search

paketo-buildpacks / poetry-install

Apache License 2.0
1 stars 6 forks source link

Bump the go-modules group with 39 updates #340

Closed dependabot[bot] closed 5 months ago

dependabot[bot] commented 5 months ago

Bumps the go-modules group with 39 updates:

Package From To
github.com/onsi/gomega 1.30.0 1.32.0
github.com/paketo-buildpacks/occam 0.18.0 0.18.2
github.com/CycloneDX/cyclonedx-go 0.7.2 0.8.0
github.com/Microsoft/hcsshim 0.11.4 0.12.2
github.com/anchore/stereoscope 0.0.0-20230412183729-8602f1afc574 0.0.1
github.com/andybalholm/brotli 1.0.6 1.1.0
github.com/cenkalti/backoff/v4 4.2.1 4.3.0
github.com/containerd/containerd 1.7.10 1.7.11
github.com/distribution/reference 0.5.0 0.6.0
github.com/docker/docker-credential-helpers 0.8.0 0.8.1
github.com/docker/go-connections 0.4.0 0.5.0
github.com/go-git/go-git/v5 5.10.1 5.12.0
github.com/golang/protobuf 1.5.3 1.5.4
github.com/google/go-containerregistry 0.17.0 0.19.1
github.com/google/uuid 1.4.0 1.6.0
github.com/klauspost/compress 1.17.4 1.17.8
github.com/knqyf263/go-rpmdb 0.0.0-20230301153543-ba94b245509b 0.1.0
github.com/opencontainers/runc 1.1.10 1.1.12
github.com/pierrec/lz4/v4 4.1.19 4.1.21
github.com/rivo/uniseg 0.4.4 0.4.7
github.com/sassoftware/go-rpmutils 0.2.0 0.3.0
github.com/sergi/go-diff 1.3.1 1.3.2-0.20230802210424-5b0b94c5c0d3
github.com/shirou/gopsutil/v3 3.23.11 3.24.3
github.com/skeema/knownhosts 1.2.1 1.2.2
github.com/sylabs/sif/v2 2.15.0 2.16.0
github.com/testcontainers/testcontainers-go 0.26.0 0.30.0
github.com/ulikunitz/xz 0.5.11 0.5.12
github.com/wagoodman/go-progress 0.0.0-20230301185719-21920a456ad5 0.0.0-20230925121702-07e42b3cdba0
github.com/yusufpapurcu/wmi 1.2.3 1.2.4
golang.org/x/crypto 0.17.0 0.21.0
golang.org/x/exp 0.0.0-20230510235704-dd950f8aeaea 0.0.0-20231006140011-7918f672742d
golang.org/x/mod 0.14.0 0.16.0
golang.org/x/net 0.19.0 0.22.0
golang.org/x/sync 0.5.0 0.6.0
golang.org/x/sys 0.16.0 0.18.0
golang.org/x/tools 0.16.0 0.16.1
google.golang.org/genproto/googleapis/rpc 0.0.0-20231120223509-83a465c0220f 0.0.0-20240123012728-ef4313101c80
google.golang.org/grpc 1.59.0 1.62.0
google.golang.org/protobuf 1.31.0 1.33.0

Updates github.com/onsi/gomega from 1.30.0 to 1.32.0

Release notes

Sourced from github.com/onsi/gomega's releases.

v1.32.0

1.32.0

Maintenance

  • Migrate github.com/golang/protobuf to google.golang.org/protobuf [436a197]

    This release drops the deprecated github.com/golang/protobuf and adopts google.golang.org/protobuf. Care was taken to ensure the release is backwards compatible (thanks @​jbduncan !). Please open an issue if you run into one.

