Added opt-in ability to validate private fields in PR, thanks @nikolaianohyn via the new WithPrivateFieldValidation option when initializing validator.
This is a security fix release for the fixes published in Golang 1.22.1.
OPA servers using --authentication=tls would be affected: crafted malicious client
certificates could cause a panic in the server.
Also, crafted server certificates could panic OPA's HTTP clients, in bundle plugin,
status and decision logs; and http.send calls that verify TLS.
This affects all crypto/tls clients, and servers that set Config.ClientAuth to
VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is
for TLS servers to not verify client certificates.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Bumps the go group with 8 updates:
10.18.0
10.19.0
0.62.0
0.62.1
1.62.0
1.62.1
0.29.0
0.29.2
0.29.0
0.29.2
0.29.0
0.29.2
0.29.0
0.29.2
0.11.4
0.14.0
Updates
github.com/go-playground/validator/v10
from 10.18.0 to 10.19.0Release notes
Sourced from github.com/go-playground/validator/v10's releases.
Commits
a0f74b0
update ci actions versionsad59377
add go 1.22 to ci build tests364672b
update private field opt-in commentcec504f
Resolving "Validating unexported fields #417" (#1234)Updates
github.com/open-policy-agent/opa
from 0.62.0 to 0.62.1Release notes
Sourced from github.com/open-policy-agent/opa's releases.
Changelog
Sourced from github.com/open-policy-agent/opa's changelog.
Commits
a4d77da
Release v0.62.1 (#6618)79d2f53
docs: fix broken schema link (#6617)5448790
build: bump golang 1.22.0 -> 1.22.1 (#6616)c1123cc
build(deps): bump golang.org/x/net from 0.21.0 to 0.22.00ad83cf
update: ADOPTERS.md (#6608)0227af2
build(deps): bump aquasecurity/trivy-action from 0.17.0 to 0.18.08d6b930
Add Trino to OPA ecosystem6a2402e
Prepare v0.63.0 developmentUpdates
google.golang.org/grpc
from 1.62.0 to 1.62.1Release notes
Sourced from google.golang.org/grpc's releases.
Commits
9952aa8
Change version to 1.62.1 (#7020)d7334c4
fix enabling compression by trimming whitespaces in accept encoding header (#...d076e14
rpc_util: Fix RecvBufferPool deactivation issues (#6766)9d981b0
cherry-pick #6997 to 1.62.x release branch (#6979) (#7018)7c4b553
Switch version to 1.62.1-dev (#6995)Updates
k8s.io/api
from 0.29.0 to 0.29.2Commits
d473130
Update dependencies to v0.29.2 tagf5eca04
Merge pull request #122959RomanBednar/automated-cherry-pick-of-#122728
fd1786f
flag PersistentVolumeLastPhaseTransitionTime field as betaa48c0a4
Merge pull request #122429 from MadhavJivrajani/tools-bump-129656e18f
.*: bump golang.org/x/tools to v0.16.1Updates
k8s.io/apiextensions-apiserver
from 0.29.0 to 0.29.2Commits
e1d6769
Update dependencies to v0.29.2 tagf14ac67
Merge pull request #122369cici37/automated-cherry-pick-of-#122193
eccd921
Merge pull request #122429 from MadhavJivrajani/tools-bump-12906c0a98
Merge pull request #122343jpbetz/automated-cherry-pick-of-#122329
4a82ea0
.*: bump golang.org/x/tools to v0.16.12d320bc
Wire in field dropping for CRDs510e9f2
Keep presence cost to 0 to ensure backward compatibility.Updates
k8s.io/apiserver
from 0.29.0 to 0.29.2Commits
4c39f36
Update dependencies to v0.29.2 tagbd6de43
Merge pull request #123080 from alexzielenski/automated-cherry-pick-of-#12300...b7459bd
bugfix: dont skip reconcile for unchanged policy if last sync failede9b5722
Merge pull request #122369cici37/automated-cherry-pick-of-#122193
037e27f
Merge pull request #122478 from liangyuanpeng/automated-cherry-pick-of-#12162...0065398
Merge pull request #122429 from MadhavJivrajani/tools-bump-129919f1ad
.*: bump golang.org/x/tools to v0.16.1ae9ed66
Address comment02998b3
Keep presence cost to 0 to ensure backward compatibility.5348142
use context for lazy evaluation.Updates
k8s.io/client-go
from 0.29.0 to 0.29.2Commits
62c5e9e
Update dependencies to v0.29.2 tagbaea19d
Merge pull request #122429 from MadhavJivrajani/tools-bump-1293373afd
.*: bump golang.org/x/tools to v0.16.1Updates
sigs.k8s.io/controller-tools
from 0.11.4 to 0.14.0Release notes
Sourced from sigs.k8s.io/controller-tools's releases.
... (truncated)
Commits
5ac2d0e
Merge pull request #872 from Neo2308/feature/master/bump-to-k8s-0.29.06177f44
Bump k8s deps to v0.29.0419500a
Merge pull request #870 from qinqon/crd-description-respect-multiline-comment...7488021
crd: Respect multiline comments at godocs943de6e
Merge pull request #869 from kubernetes-sigs/dependabot/go_modules/golang.org...ef54a04
:seedling: Bump golang.org/x/tools from 0.16.0 to 0.16.18e85f22
Merge pull request #867 from kubernetes-sigs/dependabot/github_actions/kubern...e184937
:seedling: Bump kubernetes-sigs/kubebuilder-release-tools72d3440
Merge pull request #863 from Danil-Grigorev/support-empty-maps-lists498f1db
Merge pull request #866 from kubernetes-sigs/dependabot/go_modules/golang.org...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show