search

paketo-buildpacks / npm-install

A Cloud Native Buildpack for npm
Apache License 2.0
10 stars 17 forks source link

Bump the go-modules group with 20 updates #612

Closed dependabot[bot] closed 10 months ago

dependabot[bot] commented 10 months ago

Bumps the go-modules group with 20 updates:

Package From To
github.com/onsi/gomega 1.30.0 1.31.1
github.com/paketo-buildpacks/occam 0.18.0 0.18.1
github.com/CycloneDX/cyclonedx-go 0.7.2 0.8.0
github.com/andybalholm/brotli 1.0.6 1.1.0
github.com/containerd/containerd 1.7.11 1.7.12
github.com/docker/docker-credential-helpers 0.8.0 0.8.1
github.com/docker/go-connections 0.4.0 0.5.0
github.com/google/go-containerregistry 0.17.0 0.18.0
github.com/google/uuid 1.4.0 1.6.0
github.com/opencontainers/runc 1.1.10 1.1.11
github.com/pierrec/lz4/v4 4.1.19 4.1.21
github.com/shirou/gopsutil/v3 3.23.11 3.23.12
github.com/sylabs/sif/v2 2.15.0 2.15.1
github.com/testcontainers/testcontainers-go 0.26.0 0.27.0
golang.org/x/crypto 0.17.0 0.18.0
golang.org/x/net 0.19.0 0.20.0
golang.org/x/sync 0.5.0 0.6.0
golang.org/x/tools 0.16.1 0.17.0
google.golang.org/grpc 1.59.0 1.61.0
google.golang.org/protobuf 1.31.0 1.32.0

Updates github.com/onsi/gomega from 1.30.0 to 1.31.1

Release notes

Sourced from github.com/onsi/gomega's releases.

v1.31.1

1.31.1

Fixes

  • Inverted arguments order of FailureMessage of BeComparableToMatcher [e0dd999]
  • Update test in case keeping msg is desired [ad1a367]

Maintenance

  • Show how to import the format sub package [24e958d]
  • tidy up go.sum [26661b8]
  • bump dependencies [bde8f7a]

v1.31.0

1.31.0

Features

  • Async assertions include context cancellation cause if present [121c37f]

Maintenance

  • Bump minimum go version [dee1e3c]
  • docs: fix typo in example usage "occured" -> "occurred" [49005fe]
  • Bump actions/setup-go from 4 to 5 (#714) [f1c8757]
  • Bump github/codeql-action from 2 to 3 (#715) [9836e76]
  • Bump github.com/onsi/ginkgo/v2 from 2.13.0 to 2.13.2 (#713) [54726f0]
  • Bump golang.org/x/net from 0.17.0 to 0.19.0 (#711) [df97ecc]
  • docs: fix HaveExactElement typo (#712) [a672c86]
Changelog

Sourced from github.com/onsi/gomega's changelog.

1.31.1

Fixes

  • Inverted arguments order of FailureMessage of BeComparableToMatcher [e0dd999]
  • Update test in case keeping msg is desired [ad1a367]

Maintenance

  • Show how to import the format sub package [24e958d]
  • tidy up go.sum [26661b8]
  • bump dependencies [bde8f7a]

1.31.0

Features

  • Async assertions include context cancellation cause if present [121c37f]

Maintenance

  • Bump minimum go version [dee1e3c]
  • docs: fix typo in example usage "occured" -> "occurred" [49005fe]
  • Bump actions/setup-go from 4 to 5 (#714) [f1c8757]
  • Bump github/codeql-action from 2 to 3 (#715) [9836e76]
  • Bump github.com/onsi/ginkgo/v2 from 2.13.0 to 2.13.2 (#713) [54726f0]
  • Bump golang.org/x/net from 0.17.0 to 0.19.0 (#711) [df97ecc]
  • docs: fix HaveExactElement typo (#712) [a672c86]
Commits
  • 762b171 v1.31.1
  • 26661b8 tidy up go.sum
  • bde8f7a bump dependencies
  • 24e958d Show how to import the format sub package
  • ad1a367 Update test in case keeping msg is desired
  • e0dd999 Inverted arguments order of FailureMessage of BeComparableToMatcher
  • ba8bba2 v1.31.0
  • 121c37f Async assertions include context cancellation cause if present
  • dee1e3c Bump minimum go version
  • 49005fe docs: fix typo in example usage "occured" -> "occurred"
  • Additional commits viewable in compare view


