search

proactiveops / opa_lambda

Lambda function to evaluate OPA policy files
MIT License
0 stars 0 forks source link

Bump github.com/open-policy-agent/opa from 0.60.0 to 0.62.1 in /lambda #119

Closed dependabot[bot] closed 7 months ago

dependabot[bot] commented 8 months ago

Bumps github.com/open-policy-agent/opa from 0.60.0 to 0.62.1.

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v0.62.1

This is a security fix release for the fixes published in Go 1.22.1.

OPA servers using --authentication=tls would be affected: crafted malicious client certificates could cause a panic in the server.

Also, crafted server certificates could panic OPA's HTTP clients, in bundle plugin, status and decision logs; and http.send calls that verify TLS.

This is CVE-2024-24783 (https://pkg.go.dev/vuln/GO-2024-2598).

Note that there are other security fixes in this Golang release, but whether or not OPA is affected is harder to assess. An update is advised.

Miscellaneous

v0.62.0

NOTES:

  • The minimum version of Go required to build the OPA module is 1.20

This release contains a mix of improvements and bugfixes.

Runtime, Tooling, SDK

  • cmd: Add environment variable backups for command-line flags (#6508) authored by @​colinjlacy
  • download/oci: Add missing WithBundleParserOpts method to OCI downloader (#6571) authored by @​slonka
  • logging: avoid %!F(MISSING) in logs by skipping calls to the {Debug,Info,Warn,Error}f functions when there are no arguments (#6555) authored by @​srenatus

Topdown and Rego

Docs + Website + Ecosystem

  • Add OpaDotNet to ecosystem projects (#6554) authored by @​me-viper
  • Add updated logos for Permit.io and OPAL (#6562) authored by @​danielbass37
  • docs: Update description of the url path usage when accessing values inside object and array documents for v1/data GET and POST (#6567) authored by @​ashutosh-narkar
  • docs: Use application/yaml instead of application/x-yaml as the former is now a recognized content type (#6565) authored by @​anderseknert

Miscellaneous

  • Add Elastic to ADOPTERS.md (#6568) authored by @​orouz
  • Dependency updates; notably:
    • bump golang 1.21.5 -> 1.22 (#6595) authored by @​srenatus
    • bump google.golang.org/grpc from 1.61.0 to 1.62.0
    • bump golang.org/x/net from 0.19.0 to 0.21.0

... (truncated)

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

0.62.1

This is a security fix release for the fixes published in Golang 1.22.1.

OPA servers using --authentication=tls would be affected: crafted malicious client certificates could cause a panic in the server.

Also, crafted server certificates could panic OPA's HTTP clients, in bundle plugin, status and decision logs; and http.send calls that verify TLS.

This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.

This is CVE-2024-24783 (https://pkg.go.dev/vuln/GO-2024-2598).

Note that there are other security fixes in this Golang release, but whether or not OPA is affected is harder to tell. An update is advised.

Miscellaneous

0.62.0

NOTES:

  • The minimum version of Go required to build the OPA module is 1.20

This release contains a mix of improvements and bugfixes.

Runtime, Tooling, SDK

  • cmd: Add environment variable backups for command-line flags (#6508) authored by @​colinjlacy
  • download/oci: Add missing WithBundleParserOpts method to OCI downloader (#6571) authored by @​slonka
  • logging: avoid %!F(MISSING) in logs by skipping calls to the {Debug,Info,Warn,Error}f functions when there are no arguments (#6555) authored by @​srenatus

Topdown and Rego

Docs + Website + Ecosystem

  • Add OpaDotNet to ecosystem projects (#6554) authored by @​me-viper
  • Add updated logos for Permit.io and OPAL (#6562) authored by @​danielbass37
  • docs: Update description of the url path usage when accessing values inside object and array documents for v1/data GET and POST (#6567) authored by @​ashutosh-narkar

... (truncated)

Commits


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
dependabot[bot] commented 7 months ago

Superseded by #136.