Bump the go_modules group across 9 directories with 13 updates #396

dependabot · 2024-04-19T10:23:55Z

Bumps the go_modules group with 1 update in the /api3 directory: golang.org/x/crypto.
Bumps the go_modules group with 6 updates in the /backend directory:

Package	From	To
golang.org/x/crypto	`0.1.0`	`0.17.0`
github.com/docker/docker	`20.10.14+incompatible`	`24.0.9+incompatible`
github.com/docker/distribution	`2.8.1+incompatible`	`2.8.2+incompatible`
github.com/jackc/pgproto3/v2	`2.3.1`	`2.3.3`
github.com/jackc/pgx/v4	`4.17.2`	`4.18.2`
google.golang.org/grpc	`1.43.0`	`1.56.3`

Bumps the go_modules group with 1 update in the /plugins/api directory: golang.org/x/net.
Bumps the go_modules group with 1 update in the /plugins/common directory: golang.org/x/net.
Bumps the go_modules group with 2 updates in the /plugins/gateway/kong directory: golang.org/x/net and google.golang.org/protobuf.
Bumps the go_modules group with 1 update in the /plugins/gateway/tyk/v3.2.2 directory: github.com/gin-gonic/gin.
Bumps the go_modules group with 3 updates in the /plugins/otel-collector/apiclarityexporter directory: golang.org/x/net, google.golang.org/grpc and go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp.
Bumps the go_modules group with 3 updates in the /plugins/taper directory: golang.org/x/net, gopkg.in/yaml.v3 and google.golang.org/grpc.
Bumps the go_modules group with 1 update in the /plugins/taper/extensions/http directory: golang.org/x/net.

Updates golang.org/x/crypto from 0.1.0 to 0.17.0

Commits

9d2ee97 ssh: implement strict KEX protocol changes
4e5a261 ssh: close net.Conn on all NewServerConn errors
152cdb1 x509roots/fallback: update bundle
fdfe1f8 ssh: defer channel window adjustment
b8ffc16 blake2b: drop Go 1.6, Go 1.8 compatibility
7e6fbd8 ssh: wrap errors from client handshake
bda2f3f argon2: avoid clobbering BP
325b735 ssh/test: skip TestSSHCLIAuth on Windows
1eadac5 go.mod: update golang.org/x dependencies
b2d7c26 ssh: add (*Client).DialContext method
Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.1.0 to 0.17.0

Commits

9d2ee97 ssh: implement strict KEX protocol changes
4e5a261 ssh: close net.Conn on all NewServerConn errors
152cdb1 x509roots/fallback: update bundle
fdfe1f8 ssh: defer channel window adjustment
b8ffc16 blake2b: drop Go 1.6, Go 1.8 compatibility
7e6fbd8 ssh: wrap errors from client handshake
bda2f3f argon2: avoid clobbering BP
325b735 ssh/test: skip TestSSHCLIAuth on Windows
1eadac5 go.mod: update golang.org/x dependencies
b2d7c26 ssh: add (*Client).DialContext method
Additional commits viewable in compare view

Updates golang.org/x/net from 0.2.0 to 0.10.0

Commits

See full diff in compare view

Updates golang.org/x/sys from 0.2.0 to 0.15.0

Commits

13b15b7 unix: add IoctlLoopConfigure on linux
11eadc0 windows: add AddDllDirectory and RemoveDllDirectory
e4099bf unix: fix trimmed socket opt string in GetsockoptString
9888904 unix: update BPF constants for Linux kernel 6.6
2d0c736 unix: use fchmodat2 in Fchmodat
ec230da unix: use fcntl(2) libc stub on OpenBSD
cb378ae syscall: call getfsstat via libc on openbsd
661d749 unix: use libc stubs for OpenBSD pledge+unveil
1168e25 unix/linux: update Linux kernel to v6.6
249e16f unix: require minimum OpenBSD 6.4 for pledge, unveil
Additional commits viewable in compare view

Updates golang.org/x/text from 0.4.0 to 0.14.0

Commits

6c97a16 all: update go directive to 1.18
f488e19 unicode/norm: fix function name on comment
fb697c0 cmd/gotext: actually use -dir flag
f3e69ed cmd/gotext: fix misbehaviors
ab07ad1 all: remove repetitive words
e503480 encoding/japanese, language: shorten very long sub-test names
2df65d7 all: regenerate for Unicode 15.0.0
e3c038a all: prepare for Unicode 15.0.0
3a7a255 internal/export/idna: make more space for mapping index
d61dd50 go.mod: delete repeated "indirect"
Additional commits viewable in compare view

Updates github.com/docker/docker from 20.10.14+incompatible to 24.0.9+incompatible

Release notes

Sourced from github.com/docker/docker's releases.

v24.0.9

24.0.9

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

docker/cli, 24.0.9 milestone

moby/moby, 24.0.9 milestone

Security

This release contains security fixes for the following CVEs affecting Docker Engine and its components.