Updates github.com/paketo-buildpacks/occam from 0.18.0 to 0.18.1

Commits
  • 1d68391 tests: adding tests for NewContainerFromInspectOutput function
  • 13e5704 fix: avoid accessing undefined host ports on while creating a new container f...
  • 0fb0353 Bump github.com/containerd/containerd from 1.7.7 to 1.7.11
  • See full diff in compare view


Updates github.com/CycloneDX/cyclonedx-go from 0.7.2 to 0.8.0

Release notes

Sourced from github.com/CycloneDX/cyclonedx-go's releases.

v0.8.0

This release ships with almost complete support for v1.5 of the CycloneDX specification.

The only exception being the extended data flow support, as used in SaaS BOMs.

Unfortunately, there are also breaking changes in this release:

  • The type of Metadata.Tools has changed from *[]Tool to *ToolsChoice, to facilitate the deprecation of Tool in the spec
    • ToolsChoice holds both legacy *[]Tool, as well as the new *[]Component and *[]Service fields
    • The Tool type, as well as the ToolsChoice.Tools field are marked as deprecated
    • During encoding and decoding, it is asserted that only one of both options can be present, in accordance with the "One of" constraint of the spec
    • When encoding to lower spec versions than v1.5 (using EncodeVersion), Components and Services are automatically converted to legacy Tools
    • It is strongly recommended to use Components and Services. However, when consuming BOMs, applications should still expect legacy Tools to be present, and handle them accordingly.

Changelog

Fixes

  • 64eb0c84b3d909db47c5154c17d075f68b0c85ae: fix: remove format linters that require extra tooling (@​nscuro)

Building and Packaging

  • 696aa66151e800a672c9ec860f30d8716ae6a025: build(deps): bump actions/checkout from 3.5.3 to 4.1.0 (@​dependabot[bot])
  • b50b319d1580d5b624cfc866bc108b589b328157: build(deps): bump actions/checkout from 4.1.0 to 4.1.1 (@​dependabot[bot])
  • 5cad1b0a7dad106950790fad960be5f7e62b2110: build(deps): bump actions/setup-go from 4.1.0 to 5.0.0 (@​dependabot[bot])
  • b0910619560e5b0b0fae51dc97c4a343983873fb: build(deps): bump gitpod/workspace-go from d3603c7 to 94ae638 (@​dependabot[bot])
  • 9e310b6d641245c89aa01f07a21b50c38f04b087: build(deps): bump gitpod/workspace-go from f37c673 to d3603c7 (@​dependabot[bot])
  • 89494fd98291ca8115e02cab78e2e47360352f00: build(deps): bump goreleaser/goreleaser-action from 4.4.0 to 5.0.0 (@​dependabot[bot])