  • chore: test with Go 1.22 (#733) [32ef35e]

  • Bump golang.org/x/net from 0.19.0 to 0.20.0 (#717) [a0d0387]

  • Bump github-pages and jekyll-feed in /docs (#732) [b71e477]

  • docs: fix typo and broken anchor link to gstruct [f460154]

  • docs: fix HaveEach matcher signature [a2862e4]

v1.31.1

1.31.1

Fixes

  • Inverted arguments order of FailureMessage of BeComparableToMatcher [e0dd999]
  • Update test in case keeping msg is desired [ad1a367]

Maintenance

  • Show how to import the format sub package [24e958d]
  • tidy up go.sum [26661b8]
  • bump dependencies [bde8f7a]

v1.31.0

1.31.0

Features

  • Async assertions include context cancellation cause if present [121c37f]

Maintenance

  • Bump minimum go version [dee1e3c]
  • docs: fix typo in example usage "occured" -> "occurred" [49005fe]
  • Bump actions/setup-go from 4 to 5 (#714) [f1c8757]
  • Bump github/codeql-action from 2 to 3 (#715) [9836e76]
  • Bump github.com/onsi/ginkgo/v2 from 2.13.0 to 2.13.2 (#713) [54726f0]
  • Bump golang.org/x/net from 0.17.0 to 0.19.0 (#711) [df97ecc]
  • docs: fix HaveExactElement typo (#712) [a672c86]
Changelog

Sourced from github.com/onsi/gomega's changelog.

1.32.0

Maintenance

  • Migrate github.com/golang/protobuf to google.golang.org/protobuf [436a197]

    This release drops the deprecated github.com/golang/protobuf and adopts google.golang.org/protobuf. Care was taken to ensure the release is backwards compatible (thanks @​jbduncan !). Please open an issue if you run into one.

  • chore: test with Go 1.22 (#733) [32ef35e]

  • Bump golang.org/x/net from 0.19.0 to 0.20.0 (#717) [a0d0387]

  • Bump github-pages and jekyll-feed in /docs (#732) [b71e477]

  • docs: fix typo and broken anchor link to gstruct [f460154]

  • docs: fix HaveEach matcher signature [a2862e4]

1.31.1

Fixes

  • Inverted arguments order of FailureMessage of BeComparableToMatcher [e0dd999]
  • Update test in case keeping msg is desired [ad1a367]

Maintenance

  • Show how to import the format sub package [24e958d]
  • tidy up go.sum [26661b8]
  • bump dependencies [bde8f7a]

1.31.0

Features

  • Async assertions include context cancellation cause if present [121c37f]

Maintenance

  • Bump minimum go version [dee1e3c]
  • docs: fix typo in example usage "occured" -> "occurred" [49005fe]
  • Bump actions/setup-go from 4 to 5 (#714) [f1c8757]
  • Bump github/codeql-action from 2 to 3 (#715) [9836e76]
  • Bump github.com/onsi/ginkgo/v2 from 2.13.0 to 2.13.2 (#713) [54726f0]
  • Bump golang.org/x/net from 0.17.0 to 0.19.0 (#711) [df97ecc]
  • docs: fix HaveExactElement typo (#712) [a672c86]
Commits
  • 4379951 v1.32.0
  • a350b95 Maintain source backwards compatibility
  • a6c8875 Fix failing test
  • 436a197 Migrate github.com/golang/protobuf to google.golang.org/protobuf
  • 32ef35e chore: test with Go 1.22 (#733)
  • a0d0387 Bump golang.org/x/net from 0.19.0 to 0.20.0 (#717)
  • b71e477 Bump github-pages and jekyll-feed in /docs (#732)
  • f460154 docs: fix typo and broken anchor link to gstruct
  • a2862e4 docs: fix HaveEach matcher signature
  • 762b171 v1.31.1
  • Additional commits viewable in compare view


Updates github.com/paketo-buildpacks/occam from 0.18.0 to 0.18.2

Release notes

Sourced from github.com/paketo-buildpacks/occam's releases.

v0.18.2

What's Changed

Full Changelog: https://github.com/paketo-buildpacks/occam/compare/v0.18.1...v0.18.2

v0.18.1

No release notes provided.