CVE Component Fix version Severity

CVE-2024-21626 runc 1.1.12 High, CVSS 8.6

CVE-2024-24557 Docker Engine 24.0.9 Medium, CVSS 6.9

Important ⚠️

Note that this release of Docker Engine doesn't include fixes for the following known vulnerabilities in BuildKit:

CVE-2024-23651

CVE-2024-23652

CVE-2024-23653

CVE-2024-23650

To address these vulnerabilities, upgrade to Docker Engine v25.0.2.

For more information about the security issues addressed in this release, and the unaddressed vulnerabilities in BuildKit, refer to the blog post. For details about each vulnerability, see the relevant security advisory:

CVE-2024-21626

CVE-2024-24557

Packaging updates

Upgrade runc to v1.1.12. moby/moby#47269

Upgrade containerd to v1.7.13 (static binaries only). moby/moby#47280

v24.0.8

24.0.8

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

docker/cli, 24.0.8 milestone

moby/moby, 24.0.8 milestone

Bug fixes and enhancements

Live restore: Containers with auto remove (docker run --rm) are no longer forcibly removed on engine restart. moby/moby#46857

... (truncated)

Commits

fca702d Merge pull request from GHSA-xw73-rw38-6vjc
f78a772 Merge pull request #47281 from thaJeztah/24.0_backport_bump_containerd_binary...
61afffe Merge pull request #47270 from thaJeztah/24.0_backport_bump_runc_binary_1.1.12
b38e74c Merge pull request #47276 from thaJeztah/24.0_backport_bump_runc_1.1.12
dac5663 update containerd binary to v1.7.13
20e1af3 vendor: github.com/opencontainers/runc v1.1.12
858919d update runc binary to v1.1.12
141ad39 Merge pull request #47266 from vvoland/ci-fix-makeps1-templatefail-24
db968c6 hack/make.ps1: Fix go list pattern
61c51fb Merge pull request #47221 from vvoland/pkg-pools-close-noop-24
Additional commits viewable in compare view

Updates github.com/docker/distribution from 2.8.1+incompatible to 2.8.2+incompatible

Release notes

Sourced from github.com/docker/distribution's releases.

v2.8.2

What's Changed

Revert registry/client: set Accept: identity header when getting layers by @ndeloof in distribution/distribution#3783

Parse http forbidden as denied by @vvoland in distribution/distribution#3914

Fix CVE-2022-28391 by bumping alpine from 3.14 to 3.16 by @thaJeztah (#3650)

Fix CVE-2023-2253 runaway allocation on /v2/_catalog by @josegomezr 521ea3d9

Fix panic in inmemory driver by @wy65701436 in distribution/distribution#3815

bump up golang version (alternative) by @thaJeztah in distribution/distribution#3903

Dockerfile: update xx to v1.2.1 by @thaJeztah in distribution/distribution#3907

update to go1.19.9 by @thaJeztah in distribution/distribution#3908

Add code to handle pagination of parts. Fixes max layer size of 10GB bug by @DavidSpek in distribution/distribution#3893

Dockerfile: fix filenames of artifacts by @thaJeztah in distribution/distribution#3911

Full Changelog: distribution/distribution@v2.8.1...v2.8.2

v2.8.2-beta.2

What's Changed

Fix CVE-2022-28391 by bumping alpine from 3.14 to 3.16 by @thaJeztah (#3650)

Fix CVE-2023-2253 runaway allocation on /v2/_catalog by @josegomezr 521ea3d9

Fix panic in inmemory driver by @wy65701436 in distribution/distribution#3815

bump up golang version (alternative) by @thaJeztah in distribution/distribution#3903

Dockerfile: update xx to v1.2.1 by @thaJeztah in distribution/distribution#3907

update to go1.19.9 by @thaJeztah in distribution/distribution#3908

Add code to handle pagination of parts. Fixes max layer size of 10GB bug by @DavidSpek in distribution/distribution#3893

Dockerfile: fix filenames of artifacts by @thaJeztah in distribution/distribution#3911

Full Changelog: distribution/distribution@v2.8.1...v2.8.2-beta.2

v2.8.2-beta.1

NOTE: This is a pre-release that does not contain any artifacts!