Others

  • 61dd91e0bbe730454bef42bc0c1b0a3f97411c02: feat(spec1-5): add support for machine learning (@​nscuro)
  • f831960f0887c1f60681924e4d4382cd4bb52ff0: feat(spec1-5): update valid-vulnerability test snapshots (@​nscuro)
  • ffc9a4eb9204f5a31b7fb1d6cd907e6cc3e93578: ci: enable more linters (@​mmorel-35)
  • 3feda7530db8c959381261e44a96b201f79f908c: feat(spec1-5): add additional external reference types (@​nscuro)
  • bd66a368c5116c0420f49157a217e71cde1544be: feat(spec1-5): add support for CVSSv4 scoring method (@​nscuro)
  • d597bb9076e1856b9f2d3bb9d420728df8d43d9a: feat(spec1-5): add support for firstIssued and lastUpdated in vuln analysis (@​nscuro)
  • 2ae5445d02b8e6e7391a8a0eb4d1a5bb8a6f377c: feat(spec1-5): add support for additional compositions and composition identity (@​nscuro)
  • f856daa3212521eaf5f1dd69424b9c98eee2db52: feat(spec1-5): add support for formulation (@​nscuro)
  • 2fbde0e17ac5876ff525ccdc9d1eebf90918d306: feat(spec1-5): add support for identity, occurrences, and callstack evidence (@​nscuro)
  • 745a35a73d395923303817de650a60fe82cf8ec8: feat(spec1-5): add support for licensing (@​nscuro)
  • b02255f3784c608100b2ae3d1123e41500a50ff3: feat(spec1-5): add support for lifecycles (@​nscuro)
  • fe3a9040862e5fa088e84efb004fd9e338a783d7: feat(spec1-5): add support for ssvc scoring method (@​nscuro)
  • 7d2713f4459184df4628b839e4c01bae7fd6abcf: feat(spec1-5): add support for vulnerability proof of concept (@​nscuro)
  • 25b250ac0efea93283362584394a16ca602e260f: feat(spec1-5): add support for vulnerability rejected timestamps (@​nscuro)
  • c7a84ac4ba209f5860b1aedffa2f1e71414e4508: feat(spec1-5): handle deprecation of tools (@​nscuro)
Commits
  • b9654ae Merge pull request #90 from CycloneDX/spec-v1.5
  • 64eb0c8 fix: remove format linters that require extra tooling
  • c7a84ac feat(spec1-5): handle deprecation of tools
  • f856daa feat(spec1-5): add support for formulation
  • 2fbde0e feat(spec1-5): add support for identity, occurrences, and callstack evidence
  • 61dd91e feat(spec1-5): add support for machine learning
  • f831960 feat(spec1-5): update valid-vulnerability test snapshots
  • fe3a904 feat(spec1-5): add support for ssvc scoring method
  • 7d2713f feat(spec1-5): add support for vulnerability proof of concept
  • 2ae5445 feat(spec1-5): add support for additional compositions and composition identity
  • Additional commits viewable in compare view


Updates github.com/andybalholm/brotli from 1.0.6 to 1.1.0

Commits
  • 17e5901 Make my matchfinder work more accessible.
  • cf812c0 matchfinder: add M0
  • 1b6cf36 matchfinder: remove MultiHash
  • 265f3af matchfinder: penalize score for overlapping matches
  • a8d524a matchfinder: replace Score function with DistanceBitCost
  • 578645e matchfinder: add MultiHash
  • 24b2bfa matchfinder.M4: add Score function
  • 4a024e3 matchfinder.M4: add match chain
  • 3a1c5cd Fix typo in comment.
  • 0d2aef3 matchfinder.M4: factor out extendMatch2
  • Additional commits viewable in compare view


Updates github.com/containerd/containerd from 1.7.11 to 1.7.12

Release notes

Sourced from github.com/containerd/containerd's releases.

containerd 1.7.12

Welcome to the v1.7.12 release of containerd!

The twelfth patch release for containerd 1.7 contains various fixes and updates.

Notable Updates

  • Fix on dialer function for Windows (#9501)
  • Improve /etc/group handling when appending groups (#9544)
  • Update shim pidfile permissions to 0644 (#9548)
  • Update runc binary to v1.1.11 (#9596)
  • Allow import and export to reference missing content (#9600)
  • Remove runc import (#9605)
  • Update Go version to 1.20.13 (#9624)

Deprecation Warnings

  • Emit deprecation warning for containerd.io/restart.logpath label usage (#9567)

See the changelog for complete list of changes

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

  • Akihiro Suda
  • Sebastiaan van Stijn
  • Wei Fu
  • Derek McGowan
  • Paweł Gronowski
  • Jaroslav Jindrak
  • Maksym Pavlenko
  • Samuel Karp
  • Anthony Nandaa
  • Bjorn Neergaard
  • Djordje Lukic
  • Kay Yan

Changes

  • [release/1.7] Prepare release notes for v1.7.12 (#9632)
    • 775d544fe Prepare release notes for v1.7.12
  • [release/1.7] update to go1.20.13, test go1.21.6 (#9624)
    • a5dc5b894 update to go1.20.13, test go1.21.6
  • [release/1.7] shim: Create pid-file and address with 0644 permissions (#9548)
    • 8d82242eb shim: Create address file with 0644 permissions
    • 260963a35 shim: Create pid-file with 0644 permissions

