Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Bump the go_modules group across 10 directories with 5 updates (#219)
Bumps the go_modules group with 2 updates in the /aws-auth directory: [golang.org/x/net](https://github.com/golang/net) and google.golang.org/protobuf. Bumps the go_modules group with 3 updates in the /event-recorder directory: [golang.org/x/net](https://github.com/golang/net), google.golang.org/protobuf and [github.com/go-jose/go-jose/v3](https://github.com/go-jose/go-jose). Bumps the go_modules group with 3 updates in the /github-issue-opener directory: google.golang.org/protobuf, [github.com/cloudevents/sdk-go/v2](https://github.com/cloudevents/sdk-go) and [github.com/go-jose/go-jose/v3](https://github.com/go-jose/go-jose). Bumps the go_modules group with 3 updates in the /image-copy-ecr directory: [golang.org/x/net](https://github.com/golang/net), google.golang.org/protobuf and [github.com/docker/docker](https://github.com/docker/docker). Bumps the go_modules group with 5 updates in the /image-copy-gcp directory: | Package | From | To | | --- | --- | --- | | [golang.org/x/net](https://github.com/golang/net) | `0.18.0` | `0.23.0` | | google.golang.org/protobuf | `1.31.0` | `1.33.0` | | [github.com/cloudevents/sdk-go/v2](https://github.com/cloudevents/sdk-go) | `2.14.0` | `2.15.2` | | [github.com/go-jose/go-jose/v3](https://github.com/go-jose/go-jose) | `3.0.1` | `3.0.3` | | [github.com/docker/docker](https://github.com/docker/docker) | `24.0.7+incompatible` | `25.0.6+incompatible` | Bumps the go_modules group with 2 updates in the /image-diff directory: [golang.org/x/net](https://github.com/golang/net) and google.golang.org/protobuf. Bumps the go_modules group with 3 updates in the /jira-issue-opener directory: google.golang.org/protobuf, [github.com/cloudevents/sdk-go/v2](https://github.com/cloudevents/sdk-go) and [github.com/go-jose/go-jose/v3](https://github.com/go-jose/go-jose). Bumps the go_modules group with 2 updates in the /registry-repo-readmes directory: [golang.org/x/net](https://github.com/golang/net) and google.golang.org/protobuf. Bumps the go_modules group with 4 updates in the /slack-webhook directory: [golang.org/x/net](https://github.com/golang/net), google.golang.org/protobuf, [github.com/cloudevents/sdk-go/v2](https://github.com/cloudevents/sdk-go) and [github.com/go-jose/go-jose/v3](https://github.com/go-jose/go-jose). Bumps the go_modules group with 2 updates in the /tag-history directory: [golang.org/x/net](https://github.com/golang/net) and google.golang.org/protobuf. Updates `golang.org/x/net` from 0.18.0 to 0.23.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/net/commit/c48da131589f122489348be5dfbcb6457640046f"><code>c48da13</code></a> http2: fix TestServerContinuationFlood flakes</li> <li><a href="https://github.com/golang/net/commit/762b58d1cf6e0779780decad89c6c1523386638d"><code>762b58d</code></a> http2: fix tipos in comment</li> <li><a href="https://github.com/golang/net/commit/ba872109ef2dc8f1da778651bd1fd3792d0e4587"><code>ba87210</code></a> http2: close connections when receiving too many headers</li> <li><a href="https://github.com/golang/net/commit/ebc8168ac8ac742194df729305175940790c55a2"><code>ebc8168</code></a> all: fix some typos</li> <li><a href="https://github.com/golang/net/commit/3678185f8a652e52864c44049a9ea96b7bcc066a"><code>3678185</code></a> http2: make TestCanonicalHeaderCacheGrowth faster</li> <li><a href="https://github.com/golang/net/commit/448c44f9287b6745f958d74aa2a17ec7761c2f13"><code>448c44f</code></a> http2: remove clientTester</li> <li><a href="https://github.com/golang/net/commit/c7877ac4213b2f859831366f5a35b353e0dc9f66"><code>c7877ac</code></a> http2: convert the remaining clientTester tests to testClientConn</li> <li><a href="https://github.com/golang/net/commit/d8870b0bf2f2426fc8d19a9332f652da5c25418f"><code>d8870b0</code></a> http2: use synthetic time in TestIdleConnTimeout</li> <li><a href="https://github.com/golang/net/commit/d73acffdc9493532acb85777105bb4a351eea702"><code>d73acff</code></a> http2: only set up deadline when Server.IdleTimeout is positive</li> <li><a href="https://github.com/golang/net/commit/89f602b7bbf237abe0467031a18b42fc742ced08"><code>89f602b</code></a> http2: validate client/outgoing trailers</li> <li>Additional commits viewable in <a href="https://github.com/golang/net/compare/v0.18.0...v0.23.0">compare view</a></li> </ul> </details> <br /> Updates `google.golang.org/protobuf` from 1.31.0 to 1.33.0 Updates `golang.org/x/net` from 0.21.0 to 0.23.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/net/commit/c48da131589f122489348be5dfbcb6457640046f"><code>c48da13</code></a> http2: fix TestServerContinuationFlood flakes</li> <li><a href="https://github.com/golang/net/commit/762b58d1cf6e0779780decad89c6c1523386638d"><code>762b58d</code></a> http2: fix tipos in comment</li> <li><a href="https://github.com/golang/net/commit/ba872109ef2dc8f1da778651bd1fd3792d0e4587"><code>ba87210</code></a> http2: close connections when receiving too many headers</li> <li><a href="https://github.com/golang/net/commit/ebc8168ac8ac742194df729305175940790c55a2"><code>ebc8168</code></a> all: fix some typos</li> <li><a href="https://github.com/golang/net/commit/3678185f8a652e52864c44049a9ea96b7bcc066a"><code>3678185</code></a> http2: make TestCanonicalHeaderCacheGrowth faster</li> <li><a href="https://github.com/golang/net/commit/448c44f9287b6745f958d74aa2a17ec7761c2f13"><code>448c44f</code></a> http2: remove clientTester</li> <li><a href="https://github.com/golang/net/commit/c7877ac4213b2f859831366f5a35b353e0dc9f66"><code>c7877ac</code></a> http2: convert the remaining clientTester tests to testClientConn</li> <li><a href="https://github.com/golang/net/commit/d8870b0bf2f2426fc8d19a9332f652da5c25418f"><code>d8870b0</code></a> http2: use synthetic time in TestIdleConnTimeout</li> <li><a href="https://github.com/golang/net/commit/d73acffdc9493532acb85777105bb4a351eea702"><code>d73acff</code></a> http2: only set up deadline when Server.IdleTimeout is positive</li> <li><a href="https://github.com/golang/net/commit/89f602b7bbf237abe0467031a18b42fc742ced08"><code>89f602b</code></a> http2: validate client/outgoing trailers</li> <li>Additional commits viewable in <a href="https://github.com/golang/net/compare/v0.18.0...v0.23.0">compare view</a></li> </ul> </details> <br /> Updates `google.golang.org/protobuf` from 1.32.0 to 1.33.0 Updates `github.com/go-jose/go-jose/v3` from 3.0.1 to 3.0.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-jose/go-jose/releases">github.com/go-jose/go-jose/v3's releases</a>.</em></p> <blockquote> <h2>Version 3.0.3</h2> <h2>Fixed</h2> <ul> <li>Limit decompression output size to prevent a DoS. Backport from v4.0.1.