What's Changed

Fix runaway allocation on /v2/_catalog by @josegomezr 521ea3d9

Fix CVE-2022-28391 by bumping alpine from 3.14 to 3.16 by @thaJeztah in distribution/distribution#3650

Fix panic in inmemory driver by @wy65701436 in distribution/distribution#3815

bump up golang version (alternative) by @thaJeztah in distribution/distribution#3903

Dockerfile: update xx to v1.2.1 by @thaJeztah in distribution/distribution#3907

update to go1.19.9 by @thaJeztah in distribution/distribution#3908

Add code to handle pagination of parts. Fixes max layer size of 10GB bug by @DavidSpek in distribution/distribution#3893

Full Changelog: distribution/distribution@v2.8.1...v2.8.2-beta.1

Commits

7c354a4 Merge pull request #3915 from distribution/2.8.2-release-notes
a173a9c Add v2.8.2 release notes
4894d35 Merge pull request #3914 from vvoland/handle-forbidden-28
f067f66 Merge pull request #3783 from ndeloof/accept-encoding-28
483ad69 registry/errors: Parse http forbidden as denied
2b0f84d Revert "registry/client: set Accept: identity header when getting layers"
320d6a1 Merge pull request #3912 from distribution/2.8.2-beta.2-release-notes
5f3ca1b Add release notes for 2.8.2-beta.2 release
cb840f6 Merge pull request #3911 from thaJeztah/2.8_backport_fix_releaser_filenames
e884644 Dockerfile: fix filenames of artifacts
Additional commits viewable in compare view

Updates github.com/jackc/pgproto3/v2 from 2.3.1 to 2.3.3

Commits

945c212 Backport fixes from pgx v5
0c0f7b0 Add pgx v5 note
f59ff94 UnmarshalJSON: removing hex decode
See full diff in compare view

Updates github.com/jackc/pgx/v4 from 4.17.2 to 4.18.2

Changelog

Sourced from github.com/jackc/pgx/v4's changelog.

4.18.2 (March 4, 2024)

Fix CVE-2024-27289

SQL injection can occur when all of the following conditions are met:

The non-default simple protocol is used.

A placeholder for a numeric value must be immediately preceded by a minus.

There must be a second placeholder for a string value after the first placeholder; both must be on the same line.

Both parameter values must be user-controlled.

Thanks to Paul Gerste for reporting this issue.

Fix CVE-2024-27304

SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control.

Thanks to Paul Gerste for reporting this issue.

Fix *dbTx.Exec not checking if it is already closed

4.18.1 (February 27, 2023)

Fix: Support pgx v4 and v5 stdlib in same program (Tomáš Procházka)

4.18.0 (February 11, 2023)

Upgrade pgconn to v1.14.0

Upgrade pgproto3 to v2.3.2

Upgrade pgtype to v1.14.0

Fix query sanitizer when query text contains Unicode replacement character

Fix context with value in BeforeConnect (David Harju)

Support pgx v4 and v5 stdlib in same program (Vitalii Solodilov)

Commits

14690df Update changelog
779548e Update required Go version to 1.17
80e9662 Update github.com/jackc/pgconn to v1.14.3
0bf9ac3 Fix erroneous test case
f94eb0e Always wrap arguments in parentheses in the SQL sanitizer
826a892 Fix SQL injection via line comment creation in simple protocol
7d882f9 Fix *dbTx.Exec not checking if it is already closed
1d07b8b go mod tidy
13468eb Release v4.18.1
7fed69b simplify duplicate pgx registration guard
Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.43.0 to 1.56.3

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.56.3

Security

server: prohibit more than MaxConcurrentStreams handlers from running at once (CVE-2023-44487)

In addition to this change, applications should ensure they do not leave running tasks behind related to the RPC before returning from method handlers, or should enforce appropriate limits on any such work.

Release 1.56.2

status: To fix a panic, status.FromError now returns an error with codes.Unknown when the error implements the GRPCStatus() method, and calling GRPCStatus() returns nil. (#6374)

Release 1.56.1

client: handle empty address lists correctly in addrConn.updateAddrs

Release 1.56.0

New Features

client: support channel idleness using WithIdleTimeout dial option (#6263)

This feature is currently disabled by default, but will be enabled with a 30 minute default in the future.

client: when using pickfirst, keep channel state in TRANSIENT_FAILURE until it becomes READY (gRFC A62) (#6306)

xds: Add support for Custom LB Policies (gRFC A52) (#6224)

xds: support pick_first Custom LB policy (gRFC A62) (#6314) (#6317)

client: add support for pickfirst address shuffling (gRFC A62) (#6311)

xds: Add support for String Matcher Header Matcher in RDS (#6313)

xds/outlierdetection: Add Channelz Logger to Outlier Detection LB (#6145)

