter blocking snapshot GC on remove failure (#9482)
  • Mask /sys/devices/virtual/powercap path in runtime spec and deny in default apparmor profile (GHSA-7ww5-4wqc-m92c)

Deprecation Warnings

  • Emit deprecation warning for AUFS snapshotter (#9436)
  • Emit deprecation warning for v1 runtime (#9450)
  • Emit deprecation warning for deprecated CRI configs (#9469)
  • Emit deprecation warning for CRI v1alpha1 usage (#9479)
  • Emit deprecation warning for CRIU config in CRI (#9481)

See the changelog for complete list of changes

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

  • Samuel Karp
  • Derek McGowan
  • Phil Estes
  • Bjorn Neergaard
  • Danny Canter
  • Sebastiaan van Stijn
  • ruiwen-zhao
  • Akihiro Suda
  • Amit Barve
  • Charity Kathure
  • Maksym Pavlenko
  • Milas Bowman
  • Paweł Gronowski
  • Wei Fu

Changes

  • [release/1.7] Prepare release notes for v1.7.11 (#9491)

... (truncated)

Commits
  • 64b8a81 Merge pull request #9491 from dmcgowan/prepare-1.7.11
  • ea5a477 Merge pull request #9352 from thaJeztah/1.7_update_golang_1.20.11
  • 67d356c Merge pull request from GHSA-7ww5-4wqc-m92c
  • dfae68b Prepare release notes for v1.7.11
  • de6d8a8 Merge pull request #9482 from ambarve/sn_cleanup_1.7
  • ed7c689 Don't block snapshot garbage collection on Remove failures
  • 467de56 Merge pull request #9481 from ruiwen-zhao/cri-u
  • d94f8ff Merge pull request #9483 from dmcgowan/backport-1.7-fix-otel-http
  • 1fdefdd Add warning for CRIU config usage
  • 8e06899 Merge pull request #9479 from ruiwen-zhao/cri-api-warning
  • Additional commits viewable in compare view


Updates github.com/docker/go-connections from 0.4.0 to 0.5.0

Commits
  • fa09c95 Merge pull request #108 from thaJeztah/carry_6
  • 7a67a58 Swap CloseRead and CloseWrite
  • 481d3d2 Merge pull request #107 from thaJeztah/drop_legacy_go
  • 9548f9f tlsconfig: remove deprecated io/ioutil
  • c564c21 drop support for go1.17 and older
  • 7cbebcf gha: update actions
  • 2cf423f tlsconfig: move allTLSVersions var
  • dca283b tlsconfig: drop support for go1.12 and older
  • 21876c5 tlsconfig: drop support for go1.6 and older
  • 4d174db tlsconfig: drop support for go1.4 and older
  • Additional commits viewable in compare view


Updates github.com/google/uuid from 1.4.0 to 1.5.0

Release notes

Sourced from github.com/google/uuid's releases.

v1.5.0

1.5.0 (2023-12-12)

Features

  • Validate UUID without creating new UUID (#141) (9ee7366)
Changelog

Sourced from github.com/google/uuid's changelog.

1.5.0 (2023-12-12)

Features

  • Validate UUID without creating new UUID (#141) (9ee7366)
Commits


Updates github.com/opencontainers/runc from 1.1.10 to 1.1.11

Release notes

Sourced from github.com/opencontainers/runc's releases.

runc 1.1.11 -- "Happy New Year!"

This is the eleventh patch release in the 1.1.z release branch of runc. It primarily fixes a few issues with runc's handling of containers that are configured to join existing user namespaces, as well as improvements to cgroupv2 support.

  • Fix several issues with userns path handling. (#4122, #4124, #4134, #4144)
  • Support memory.peak and memory.swap.peak in cgroups v2. Add swapOnlyUsage in MemoryStats. This field reports swap-only usage. For cgroupv1, Usage and Failcnt are set by subtracting memory usage from memory+swap usage. For cgroupv2, Usage, Limit, and MaxUsage are set. (#4000, #4010, #4131)
  • build(deps): bump github.com/cyphar/filepath-securejoin. (#4140)

Static Linking Notices

The runc binary distributed with this release are statically linked with the following GNU LGPL-2.1 licensed libraries, with runc acting as a "work that uses the Library":

The versions of these libraries were not modified from their upstream versions, but in order to comply with the LGPL-2.1 (§6(a)), we have attached the complete source code for those libraries which (when combined with the attached runc source code) may be used to exercise your rights under the LGPL-2.1.

However we strongly suggest that you make use of your distribution's packages or download them from the authoritative upstream sources, especially since these libraries are related to the security of your containers.

Thanks to all of the contributors who made this release possible:

Signed-off-by: Aleksa Sarai cyphar@cyphar.com

Changelog

Sourced from github.com/opencontainers/runc's changelog.

[1.1.11] - 2024-01-01

Happy New Year!