</li> </ul> <h2>Version 3.0.2</h2> <h2>Fixed</h2> <ul> <li>DecryptMulti: handle decompression error (<a href="https://redirect.github.com/go-jose/go-jose/issues/19">#19</a>)</li> </ul> <h2>Changed</h2> <ul> <li>jwe/CompactSerialize: improve performance (<a href="https://redirect.github.com/go-jose/go-jose/issues/67">#67</a>)</li> <li>Increase the default number of PBKDF2 iterations to 600k (<a href="https://redirect.github.com/go-jose/go-jose/issues/48">#48</a>)</li> <li>Return the proper algorithm for ECDSA keys (<a href="https://redirect.github.com/go-jose/go-jose/issues/45">#45</a>)</li> <li>Update golang.org/x/crypto to v0.19 (<a href="https://redirect.github.com/go-jose/go-jose/issues/94">#94</a>)</li> </ul> <h2>Added</h2> <ul> <li>Add Thumbprint support for opaque signers (<a href="https://redirect.github.com/go-jose/go-jose/issues/38">#38</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/go-jose/go-jose/blob/v3.0.3/CHANGELOG.md">github.com/go-jose/go-jose/v3's changelog</a>.</em></p> <blockquote> <h1>v3.0.3</h1> <h2>Fixed</h2> <ul> <li>Limit decompression output size to prevent a DoS. Backport from v4.0.1.</li> </ul> <h1>v3.0.2</h1> <h2>Fixed</h2> <ul> <li>DecryptMulti: handle decompression error (<a href="https://redirect.github.com/go-jose/go-jose/issues/19">#19</a>)</li> </ul> <h2>Changed</h2> <ul> <li>jwe/CompactSerialize: improve performance (<a href="https://redirect.github.com/go-jose/go-jose/issues/67">#67</a>)</li> <li>Increase the default number of PBKDF2 iterations to 600k (<a href="https://redirect.github.com/go-jose/go-jose/issues/48">#48</a>)</li> <li>Return the proper algorithm for ECDSA keys (<a href="https://redirect.github.com/go-jose/go-jose/issues/45">#45</a>)</li> </ul> <h2>Added</h2> <ul> <li>Add Thumbprint support for opaque signers (<a href="https://redirect.github.com/go-jose/go-jose/issues/38">#38</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-jose/go-jose/commit/add6a284ea0f844fd6628cba637be5451fe4b28a"><code>add6a28</code></a> v3: backport decompression limit fix (<a href="https://redirect.github.com/go-jose/go-jose/issues/107">#107</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/11bb4e72bf7eb95794be9fef31b38ba85633fc84"><code>11bb4e7</code></a> doc: in v3 branch's README, point to v4 as latest (<a href="https://redirect.github.com/go-jose/go-jose/issues/101">#101</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/863f73b9dbfcc5944d74d5106992e3cf949c4557"><code>863f73b</code></a> v3.0.2: Update changelog (<a href="https://redirect.github.com/go-jose/go-jose/issues/95">#95</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/bdbc794b6b28c67c0949c1e336851a30dd95a07e"><code>bdbc794</code></a> Update golang.org/x/crypto to v0.19 (backport) (<a href="https://redirect.github.com/go-jose/go-jose/issues/94">#94</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/25bce79fd677a736af4b1a38828f5a754775afb6"><code>25bce79</code></a> Updated go-jose v3.0.0 to v3.0.1 in jose-util (<a href="https://redirect.github.com/go-jose/go-jose/issues/70">#70</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/aa386df3933e180ca8a2f20b9af1a1288b7b5aeb"><code>aa386df</code></a> jwe/CompactSerialize: improve performance. (<a href="https://redirect.github.com/go-jose/go-jose/issues/67">#67</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/053c9bf3d6ce7fe10812cfc7a92b7ab7a8e5610f"><code>053c9bf</code></a> DecryptMulti: handle decompression error (<a href="https://redirect.github.com/go-jose/go-jose/issues/19">#19</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/ca9011bec5e215a4604f66d8449f572c5b258c06"><code>ca9011b</code></a> Bump go version to 1.21.4 to satisfy govulncheck (<a href="https://redirect.github.com/go-jose/go-jose/issues/68">#68</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/c8399df7de1af8829e68f3942a89c6d4457bfdf4"><code>c8399df</code></a> Revert pull request <a href="https://redirect.github.com/go-jose/go-jose/issues/10">#10</a> (multiple audiences) (<a href="https://redirect.github.com/go-jose/go-jose/issues/24">#24</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/ec819e926a61a07cd6df4712e781806823f4c266"><code>ec819e9</code></a> Add a security.md doc for contacting us about potential security vulnerabilit...</li> <li>Additional commits viewable in <a href="https://github.com/go-jose/go-jose/compare/v3.0.1...v3.0.3">compare view</a></li> </ul> </details> <br /> Updates `google.golang.org/protobuf` from 1.32.0 to 1.33.0 Updates `github.com/cloudevents/sdk-go/v2` from 2.15.0 to 2.15.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cloudevents/sdk-go/releases">github.com/cloudevents/sdk-go/v2's releases</a>.</em></p> <blockquote> <h2>Release v2.15.2</h2> <h2>What's Changed</h2> <ul> <li>Patch for a potential security issue. See <a href="https://github.com/cloudevents/sdk-go/blob/HEAD/TBD">CVE-2024-28110</a>.</li> <li>Note: this could be a breaking change for people if they purposely change golang's HTTP <code>DefaultClient</code>, or change the CloudEvents <code>Client</code> returned from <code>NewClient</code>, and expect those changes to be visible on other HTTP flows using those Clients. E.g. auth</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/cloudevents/sdk-go/compare/v2.15.1...v2.15.2">https://github.com/cloudevents/sdk-go/compare/v2.15.1...v2.15.2</a></p> <h2>Release v2.15.1</h2> <h2>What's Changed</h2> <ul> <li>Bump andstor/file-existence-action from 2 to 3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1009">cloudevents/sdk-go#1009</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /test/conformance by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/993">cloudevents/sdk-go#993</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /test/benchmark by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/994">cloudevents/sdk-go#994</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /samples/kafka by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/995">cloudevents/sdk-go#995</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /test/integration by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/996">cloudevents/sdk-go#996</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /protocol/kafka_sarama/v2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/997">cloudevents/sdk-go#997</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /samples/http by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/998">cloudevents/sdk-go#998</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /samples/nats by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/999">cloudevents/sdk-go#999</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /samples/stan by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1004">cloudevents/sdk-go#1004</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /samples/nats_jetstream by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1003">cloudevents/sdk-go#1003</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /protocol/nats/v2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1002">cloudevents/sdk-go#1002</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /protocol/nats_jetstream/v2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1001">cloudevents/sdk-go#1001</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /protocol/stan/v2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1000">cloudevents/sdk-go#1000</a></li> <li>Propose the <code>confluent-kafka-go</code> binding for Kafka by <a href="https://github.com/yanmxa"><code>@yanmxa</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1008">cloudevents/sdk-go#1008</a></li> <li>Sync CESQL tck tests by <a