Special Thanks: @s-matyukevich

xds: enable RLS in xDS by default (#6343)

orca: add support for application_utilization field and missing range checks on several metrics setters

balancer/weightedroundrobin: add new LB policy for balancing between backends based on their load reports (gRFC A58) (#6241)

authz: add conversion of json to RBAC Audit Logging config (#6192)

authz: add support for stdout logger (#6230 and #6298)

authz: support customizable audit functionality for authorization policy (#6192 #6230 #6298 #6158 #6304 and #6225)

Bug Fixes

orca: fix a race at startup of out-of-band metric subscriptions that would cause the report interval to request 0 (#6245)

xds/xdsresource: Fix Outlier Detection Config Handling and correctly set xDS Defaults (#6361)

xds/outlierdetection: Fix Outlier Detection Config Handling by setting defaults in ParseConfig() (#6361)

API Changes

orca: allow a ServerMetricsProvider to be passed to the ORCA service and ServerOption (#6223)

Release 1.55.1

status: To fix a panic, status.FromError now returns an error with codes.Unknown when the error implements the GRPCStatus() method, and calling GRPCStatus() returns nil. (#6374)

Release 1.55.0

Behavior Changes

xds: enable federation support by default (#6151)

status: status.Code and status.FromError handle wrapped errors (#6031 and #6150)

... (truncated)

Commits

1055b48 Update version.go to 1.56.3 (#6713)
5efd7bd server: prohibit more than MaxConcurrentStreams handlers from running at once...
bd1f038 Upgrade version.go to 1.56.3-dev (#6434)
faab873 Update version.go to v1.56.2 (#6432)
6b0b291 status: fix panic when servers return a wrapped error with status OK (#6374) ...
ed56401 [PSM interop] Don't fail target if sub-target already failed (#6390) (#6405)
cd6a794 Update version.go to v1.56.2-dev (#6387)
5b67e5e Update version.go to v1.56.1 (#6386)
d0f5150 client: handle empty address lists correctly in addrConn.updateAddrs (#6354) ...
997c1ea Change version to 1.56.1-dev (#6345)
Additional commits viewable in compare view

Updates google.golang.org/protobuf from 1.28.1 to 1.30.0

Updates golang.org/x/net from 0.0.0-20211101193420-4a448f8816b3 to 0.23.0

Commits

See full diff in compare view

Updates golang.org/x/net from 0.0.0-20211101193420-4a448f8816b3 to 0.23.0

Commits

See full diff in compare view

Updates golang.org/x/sys from 0.0.0-20210423082822-04245dca01da to 0.18.0

Commits

13b15b7 unix: add IoctlLoopConfigure on linux
11eadc0 windows: add AddDllDirectory and RemoveDllDirectory
e4099bf unix: fix trimmed socket opt string in GetsockoptString
9888904 unix: update BPF constants for Linux kernel 6.6
2d0c736 unix: use fchmodat2 in Fchmodat
ec230da unix: use fcntl(2) libc stub on OpenBSD
cb378ae syscall: call getfsstat via libc on openbsd
661d749 unix: use libc stubs for OpenBSD pledge+unveil
1168e25 unix/linux: update Linux kernel to v6.6
249e16f unix: require minimum OpenBSD 6.4 for pledge, unveil
Additional commits viewable in compare view

Updates golang.org/x/text from 0.3.7 to 0.14.0

Commits

6c97a16 all: update go directive to 1.18
f488e19 unicode/norm: fix function name on comment
fb697c0 cmd/gotext: actually use -dir flag
f3e69ed cmd/gotext: fix misbehaviors
ab07ad1 all: remove repetitive words
e503480 encoding/japanese, language: shorten very long sub-test names
2df65d7 all: regenerate for Unicode 15.0.0
e3c038a all: prepare for Unicode 15.0.0
3a7a255 internal/export/idna: make more space for mapping index
d61dd50 go.mod: delete repeated "indirect"
Additional commits viewable in compare view

Updates golang.org/x/net from 0.0.0-20211112202133-69e39bad7dc2 to 0.23.0

Commits

See full diff in compare view

Updates golang.org/x/sys from 0.0.0-20210615035016-665e8c7367d1 to 0.18.0

Commits

13b15b7 unix: add IoctlLoopConfigure on linux
11eadc0 windows: add AddDllDirectory and RemoveDllDirectory
e4099bf unix: fix trimmed socket opt string in GetsockoptString
9888904 unix: update BPF constants for Linux kernel 6.6
2d0c736 unix: use fchmodat2 in Fchmodat
ec230da unix: use fcntl(2) libc stub on OpenBSD
cb378ae syscall: call getfsstat via libc on openbsd
661d749 unix: use libc stubs for OpenBSD pledge+unveil
1168e25 unix/linux: update Linux kernel to v6.6
249e16f unix: require minimum OpenBSD 6.4 for pledge, unveil
Additional commits viewable in compare view