... (truncated)

Commits
  • 71909c1 Merge pull request #9632 from dmcgowan/prepare-v1.7.12
  • 775d544 Prepare release notes for v1.7.12
  • 4ebe8e2 Merge pull request #9624 from thaJeztah/1.7_update_golang_1.20.13
  • a5dc5b8 update to go1.20.13, test go1.21.6
  • 50e7359 Merge pull request #9548 from Dzejrou/1.7_fix_ignoring_umask
  • 5a675f2 Merge pull request #9602 from thaJeztah/1.7_backport_no_execabs
  • ccca466 Merge pull request #9605 from thaJeztah/1.7_backport_switch_moby_user
  • 9251072 remove github.com/opencontainers/runc dependency
  • 4e67213 vendor: github.com/cncf-tags/container-device-interface v0.6.1
  • e0ee0be go.mod: github.com/opencontainers/runtime-spec v1.1.0
  • Additional commits viewable in compare view


Updates github.com/docker/docker-credential-helpers from 0.8.0 to 0.8.1

Release notes

Sourced from github.com/docker/docker-credential-helpers's releases.

v0.8.1

What's Changed

Full Changelog: https://github.com/docker/docker-credential-helpers/compare/v0.8.0...v0.8.1

Commits
  • 292722b Merge pull request #308 from thaJeztah/update_golang_1.21.6
  • 979dcc4 Merge pull request #309 from thaJeztah/update_golangci
  • f411a65 Dockerfile: update golangci-lint to v1.55.2
  • 9629bd7 update to go1.21.6
  • f642c26 Merge pull request #306 from thaJeztah/err_checks
  • 8fc3306 Merge pull request #307 from thaJeztah/bump_wincred
  • 6a3e64c move trimming whitespace to error-check helpers
  • 218f178 vendor: github.com/danieljoos/wincred v1.2.1
  • See full diff in compare view


Updates github.com/docker/go-connections from 0.4.0 to 0.5.0

Commits
  • fa09c95 Merge pull request #108 from thaJeztah/carry_6
  • 7a67a58 Swap CloseRead and CloseWrite
  • 481d3d2 Merge pull request #107 from thaJeztah/drop_legacy_go
  • 9548f9f tlsconfig: remove deprecated io/ioutil
  • c564c21 drop support for go1.17 and older
  • 7cbebcf gha: update actions
  • 2cf423f tlsconfig: move allTLSVersions var
  • dca283b tlsconfig: drop support for go1.12 and older
  • 21876c5 tlsconfig: drop support for go1.6 and older
  • 4d174db tlsconfig: drop support for go1.4 and older
  • Additional commits viewable in compare view


Updates github.com/google/go-containerregistry from 0.17.0 to 0.18.0

Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.18.0

What's Changed

New Contributors

Full Changelog: https://github.com/google/go-containerregistry/compare/v0.17.0...v0.18.0

Commits


Updates github.com/google/uuid from 1.4.0 to 1.6.0

Release notes

Sourced from github.com/google/uuid's releases.

v1.6.0

1.6.0 (2024-01-16)

Features

Bug Fixes

v1.5.0

1.5.0 (2023-12-12)

Features

  • Validate UUID without creating new UUID (#141) (9ee7366)
Changelog

Sourced from github.com/google/uuid's changelog.

1.6.0 (2024-01-16)

Features

Bug Fixes

1.5.0 (2023-12-12)

Features

  • Validate UUID without creating new UUID (#141) (9ee7366)
Commits


Updates github.com/opencontainers/runc from 1.1.10 to 1.1.11

Release notes

Sourced from github.com/opencontainers/runc's releases.

runc 1.1.11 -- "Happy New Year!"

This is the eleventh patch release in the 1.1.z release branch of runc. It primarily fixes a few issues with runc's handling of containers that are configured to join existing user namespaces, as well as improvements to cgroupv2 support.