Fixed

Changed

  • Support memory.peak and memory.swap.peak in cgroups v2. Add swapOnlyUsage in MemoryStats. This field reports swap-only usage. For cgroupv1, Usage and Failcnt are set by subtracting memory usage from memory+swap usage. For cgroupv2, Usage, Limit, and MaxUsage are set. (#4000, #4010, #4131)
  • build(deps): bump github.com/cyphar/filepath-securejoin. (#4140)
Commits
  • 4bccb38 VERSION: release 1.1.11
  • 930fde5 Merge pull request #4144 from cyphar/1.1-ns-path-handling
  • 617db78 configs: make id mappings int64 to better handle 32-bit
  • e65d4ca specconv: temporarily allow userns path and mapping if they match
  • 2dd8368 integration: add mega-test for joining namespaces
  • 8f8cb45 configs: disallow ambiguous userns and timens configurations
  • 0c8e2cc *: actually support joining a userns with a new container
  • 75d99b4 Merge pull request #4131 from harche/backport
  • 87792ce libct/cg: add swapOnlyUsage in MemoryStats
  • 4f13093 Merge pull request #4140 from thaJeztah/1.1_backport_update_securejoin
  • Additional commits viewable in compare view


Updates github.com/pierrec/lz4/v4 from 4.1.19 to 4.1.21

Commits
  • 294e765 Merge pull request #216 from evanphx/b-fix-tests
  • 6e17a24 Reverts bc1239ba, no longer needed to conform to legacy
  • 9542ba5 CI: update go versions to more recent ones
  • d9eb671 cmd/lz4c: update go.mod and fix issue #214
  • 219b252 Merge pull request #213 from corneliusroemer/patch-1
  • 58c6073 Update README.md: add @​latest to cli install command
  • e974631 Merge pull request #211 from oakad/issue_210
  • 7613989 CompressingReader: support older Go versions
  • 4a80a2f CompressingReader: account for possible out buffer state
  • f2ece5b CompressingReader: make sure to clear out buffer
  • Additional commits viewable in compare view


Updates github.com/shirou/gopsutil/v3 from 3.23.11 to 3.23.12

Release notes

Sourced from github.com/shirou/gopsutil/v3's releases.

v3.23.12

What's Changed

cpu

disk

host

Other Changes

New Contributors

Full Changelog: https://github.com/shirou/gopsutil/compare/v3.23.11...v3.23.12

Commits
  • df3c7bd Merge pull request #1573 from scop/feat/udev-fs-label
  • adaeba0 feat(disk): look for filesystem labels from udev on Linux
  • 4870f6f Merge pull request #1569 from scop/perf/regex-compile
  • 08afc01 Merge pull request #1570 from scop/perf/unnecessary-regexps
  • 11bc5b3 Avoid some uses of regexps
  • 362fa4b Avoid repeated regexp compilations
  • 108235a Merge pull request #1561 from keeword/master
  • f308985 Merge pull request #1563 from shirou/dependabot/github_actions/actions/upload...
  • 5ce87a6 chore(deps): bump actions/upload-artifact from 3.1.3 to 4.0.0
  • 4b820ed Merge pull request #1564 from shirou/revert-1559-dependabot/github_actions/ac...
  • Additional commits viewable in compare view


Updates github.com/sylabs/sif/v2 from 2.15.0 to 2.15.1

Release notes

Sourced from github.com/sylabs/sif/v2's releases.

v2.15.1

What's Changed

Full Changelog: https://github.com/sylabs/sif/compare/v2.15.0...v2.15.1

Commits
  • c428dc6 Merge pull request #341 from tri-adam/bump-crypto
  • 3af14f4 build(deps): bump github.com/ProtonMail/go-crypto from v0.0.0-20230717121422-...
  • 4fa5c1d Merge pull request #339 from sylabs/dependabot/go_modules/main/github.com/sec...
  • cb18ad9 refactor: adapt to breaking change in dsse package
  • 702020f build(deps): bump github.com/secure-systems-lab/go-securesystemslib
  • bb85aa2 build(deps): bump golang.org/x/crypto from 0.15.0 to 0.17.0 (#338)
  • 3685695 build(deps): bump github.com/google/uuid from 1.4.0 to 1.5.0 (#337)
  • 252b6fb build(deps): bump github.com/sigstore/sigstore from 1.7.5 to 1.7.6 (#336)
  • 85920b1 build(deps): bump github.com/google/go-containerregistry (#335)
  • a8b0ecf build(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (#334)
  • Additional commits viewable in compare view


Updates github.com/testcontainers/testcontainers-go from 0.26.0 to 0.27.0

Release notes

Sourced from github.com/testcontainers/testcontainers-go's releases.

v0.27.0

What's Changed

⚠️ Breaking Changes

Building images with FromDockerfile

The ImageBuildInfo interface now includes a new method: BuildOptions, which is used to configure the build process. This method returns the image build options when building a Docker image from a Dockerfile, and it will apply some defaults and finally call the new BuildOptionsModifier method from the FromDockerfile struct, if set. This way it's possible to access Docker's types.ImageBuildOptions type and modify it before the build process starts.