Updates golang.org/x/text from 0.3.7 to 0.14.0

Commits

6c97a16 all: update go directive to 1.18
f488e19 unicode/norm: fix function name on comment
fb697c0 cmd/gotext: actually use -dir flag
f3e69ed cmd/gotext: fix misbehaviors
ab07ad1 all: remove repetitive words
e503480 encoding/japanese, language: shorten very long sub-test names
2df65d7 all: regenerate for Unicode 15.0.0
e3c038a all: prepare for Unicode 15.0.0
3a7a255 internal/export/idna: make more space for mapping index
d61dd50 go.mod: delete repeated "indirect"
Additional commits viewable in compare view

Updates google.golang.org/protobuf from 1.28.0 to 1.33.0

Updates github.com/gin-gonic/gin from 1.7.0 to 1.9.1

Release notes

Sourced from github.com/gin-gonic/gin's releases.

v1.9.1

Changelog

BUG FIXES

fix Request.Context() checks #3512

SECURITY

fix lack of escaping of filename in Content-Disposition #3556

ENHANCEMENTS

refactor: use bytes.ReplaceAll directly #3455

convert strings and slices using the officially recommended way #3344

improve render code coverage #3525

DOCS

docs: changed documentation link for trusted proxies #3575

chore: improve linting, testing, and GitHub Actions setup #3583

v1.9.0

Changelog

BREAK CHANGES

Stop useless panicking in context and render #2150

BUG FIXES

fix(router): tree bug where loop index is not decremented. #3460

fix(context): panic on NegotiateFormat - index out of range #3397

Add escape logic for header #3500 and #3503

SECURITY

Fix the GO-2022-0969 and GO-2022-0288 vulnerabilities #3333

fix(security): vulnerability GO-2023-1571 #3505

ENHANCEMENTS

feat: add sonic json support #3184

chore(file): Creates a directory named path #3316

fix: modify interface check way #3327

remove deprecated of package io/ioutil #3395

refactor: avoid calling strings.ToLower twice #3343

console logger HTTP status code bug fixed #3453

chore(yaml): upgrade dependency to v3 version #3456

chore(router): match method added to routergroup for multiple HTTP methods supporting #3464

... (truncated)

Changelog

Sourced from github.com/gin-gonic/gin's changelog.

Gin v1.9.1

BUG FIXES

fix Request.Context() checks #3512

SECURITY

fix lack of escaping of filename in Content-Disposition #3556

ENHANCEMENTS

refactor: use bytes.ReplaceAll directly #3455

convert strings and slices using the officially recommended way #3344

improve render code coverage #3525

DOCS

docs: changed documentation link for trusted proxies #3575

chore: improve linting, testing, and GitHub Actions setup #3583

Gin v1.9.0

BREAK CHANGES

Stop useless panicking in context and render #2150

BUG FIXES

fix(router): tree bug where loop index is not decremented. #3460

fix(context): panic on NegotiateFormat - index out of range #3397

Add escape logic for header #3500 and #3503

SECURITY

Fix the GO-2022-0969 and GO-2022-0288 vulnerabilities #3333

fix(security): vulnerability GO-2023-1571 #3505

ENHANCEMENTS

feat: add sonic json support #3184

chore(file): Creates a directory named path #3316

fix: modify interface check way #3327

remove deprecated of package io/ioutil #3395

refactor: avoid calling strings.ToLower twice #3343

console logger HTTP status code bug fixed #3453

chore(yaml): upgrade dependency to v3 version #3456

chore(router): match method added to routergroup for multiple HTTP methods supporting #3464

chore(http): add support for go1.20 http.rwUnwrapper to gin.responseWriter #3489

... (truncated)

Commits

4ea0e64 Ready release gin 1.9.1 (by: thinkerou) (#3630)
bb1fc2e fix Request.Context() checks (#3512)
2d4bbec fix lack of escaping of filename in Content-Disposition (#3556)
9f5ecd4 chore(deps): bump actions/setup-go from 3 to 4 (#3543)
20cd6bc chore(deps): bump github.com/go-playground/validator/v10 (#3610)
6bdc725 Fix typos in ISSUE_TEMPLATE.md (#3616)
1ab2689 chore(deps): bump golang.org/x/net from 0.9.0 to 0.10.0 (#3599)
6a0556e improve render code coverage (#3525)
eac2daa chore: update dependencies for various packages and libraries (#3585)
757a638 chore: improve linting, testing, and GitHub Actions setup (#3583)
Additional commits viewable in compare view