Commits
  • f37d228 Bump github.com/opencontainers/runc from 1.1.5 to 1.1.12
  • 1d68391 tests: adding tests for NewContainerFromInspectOutput function
  • 13e5704 fix: avoid accessing undefined host ports on while creating a new container f...
  • 0fb0353 Bump github.com/containerd/containerd from 1.7.7 to 1.7.11
  • See full diff in compare view


Updates github.com/CycloneDX/cyclonedx-go from 0.7.2 to 0.8.0

Release notes

Sourced from github.com/CycloneDX/cyclonedx-go's releases.

v0.8.0

This release ships with almost complete support for v1.5 of the CycloneDX specification.

The only exception being the extended data flow support, as used in SaaS BOMs.

Unfortunately, there are also breaking changes in this release:

  • The type of Metadata.Tools has changed from *[]Tool to *ToolsChoice, to facilitate the deprecation of Tool in the spec
    • ToolsChoice holds both legacy *[]Tool, as well as the new *[]Component and *[]Service fields
    • The Tool type, as well as the ToolsChoice.Tools field are marked as deprecated
    • During encoding and decoding, it is asserted that only one of both options can be present, in accordance with the "One of" constraint of the spec
    • When encoding to lower spec versions than v1.5 (using EncodeVersion), Components and Services are automatically converted to legacy Tools
    • It is strongly recommended to use Components and Services. However, when consuming BOMs, applications should still expect legacy Tools to be present, and handle them accordingly.

Changelog

Fixes

  • 64eb0c84b3d909db47c5154c17d075f68b0c85ae: fix: remove format linters that require extra tooling (@​nscuro)

Building and Packaging

  • 696aa66151e800a672c9ec860f30d8716ae6a025: build(deps): bump actions/checkout from 3.5.3 to 4.1.0 (@​dependabot[bot])
  • b50b319d1580d5b624cfc866bc108b589b328157: build(deps): bump actions/checkout from 4.1.0 to 4.1.1 (@​dependabot[bot])
  • 5cad1b0a7dad106950790fad960be5f7e62b2110: build(deps): bump actions/setup-go from 4.1.0 to 5.0.0 (@​dependabot[bot])
  • b0910619560e5b0b0fae51dc97c4a343983873fb: build(deps): bump gitpod/workspace-go from d3603c7 to 94ae638 (@​dependabot[bot])
  • 9e310b6d641245c89aa01f07a21b50c38f04b087: build(deps): bump gitpod/workspace-go from f37c673 to d3603c7 (@​dependabot[bot])
  • 89494fd98291ca8115e02cab78e2e47360352f00: build(deps): bump goreleaser/goreleaser-action from 4.4.0 to 5.0.0 (@​dependabot[bot])