Executing commands using the Executable interface

It now includes an Options method that needs to be implemented. This method will allow configuring the exec options added in this PR for the WithStartupCommand functional option. If your code is implementing Executable, you can embed the ExecOptions struct in your own struct in order to satisfy the interface. Please take a look at the RabbitMQ test types to see examples on how to do it.

  • feat: support for executing commands in a container with user, workDir and env (#1914) @​mdelapenya

🔒 Security

🚀 Features

🐛 Bug Fixes

📖 Documentation

... (truncated)

Commits
  • 8d0f53a chore: use new version (v0.27.0) in modules and examples
  • c3a1834 chore: do not read config but instead pass the hub prefix to the prependHub m...
  • 1bac302 fix: remove docker.io from Ryuk image name (#2046)
  • 61a37cb adds gotestsum to install tools (#2043)
  • 1c45958 Add neo4j license agreement customization options (#2036)
  • 974afd9 chore: bump Ryuk to 0.6.0 (#2040)
  • cb51b9b chore(deps): bump github.com/containerd/containerd from 1.7.7 to 1.7.11 (#2011)
  • 9f68760 feat: support configuring Ryuk verbose mode at config level (#2038)
  • 5faf6f4 chore: lookup exposed ports in the image from Config, not from ContainerConfi...
  • a9f0ac8 chore(deps): bump golang.org/x/crypto to 0.17.0 in /modules (#2006)
  • Additional commits viewable in compare view


Updates golang.org/x/crypto from 0.17.0 to 0.18.0

Commits
  • dbb6ec1 ssh/test: skip tests on darwin that fail on the darwin-amd64-longtest LUCI bu...
  • 403f699 ssh/test: avoid leaking a net.UnixConn in server.TryDialWithAddr
  • 055043d go.mod: update golang.org/x dependencies
  • 08396bb internal/poly1305: drop Go 1.12 compatibility
  • See full diff in compare view


Updates golang.org/x/net from 0.19.0 to 0.20.0

Commits
  • cb5b10f go.mod: update golang.org/x dependencies
  • 689bbc7 quic: deflake TestStreamsCreateConcurrency
  • f12db26 internal/quic/cmd/interop: use wget --no-verbose in Dockerfile
  • c136d0c quic: avoid panic when PTO expires and implicitly-created streams exist
  • f9726a9 quic: fix packet size logging
  • c337daf quic: enable qlog output in tests
  • 2b416c3 quic/qlog: create log files with O_EXCL
  • 1e59a7e quic/qlog: correctly write negative durations
  • b0eb4d6 quic: compute pnum len from max ack received, not sent
  • b952594 quic: fix data race in connection close
  • Additional commits viewable in compare view


Updates golang.org/x/sync from 0.5.0 to 0.6.0

Commits


Updates golang.org/x/tools from 0.16.0 to 0.16.1

Commits
  • 2acb2e6 gopls/internal/test/marker: minor clean up of marker test doc
  • 28b92af internal/typeparams: eliminate remainining compatibility shims
  • ee35f8e gopls/internal/lsp/source: hovering over broken packages is not an error
  • 67611a1 internal/typeparams: eliminate type aliases
  • 23c86e8 internal/typeparams: delete const Enabled=true and simplify
  • e46688f gopls/internal/analysis/fillstruct: don't panic with invalid fields
  • 8bd7553 gopls/internal/util/goversion: warn about EOL for Go 1.18
  • bc9cd15 gopls/internal/settings: remove MemoryMode option
  • bbc30f1 gopls/protocol: Allow AnnotatedTextEdits
  • f40889d gopls/internal/analysis/stubmethods: fix OOB panic in fromValueSpec
  • Additional commits viewable in compare view


Updates google.golang.org/grpc from 1.59.0 to 1.60.1

Release notes

Sourced from google.golang.org/grpc's releases.

Release v1.60.1

Bug Fixes

  • server: fix two bugs that could lead to panics at shutdown when using NumStreamWorkers (experimental feature).

Release 1.60.0

Security

  • credentials/tls: if not set, set TLS MinVersion to 1.2 and CipherSuites according to supported suites not forbidden by RFC7540.
    • This is a behavior change to bring us into better alignment with RFC 7540.

API Changes

  • resolver: remove deprecated and experimental ClientConn.NewServiceConfig (#6784)
  • client: remove deprecated grpc.WithServiceConfig DialOption (#6800)

Bug Fixes

  • client: fix race that could cause a deadlock while entering idle mode and receiving a name resolver update (#6804)
  • client: always enable TCP keepalives with OS defaults (#6834)
  • credentials/alts: fix a bug preventing ALTS from connecting to the metadata server if the default scheme is overridden (#6686)

Behavior Changes

  • server: Do not return from Stop() or GracefulStop() until all resources are released (#6489)

Documentation

  • codes: clarify that only codes defined by this package are valid and that users should not cast other values to codes.Code (#6701)
Commits


Updates google.golang.org/protobuf from 1.31.0 to 1.32.0

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
dependabot[bot] commented 10 months ago

Looks like these dependencies are updatable in another way, so this is no longer needed.