href="https://github.com/Cali0707"><code>@Cali0707</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1010">cloudevents/sdk-go#1010</a></li> <li>Fix docstring typos in nats and jetstream protocol by <a href="https://github.com/jafossum"><code>@jafossum</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1013">cloudevents/sdk-go#1013</a></li> <li>Bump golangci/golangci-lint-action from 3 to 4 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1016">cloudevents/sdk-go#1016</a></li> <li>Bump the bundler group across 1 directories with 1 update by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1011">cloudevents/sdk-go#1011</a></li> <li>Remove vi swp file by <a href="https://github.com/duglin"><code>@duglin</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1020">cloudevents/sdk-go#1020</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Cali0707"><code>@Cali0707</code></a> made their first contribution in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1010">cloudevents/sdk-go#1010</a></li> <li><a href="https://github.com/jafossum"><code>@jafossum</code></a> made their first contribution in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1013">cloudevents/sdk-go#1013</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/cloudevents/sdk-go/compare/v2.15.0...v2.15.1">https://github.com/cloudevents/sdk-go/compare/v2.15.0...v2.15.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cloudevents/sdk-go/commit/de2f28370b0d2a0f64f92c0c6139fa4b8a7c3851"><code>de2f283</code></a> Merge pull request from GHSA-5pf6-2qwx-pxm2</li> <li><a href="https://github.com/cloudevents/sdk-go/commit/c5f8d9dd259c4197305ece455ad501795c786f7f"><code>c5f8d9d</code></a> Update v2/protocol/http/protocol.go</li> <li><a href="https://github.com/cloudevents/sdk-go/commit/c17d949c7001b7907c2a643771e673c2af317a60"><code>c17d949</code></a> Avoid modifying the DefaultClient's Transport</li> <li><a href="https://github.com/cloudevents/sdk-go/commit/67e389964131d55d65cd14b4eb32d57a47312695"><code>67e3899</code></a> Merge pull request <a href="https://redirect.github.com/cloudevents/sdk-go/issues/1020">#1020</a> from duglin/oops</li> <li><a href="https://github.com/cloudevents/sdk-go/commit/f0061e0ad9a7071a091fc4c92c91f504c1462bc5"><code>f0061e0</code></a> oops</li> <li><a href="https://github.com/cloudevents/sdk-go/commit/4cc6c2d62d63da00f5b00efd4147e7dd5e40ee4c"><code>4cc6c2d</code></a> Merge pull request <a href="https://redirect.github.com/cloudevents/sdk-go/issues/1011">#1011</a> from cloudevents/dependabot/bundler/docs/bundler-sec...</li> <li><a href="https://github.com/cloudevents/sdk-go/commit/b6949b02324839338c4bb8fbc7031cd0fba55899"><code>b6949b0</code></a> Bump the bundler group across 1 directories with 1 update</li> <li><a href="https://github.com/cloudevents/sdk-go/commit/df51395f567d75bc5e2ac51a1796ae81522d2e87"><code>df51395</code></a> Merge pull request <a href="https://redirect.github.com/cloudevents/sdk-go/issues/1016">#1016</a> from cloudevents/dependabot/github_actions/golangci/...</li> <li><a href="https://github.com/cloudevents/sdk-go/commit/1af6e066857109cba2b636642ffa10a30facfce3"><code>1af6e06</code></a> Bump golangci/golangci-lint-action from 3 to 4</li> <li><a href="https://github.com/cloudevents/sdk-go/commit/2574a05f7b10376e4d536157f447f1d4f3ead380"><code>2574a05</code></a> Merge pull request <a href="https://redirect.github.com/cloudevents/sdk-go/issues/1013">#1013</a> from jafossum/fix-nats-typos</li> <li>Additional commits viewable in <a href="https://github.com/cloudevents/sdk-go/compare/v2.15.0...v2.15.2">compare view</a></li> </ul> </details> <br /> Updates `github.com/go-jose/go-jose/v3` from 3.0.1 to 3.0.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-jose/go-jose/releases">github.com/go-jose/go-jose/v3's releases</a>.</em></p> <blockquote> <h2>Version 3.0.3</h2> <h2>Fixed</h2> <ul> <li>Limit decompression output size to prevent a DoS. Backport from v4.0.1.</li> </ul> <h2>Version 3.0.2</h2> <h2>Fixed</h2> <ul> <li>DecryptMulti: handle decompression error (<a href="https://redirect.github.com/go-jose/go-jose/issues/19">#19</a>)</li> </ul> <h2>Changed</h2> <ul> <li>jwe/CompactSerialize: improve performance (<a href="https://redirect.github.com/go-jose/go-jose/issues/67">#67</a>)</li> <li>Increase the default number of PBKDF2 iterations to 600k (<a href="https://redirect.github.com/go-jose/go-jose/issues/48">#48</a>)</li> <li>Return the proper algorithm for ECDSA keys (<a href="https://redirect.github.com/go-jose/go-jose/issues/45">#45</a>)</li> <li>Update golang.org/x/crypto to v0.19 (<a href="https://redirect.github.com/go-jose/go-jose/issues/94">#94</a>)</li> </ul> <h2>Added</h2> <ul> <li>Add Thumbprint support for opaque signers (<a href="https://redirect.github.com/go-jose/go-jose/issues/38">#38</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/go-jose/go-jose/blob/v3.0.3/CHANGELOG.md">github.com/go-jose/go-jose/v3's changelog</a>.</em></p> <blockquote> <h1>v3.0.3</h1> <h2>Fixed</h2> <ul> <li>Limit decompression output size to prevent a DoS. Backport from v4.0.1.</li> </ul> <h1>v3.0.2</h1> <h2>Fixed</h2> <ul> <li>DecryptMulti: handle decompression error (<a href="https://redirect.github.com/go-jose/go-jose/issues/19">#19</a>)</li> </ul> <h2>Changed</h2> <ul> <li>jwe/CompactSerialize: improve performance (<a href="https://redirect.github.com/go-jose/go-jose/issues/67">#67</a>)</li> <li>Increase the default number of PBKDF2 iterations to 600k (<a href="https://redirect.github.com/go-jose/go-jose/issues/48">#48</a>)</li> <li>Return the proper algorithm for ECDSA keys (<a href="https://redirect.github.com/go-jose/go-jose/issues/45">#45</a>)</li> </ul> <h2>Added</h2> <ul> <li>Add Thumbprint support for opaque signers (<a href="https://redirect.github.com/go-jose/go-jose/issues/38">#38</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-jose/go-jose/commit/add6a284ea0f844fd6628cba637be5451fe4b28a"><code>add6a28</code></a> v3: backport decompression limit fix (<a href="https://redirect.github.com/go-jose/go-jose/issues/107">#107</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/11bb4e72bf7eb95794be9fef31b38ba85633fc84"><code>11bb4e7</code></a> doc: in v3 branch's README, point to v4 as latest (<a href="https://redirect.github.com/go-jose/go-jose/issues/101">#101</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/863f73b9dbfcc5944d74d5106992e3cf949c4557"><code>863f73b</code></a> v3.0.2: Update changelog (<a href="https://redirect.github.com/go-jose/go-jose/issues/95">#95</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/bdbc794b6b28c67c0949c1e336851a30dd95a07e"><code>bdbc794</code></a> Update golang.org/x/crypto to v0.19 (backport) (<a href="https://redirect.github.com/go-jose/go-jose/issues/94">#94</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/25bce79fd677a736af4b1a38828f5a754775afb6"><code>25bce79</code></a> Updated go-jose v3.0.0 to v3.0.1 in jose-util (<a href="https://redirect.github.com/go-jose/go-jose/issues/70">#70</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/aa386df3933e180ca8a2f20b9af1a1288b7b5aeb"><code>aa386df</code></a> jwe/CompactSerialize: improve performance. (<a href="https://redirect.github.com/go-jose/go-jose/issues/67">#67</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/053c9bf3d6ce7fe10812cfc7a92b7ab7a8e5610f"><code>053c9bf</code></a> DecryptMulti: handle decompression error (<a href="https://redirect.github.com/go-jose/go-jose/issues/19">#19</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/ca9011bec5e215a4604f66d8449f572c5b258c06"><code>ca9011b</code></a> Bump go version to 1.21.4 to satisfy govulncheck (<a href="https://redirect.github.com/go-jose/go-jose/issues/68">#68</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/c8399df7de1af8829e68f3942a89c6d4457bfdf4"><code>c8399df</code></a> Revert pull request <a href="https://redirect.github.com/go-jose/go-jose/issues/10">#10</a> (multiple audiences) (<a href="https://redirect.github.com/go-jose/go-jose/issues/24">#24</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/ec819e926a61a07cd6df4712e781806823f4c266"><code>ec819e9</code></a> Add a security.md doc for contacting us about potential security vulnerabilit...