Others

  • 61dd91e0bbe730454bef42bc0c1b0a3f97411c02: feat(spec1-5): add support for machine learning (@​nscuro)
  • f831960f0887c1f60681924e4d4382cd4bb52ff0: feat(spec1-5): update valid-vulnerability test snapshots (@​nscuro)
  • ffc9a4eb9204f5a31b7fb1d6cd907e6cc3e93578: ci: enable more linters (@​mmorel-35)
  • 3feda7530db8c959381261e44a96b201f79f908c: feat(spec1-5): add additional external reference types (@​nscuro)
  • bd66a368c5116c0420f49157a217e71cde1544be: feat(spec1-5): add support for CVSSv4 scoring method (@​nscuro)
  • d597bb9076e1856b9f2d3bb9d420728df8d43d9a: feat(spec1-5): add support for firstIssued and lastUpdated in vuln analysis (@​nscuro)
  • 2ae5445d02b8e6e7391a8a0eb4d1a5bb8a6f377c: feat(spec1-5): add support for additional compositions and composition identity (@​nscuro)
  • f856daa3212521eaf5f1dd69424b9c98eee2db52: feat(spec1-5): add support for formulation (@​nscuro)
  • 2fbde0e17ac5876ff525ccdc9d1eebf90918d306: feat(spec1-5): add support for identity, occurrences, and callstack evidence (@​nscuro)
  • 745a35a73d395923303817de650a60fe82cf8ec8: feat(spec1-5): add support for licensing (@​nscuro)
  • b02255f3784c608100b2ae3d1123e41500a50ff3: feat(spec1-5): add support for lifecycles (@​nscuro)
  • fe3a9040862e5fa088e84efb004fd9e338a783d7: feat(spec1-5): add support for ssvc scoring method (@​nscuro)
  • 7d2713f4459184df4628b839e4c01bae7fd6abcf: feat(spec1-5): add support for vulnerability proof of concept (@​nscuro)
  • 25b250ac0efea93283362584394a16ca602e260f: feat(spec1-5): add support for vulnerability rejected timestamps (@​nscuro)
  • c7a84ac4ba209f5860b1aedffa2f1e71414e4508: feat(spec1-5): handle deprecation of tools (@​nscuro)
Commits
  • b9654ae Merge pull request #90 from CycloneDX/spec-v1.5
  • 64eb0c8 fix: remove format linters that require extra tooling
  • c7a84ac feat(spec1-5): handle deprecation of tools
  • f856daa feat(spec1-5): add support for formulation
  • 2fbde0e feat(spec1-5): add support for identity, occurrences, and callstack evidence
  • 61dd91e feat(spec1-5): add support for machine learning
  • f831960 feat(spec1-5): update valid-vulnerability test snapshots
  • fe3a904 feat(spec1-5): add support for ssvc scoring method
  • 7d2713f feat(spec1-5): add support for vulnerability proof of concept
  • 2ae5445 feat(spec1-5): add support for additional compositions and composition identity
  • Additional commits viewable in compare view


Updates github.com/Microsoft/hcsshim from 0.11.4 to 0.12.2

Release notes

Sourced from github.com/Microsoft/hcsshim's releases.

v0.12.2

No release notes provided.

v0.12.1

What's Changed

Full Changelog: https://github.com/microsoft/hcsshim/compare/v0.12.0...v0.12.1

v0.12.0

What's Changed

New Contributors

Full Changelog: https://github.com/microsoft/hcsshim/compare/v0.12.0-rc.3...v0.12.0

v0.12.0-rc.3

What's Changed

Full Changelog: https://github.com/microsoft/hcsshim/compare/v0.12.0-rc.2...v0.12.0-rc.3

v0.12.0-rc.2

What's Changed

... (truncated)

Commits


Updates github.com/anchore/stereoscope from 0.0.0-20230412183729-8602f1afc574 to 0.0.1

Release notes

Sourced from github.com/anchore/stereoscope's releases.

v0.0.1

Security Fixes

Full Changelog: https://github.com/anchore/stereoscope/commits/v0.0.1

Commits


Updates github.com/andybalholm/brotli from 1.0.6 to 1.1.0

Commits
  • 17e5901 Make my matchfinder work more accessible.
  • cf812c0 matchfinder: add M0
  • 1b6cf36 matchfinder: remove MultiHash
  • 265f3af matchfinder: penalize score for overlapping matches
  • a8d524a matchfinder: replace Score function with DistanceBitCost
  • 578645e matchfinder: add MultiHash
  • 24b2bfa matchfinder.M4: add Score function
  • 4a024e3 matchfinder.M4: add match chain
  • 3a1c5cd Fix typo in comment.
  • 0d2aef3 matchfinder.M4: factor out extendMatch2
  • Additional commits viewable in compare view


Updates github.com/cenkalti/backoff/v4 from 4.2.1 to 4.3.0

Commits
  • 720b789 remove travis badge from readme
  • a83af7f feat(backoff): Add functional options for ExponentialBackOff Closes #136
  • See full diff in compare view


Updates github.com/containerd/containerd from 1.7.10 to 1.7.11

Release notes

Sourced from github.com/containerd/containerd's releases.

containerd 1.7.11

Welcome to the v1.7.11 release of containerd!

The eleventh patch release for containerd 1.7 contains various fixes and updates including one security issue.