Updates golang.org/x/net from 0.0.0-20220225172249-27dd8689420f to 0.23.0

Commits

See full diff in compare view

Updates golang.org/x/sys from 0.0.0-20220808155132-1c4a2a72c664 to 0.18.0

Commits

13b15b7 unix: add IoctlLoopConfigure on linux
11eadc0 windows: add AddDllDirectory and RemoveDllDirectory
e4099bf unix: fix trimmed socket opt string in GetsockoptString
9888904 unix: update BPF constants for Linux kernel 6.6
2d0c736 unix: use fchmodat2 in Fchmodat
ec230da unix: use fcntl(2) libc stub on OpenBSD
cb378ae syscall: call getfsstat via libc on openbsd
661d749 unix: use libc stubs for OpenBSD pledge+unveil
1168e25 unix/linux: update Linux kernel to v6.6
249e16f unix: require minimum OpenBSD 6.4 for pledge, unveil
Additional commits viewable in compare view

Updates golang.org/x/text from 0.3.7 to 0.14.0

Commits

6c97a16 all: update go directive to 1.18
f488e19 unicode/norm: fix function name on comment
fb697c0 cmd/gotext: actually use -dir flag
f3e69ed cmd/gotext: fix misbehaviors
ab07ad1 all: remove repetitive words
e503480 encoding/japanese, language: shorten very long sub-test names
2df65d7 all: regenerate for Unicode 15.0.0
e3c038a all: prepare for Unicode 15.0.0
3a7a255 internal/export/idna: make more space for mapping index
d61dd50 go.mod: delete repeated "indirect"
Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.49.0 to 1.56.3

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.56.3

Security

server: prohibit more than MaxConcurrentStreams handlers from running at once (CVE-2023-44487)

In addition to this change, applications should ensure they do not leave running tasks behind related to the RPC before returning from method handlers, or should enforce appropriate limits on any such work.

Release 1.56.2

status: To fix a panic, status.FromError now returns an error with codes.Unknown when the error implements the GRPCStatus() method, and calling GRPCStatus() returns nil. (#6374)

Release 1.56.1

client: handle empty address lists correctly in addrConn.updateAddrs

Release 1.56.0

New Features

client: support channel idleness using WithIdleTimeout dial option (#6263)

This feature is currently disabled by default, but will be enabled with a 30 minute default in the future.

client: when using pickfirst, keep channel state in TRANSIENT_FAILURE until it becomes READY (gRFC A62) (#6306)

xds: Add support for Custom LB Policies (gRFC A52) (#6224)

xds: support pick_first Custom LB policy (gRFC A62) (#6314) (#6317)

client: add support for pickfirst address shuffling (gRFC A62) (#6311)

xds: Add support for String Matcher Header Matcher in RDS (#6313)

xds/outlierdetection: Add Channelz Logger to Outlier Detection LB (#6145)

Special Thanks: @s-matyukevich

xds: enable RLS in xDS by default (#6343)

orca: add support for application_utilization field and missing range checks on several metrics setters

balancer/weightedroundrobin: add new LB policy for balancing between backends based on their load reports (gRFC A58) (#6241)

authz: add conversion of json to RBAC Audit Logging config (#6192)

authz: add support for stdout logger (#6230 and #6298)

authz: support customizable audit functionality for authorization policy (#6192 #6230 #6298 #6158 #6304 and #6225)

Bug Fixes

orca: fix a race at startup of out-of-band metric subscriptions that would cause the report interval to request 0 (#6245)

xds/xdsresource: Fix Outlier Detection Config Handling and correctly set xDS Defaults (#6361)

xds/outlierdetection: Fix Outlier Detection Config Handling by setting defaults in ParseConfig() (#6361)

API Changes

orca: allow a ServerMetricsProvider to be passed to the ORCA service and ServerOption (#6223)

Release 1.55.1

status: To fix a panic, status.FromError now returns an error with codes.Unknown when the error implements the GRPCStatus() method, and callin...
Description has been truncated