</li> <li>Additional commits viewable in <a href="https://github.com/go-jose/go-jose/compare/v3.0.1...v3.0.3">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/net` from 0.18.0 to 0.23.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/net/commit/c48da131589f122489348be5dfbcb6457640046f"><code>c48da13</code></a> http2: fix TestServerContinuationFlood flakes</li> <li><a href="https://github.com/golang/net/commit/762b58d1cf6e0779780decad89c6c1523386638d"><code>762b58d</code></a> http2: fix tipos in comment</li> <li><a href="https://github.com/golang/net/commit/ba872109ef2dc8f1da778651bd1fd3792d0e4587"><code>ba87210</code></a> http2: close connections when receiving too many headers</li> <li><a href="https://github.com/golang/net/commit/ebc8168ac8ac742194df729305175940790c55a2"><code>ebc8168</code></a> all: fix some typos</li> <li><a href="https://github.com/golang/net/commit/3678185f8a652e52864c44049a9ea96b7bcc066a"><code>3678185</code></a> http2: make TestCanonicalHeaderCacheGrowth faster</li> <li><a href="https://github.com/golang/net/commit/448c44f9287b6745f958d74aa2a17ec7761c2f13"><code>448c44f</code></a> http2: remove clientTester</li> <li><a href="https://github.com/golang/net/commit/c7877ac4213b2f859831366f5a35b353e0dc9f66"><code>c7877ac</code></a> http2: convert the remaining clientTester tests to testClientConn</li> <li><a href="https://github.com/golang/net/commit/d8870b0bf2f2426fc8d19a9332f652da5c25418f"><code>d8870b0</code></a> http2: use synthetic time in TestIdleConnTimeout</li> <li><a href="https://github.com/golang/net/commit/d73acffdc9493532acb85777105bb4a351eea702"><code>d73acff</code></a> http2: only set up deadline when Server.IdleTimeout is positive</li> <li><a href="https://github.com/golang/net/commit/89f602b7bbf237abe0467031a18b42fc742ced08"><code>89f602b</code></a> http2: validate client/outgoing trailers</li> <li>Additional commits viewable in <a href="https://github.com/golang/net/compare/v0.18.0...v0.23.0">compare view</a></li> </ul> </details> <br /> Updates `google.golang.org/protobuf` from 1.31.0 to 1.33.0 Updates `github.com/docker/docker` from 24.0.7+incompatible to 25.0.6+incompatible <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/docker/releases">github.com/docker/docker's releases</a>.</em></p> <blockquote> <h2>v25.0.6</h2> <h2>25.0.6</h2> <p>For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:</p> <ul> <li><a href="https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A25.0.6">docker/cli, 25.0.6 milestone</a></li> <li><a href="https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A25.0.6">moby/moby, 25.0.6 milestone</a></li> <li>Deprecated and removed features, see <a href="https://github.com/docker/cli/blob/v25.0.6/docs/deprecated.md">Deprecated Features</a>.</li> <li>Changes to the Engine API, see <a href="https://github.com/moby/moby/blob/v25.0.6/docs/api/version-history.md">API version history</a>.</li> </ul> <h3>Security</h3> <p>This release contains a fix for <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41110">CVE-2024-41110</a> / <a href="https://github.com/moby/moby/security/advisories/GHSA-v23v-6jw2-98fq">GHSA-v23v-6jw2-98fq</a> that impacted setups using <a href="https://docs.docker.com/engine/extend/plugins_authorization/">authorization plugins (AuthZ)</a> for access control.</p> <h3>Bug fixes and enhancements</h3> <ul> <li>[25.0] remove erroneous <code>platform</code> from image <code>config</code> OCI descriptor in <code>docker save</code> output. <a href="https://redirect.github.com/moby/moby/pull/47695">moby/moby#47695</a></li> <li>[25.0 backport] Fix a nil dereference when getting image history for images having layers without the <code>Created</code> value set. <a href="https://redirect.github.com/moby/moby/pull/47759">moby/moby#47759</a></li> <li>[25.0 backport] apparmor: Allow confined runc to kill containers. <a href="https://redirect.github.com/moby/moby/pull/47830">moby/moby#47830</a></li> <li>[25.0 backport] Fix an issue where rapidly promoting a Swarm node after another node was demoted could cause the promoted node to fail its promotion. <a href="https://redirect.github.com/moby/moby/pull/47869">moby/moby#47869</a></li> <li>[25.0 backport] don't depend on containerd platform.Parse to return a typed error. <a href="https://redirect.github.com/moby/moby/pull/47890">moby/moby#47890</a></li> <li>[25.0 backport] builder/mobyexporter: Add missing nil check <a href="https://redirect.github.com/moby/moby/pull/47987">moby/moby#47987</a></li> </ul> <h3>Packaging updates</h3> <ul> <li>Update AWS SDK Go v2 to v1.24.1 for AWS CloudWatch logging driver. <a href="https://redirect.github.com/moby/moby/pull/47724">moby/moby#47724</a></li> <li>Update Go runtime to 1.21.12, which contains security fixes for <a href="https://github.com/advisories/GHSA-hw49-2p59-3mhj">CVE-2024-24791</a> <a href="https://redirect.github.com/moby/moby/pull/48146">moby/moby#48146</a></li> <li>Update Containerd (static binaries only) to <a href="https://github.com/containerd/containerd/releases/tag/v1.7.20">v1.7.20</a>. <a href="https://redirect.github.com/moby/moby/pull/48199">moby/moby#48199</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/moby/moby/compare/v25.0.5...v25.0.6">https://github.com/moby/moby/compare/v25.0.5...v25.0.6</a></p> <h2>v25.0.5</h2> <h2>25.0.5</h2> <p>For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:</p> <ul> <li><a href="https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A25.0.5">docker/cli, 25.0.5 milestone</a></li> <li><a href="https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A25.0.5">moby/moby, 25.0.5 milestone</a></li> <li>Deprecated and removed features, see <a href="https://github.com/docker/cli/blob/v25.0.5/docs/deprecated.md">Deprecated Features</a>.</li> <li>Changes to the Engine API, see <a href="https://github.com/moby/moby/blob/v25.0.5/docs/api/version-history.md">API version history</a>.</li> </ul> <h3>Security</h3> <p>This release contains a security fix for <a href="https://github.com/moby/moby/security/advisories/GHSA-mq39-4gv4-mvpx">CVE-2024-29018</a>, a potential data exfiltration from 'internal' networks via authoritative DNS servers.