  • Fix several issues with userns path handling. (#4122, #4124, #4134, #4144)
  • Support memory.peak and memory.swap.peak in cgroups v2. Add swapOnlyUsage in MemoryStats. This field reports swap-only usage. For cgroupv1, Usage and Failcnt are set by subtracting memory usage from memory+swap usage. For cgroupv2, Usage, Limit, and MaxUsage are set. (#4000, #4010, #4131)
  • build(deps): bump github.com/cyphar/filepath-securejoin. (#4140)

Static Linking Notices

The runc binary distributed with this release are statically linked with the following GNU LGPL-2.1 licensed libraries, with runc acting as a "work that uses the Library":

The versions of these libraries were not modified from their upstream versions, but in order to comply with the LGPL-2.1 (§6(a)), we have attached the complete source code for those libraries which (when combined with the attached runc source code) may be used to exercise your rights under the LGPL-2.1.

However we strongly suggest that you make use of your distribution's packages or download them from the authoritative upstream sources, especially since these libraries are related to the security of your containers.

Thanks to all of the contributors who made this release possible:

Signed-off-by: Aleksa Sarai cyphar@cyphar.com

Changelog

Sourced from github.com/opencontainers/runc's changelog.

[1.1.11] - 2024-01-01

Happy New Year!

Fixed

Changed

  • Support memory.peak and memory.swap.peak in cgroups v2. Add swapOnlyUsage in MemoryStats. This field reports swap-only usage. For cgroupv1, Usage and Failcnt are set by subtracting memory usage from memory+swap usage. For cgroupv2, Usage, Limit, and MaxUsage are set. (#4000, #4010, #4131)
  • build(deps): bump github.com/cyphar/filepath-securejoin. (#4140)
Commits
  • 4bccb38 VERSION: release 1.1.11
  • 930fde5 Merge pull request #4144 from cyphar/1.1-ns-path-handling
  • 617db78 configs: make id mappings int64 to better handle 32-bit
  • e65d4ca specconv: temporarily allow userns path and mapping if they match
  • 2dd8368 integration: add mega-test for joining namespaces
  • 8f8cb45 configs: disallow ambiguous userns and timens configurations
  • 0c8e2cc *: actually support joining a userns with a new container
  • 75d99b4 Merge pull request #4131 from harche/backport
  • 87792ce libct/cg: add swapOnlyUsage in MemoryStats
  • 4f13093 Merge pull request #4140 from thaJeztah/1.1_backport_update_securejoin
  • Additional commits viewable in compare view


Updates github.com/pierrec/lz4/v4 from 4.1.19 to 4.1.21

Commits
  • 294e765 Merge pull request #216 from evanphx/b-fix-tests
  • 6e17a24 Reverts bc1239ba, no longer needed to conform to legacy
  • 9542ba5 CI: update go versions to more recent ones
  • d9eb671 cmd/lz4c: update go.mod and fix issue #214
  • 219b252 Merge pull request #213 from corneliusroemer/patch-1
  • 58c6073 Update README.md: add @​latest to cli install command
  • e974631 Merge pull request #211 from oakad/issue_210
  • 7613989 CompressingReader: support older Go versions
  • 4a80a2f CompressingReader: account for possible out buffer state
  • f2ece5b CompressingReader: make sure to clear out buffer
  • Additional commits viewable in compare view


Updates github.com/shirou/gopsutil/v3 from 3.23.11 to 3.23.12

Release notes

Sourced from github.com/shirou/gopsutil/v3's releases.

v3.23.12

What's Changed

cpu

disk

host

Other Changes

New Contributors

Full Changelog: https://github.com/shirou/gopsutil/compare/v3.23.11...v3.23.12

Commits
  • df3c7bd Merge pull request #1573 from scop/feat/udev-fs-label
  • adaeba0 feat(disk): look for filesystem labels from udev on Linux
  • 4870f6f Merge pull request #1569 from scop/perf/regex-compile
  • 08afc01 Merge pull request #1570 from scop/perf/unnecessary-regexps
  • 11bc5b3 Avoid some uses of regexps
  • 362fa4b Avoid repeated regexp compilations
  • 108235a Merge pull request #1561 from keeword/master
  • f308985 Merge pull request #1563 from shirou/dependabot/github_actions/actions/upload...
  • 5ce87a6 chore(deps): bump actions/upload-artifact from 3.1.3 to 4.0.0
  • 4b820ed Merge pull request #1564 from shirou/revert-1559-dependabot/github_actions/ac...
  • Additional commits viewable in compare view


