search

philips-labs / dct-notary-admin

To manage Docker Content Trust and Notary certificates
MIT License
12 stars 1 forks source link

Bump github.com/hashicorp/vault/api from 1.9.2 to 1.12.2 #813

Closed dependabot[bot] closed 6 months ago

dependabot[bot] commented 7 months ago

Bumps github.com/hashicorp/vault/api from 1.9.2 to 1.12.2.

Release notes

Sourced from github.com/hashicorp/vault/api's releases.

v1.12.2

1.12.2

November 30, 2022

CHANGES:

  • core: Bump Go version to 1.19.3.
  • plugins: Mounts can no longer be pinned to a specific builtin version. Mounts previously pinned to a specific builtin version will now automatically upgrade to the latest builtin version, and may now be overridden if an unversioned plugin of the same name and type is registered. Mounts using plugin versions without builtin in their metadata remain unaffected. [GH-18051]

IMPROVEMENTS:

  • secrets/pki: Allow issuer creation, import to change default issuer via default_follows_latest_issuer. [GH-17824]
  • storage/raft: Add retry_join_as_non_voter config option. [GH-18030]

BUG FIXES:

  • auth/okta: fix a panic for AuthRenew in Okta [GH-18011]
  • auth: Deduplicate policies prior to ACL generation [GH-17914]
  • cli: Fix issue preventing kv commands from executing properly when the mount path provided by -mount flag and secret key path are the same. [GH-17679]
  • core (enterprise): Supported storage check in vault server command will no longer prevent startup. Instead, a warning will be logged if configured to use storage backend other than raft or consul.
  • core/quotas (enterprise): Fix a lock contention issue that could occur and cause Vault to become unresponsive when creating, changing, or deleting lease count quotas.
  • core: Fix potential deadlock if barrier ciphertext is less than 4 bytes. [GH-17944]
  • core: fix a start up race condition where performance standbys could go into a mount loop if default policies are not yet synced from the active node. [GH-17801]
  • plugins: Only report deprecation status for builtin plugins. [GH-17816]
  • plugins: Vault upgrades will no longer fail if a mount has been created using an explicit builtin plugin version. [GH-18051]
  • secret/pki: fix bug with initial legacy bundle migration (from < 1.11 into 1.11+) and missing issuers from ca_chain [GH-17772]
  • secrets/azure: add WAL to clean up role assignments if errors occur [GH-18086]
  • secrets/gcp: Fixes duplicate service account key for rotate root on standby or secondary [GH-18111]
  • secrets/pki: Fix upgrade of missing expiry, delta_rebuild_interval by setting them to the default. [GH-17693]
  • ui: Fixes issue with not being able to download raft snapshot via service worker [GH-17769]
  • ui: fix entity policies list link to policy show page [GH-17950]

v1.12.1

1.12.1

November 2, 2022

IMPROVEMENTS:

  • api: Support VAULT_DISABLE_REDIRECTS environment variable (and --disable-redirects flag) to disable default client behavior and prevent the client following any redirection responses. [GH-17352]
  • database/snowflake: Allow parallel requests to Snowflake [GH-17593]
  • plugins: Add plugin version information to key plugin lifecycle log lines. [GH-17430]
  • sdk/ldap: Added support for paging when searching for groups using group filters [GH-17640]

BUG FIXES:

  • cli: Remove empty table heading for vault secrets list -detailed output. [GH-17577]
  • core/managed-keys (enterprise): Return better error messages when encountering key creation failures
  • core/managed-keys (enterprise): Switch to using hash length as PSS Salt length within the test/sign api for better PKCS#11 compatibility
  • core: Fix panic caused in Vault Agent when rendering certificate templates [GH-17419]

... (truncated)

Changelog

Sourced from github.com/hashicorp/vault/api's changelog.

1.9.10

September 30, 2022

SECURITY:

  • secrets/pki: Vault’s TLS certificate auth method did not initially load the optionally-configured CRL issued by the role’s CA into memory on startup, resulting in the revocation list not being checked, if the CRL has not yet been retrieved. This vulnerability, CVE-2022-41316, is fixed in Vault 1.12.0, 1.11.4, 1.10.7, and 1.9.10. [HSEC-2022-24]

BUG FIXES:

  • auth/cert: Vault does not initially load the CRLs in cert auth unless the read/write CRL endpoint is hit. [GH-17138]
  • replication (enterprise): Fix data race in SaveCheckpoint()
  • ui: Fix lease force revoke action [GH-16930]

1.9.9

August 31, 2022

SECURITY:

  • core: When entity aliases mapped to a single entity share the same alias name, but have different mount accessors, Vault can leak metadata between the aliases. This metadata leak may result in unexpected access if templated policies are using alias metadata for path names. This vulnerability, CVE-2022-40186, is fixed in 1.11.3, 1.10.6, and 1.9.9. [HSEC-2022-18]

CHANGES:

  • core: Bump Go version to 1.17.13.

BUG FIXES:

  • core (enterprise): Fix some races in merkle index flushing code found in testing
  • core: Increase the allowed concurrent gRPC streams over the cluster port. [GH-16327]
  • database: Invalidate queue should cancel context first to avoid deadlock [GH-15933]
  • secrets/database: Fix a bug where the secret engine would queue up a lot of WAL deletes during startup. [GH-16686]
  • ui: Fix OIDC callback to accept namespace flag in different formats [GH-16886]
  • ui: Fix issue logging in with JWT auth method [GH-16466]

SECURITY:

  • identity/entity: When entity aliases mapped to a single entity share the same alias name, but have different mount accessors, Vault can leak metadata between the aliases. This metadata leak may result in unexpected access if templated policies are using alias metadata for path names. [HCSEC-2022-18]

1.9.8

July 21, 2022

SECURITY:

  • storage/raft: Vault Enterprise (“Vault”) clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a node within a Vault HA cluster, introducing potential for future data loss or catastrophic failure. This vulnerability, CVE-2022-36129, was fixed in Vault 1.9.8, 1.10.5, and 1.11.1. [HSEC-2022-15]

CHANGES:

  • core: Bump Go version to 1.17.12.

... (truncated)

Commits
  • 415e1fe Backport 1.12.x: secrets/gcp - Fixes duplicate service account key for rotate...
  • a8de422 Fix .go-version path in Makefile (#18106)
  • 3cc6b6a Remove pinned builtin plugin versions from storage (#18051) (#18102)
  • f8786e5 Update 1.12.2 to Go 1.19.3 (#18088)
  • fbbc3be Reduce number of places where go version is set (#17762) (#18099)
  • 4d96205 Backport 1.12: secrets/azure: add wal to cleanup role assignments (#18086)
  • 489e175 backport of commit 7d9bc82beee0681f49f349f92d9127dfcaaf9e5f (#18076)
  • a266cbf add missing consul dataplane partial (#18078)
  • ddcd4d0 backport of commit 8b8c077dda43c0aeeee064649678bafe9a4be5f3 (#17572)
  • 45c2543 backport of commit 0f0fe198ad1908a00e1d29dd29ad5e3f8754a290 (#18073)
  • Additional commits viewable in compare view


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
dependabot[bot] commented 6 months ago

Superseded by #824.