</p> <h3>Bug fixes and enhancements</h3> <ul> <li> <p><a href="https://github.com/moby/moby/security/advisories/GHSA-mq39-4gv4-mvpx">CVE-2024-29018</a>: Do not forward requests to external DNS servers for a container that is only connected to an 'internal' network. Previously, requests were forwarded if the host's DNS server was running on a loopback address, like systemd's 127.0.0.53. <a href="https://redirect.github.com/moby/moby/pull/47589">moby/moby#47589</a></p> </li> <li> <p>plugin: fix mounting /etc/hosts when running in UserNS. <a href="https://redirect.github.com/moby/moby/pull/47588">moby/moby#47588</a></p> </li> <li> <p>rootless: fix <code>open /etc/docker/plugins: permission denied</code>. <a href="https://redirect.github.com/moby/moby/pull/47587">moby/moby#47587</a></p> </li> <li> <p>Fix multiple parallel <code>docker build</code> runs leaking disk space. <a href="https://redirect.github.com/moby/moby/pull/47527">moby/moby#47527</a></p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/moby/moby/commit/b08a51fe16eed67de3861c03b363ba403643b12e"><code>b08a51f</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/48231">#48231</a> from austinvazquez/backport-vendor-otel-v0.46.1-to-...</li> <li><a href="https://github.com/moby/moby/commit/d151b0f87f9673f206b477c90db25956e1704ba5"><code>d151b0f</code></a> vendor: OTEL v0.46.1 / v1.21.0</li> <li><a href="https://github.com/moby/moby/commit/c6ba9a5124603357bfc4a64971cbb9708180f06e"><code>c6ba9a5</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/48225">#48225</a> from austinvazquez/backport-workflow-artifact-reten...</li> <li><a href="https://github.com/moby/moby/commit/4673a3ca2c37ae30270a29c281ccd9477107dcee"><code>4673a3c</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/48227">#48227</a> from austinvazquez/backport-backport-branch-check-t...</li> <li><a href="https://github.com/moby/moby/commit/30f89081028ce6fb1b49a71c02c156dacbe9aa62"><code>30f8908</code></a> github/ci: Check if backport is opened against the expected branch</li> <li><a href="https://github.com/moby/moby/commit/7454d6a2e672b0b977aaa14463c9aeb53acd06af"><code>7454d6a</code></a> ci: update workflow artifacts retention</li> <li><a href="https://github.com/moby/moby/commit/65cc597cea28cdc25bea3b8a86384b4251872919"><code>65cc597</code></a> Merge commit from fork</li> <li><a href="https://github.com/moby/moby/commit/b722836927669b414569c42f096869cd800b59a6"><code>b722836</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/48199">#48199</a> from austinvazquez/update-containerd-binary-to-1.7.20</li> <li><a href="https://github.com/moby/moby/commit/e8ecb9c76d97579ebbf3f9d3ef770d08ac303809"><code>e8ecb9c</code></a> update containerd binary to v1.7.20</li> <li><a href="https://github.com/moby/moby/commit/e6cae1f2373d4ff37499570e67f23b2cebb7a043"><code>e6cae1f</code></a> update containerd binary to v1.7.19</li> <li>Additional commits viewable in <a href="https://github.com/docker/docker/compare/v24.0.7...v25.0.6">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/net` from 0.18.0 to 0.23.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/net/commit/c48da131589f122489348be5dfbcb6457640046f"><code>c48da13</code></a> http2: fix TestServerContinuationFlood flakes</li> <li><a href="https://github.com/golang/net/commit/762b58d1cf6e0779780decad89c6c1523386638d"><code>762b58d</code></a> http2: fix tipos in comment</li> <li><a href="https://github.com/golang/net/commit/ba872109ef2dc8f1da778651bd1fd3792d0e4587"><code>ba87210</code></a> http2: close connections when receiving too many headers</li> <li><a href="https://github.com/golang/net/commit/ebc8168ac8ac742194df729305175940790c55a2"><code>ebc8168</code></a> all: fix some typos</li> <li><a href="https://github.com/golang/net/commit/3678185f8a652e52864c44049a9ea96b7bcc066a"><code>3678185</code></a> http2: make TestCanonicalHeaderCacheGrowth faster</li> <li><a href="https://github.com/golang/net/commit/448c44f9287b6745f958d74aa2a17ec7761c2f13"><code>448c44f</code></a> http2: remove clientTester</li> <li><a href="https://github.com/golang/net/commit/c7877ac4213b2f859831366f5a35b353e0dc9f66"><code>c7877ac</code></a> http2: convert the remaining clientTester tests to testClientConn</li> <li><a href="https://github.com/golang/net/commit/d8870b0bf2f2426fc8d19a9332f652da5c25418f"><code>d8870b0</code></a> http2: use synthetic time in TestIdleConnTimeout</li> <li><a href="https://github.com/golang/net/commit/d73acffdc9493532acb85777105bb4a351eea702"><code>d73acff</code></a> http2: only set up deadline when Server.IdleTimeout is positive</li> <li><a href="https://github.com/golang/net/commit/89f602b7bbf237abe0467031a18b42fc742ced08"><code>89f602b</code></a> http2: validate client/outgoing trailers</li> <li>Additional commits viewable in <a href="https://github.com/golang/net/compare/v0.18.0...v0.23.0">compare view</a></li> </ul> </details> <br /> Updates `google.golang.org/protobuf` from 1.31.0 to 1.33.0 Updates `github.com/cloudevents/sdk-go/v2` from 2.14.0 to 2.15.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cloudevents/sdk-go/releases">github.com/cloudevents/sdk-go/v2's releases</a>.</em></p> <blockquote> <h2>Release v2.15.2</h2> <h2>What's Changed</h2> <ul> <li>Patch for a potential security issue. See <a href="https://github.com/cloudevents/sdk-go/blob/HEAD/TBD">CVE-2024-28110</a>.</li> <li>Note: this could be a breaking change for people if they purposely change golang's HTTP <code>DefaultClient</code>, or change the CloudEvents <code>Client</code> returned from <code>NewClient</code>, and expect those changes to be visible on other HTTP flows using those Clients. E.g. auth</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/cloudevents/sdk-go/compare/v2.15.1...v2.15.2">https://github.com/cloudevents/sdk-go/compare/v2.15.1...v2.15.2</a></p> <h2>Release v2.15.1</h2> <h2>What's Changed</h2> <ul> <li>Bump andstor/file-existence-action from 2 to 3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1009">cloudevents/sdk-go#1009</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /test/conformance by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/993">cloudevents/sdk-go#993</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /test/benchmark by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/994">cloudevents/sdk-go#994</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /samples/kafka by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/995">cloudevents/sdk-go#995</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /test/integration by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/996">cloudevents/sdk-go#996</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /protocol/kafka_sarama/v2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/997">cloudevents/sdk-go#997</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /samples/http by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/998">cloudevents/sdk-go#998</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /samples/nats by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/999">cloudevents/sdk-go#999</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /samples/stan by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1004">cloudevents/sdk-go#1004</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /samples/nats_jetstream