Updates github.com/sylabs/sif/v2 from 2.15.0 to 2.15.1

Release notes

Sourced from github.com/sylabs/sif/v2's releases.

v2.15.1

What's Changed

Full Changelog: https://github.com/sylabs/sif/compare/v2.15.0...v2.15.1

Commits
  • c428dc6 Merge pull request #341 from tri-adam/bump-crypto
  • 3af14f4 build(deps): bump github.com/ProtonMail/go-crypto from v0.0.0-20230717121422-...
  • 4fa5c1d Merge pull request #339 from sylabs/dependabot/go_modules/main/github.com/sec...
  • cb18ad9 refactor: adapt to breaking change in dsse package
  • 702020f build(deps): bump github.com/secure-systems-lab/go-securesystemslib
  • bb85aa2 build(deps): bump golang.org/x/crypto from 0.15.0 to 0.17.0 (#338)
  • 3685695 build(deps): bump github.com/google/uuid from 1.4.0 to 1.5.0 (#337)
  • 252b6fb build(deps): bump github.com/sigstore/sigstore from 1.7.5 to 1.7.6 (#336)
  • 85920b1 build(deps): bump github.com/google/go-containerregistry (#335)
  • a8b0ecf build(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (#334)
  • Additional commits viewable in compare view


Updates github.com/testcontainers/testcontainers-go from 0.26.0 to 0.27.0

Release notes

Sourced from github.com/testcontainers/testcontainers-go's releases.

v0.27.0

What's Changed

⚠️ Breaking Changes

Building images with FromDockerfile

The ImageBuildInfo interface now includes a new method: BuildOptions, which is used to configure the build process. This method returns the image build options when building a Docker image from a Dockerfile, and it will apply some defaults and finally call the new BuildOptionsModifier method from the FromDockerfile struct, if set. This way it's possible to access Docker's types.ImageBuildOptions type and modify it before the build process starts.

Executing commands using the Executable interface

It now includes an Options method that needs to be implemented. This method will allow configuring the exec options added in this PR for the WithStartupCommand functional option. If your code is implementing Executable, you can embed the ExecOptions struct in your own struct in order to satisfy the interface. Please take a look at the RabbitMQ test types to see examples on how to do it.

  • feat: support for executing commands in a container with user, workDir and env (#1914) @​mdelapenya

🔒 Security

🚀 Features

🐛 Bug Fixes

📖 Documentation

... (truncated)

Commits
  • 8d0f53a chore: use new version (v0.27.0) in modules and examples
  • c3a1834 chore: do not read config but instead pass the hub prefix to the prependHub m...
  • 1bac302 fix: remove docker.io from Ryuk image name (#2046)
  • 61a37cb adds gotestsum to install tools (#2043)
  • 1c45958 Add neo4j license agreement customization options (#2036)
  • 974afd9 chore: bump Ryuk to 0.6.0 (#2040)
  • cb51b9b chore(deps): bump github.com/containerd/containerd from 1.7.7 to 1.7.11 (#2011)
  • 9f68760 feat: support configuring Ryuk verbose mode at config level (#2038)
  • 5faf6f4 chore: lookup exposed ports in the image from Config, not from ContainerConfi...
  • a9f0ac8 chore(deps): bump golang.org/x/crypto to 0.17.0 in /modules (#2006)
  • Additional commits viewable in compare view


Updates golang.org/x/crypto from 0.17.0 to 0.18.0

Commits
  • dbb6ec1 ssh/test: skip tests on darwin that fail on the darwin-amd64-longtest LUCI bu...
  • 403f699 ssh/test: avoid leaking a net.UnixConn in server.TryDialWithAddr
  • 055043d go.mod: update golang.org... _Description has been truncated_
dependabot[bot] commented 10 months ago

Looks like these dependencies are updatable in another way, so this is no longer needed.