Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

go: bump github.com/hashicorp/vault from 1.14.1 to 1.14.6 #187

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Nov 10, 2023

Bumps github.com/hashicorp/vault from 1.14.1 to 1.14.6.

Release notes

Sourced from github.com/hashicorp/vault's releases.

v1.14.6

1.14.6

November 09, 2023

SECURITY:

  • core: inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. This vulnerability, CVE-2023-5954, was introduced in Vault 1.15.0, 1.14.3, and 1.13.7, and is fixed in Vault 1.15.2, 1.14.6, and 1.13.10. [HSEC-2023-33]

CHANGES:

  • auth/approle: Normalized error response messages when invalid credentials are provided [GH-23786]
  • secrets/mongodbatlas: Update plugin to v0.10.2 [GH-23849]

FEATURES:

  • cli/snapshot: Add CLI tool to inspect Vault snapshots [GH-23457]

IMPROVEMENTS:

  • storage/etcd: etcd should only return keys when calling List() [GH-23872]

BUG FIXES:

  • api/seal-status: Fix deadlock on calls to sys/seal-status with a namespace configured on the request. [GH-23861]
  • core (enterprise): Do not return an internal error when token policy type lookup fails, log it instead and continue.
  • core/activity: Fixes segments fragment loss due to exceeding entry record size limit [GH-23781]
  • core/mounts: Fix reading an "auth" mount using "sys/internal/ui/mounts/" when filter paths are enforced returns 500 error code from the secondary [GH-23802]
  • core: Revert PR causing memory consumption bug [GH-23986]
  • core: Skip unnecessary deriving of policies during Login MFA Check. [GH-23894]
  • core: fix bug where deadlock detection was always on for expiration and quotas. These can now be configured individually with detect_deadlocks. [GH-23902]
  • core: fix policies with wildcards not matching list operations due to the policy path not having a trailing slash [GH-23874]
  • expiration: Fix fatal error "concurrent map iteration and map write" when collecting metrics from leases. [GH-24027]

v1.14.5

1.14.5

October 25, 2023

CHANGES:

  • core: Bump Go version to 1.20.10.
  • replication (enterprise): Switch to non-deprecated gRPC field for resolver target host

IMPROVEMENTS:

  • api/plugins: add tls-server-name arg for plugin registration [GH-23549]
  • core: Use a worker pool for the rollback manager. Add new metrics for the rollback manager to track the queued tasks. [GH-22567]
  • ui: Adds toggle to KV secrets engine value download modal to optionally stringify value in downloaded file [GH-23747]
  • website/docs: fix inaccuracies with unauthenticated_in_flight_requests_access parameter [GH-23287]

... (truncated)

Changelog

Sourced from github.com/hashicorp/vault's changelog.

1.14.6

November 09, 2023

SECURITY:

  • core: inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. This vulnerability, CVE-2023-5954, was introduced in Vault 1.15.0, 1.14.3, and 1.13.7, and is fixed in Vault 1.15.2, 1.14.6, and 1.13.10. [HSEC-2023-33]

CHANGES:

  • auth/approle: Normalized error response messages when invalid credentials are provided [GH-23786]
  • secrets/mongodbatlas: Update plugin to v0.10.2 [GH-23849]

FEATURES:

  • cli/snapshot: Add CLI tool to inspect Vault snapshots [GH-23457]

IMPROVEMENTS:

  • storage/etcd: etcd should only return keys when calling List() [GH-23872]

BUG FIXES:

  • api/seal-status: Fix deadlock on calls to sys/seal-status with a namespace configured on the request. [GH-23861]
  • core (enterprise): Do not return an internal error when token policy type lookup fails, log it instead and continue.
  • core/activity: Fixes segments fragment loss due to exceeding entry record size limit [GH-23781]
  • core/mounts: Fix reading an "auth" mount using "sys/internal/ui/mounts/" when filter paths are enforced returns 500 error code from the secondary [GH-23802]
  • core: Revert PR causing memory consumption bug [GH-23986]
  • core: Skip unnecessary deriving of policies during Login MFA Check. [GH-23894]
  • core: fix bug where deadlock detection was always on for expiration and quotas. These can now be configured individually with detect_deadlocks. [GH-23902]
  • core: fix policies with wildcards not matching list operations due to the policy path not having a trailing slash [GH-23874]
  • expiration: Fix fatal error "concurrent map iteration and map write" when collecting metrics from leases. [GH-24027]