by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1003">cloudevents/sdk-go#1003</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /protocol/nats/v2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1002">cloudevents/sdk-go#1002</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /protocol/nats_jetstream/v2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1001">cloudevents/sdk-go#1001</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /protocol/stan/v2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1000">cloudevents/sdk-go#1000</a></li> <li>Propose the <code>confluent-kafka-go</code> binding for Kafka by <a href="https://github.com/yanmxa"><code>@yanmxa</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1008">cloudevents/sdk-go#1008</a></li> <li>Sync CESQL tck tests by <a href="https://github.com/Cali0707"><code>@Cali0707</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1010">cloudevents/sdk-go#1010</a></li> <li>Fix docstring typos in nats and jetstream protocol by <a href="https://github.com/jafossum"><code>@jafossum</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1013">cloudevents/sdk-go#1013</a></li> <li>Bump golangci/golangci-lint-action from 3 to 4 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1016">cloudevents/sdk-go#1016</a></li> <li>Bump the bundler group across 1 directories with 1 update by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1011">cloudevents/sdk-go#1011</a></li> <li>Remove vi swp file by <a href="https://github.com/duglin"><code>@duglin</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1020">cloudevents/sdk-go#1020</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Cali0707"><code>@Cali0707</code></a> made their first contribution in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1010">cloudevents/sdk-go#1010</a></li> <li><a href="https://github.com/jafossum"><code>@jafossum</code></a> made their first contribution in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1013">cloudevents/sdk-go#1013</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/cloudevents/sdk-go/compare/v2.15.0...v2.15.1">https://github.com/cloudevents/sdk-go/compare/v2.15.0...v2.15.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cloudevents/sdk-go/commit/de2f28370b0d2a0f64f92c0c6139fa4b8a7c3851"><code>de2f283</code></a> Merge pull request from GHSA-5pf6-2qwx-pxm2</li> <li><a href="https://github.com/cloudevents/sdk-go/commit/c5f8d9dd259c4197305ece455ad501795c786f7f"><code>c5f8d9d</code></a> Update v2/protocol/http/protocol.go</li> <li><a href="https://github.com/cloudevents/sdk-go/commit/c17d949c7001b7907c2a643771e673c2af317a60"><code>c17d949</code></a> Avoid modifying the DefaultClient's Transport</li> <li><a href="https://github.com/cloudevents/sdk-go/commit/67e389964131d55d65cd14b4eb32d57a47312695"><code>67e3899</code></a> Merge pull request <a href="https://redirect.github.com/cloudevents/sdk-go/issues/1020">#1020</a> from duglin/oops</li> <li><a href="https://github.com/cloudevents/sdk-go/commit/f0061e0ad9a7071a091fc4c92c91f504c1462bc5"><code>f0061e0</code></a> oops</li> <li><a href="https://github.com/cloudevents/sdk-go/commit/4cc6c2d62d63da00f5b00efd4147e7dd5e40ee4c"><code>4cc6c2d</code></a> Merge pull request <a href="https://redirect.github.com/cloudevents/sdk-go/issues/1011">#1011</a> from cloudevents/dependabot/bundler/docs/bundler-sec...</li> <li><a href="https://github.com/cloudevents/sdk-go/commit/b6949b02324839338c4bb8fbc7031cd0fba55899"><code>b6949b0</code></a> Bump the bundler group across 1 directories with 1 update</li> <li><a href="https://github.com/cloudevents/sdk-go/commit/df51395f567d75bc5e2ac51a1796ae81522d2e87"><code>df51395</code></a> Merge pull request <a href="https://redirect.github.com/cloudevents/sdk-go/issues/1016">#1016</a> from cloudevents/dependabot/github_actions/golangci/...</li> <li><a href="https://github.com/cloudevents/sdk-go/commit/1af6e066857109cba2b636642ffa10a30facfce3"><code>1af6e06</code></a> Bump golangci/golangci-lint-action from 3 to 4</li> <li><a href="https://github.com/cloudevents/sdk-go/commit/2574a05f7b10376e4d536157f447f1d4f3ead380"><code>2574a05</code></a> Merge pull request <a href="https://redirect.github.com/cloudevents/sdk-go/issues/1013">#1013</a> from jafossum/fix-nats-typos</li> <li>Additional commits viewable in <a href="https://github.com/cloudevents/sdk-go/compare/v2.15.0...v2.15.2">compare view</a></li> </ul> </details> <br /> Updates `github.com/go-jose/go-jose/v3` from 3.0.1 to 3.0.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-jose/go-jose/releases">github.com/go-jose/go-jose/v3's releases</a>.</em></p> <blockquote> <h2>Version 3.0.3</h2> <h2>Fixed</h2> <ul> <li>Limit decompression output size to prevent a DoS. Backport from v4.0.1.</li> </ul> <h2>Version 3.0.2</h2> <h2>Fixed</h2> <ul> <li>DecryptMulti: handle decompression error (<a href="https://redirect.github.com/go-jose/go-jose/issues/19">#19</a>)</li> </ul> <h2>Changed</h2> <ul> <li>jwe/CompactSerialize: improve performance (<a href="https://redirect.github.com/go-jose/go-jose/issues/67">#67</a>)</li> <li>Increase the default number of PBKDF2 iterations to 600k (<a href="https://redirect.github.com/go-jose/go-jose/issues/48">#48</a>)</li> <li>Return the proper algorithm for ECDSA keys (<a href="https://redirect.github.com/go-jose/go-jose/issues/45">#45</a>)</li> <li>Update golang.org/x/crypto to v0.19 (<a href="https://redirect.github.com/go-jose/go-jose/issues/94">#94</a>)</li> </ul> <h2>Added</h2> <ul> <li>Add Thumbprint support for opaque signers (<a href="https://redirect.github.com/go-jose/go-jose/issues/38">#38</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/go-jose/go-jose/blob/v3.0.3/CHANGELOG.md">github.com/go-jose/go-jose/v3's changelog</a>.</em></p> <blockquote> <h1>v3.0.3</h1> <h2>Fixed</h2> <ul> <li>Limit decompression output size to prevent a DoS. Backport from v4.0.1.</li> </ul> <h1>v3.0.2</h1> <h2>Fixed</h2> <ul> <li>DecryptMulti: handle decompression error (<a href="https://redirect.github.com/go-jose/go-jose/issues/19">#19</a>)</li> </ul> <h2>Changed</h2> <ul> <li>jwe/CompactSerialize: improve performance (<a href="https://redirect.github.com/go-jose/go-jose/issues/67">#67</a>)</li> <li>Increase the default number of PBKDF2 iterations to 600k (<a href="https://redirect.github.com/go-jose/go-jose/issues/48">#48</a>)</li> <li>Return the proper algorithm for ECDSA keys (<a href="https://redirect.github.com/go-jose/go-jose/issues/45">#45</a>)</li> </ul> <h2>Added</h2> <ul> <li>Add Thumbprint support for opaque signers (<a href="https://redirect.github.com/go-jose/go-jose/issues/38">#38</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-jose/go-jose/commit/add6a284ea0f844fd6628cba637be5451fe4b28a"><code>add6a28</code></a> v3: backport decompression limit fix (<a href="https://redirect.github.com/go-jose/go-jose/issues/107">#107</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/11bb4e72bf7eb95794be9fef31b38ba85633fc84"><code>11bb4e7</code></a> doc: in v3 branch's README, point to v4 as latest (<a href="https://redirect.github.com/go-jose/go-jose/issues/101">#101</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/863f73b9dbfcc5944d74d5106992e3cf949c4557"><code>863f73b</code></a> v3.0.2: Update changelog (<a