Bump the backend group across 1 directory with 8 updates #3976

dependabot · 2024-08-12T04:06:41Z

Bumps the backend group with 7 updates in the / directory:

Package	From	To
github.com/aquasecurity/trivy	`0.53.0`	`0.54.1`
github.com/google/go-containerregistry	`0.20.1`	`0.20.2`
github.com/open-policy-agent/opa	`0.67.0`	`0.67.1`
github.com/tektoncd/pipeline	`0.62.0`	`0.62.1`
golang.org/x/crypto	`0.25.0`	`0.26.0`
golang.org/x/oauth2	`0.21.0`	`0.22.0`
google.golang.org/api	`0.189.0`	`0.191.0`

Updates github.com/aquasecurity/trivy from 0.53.0 to 0.54.1

Release notes

Sourced from github.com/aquasecurity/trivy's releases.

v0.54.1

Changelog

854c61d34a550a9fcbab3bc59e55b868c15d1962 release: v0.54.1 [release/v0.54] (#7282)

334a1c293bb3d490af2a6d80732f399efaac22f7 fix(flag): incorrect behavior for deprected flag --clear-cache [backport: release/v0.54] (#7285)

f61725c28b56d80fb46395479842a2ab0c517c5f fix(java): Return error when trying to find a remote pom to avoid segfault [backport: release/v0.54] (#7283)

a7b7117fe2c9608e990b42e702cc83675c48f888 fix(plugin): do not call GitHub content API for releases and tags [backport: release/v0.54] (#7279)

v0.54.0

⚡Release highlights and summary⚡

👉 aquasecurity/trivy#7268

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0540-2024-07-30

Changelog

Sourced from github.com/aquasecurity/trivy's changelog.

0.54.1 (2024-07-31)

Bug Fixes

flag: incorrect behavior for deprected flag --clear-cache [backport: release/v0.54] (#7285) (334a1c2)

java: Return error when trying to find a remote pom to avoid segfault [backport: release/v0.54] (#7283) (f61725c)

plugin: do not call GitHub content API for releases and tags [backport: release/v0.54] (#7279) (a7b7117)

0.54.0 (2024-07-30)

Features

add log.FilePath() function for logger (#7080) (1f5f348)

add openSUSE tumbleweed detection and scanning (#6965) (17b5dbf)

cli: rename --vuln-type flag to --pkg-types flag (#7104) (7cbdb0a)

mariner: Add support for Azure Linux (#7186) (5cbc452)

misconf: enabled China configuration for ACRs (#7156) (d1ec89d)

nodejs: add license parser to pnpm analyser (#7036) (03ac93d)

sbom: add image labels into SPDX and CycloneDX reports (#7257) (4a2f492)

sbom: add vulnerability support for SPDX formats (#7213) (efb1f69)

share build-in rules (#7207) (bff317c)

vex: retrieve VEX attestations from OCI registries (#7249) (c2fd2e0)

vex: VEX Repository support (#7206) (88ba460)

vuln: add --pkg-relationships (#7237) (5c37361)

Bug Fixes

Add dependencyManagement exclusions to the child exclusions (#6969) (dc68a66)

add missing platform and type to spec (#7149) (c8a7abd)

cli: error on missing config file (#7154) (7fa5e7d)

close file when failed to open gzip (#7164) (2a577a7)

dotnet: don't include non-runtime libraries into report for *.deps.json files (#7039) (5bc662b)

dotnet: show nuget package dir not found log only when checking nuget packages (#7194) (d76feba)

ignore nodes when listing permission is not allowed (#7107) (25f8143)

java: avoid panic if deps from pom in it dir are not found (#7245) (4e54a7e)

java: use go-mvn-version to remove Package duplicates (#7088) (a7a304d)

misconf: do not evaluate TF when a load error occurs (#7109) (f27c236)

nodejs: detect direct dependencies when using latest version for files yarn.lock + package.json (#7110) (54bb8bd)

report: hide empty table when all secrets/license/misconfigs are ignored (#7171) (c3036de)

secret: skip regular strings contain secret patterns (#7182) (174b1e3)

secret: trim excessively long lines (#7192) (92b13be)

secret: update length of hugging-face-access-token (#7216) (8c87194)

server: pass license categories to options (#7203) (9d52018)

Performance Improvements

... (truncated)

Commits

854c61d release: v0.54.1 [release/v0.54] (#7282)
334a1c2 fix(flag): incorrect behavior for deprected flag --clear-cache [backport: r...
f61725c fix(java): Return error when trying to find a remote pom to avoid segfault [b...
a7b7117 fix(plugin): do not call GitHub content API for releases and tags [backport: ...
ff403a3 release: v0.54.0 [main] (#7075)
b3ee4bc docs: update ecosystem page reporting with plopsec.com app (#7262)
3b7aad3 chore(deps): bump google.golang.org/grpc from 1.64.0 to 1.64.1 (#7136)
c2fd2e0 feat(vex): retrieve VEX attestations from OCI registries (#7249)
4a2f492 feat(sbom): add image labels into SPDX and CycloneDX reports (#7257)
f198cf8 refactor(flag): return error if both --download-db-only and `--download-jav...
Additional commits viewable in compare view

Updates github.com/google/go-containerregistry from 0.20.1 to 0.20.2

Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.20.2

What's Changed

deps: bump docker dep by @imjasonh in google/go-containerregistry#1991

Full Changelog: google/go-containerregistry@v0.20.1...v0.20.2

Commits

c195f15 deps: bump docker dep (#1991)
See full diff in compare view

Updates github.com/open-policy-agent/opa from 0.67.0 to 0.67.1

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v0.67.1

This is a bug fix release addressing the following issue:

util+server: Fix bug around chunked request handling (#6906) authored by @philipaconrad, reported by @David-Wobrock. A request handling bug was introduced in (#6868), which caused OPA to treat all incoming chunked requests as if they had zero-length request bodies.

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

0.67.1

This is a bug fix release addressing the following issue:

util+server: Fix bug around chunked request handling (#6906) authored by @philipaconrad, reported by @David-Wobrock. A request handling bug was introduced in (#6868), which caused OPA to treat all incoming chunked requests as if they had zero-length request bodies.

Commits

b88c09e Prepare v0.67.1 release
11e91b0 util+server: Fix bug around chunked request handling. (#6906)
See full diff in compare view

Updates github.com/tektoncd/pipeline from 0.62.0 to 0.62.1

Release notes

Sourced from github.com/tektoncd/pipeline's releases.

Tekton Pipeline release v0.62.1 "Birman HAL LTS"

-Docs @ v0.62.1 -Examples @ v0.62.1

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.62.1/release.yaml

Attestation

The Rekor UUID for this release is 24296fb24b8ad77a888f88120c037b3b7b9b3be97d8dd4ea1950235f44033f29dce4a1123992a3d9

Obtain the attestation:

REKOR_UUID=24296fb24b8ad77a888f88120c037b3b7b9b3be97d8dd4ea1950235f44033f29dce4a1123992a3d9
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.62.1/release.yaml
REKOR_UUID=24296fb24b8ad77a888f88120c037b3b7b9b3be97d8dd4ea1950235f44033f29dce4a1123992a3d9
Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.62.1@sha256:" + .digest.sha256')
Download the release file
curl "$RELEASE_FILE" > release.yaml
For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

... (truncated)

Commits

e58ca13 Refine check if the result is from a matrix task
See full diff in compare view

Updates golang.org/x/crypto from 0.25.0 to 0.26.0

Commits

5bcd010 go.mod: update golang.org/x dependencies
3375612 ssh: add support for unpadded RSA signatures
bb80217 ssh: don't use dsa keys in integration tests
6879722 ssh: remove go 1.21+ dependency on slices
e983fa2 sha3: Avo port of keccakf_amd64.s
80fd972 LICENSE: update per Google Legal
f2bc3a6 x509roots/fallback/internal/goissue52287: delete
d66d9c3 x509roots/fallback: update bundle
See full diff in compare view

Updates golang.org/x/oauth2 from 0.21.0 to 0.22.0

Commits

6d8340f LICENSE: update per Google Legal
See full diff in compare view

Updates golang.org/x/text from 0.16.0 to 0.17.0

Commits

b2bec85 go.mod: update golang.org/x dependencies
ae0cf96 LICENSE: update per Google Legal
See full diff in compare view

Updates google.golang.org/api from 0.189.0 to 0.191.0

Release notes

Sourced from google.golang.org/api's releases.

v0.191.0

0.191.0 (2024-08-07)

Features

all: Auto-regenerate discovery clients (#2719) (a5ddb40)

all: Auto-regenerate discovery clients (#2722) (0d15913)

all: Auto-regenerate discovery clients (#2724) (918e3d2)

Bug Fixes

Reference gax import in storage libs (#2720) (fffff7f)

transport: Disable automatic universe domain check (#2717) (f5b0bb5)

v0.190.0

0.190.0 (2024-08-01)

Features

all: Auto-regenerate discovery clients (#2693) (cbc19e7)

all: Auto-regenerate discovery clients (#2698) (ddc4e0b)

all: Auto-regenerate discovery clients (#2699) (d07fd26)

all: Auto-regenerate discovery clients (#2700) (a8b0821)

all: Auto-regenerate discovery clients (#2703) (7b03cff)

all: Auto-regenerate discovery clients (#2706) (05a4fc5)

all: Auto-regenerate discovery clients (#2715) (164a8d6)

Move storage, bigquery, and compute to new auth lib (#2695) (66ace6c)

Reverts

Move storage, bigquery, and compute to new auth lib (#2695)" (#2704) (aa62c85)

Changelog

Sourced from google.golang.org/api's changelog.

0.191.0 (2024-08-07)

Features

all: Auto-regenerate discovery clients (#2719) (a5ddb40)

all: Auto-regenerate discovery clients (#2722) (0d15913)

all: Auto-regenerate discovery clients (#2724) (918e3d2)

Bug Fixes

Reference gax import in storage libs (#2720) (fffff7f)

transport: Disable automatic universe domain check (#2717) (f5b0bb5)

0.190.0 (2024-08-01)

Features

all: Auto-regenerate discovery clients (#2693) (cbc19e7)

all: Auto-regenerate discovery clients (#2698) (ddc4e0b)

all: Auto-regenerate discovery clients (#2699) (d07fd26)

all: Auto-regenerate discovery clients (#2700) (a8b0821)

all: Auto-regenerate discovery clients (#2703) (7b03cff)

all: Auto-regenerate discovery clients (#2706) (05a4fc5)

all: Auto-regenerate discovery clients (#2715) (164a8d6)

Move storage, bigquery, and compute to new auth lib (#2695) (66ace6c)

Reverts

Move storage, bigquery, and compute to new auth lib (#2695)" (#2704) (aa62c85)

Commits

d0759b0 chore(main): release 0.191.0 (#2718)
918e3d2 feat(all): auto-regenerate discovery clients (#2724)
0d15913 feat(all): auto-regenerate discovery clients (#2722)
b365461 chore(all): update all (#2721)
fffff7f fix: reference gax import in storage libs (#2720)
a5ddb40 feat(all): auto-regenerate discovery clients (#2719)
f5b0bb5 fix(transport): disable automatic universe domain check (#2717)
88dca19 chore(main): release 0.190.0 (#2694)
1f2d6d3 chore: bump cloud.google.com/go/[email protected] (#2716)
164a8d6 feat(all): auto-regenerate discovery clients (#2715)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the backend group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/aquasecurity/trivy](https://github.com/aquasecurity/trivy) | `0.53.0` | `0.54.1` | | [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) | `0.20.1` | `0.20.2` | | [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) | `0.67.0` | `0.67.1` | | [github.com/tektoncd/pipeline](https://github.com/tektoncd/pipeline) | `0.62.0` | `0.62.1` | | [golang.org/x/crypto](https://github.com/golang/crypto) | `0.25.0` | `0.26.0` | | [golang.org/x/oauth2](https://github.com/golang/oauth2) | `0.21.0` | `0.22.0` | | [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.189.0` | `0.191.0` | Updates `github.com/aquasecurity/trivy` from 0.53.0 to 0.54.1 - [Release notes](https://github.com/aquasecurity/trivy/releases) - [Changelog](https://github.com/aquasecurity/trivy/blob/v0.54.1/CHANGELOG.md) - [Commits](aquasecurity/trivy@v0.53.0...v0.54.1) Updates `github.com/google/go-containerregistry` from 0.20.1 to 0.20.2 - [Release notes](https://github.com/google/go-containerregistry/releases) - [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml) - [Commits](google/go-containerregistry@v0.20.1...v0.20.2) Updates `github.com/open-policy-agent/opa` from 0.67.0 to 0.67.1 - [Release notes](https://github.com/open-policy-agent/opa/releases) - [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md) - [Commits](open-policy-agent/opa@v0.67.0...v0.67.1) Updates `github.com/tektoncd/pipeline` from 0.62.0 to 0.62.1 - [Release notes](https://github.com/tektoncd/pipeline/releases) - [Changelog](https://github.com/tektoncd/pipeline/blob/main/releases.md) - [Commits](tektoncd/pipeline@v0.62.0...v0.62.1) Updates `golang.org/x/crypto` from 0.25.0 to 0.26.0 - [Commits](golang/crypto@v0.25.0...v0.26.0) Updates `golang.org/x/oauth2` from 0.21.0 to 0.22.0 - [Commits](golang/oauth2@v0.21.0...v0.22.0) Updates `golang.org/x/text` from 0.16.0 to 0.17.0 - [Release notes](https://github.com/golang/text/releases) - [Commits](golang/text@v0.16.0...v0.17.0) Updates `google.golang.org/api` from 0.189.0 to 0.191.0 - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.189.0...v0.191.0) --- updated-dependencies: - dependency-name: github.com/aquasecurity/trivy dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend - dependency-name: github.com/google/go-containerregistry dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend - dependency-name: github.com/open-policy-agent/opa dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend - dependency-name: github.com/tektoncd/pipeline dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend - dependency-name: golang.org/x/oauth2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend - dependency-name: golang.org/x/text dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend - dependency-name: google.golang.org/api dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot · 2024-08-19T05:00:34Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Aug 12, 2024

dependabot bot closed this Aug 19, 2024

dependabot bot deleted the dependabot/go_modules/backend-2104ae7c14 branch August 19, 2024 05:00

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the backend group across 1 directory with 8 updates #3976

Bump the backend group across 1 directory with 8 updates #3976

dependabot bot commented on behalf of github Aug 12, 2024 •

edited

Loading

dependabot bot commented on behalf of github Aug 19, 2024

Bump the backend group across 1 directory with 8 updates #3976

Bump the backend group across 1 directory with 8 updates #3976

Conversation

dependabot bot commented on behalf of github Aug 12, 2024 • edited Loading

v0.54.1

Changelog

v0.54.0

⚡Release highlights and summary⚡

Changelog

0.54.1 (2024-07-31)

Bug Fixes

0.54.0 (2024-07-30)

Features

Bug Fixes

Performance Improvements

v0.20.2

What's Changed

v0.67.1

0.67.1

Tekton Pipeline release v0.62.1 "Birman HAL LTS"

Installation one-liner

Attestation

Changes

Features

v0.191.0

0.191.0 (2024-08-07)

Features

Bug Fixes

v0.190.0

0.190.0 (2024-08-01)

Features

Reverts

0.191.0 (2024-08-07)

Features

Bug Fixes

0.190.0 (2024-08-01)

Features

Reverts

dependabot bot commented on behalf of github Aug 19, 2024

dependabot bot commented on behalf of github Aug 12, 2024 •

edited

Loading