Notable Updates

  • Fix Windows default path overwrite issue (#9440)
  • Update push to always inherit distribution sources from parent (#9452)
  • Update shim to use net dial for gRPC shim sockets (#9458)
  • Fix otel version incompatibility (#9483)
  • Fix Windows snapshotter blocking snapshot GC on remove failure (#9482)
  • Mask /sys/devices/virtual/powercap path in runtime spec and deny in default apparmor profile (GHSA-7ww5-4wqc-m92c)

Deprecation Warnings

  • Emit deprecation warning for AUFS snapshotter (#9436)
  • Emit deprecation warning for v1 runtime (#9450)
  • Emit deprecation warning for deprecated CRI configs (#9469)
  • Emit deprecation warning for CRI v1alpha1 usage (#9479)
  • Emit deprecation warning for CRIU config in CRI (#9481)

See the changelog for complete list of changes

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

  • Samuel Karp
  • Derek McGowan
  • Phil Estes
  • Bjorn Neergaard
  • Danny Canter
  • Sebastiaan van Stijn
  • ruiwen-zhao
  • Akihiro Suda
  • Amit Barve
  • Charity Kathure
  • Maksym Pavlenko
  • Milas Bowman
  • Paweł Gronowski
  • Wei Fu

Changes

  • [release/1.7] Prepare release notes for v1.7.11 (#9491)

... (truncated)

Changelog

Sourced from github.com/containerd/containerd's changelog.

Versioning and Release

This document details the versioning and release plan for containerd. Stability is a top goal for this project, and we hope that this document and the processes it entails will help to achieve that. It covers the release process, versioning numbering, backporting, API stability and support horizons.

If you rely on containerd, it would be good to spend time understanding the areas of the API that are and are not supported and how they impact your project in the future.

This document will be considered a living document. Supported timelines, backport targets and API stability guarantees will be updated here as they change.

If there is something that you require or this document leaves out, please reach out by filing an issue.

Releases

Releases of containerd will be versioned using dotted triples, similar to Semantic Version. For the purposes of this document, we will refer to the respective components of this triple as <major>.<minor>.<patch>. The version number may have additional information, such as alpha, beta and release candidate qualifications. Such releases will be considered "pre-releases".

Major and Minor Releases

Major and minor releases of containerd will be made from main. Releases of containerd will be marked with GPG signed tags and announced at https://github.com/containerd/containerd/releases. The tag will be of the format v<major>.<minor>.<patch> and should be made with the command git tag -s v<major>.<minor>.<patch>.

After a minor release, a branch will be created, with the format release/<major>.<minor> from the minor tag. All further patch releases will be done from that branch. For example, once we release v1.0.0, a branch release/1.0 will be created from that tag. All future patch releases will be done against that branch.

Pre-releases

Pre-releases, such as alphas, betas and release candidates will be conducted from their source branch. For major and minor releases, these releases will be done from main. For patch releases, these pre-releases should be done within the corresponding release branch.

While pre-releases are done to assist in the stabilization process, no guarantees are provided.

... (truncated)

Commits
  • 64b8a81 Merge pull request #9491 from dmcgowan/prepare-1.7.11
  • ea5a477 Merge pull request #9352 from thaJeztah/1.7_update_golang_1.20.11
  • 67d356c Merge pull request from GHSA-7ww5-4wqc-m92c
  • dfae68b Prepare release notes for v1.7.11
  • de6d8a8 Merge pull request #9482 from ambarve/sn_cleanup_1.7
  • ed7c689 Don't block snapshot garbage collection on Remove failures
  • 467de56 Merge pull request #9481 from ruiwen-zhao/cri-u
  • d94f8ff Merge pull request #9483 from dmcgowan/backport-1.7-fix-otel-http
  • 1fdefdd Add warning for CRIU config usage
  • 8e06899 Merge pull request #9479 from ruiwen-zhao/cri-api-warning
  • Additional commits viewable in compare view


Updates github.com/distribution/reference from 0.5.0 to 0.6.0

Release notes

Sourced from github.com/distribution/reference's releases.

v0.6.0

What's Changed

New Contributors

Full Changelog: https://github.com/distribution/reference/compare/v0.5.0...v0.6.0

Commits
  • ff14faf Merge pull request #9 from ozairasim/exclude-domain-from-name-length-validation
  • 2a66312 Merge pull request #10 from xrstf/patch-1
  • 094e717 fix typo in readme
  • aaca75e Exclude domain from name length check
  • 8507c7f Merge pull request #7 from thaJeztah/cleanup_splitDockerDomain
  • 89ee7ec refactor splitDockerDomain to include more documentation
  • a3fb784 Merge pull request #5 from thaJeztah/rm_deprecated
  • 4894124 remove deprecated SplitHostname
  • See full diff in compare view


Updates github.com/docker/docker-credential-helpers from 0.8.0 to 0.8.1

Release notes

Sourced from github.com/docker/docker-credential-helpers's releases.

v0.8.1

What's Changed

Full Changelog: https://github.com/docker/docker-credential-helpers/compare/v0.8.0...v0.8.1

Commits
  • 292722b Merge pull request #308 from thaJeztah/update_golang_1.21.6
  • 979dcc4 Merge pull request #309 from thaJeztah/update_golangci
  • f411a65 Dockerfile: update golangci-lint to v1.55.2
  • 9629bd7 update to go1.21.6
  • f642c26 Merge pull request #306 from thaJeztah/err_checks
  • 8fc3306 Merge pull request #307 from thaJeztah/bump_wincred
  • 6a3e64c move trimming whitespace to error-check helpers
  • 218f178 vendor: github.com/danieljoos/wincred v1.2.1
  • See full diff in compare view


Updates github.com/docker/go-connections from 0.4.0 to 0.5.0

Commits
  • fa09c95 Merge pull request #108 from thaJeztah/carry_6
  • 7a67a58 Swap CloseRead and CloseWrite
  • 481d3d2 Merge pull request #107 from thaJeztah/drop_legacy_go
  • 9548f9f tlsconfig: remove deprecated io/ioutil
  • c564c21 drop support for go1.17 and older
  • 7cbebcf gha: update actions
  • 2cf423f tlsconfig: move allTLSVersions var
  • dca283b tlsconfig: drop support for go1.12 and older
  • 21876c5 tlsconfig: drop support for go1.6 and older
  • 4d174db tlsconfig: drop support for go1.4 and older
  • Additional commits viewable in compare view


Updates github.com/go-git/go-git/v5 from 5.10.1 to 5.12.0

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.12.0

What's Changed

New Contributors

Full Changelog: https://github.com/go-git/go-git/compare/v5.11.0...v5.12.0

v5.11.0

What's Changed

... (truncated)

Commits
  • 302ddde Merge pull request #1060 from go-git/dependabot/go_modules/github.com/gliderl...
  • 6bba34d build: bump github.com/gliderlabs/ssh from 0.3.6 to 0.3.7
  • feaeb36 Merge pull request #937 from matejrisek/feature/rename-short-fields
  • 7959a42 Merge pull request #1052 from go-git/dependabot/go_modules/github.com/skeema/...
  • 4c17ce7 build: bump github.com/skeema/knownhosts from 1.2.1 to 1.2.2
  • 3f77e6f Merge pull request #1048 from pjbgf/fix-reset-validation
  • 6af38e0 Merge pull request #1047 from avoidalone/master
  • e6c3e58 Merge pull request #1044 from pjbgf/ff-merge
  • 04f7b23 *: fix some comments
  • f4f1a87 Merge pull request #971 from nodivbyzero/fix-177-diff-print-file-stats
  • Additional commits viewable in compare view


Updates github.com/golang/protobuf from 1.5.3 to 1.5.4

Release notes

Sourced from github.com/golang/protobuf's releases.

v1.5.4

Notable changes

  • update descriptor.proto to latest version
Commits


Updates github.com/google/go-containerregistry from 0.17.0 to 0.19.1

Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.19.1

What's Changed

dependabot[bot] commented 5 months ago

Looks like these dependencies are updatable in another way, so this is no longer needed.