href="https://redirect.github.com/go-jose/go-jose/issues/95">#95</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/bdbc794b6b28c67c0949c1e336851a30dd95a07e"><code>bdbc794</code></a> Update golang.org/x/crypto to v0.19 (backport) (<a href="https://redirect.github.com/go-jose/go-jose/issues/94">#94</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/25bce79fd677a736af4b1a38828f5a754775afb6"><code>25bce79</code></a> Updated go-jose v3.0.0 to v3.0.1 in jose-util (<a href="https://redirect.github.com/go-jose/go-jose/issues/70">#70</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/aa386df3933e180ca8a2f20b9af1a1288b7b5aeb"><code>aa386df</code></a> jwe/CompactSerialize: improve performance. (<a href="https://redirect.github.com/go-jose/go-jose/issues/67">#67</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/053c9bf3d6ce7fe10812cfc7a92b7ab7a8e5610f"><code>053c9bf</code></a> DecryptMulti: handle decompression error (<a href="https://redirect.github.com/go-jose/go-jose/issues/19">#19</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/ca9011bec5e215a4604f66d8449f572c5b258c06"><code>ca9011b</code></a> Bump go version to 1.21.4 to satisfy govulncheck (<a href="https://redirect.github.com/go-jose/go-jose/issues/68">#68</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/c8399df7de1af8829e68f3942a89c6d4457bfdf4"><code>c8399df</code></a> Revert pull request <a href="https://redirect.github.com/go-jose/go-jose/issues/10">#10</a> (multiple audiences) (<a href="https://redirect.github.com/go-jose/go-jose/issues/24">#24</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/ec819e926a61a07cd6df4712e781806823f4c266"><code>ec819e9</code></a> Add a security.md doc for contacting us about potential security vulnerabilit...</li> <li>Additional commits viewable in <a href="https://github.com/go-jose/go-jose/compare/v3.0.1...v3.0.3">compare view</a></li> </ul> </details> <br /> Updates `github.com/docker/docker` from 24.0.7+incompatible to 25.0.6+incompatible <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/docker/releases">github.com/docker/docker's releases</a>.</em></p> <blockquote> <h2>v25.0.6</h2> <h2>25.0.6</h2> <p>For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:</p> <ul> <li><a href="https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A25.0.6">docker/cli, 25.0.6 milestone</a></li> <li><a href="https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A25.0.6">moby/moby, 25.0.6 milestone</a></li> <li>Deprecated and removed features, see <a href="https://github.com/docker/cli/blob/v25.0.6/docs/deprecated.md">Deprecated Features</a>.</li> <li>Changes to the Engine API, see <a href="https://github.com/moby/moby/blob/v25.0.6/docs/api/version-history.md">API version history</a>.</li> </ul> <h3>Security</h3> <p>This release contains a fix for <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41110">CVE-2024-41110</a> / <a href="https://github.com/moby/moby/security/advisories/GHSA-v23v-6jw2-98fq">GHSA-v23v-6jw2-98fq</a> that impacted setups using <a href="https://docs.docker.com/engine/extend/plugins_authorization/">authorization plugins (AuthZ)</a> for access control.</p> <h3>Bug fixes and enhancements</h3> <ul> <li>[25.0] remove erroneous <code>platform</code> from image <code>config</code> OCI descriptor in <code>docker save</code> output. <a href="https://redirect.github.com/moby/moby/pull/47695">moby/moby#47695</a></li> <li>[25.0 backport] Fix a nil dereference when getting image history for images having layers without the <code>Created</code> value set. <a href="https://redirect.github.com/moby/moby/pull/47759">moby/moby#47759</a></li> <li>[25.0 backport] apparmor: Allow confined runc to kill containers. <a href="https://redirect.github.com/moby/moby/pull/47830">moby/moby#47830</a></li> <li>[25.0 backport] Fix an issue where rapidly promoting a Swarm node after another node was demoted could cause the promoted node to fail its promotion. <a href="https://redirect.github.com/moby/moby/pull/47869">moby/moby#47869</a></li> <li>[25.0 backport] don't depend on containerd platform.Parse to return a typed error. <a href="https://redirect.github.com/moby/moby/pull/47890">moby/moby#47890</a></li> <li>[25.0 backport] builder/mobyexporter: Add missing nil check <a href="https://redirect.github.com/moby/moby/pull/47987">moby/moby#47987</a></li> </ul> <h3>Packaging updates</h3> <ul> <li>Update AWS SDK Go v2 to v1.24.1 for AWS CloudWatch logging driver. <a href="https://redirect.github.com/moby/moby/pull/47724">moby/moby#47724</a></li> <li>Update Go runtime to 1.21.12, which contains security fixes for <a href="https://github.com/advisories/GHSA-hw49-2p59-3mhj">CVE-2024-24791</a> <a href="https://redirect.github.com/moby/moby/pull/48146">moby/moby#48146</a></li> <li>Update Containerd (static binaries only) to <a href="https://github.com/containerd/containerd/releases/tag/v1.7.20">v1.7.20</a>. <a href="https://redirect.github.com/moby/moby/pull/48199">moby/moby#48199</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/moby/moby/compare/v25.0.5...v25.0.6">https://github.com/moby/moby/compare/v25.0.5...v25.0.6</a></p> <h2>v25.0.5</h2> <h2>25.0.5</h2> <p>For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:</p> <ul> <li><a href="https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A25.0.5">docker/cli, 25.0.5 milestone</a></li> <li><a href="https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A25.0.5">moby/moby, 25.0.5 milestone</a></li> <li>Deprecated and removed features, see <a href="https://github.com/docker/cli/blob/v25.0.5/docs/deprecated.md">Deprecated Features</a>.</li> <li>Changes to the Engine API, see <a href="https://github.com/moby/moby/blob/v25.0.5/docs/api/version-history.md">API version history</a>.</li> </ul> <h3>Security</h3> <p>This release contains a security fix for <a href="https://github.com/moby/moby/security/advisories/GHSA-mq39-4gv4-mvpx">CVE-2024-29018</a>, a potential data exfiltration from 'internal' networks via authoritative DNS servers.</p> <h3>Bug fixes and enhancements</h3> <ul> <li> <p><a href="https://github.com/moby/moby/security/advisories/GHSA-mq39-4gv4-mvpx">CVE-2024-29018</a>: Do not forward requests to external DNS servers for a container that is only connected to an 'internal' network. Previously, requests were forwarded if the host's DNS server was running on a loopback address, like systemd's 127.0.0.53. <a href="https://redirect.github.com/moby/moby/pull/47589">moby/moby#47589</a></p> </li> <li> <p>plugin: fix mounting /etc/hosts when running in UserNS. <a href="https://redirect.github.com/moby/moby/pull/47588">moby/moby#47588</a></p> </li> <li> <p>rootless: fix <code>open /etc/docker/plugins: permission denied</code>. <a href="https://redirect.github.com/moby/moby/pull/47587">moby/moby#47587</a></p> </li> <li> <p>Fix multiple parallel <code>docker build</code> runs leaking disk space. <a href="https://redirect.github.com/moby/moby/pull/47527">moby/moby#47527</a></p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/moby/moby/commit/b08a51fe16eed67de3861c03b363ba403643b12e"><code>b08a51f</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/48231">#48231</a> from austinvazquez/backport-vendor-otel-v0.46.1-to-...