1.14.5

October 25, 2023

CHANGES:

  • core: Bump Go version to 1.20.10.
  • replication (enterprise): Switch to non-deprecated gRPC field for resolver target host

IMPROVEMENTS:

  • api/plugins: add tls-server-name arg for plugin registration [GH-23549]
  • core: Use a worker pool for the rollback manager. Add new metrics for the rollback manager to track the queued tasks. [GH-22567]
  • ui: Adds toggle to KV secrets engine value download modal to optionally stringify value in downloaded file [GH-23747]

BUG FIXES:

  • command/server: Fix bug with sigusr2 where pprof files were not closed correctly [GH-23636]

... (truncated)

Commits
  • 5efc0cb backport of commit 7ec3867eea2ad3c405f15f9ab5447618685739cf (#24031)
  • 891eb6f backport of commit b19562db9a8c1b65ea660ed0d51aaf9498a9887d (#24025)
  • d828122 docs: add workaround to known issue loading missing policies from other names...
  • e517967 Docs: Update known issues table logger leak (#24012) (#24013)
  • 96f5e64 Revert "Automatically track subloggers in allLoggers (#22038)" (#24005)
  • 59c189b Add known issue for sublogger memory leak (#23977) (#24008)
  • cde950d backport of commit 9538c6e59b69033b7d0441e6eaf6260c0cbbee6d (#23997)
  • b488b2f backport of commit d93a13a7e3f5c2ef9293e3ef0bc84e8823dfe560 (#23990)
  • b7517d0 replace nytimes/gziphandler with klauspost/compress/gzhttp (#23898) (#23962)
  • 8814a4b backport of commit 750ab337eaa0b049d9cf1535c00e860129e5e9a0 (#23955)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot dependabot bot added dependencies Pull requests that update a dependency file golang labels Nov 10, 2023
@dependabot dependabot bot requested review from Joibel and tico24 November 10, 2023 00:45
Copy link

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

GoGitOps Review

Grade: A+ (100.0%)

Files: 27

Issues: 0

gofmt: 100%

go_vet: 100%

gocyclo: 100%

golint: 100%

ineffassign: 100%

license: 100%

misspell: 100%

This report was generated using GoGitOps.

@dependabot dependabot bot force-pushed the dependabot/go_modules/github.com/hashicorp/vault-1.14.6 branch from 224a4c4 to 3909ae2 Compare November 28, 2023 10:37
Bumps [github.com/hashicorp/vault](https://github.com/hashicorp/vault) from 1.14.1 to 1.14.6.
- [Release notes](https://github.com/hashicorp/vault/releases)
- [Changelog](https://github.com/hashicorp/vault/blob/main/CHANGELOG.md)
- [Commits](hashicorp/vault@v1.14.1...v1.14.6)

---
updated-dependencies:
- dependency-name: github.com/hashicorp/vault
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/go_modules/github.com/hashicorp/vault-1.14.6 branch from 3909ae2 to 504bc76 Compare November 28, 2023 10:39
Copy link

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

GoGitOps Review

Grade: A+ (100.0%)

Files: 27

Issues: 0

gofmt: 100%

go_vet: 100%

gocyclo: 100%

golint: 100%

ineffassign: 100%

license: 100%

misspell: 100%

This report was generated using GoGitOps.

Copy link
Contributor Author

dependabot bot commented on behalf of github Dec 12, 2023

Superseded by #197.

@dependabot dependabot bot closed this Dec 12, 2023
@dependabot dependabot bot deleted the dependabot/go_modules/github.com/hashicorp/vault-1.14.6 branch December 12, 2023 00:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file golang
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants