Bump the go-deps group with 8 updates #1245

dependabot · 2024-09-16T03:01:39Z

Bumps the go-deps group with 8 updates:

Package	From	To
github.com/cyphar/filepath-securejoin	`0.3.1`	`0.3.2`
github.com/fluxcd/pkg/apis/event	`0.10.0`	`0.10.1`
github.com/fluxcd/pkg/apis/kustomize	`1.6.0`	`1.6.1`
github.com/fluxcd/pkg/apis/meta	`1.6.0`	`1.6.1`
github.com/fluxcd/pkg/http/fetch	`0.12.0`	`0.12.1`
github.com/fluxcd/pkg/runtime	`0.49.0`	`0.49.1`
github.com/fluxcd/pkg/ssa	`0.41.0`	`0.41.1`
github.com/fluxcd/pkg/tar	`0.8.0`	`0.8.1`

Updates github.com/cyphar/filepath-securejoin from 0.3.1 to 0.3.2

Release notes

Sourced from github.com/cyphar/filepath-securejoin's releases.

v0.3.2

This release includes a few fixes for MkdirAll when dealing with S_ISUID and S_ISGID, to solve a regression runc hit when switching to MkdirAll.

Passing the S_ISUID or S_ISGID modes to MkdirAllInRoot will now return an explicit error saying that those bits are ignored by mkdirat(2). In the past a different error was returned, but since the silent ignoring behaviour is codified in the man pages a more explicit error seems apt. While silently ignoring these bits would be the most compatible option, it could lead to users thinking their code sets these bits when it doesn't. Programs that need to deal with compatibility can mask the bits themselves. (#23, #25)

If a directory has S_ISGID set, then all child directories will have S_ISGID set when created and a different gid will be used for any inode created under the directory. Previously, the "expected owner and mode" validation in securejoin.MkdirAll did not correctly handle this. We now correctly handle this case. (#24, #25)

Signed-off-by: Aleksa Sarai [email protected]

Changelog

Sourced from github.com/cyphar/filepath-securejoin's changelog.

[0.3.2] - 2024-09-13

Changed

Passing the S_ISUID or S_ISGID modes to MkdirAllInRoot will now return an explicit error saying that those bits are ignored by mkdirat(2). In the past a different error was returned, but since the silent ignoring behaviour is codified in the man pages a more explicit error seems apt. While silently ignoring these bits would be the most compatible option, it could lead to users thinking their code sets these bits when it doesn't. Programs that need to deal with compatibility can mask the bits themselves. (#23, #25)

Fixed

If a directory has S_ISGID set, then all child directories will have S_ISGID set when created and a different gid will be used for any inode created under the directory. Previously, the "expected owner and mode" validation in securejoin.MkdirAll did not correctly handle this. We now correctly handle this case. (#24, #25)

Commits

e408943 VERSION: release v0.3.2
1c875f5 CHANGELOG: fix headers
fdaafcc merge #25 into cyphar/filepath-securejoin:main
1acda83 mkdirall: correctly handle sgid directory parent
8484faf tests: mkdirall: refactor check and mkdirall helpers
350d697 mkdirall: explicitly return an error for suid/sgid bits
43b1026 tests: procfs: skip procfs tests if overmounting is blocked
82e5725 VERSION: back to development
See full diff in compare view

Updates github.com/fluxcd/pkg/apis/event from 0.10.0 to 0.10.1

Commits

196a3ba Merge pull request #93 from fluxcd/fix-le
98bdf3b Set leader election Lease duration to 35s
1d56dd8 Merge pull request #92 from fluxcd/leaderelection-options
c294d46 Add leader election config to runtime
8ef4a8f Merge pull request #91 from SomtochiAma/record-deepcopy
9a29a95 Generate deepcopy method for event
276ad93 Merge pull request #90 from SomtochiAma/runtime-suspend
4efd97c Uses suspendGuage
ec8435e Merge pull request #89 from fluxcd/controller-runtime-v0.8.3
f879c7e Update controller-runtime to v0.8.3
Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/apis/kustomize from 1.6.0 to 1.6.1

Commits

c8165af Merge pull request #809 from fluxcd/k8s-1.31.1
18924bf Update controller-gen to v0.16.1
735a85b Update dependencies
62475f1 Merge pull request #789 from dipti-pai/pkg-azure-git-wi-auth
1686996 Support Azure OIDC authentication
a2a7a01 Merge pull request #808 from matheuscscp/oci-auth-proxy
8b5c43a Add proxy support for oci/auth login
d467d6e Merge pull request #807 from fluxcd/dependabot/github_actions/ci-6f7028051e
a6b58a7 build(deps): bump the ci group with 2 updates
f0eb8aa Merge pull request #806 from fluxcd/dependabot/github_actions/ci-fc48fdf541
Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/apis/meta from 1.6.0 to 1.6.1

Commits

c8165af Merge pull request #809 from fluxcd/k8s-1.31.1
18924bf Update controller-gen to v0.16.1
735a85b Update dependencies
62475f1 Merge pull request #789 from dipti-pai/pkg-azure-git-wi-auth
1686996 Support Azure OIDC authentication
a2a7a01 Merge pull request #808 from matheuscscp/oci-auth-proxy
8b5c43a Add proxy support for oci/auth login
d467d6e Merge pull request #807 from fluxcd/dependabot/github_actions/ci-6f7028051e
a6b58a7 build(deps): bump the ci group with 2 updates
f0eb8aa Merge pull request #806 from fluxcd/dependabot/github_actions/ci-fc48fdf541
Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/http/fetch from 0.12.0 to 0.12.1

Commits

80ab4c3 Merge pull request #564 from fluxcd/update-deps
4759e6d runtime: update dependencies
403e3b1 version: update dependencies
7ff5151 ssh: update dependencies
1e5fbd8 ssa: update dependencies
1dd8df2 oci/tests/integration: update dependencies
31f7fe3 oci: update dependencies
f94edcc kustomize: update dependencies
51f7565 http/fetch: update dependencies
90957c7 helmtestserver: update dependencies
Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/runtime from 0.49.0 to 0.49.1

Commits

7fe9789 Merge pull request #810 from fluxcd/up-int-deps
f674386 Update internal dependencies
c8165af Merge pull request #809 from fluxcd/k8s-1.31.1
18924bf Update controller-gen to v0.16.1
735a85b Update dependencies
62475f1 Merge pull request #789 from dipti-pai/pkg-azure-git-wi-auth
1686996 Support Azure OIDC authentication
a2a7a01 Merge pull request #808 from matheuscscp/oci-auth-proxy
8b5c43a Add proxy support for oci/auth login
d467d6e Merge pull request #807 from fluxcd/dependabot/github_actions/ci-6f7028051e
Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/ssa from 0.41.0 to 0.41.1

Commits

7fe9789 Merge pull request #810 from fluxcd/up-int-deps
f674386 Update internal dependencies
c8165af Merge pull request #809 from fluxcd/k8s-1.31.1
18924bf Update controller-gen to v0.16.1
735a85b Update dependencies
62475f1 Merge pull request #789 from dipti-pai/pkg-azure-git-wi-auth
1686996 Support Azure OIDC authentication
See full diff in compare view

Updates github.com/fluxcd/pkg/tar from 0.8.0 to 0.8.1

Commits

68b676d Merge pull request #621 from fluxcd/update-runtime-deps
8026a27 runtime: update dependencies
e8edd75 Merge pull request #620 from fluxcd/update-deps
5e21e50 helmtestserver: update dependencies
a7213f0 Merge pull request #619 from fluxcd/enable-codeql-quality
79175a1 ci: enable security-and-quality CodeQL query
bfb6c67 Merge pull request #617 from fluxcd/fix-git-flake
0ac59bc git/internal/e2e: address flake for clone tests
79df79e Merge pull request #618 from fluxcd/remove-dep-rand-seed
d998987 *: remove deprecated rand.Seed calls
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the go-deps group with 8 updates: | Package | From | To | | --- | --- | --- | | [github.com/cyphar/filepath-securejoin](https://github.com/cyphar/filepath-securejoin) | `0.3.1` | `0.3.2` | | [github.com/fluxcd/pkg/apis/event](https://github.com/fluxcd/pkg) | `0.10.0` | `0.10.1` | | [github.com/fluxcd/pkg/apis/kustomize](https://github.com/fluxcd/pkg) | `1.6.0` | `1.6.1` | | [github.com/fluxcd/pkg/apis/meta](https://github.com/fluxcd/pkg) | `1.6.0` | `1.6.1` | | [github.com/fluxcd/pkg/http/fetch](https://github.com/fluxcd/pkg) | `0.12.0` | `0.12.1` | | [github.com/fluxcd/pkg/runtime](https://github.com/fluxcd/pkg) | `0.49.0` | `0.49.1` | | [github.com/fluxcd/pkg/ssa](https://github.com/fluxcd/pkg) | `0.41.0` | `0.41.1` | | [github.com/fluxcd/pkg/tar](https://github.com/fluxcd/pkg) | `0.8.0` | `0.8.1` | Updates `github.com/cyphar/filepath-securejoin` from 0.3.1 to 0.3.2 - [Release notes](https://github.com/cyphar/filepath-securejoin/releases) - [Changelog](https://github.com/cyphar/filepath-securejoin/blob/main/CHANGELOG.md) - [Commits](cyphar/filepath-securejoin@v0.3.1...v0.3.2) Updates `github.com/fluxcd/pkg/apis/event` from 0.10.0 to 0.10.1 - [Commits](fluxcd/pkg@git/v0.10.0...runtime/v0.10.1) Updates `github.com/fluxcd/pkg/apis/kustomize` from 1.6.0 to 1.6.1 - [Commits](fluxcd/pkg@apis/meta/v1.6.0...apis/meta/v1.6.1) Updates `github.com/fluxcd/pkg/apis/meta` from 1.6.0 to 1.6.1 - [Commits](fluxcd/pkg@apis/meta/v1.6.0...apis/meta/v1.6.1) Updates `github.com/fluxcd/pkg/http/fetch` from 0.12.0 to 0.12.1 - [Commits](fluxcd/pkg@git/v0.12.0...git/v0.12.1) Updates `github.com/fluxcd/pkg/runtime` from 0.49.0 to 0.49.1 - [Commits](fluxcd/pkg@runtime/v0.49.0...runtime/v0.49.1) Updates `github.com/fluxcd/pkg/ssa` from 0.41.0 to 0.41.1 - [Commits](fluxcd/pkg@oci/v0.41.0...oci/v0.41.1) Updates `github.com/fluxcd/pkg/tar` from 0.8.0 to 0.8.1 - [Commits](fluxcd/pkg@git/v0.8.0...ssh/v0.8.1) --- updated-dependencies: - dependency-name: github.com/cyphar/filepath-securejoin dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/fluxcd/pkg/apis/event dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/fluxcd/pkg/apis/kustomize dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/fluxcd/pkg/apis/meta dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/fluxcd/pkg/http/fetch dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/fluxcd/pkg/runtime dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/fluxcd/pkg/ssa dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/fluxcd/pkg/tar dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot · 2024-09-26T07:19:56Z

Looks like these dependencies are no longer updatable, so this is no longer needed.

dependabot bot added the dependencies Pull requests that update a dependency label Sep 16, 2024

dependabot bot closed this Sep 26, 2024

dependabot bot deleted the dependabot/go_modules/go-deps-dd4b40ccab branch September 26, 2024 07:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the go-deps group with 8 updates #1245

Bump the go-deps group with 8 updates #1245

Uh oh!

dependabot bot commented on behalf of github Sep 16, 2024 •

edited

Loading

Uh oh!

dependabot bot commented on behalf of github Sep 26, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Bump the go-deps group with 8 updates #1245

Bump the go-deps group with 8 updates #1245

Uh oh!

Conversation

dependabot bot commented on behalf of github Sep 16, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.3.2

[0.3.2] - 2024-09-13

Changed

Fixed

Uh oh!

dependabot bot commented on behalf of github Sep 26, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot bot commented on behalf of github Sep 16, 2024 •

edited

Loading