</li> <li><a href="https://github.com/moby/moby/commit/d151b0f87f9673f206b477c90db25956e1704ba5"><code>d151b0f</code></a> vendor: OTEL v0.46.1 / v1.21.0</li> <li><a href="https://github.com/moby/moby/commit/c6ba9a5124603357bfc4a64971cbb9708180f06e"><code>c6ba9a5</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/48225">#48225</a> from austinvazquez/backport-workflow-artifact-reten...</li> <li><a href="https://github.com/moby/moby/commit/4673a3ca2c37ae30270a29c281ccd9477107dcee"><code>4673a3c</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/48227">#48227</a> from austinvazquez/backport-backport-branch-check-t...</li> <li><a href="https://github.com/moby/moby/commit/30f89081028ce6fb1b49a71c02c156dacbe9aa62"><code>30f8908</code></a> github/ci: Check if backport is opened against the expected branch</li> <li><a href="https://github.com/moby/moby/commit/7454d6a2e672b0b977aaa14463c9aeb53acd06af"><code>7454d6a</code></a> ci: update workflow artifacts retention</li> <li><a href="https://github.com/moby/moby/commit/65cc597cea28cdc25bea3b8a86384b4251872919"><code>65cc597</code></a> Merge commit from fork</li> <li><a href="https://github.com/moby/moby/commit/b722836927669b414569c42f096869cd800b59a6"><code>b722836</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/48199">#48199</a> from austinvazquez/update-containerd-binary-to-1.7.20</li> <li><a href="https://github.com/moby/moby/commit/e8ecb9c76d97579ebbf3f9d3ef770d08ac303809"><code>e8ecb9c</code></a> update containerd binary to v1.7.20</li> <li><a href="https://github.com/moby/moby/commit/e6cae1f2373d4ff37499570e67f23b2cebb7a043"><code>e6cae1f</code></a> update containerd binary to v1.7.19</li> <li>Additional commits viewable in <a href="https://github.com/docker/docker/compare/v24.0.7...v25.0.6">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/net` from 0.18.0 to 0.23.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/net/commit/c48da131589f122489348be5dfbcb6457640046f"><code>c48da13</code></a> http2: fix TestServerContinuationFlood flakes</li> <li><a href="https://github.com/golang/net/commit/762b58d1cf6e0779780decad89c6c1523386638d"><code>762b58d</code></a> http2: fix tipos in comment</li> <li><a href="https://github.com/golang/net/commit/ba872109ef2dc8f1da778651bd1fd3792d0e4587"><code>ba87210</code></a> http2: close connections when receiving too many headers</li> <li><a href="https://github.com/golang/net/commit/ebc8168ac8ac742194df729305175940790c55a2"><code>ebc8168</code></a> all: fix some typos</li> <li><a href="https://github.com/golang/net/commit/3678185f8a652e52864c44049a9ea96b7bcc066a"><code>3678185</code></a> http2: make TestCanonicalHeaderCacheGrowth faster</li> <li><a href="https://github.com/golang/net/commit/448c44f9287b6745f958d74aa2a17ec7761c2f13"><code>448c44f</code></a> http2: remove clientTester</li> <li><a href="https://github.com/golang/net/commit/c7877ac4213b2f859831366f5a35b353e0dc9f66"><code>c7877ac</code></a> http2: convert the remaining clientTester tests to testClientConn</li> <li><a href="https://github.com/golang/net/commit/d8870b0bf2f2426fc8d19a9332f652da5c25418f"><code>d8870b0</code></a> http2: use synthetic time in TestIdleConnTimeout</li> <li><a href="https://github.com/golang/net/commit/d73acffdc9493532acb85777105bb4a351eea702"><code>d73acff</code></a> http2: only set up deadline when Server.IdleTimeout is positive</li> <li><a href="https://github.com/golang/net/commit/89f602b7bbf237abe0467031a18b42fc742ced08"><code>89f602b</code></a> http2: validate client/outgoing trailers</li> <li>Additional commits viewable in <a href="https://github.com/golang/net/compare/v0.18.0...v0.23.0">compare view</a></li> </ul> </details> <br /> Updates `google.golang.org/protobuf` from 1.31.0 to 1.33.0 Updates `google.golang.org/protobuf` from 1.31.0 to 1.33.0 Updates `github.com/cloudevents/sdk-go/v2` from 2.14.0 to 2.15.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cloudevents/sdk-go/releases">github.com/cloudevents/sdk-go/v2's releases</a>.</em></p> <blockquote> <h2>Release v2.15.2</h2> <h2>What's Changed</h2> <ul> <li>Patch for a potential security issue. See <a href="https://github.com/cloudevents/sdk-go/blob/HEAD/TBD">CVE-2024-28110</a>.</li> <li>Note: this could be a breaking change for people if they purposely change golang's HTTP <code>DefaultClient</code>, or change the CloudEvents <code>Client</code> returned from <code>NewClient</code>, and expect those changes to be visible on other HTTP flows using those Clients. E.g. auth</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/cloudevents/sdk-go/compare/v2.15.1...v2.15.2">https://github.com/cloudevents/sdk-go/compare/v2.15.1...v2.15.2</a></p> <h2>Release v2.15.1</h2> <h2>What's Changed</h2> <ul> <li>Bump andstor/file-existence-action from 2 to 3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1009">cloudevents/sdk-go#1009</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /test/conformance by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/993">cloudevents/sdk-go#993</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /test/benchmark by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/994">cloudevents/sdk-go#994</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /samples/kafka by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/995">cloudevents/sdk-go#995</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /test/integration by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/996">cloudevents/sdk-go#996</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /protocol/kafka_sarama/v2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/997">cloudevents/sdk-go#997</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /samples/http by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/998">cloudevents/sdk-go#998</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /samples/nats by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/999">cloudevents/sdk-go#999</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /samples/stan by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1004">cloudevents/sdk-go#1004</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /samples/nats_jetstream by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1003">cloudevents/sdk-go#1003</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /protocol/nats/v2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1002">cloudevents/sdk-go#1002</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /protocol/nats_jetstream/v2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1001">cloudevents/sdk-go#1001</a></li> <li>Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /protocol/stan/v2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1000">cloudevents/sdk-go#1000</a></li> <li>Propose the <code>confluent-kafka-go</code> binding for Kafka by <a href="https://github.com/yanmxa"><code>@yanmxa</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1008">cloudevents/sdk-go#1008</a></li> <li>Sync CESQL tck tests by <a href="https://github.com/Cali0707"><code>@Cali0707</code></a> in <a href="https://redirect.github.com/cloudevents/sdk-go/pull/1010">cloudevents/sdk-go#1010</a></li> <li>Fix docstring typos in nats and jetstream protocol by <a…
- Loading branch information
1 parent
920d6d4
commit db33f95