Bumps the go_modules group with 1 update in the /api3 directory: [golang.org/x/crypto](https://github.com/golang/crypto). Bumps the go_modules group with 6 updates in the /backend directory: | Package | From | To | | --- | --- | --- | | [golang.org/x/crypto](https://github.com/golang/crypto) | `0.1.0` | `0.17.0` | | [github.com/docker/docker](https://github.com/docker/docker) | `20.10.14+incompatible` | `24.0.9+incompatible` | | [github.com/docker/distribution](https://github.com/docker/distribution) | `2.8.1+incompatible` | `2.8.2+incompatible` | | [github.com/jackc/pgproto3/v2](https://github.com/jackc/pgproto3) | `2.3.1` | `2.3.3` | | [github.com/jackc/pgx/v4](https://github.com/jackc/pgx) | `4.17.2` | `4.18.2` | | [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.43.0` | `1.56.3` | Bumps the go_modules group with 1 update in the /plugins/api directory: [golang.org/x/net](https://github.com/golang/net). Bumps the go_modules group with 1 update in the /plugins/common directory: [golang.org/x/net](https://github.com/golang/net). Bumps the go_modules group with 2 updates in the /plugins/gateway/kong directory: [golang.org/x/net](https://github.com/golang/net) and google.golang.org/protobuf. Bumps the go_modules group with 1 update in the /plugins/gateway/tyk/v3.2.2 directory: [github.com/gin-gonic/gin](https://github.com/gin-gonic/gin). Bumps the go_modules group with 3 updates in the /plugins/otel-collector/apiclarityexporter directory: [golang.org/x/net](https://github.com/golang/net), [google.golang.org/grpc](https://github.com/grpc/grpc-go) and [go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp](https://github.com/open-telemetry/opentelemetry-go-contrib). Bumps the go_modules group with 3 updates in the /plugins/taper directory: [golang.org/x/net](https://github.com/golang/net), gopkg.in/yaml.v3 and [google.golang.org/grpc](https://github.com/grpc/grpc-go). Bumps the go_modules group with 1 update in the /plugins/taper/extensions/http directory: [golang.org/x/net](https://github.com/golang/net). Updates `golang.org/x/crypto` from 0.1.0 to 0.17.0 - [Commits](golang/crypto@v0.1.0...v0.17.0) Updates `golang.org/x/crypto` from 0.1.0 to 0.17.0 - [Commits](golang/crypto@v0.1.0...v0.17.0) Updates `golang.org/x/net` from 0.2.0 to 0.10.0 - [Commits](https://github.com/golang/net/commits/v0.23.0) Updates `golang.org/x/sys` from 0.2.0 to 0.15.0 - [Commits](golang/sys@v0.2.0...v0.15.0) Updates `golang.org/x/text` from 0.4.0 to 0.14.0 - [Release notes](https://github.com/golang/text/releases) - [Commits](golang/text@v0.4.0...v0.14.0) Updates `github.com/docker/docker` from 20.10.14+incompatible to 24.0.9+incompatible - [Release notes](https://github.com/docker/docker/releases) - [Commits](moby/moby@v20.10.14...v24.0.9) Updates `github.com/docker/distribution` from 2.8.1+incompatible to 2.8.2+incompatible - [Release notes](https://github.com/docker/distribution/releases) - [Commits](distribution/distribution@v2.8.1...v2.8.2) Updates `github.com/jackc/pgproto3/v2` from 2.3.1 to 2.3.3 - [Commits](jackc/pgproto3@v2.3.1...v2.3.3) Updates `github.com/jackc/pgx/v4` from 4.17.2 to 4.18.2 - [Changelog](https://github.com/jackc/pgx/blob/v4.18.2/CHANGELOG.md) - [Commits](jackc/pgx@v4.17.2...v4.18.2) Updates `google.golang.org/grpc` from 1.43.0 to 1.56.3 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.43.0...v1.56.3) Updates `google.golang.org/protobuf` from 1.28.1 to 1.30.0 Updates `golang.org/x/net` from 0.0.0-20211101193420-4a448f8816b3 to 0.23.0 - [Commits](https://github.com/golang/net/commits/v0.23.0) Updates `golang.org/x/net` from 0.0.0-20211101193420-4a448f8816b3 to 0.23.0 - [Commits](https://github.com/golang/net/commits/v0.23.0) Updates `golang.org/x/sys` from 0.0.0-20210423082822-04245dca01da to 0.18.0 - [Commits](golang/sys@v0.2.0...v0.15.0) Updates `golang.org/x/text` from 0.3.7 to 0.14.0 - [Release notes](https://github.com/golang/text/releases) - [Commits](golang/text@v0.4.0...v0.14.0) Updates `golang.org/x/net` from 0.0.0-20211112202133-69e39bad7dc2 to 0.23.0 - [Commits](https://github.com/golang/net/commits/v0.23.0) Updates `golang.org/x/sys` from 0.0.0-20210615035016-665e8c7367d1 to 0.18.0 - [Commits](golang/sys@v0.2.0...v0.15.0) Updates `golang.org/x/text` from 0.3.7 to 0.14.0 - [Release notes](https://github.com/golang/text/releases) - [Commits](golang/text@v0.4.0...v0.14.0) Updates `google.golang.org/protobuf` from 1.28.0 to 1.33.0 Updates `github.com/gin-gonic/gin` from 1.7.0 to 1.9.1 - [Release notes](https://github.com/gin-gonic/gin/releases) - [Changelog](https://github.com/gin-gonic/gin/blob/master/CHANGELOG.md) - [Commits](gin-gonic/gin@v1.7.0...v1.9.1) Updates `golang.org/x/net` from 0.0.0-20220225172249-27dd8689420f to 0.23.0 - [Commits](https://github.com/golang/net/commits/v0.23.0) Updates `golang.org/x/sys` from 0.0.0-20220808155132-1c4a2a72c664 to 0.18.0 - [Commits](golang/sys@v0.2.0...v0.15.0) Updates `golang.org/x/text` from 0.3.7 to 0.14.0 - [Release notes](https://github.com/golang/text/releases) - [Commits](golang/text@v0.4.0...v0.14.0) Updates `google.golang.org/grpc` from 1.49.0 to 1.56.3 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.43.0...v1.56.3) Updates `google.golang.org/protobuf` from 1.28.1 to 1.30.0 Updates `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` from 0.36.0 to 0.44.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go-contrib@zpages/v0.36.0...zpages/v0.44.0) Updates `golang.org/x/net` from 0.0.0-20211101193420-4a448f8816b3 to 0.23.0 - [Commits](https://github.com/golang/net/commits/v0.23.0) Updates `golang.org/x/sys` from 0.0.0-20211025201205-69cdffdb9359 to 0.18.0 - [Commits](golang/sys@v0.2.0...v0.15.0) Updates `golang.org/x/text` from 0.3.7 to 0.14.0 - [Release notes](https://github.com/golang/text/releases) - [Commits](golang/text@v0.4.0...v0.14.0) Updates `gopkg.in/yaml.v3` from 3.0.0-20210107192922-496545a6307b to 3.0.0 Updates `google.golang.org/grpc` from 1.42.0 to 1.56.3 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.43.0...v1.56.3) Updates `google.golang.org/protobuf` from 1.27.1 to 1.30.0 Updates `golang.org/x/net` from 0.0.0-20211101193420-4a448f8816b3 to 0.23.0 - [Commits](https://github.com/golang/net/commits/v0.23.0) Updates `golang.org/x/text` from 0.3.7 to 0.14.0 - [Release notes](https://github.com/golang/text/releases) - [Commits](golang/text@v0.4.0...v0.14.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/crypto dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/net dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/sys dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/text dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/docker/docker dependency-type: direct:production dependency-group: go_modules - dependency-name: github.com/docker/distribution dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/jackc/pgproto3/v2 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/jackc/pgx/v4 dependency-type: indirect dependency-group: go_modules - dependency-name: google.golang.org/grpc dependency-type: indirect dependency-group: go_modules - dependency-name: google.golang.org/protobuf dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/net dependency-type: direct:production dependency-group: go_modules - dependency-name: golang.org/x/net dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/sys dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/text dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/net dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/sys dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/text dependency-type: indirect dependency-group: go_modules - dependency-name: google.golang.org/protobuf dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/gin-gonic/gin dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/net dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/sys dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/text dependency-type: indirect dependency-group: go_modules - dependency-name: google.golang.org/grpc dependency-type: indirect dependency-group: go_modules - dependency-name: google.golang.org/protobuf dependency-type: indirect dependency-group: go_modules - dependency-name: go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/net dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/sys dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/text dependency-type: indirect dependency-group: go_modules - dependency-name: gopkg.in/yaml.v3 dependency-type: indirect dependency-group: go_modules - dependency-name: google.golang.org/grpc dependency-type: indirect dependency-group: go_modules - dependency-name: google.golang.org/protobuf dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/net dependency-type: direct:production dependency-group: go_modules - dependency-name: golang.org/x/text dependency-type: indirect dependency-group: go_modules ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Apr 19, 2024

dependabot bot mentioned this pull request Apr 19, 2024

Bump the go_modules group group in /backend with 4 updates #378

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the go_modules group across 9 directories with 13 updates #396

Bump the go_modules group across 9 directories with 13 updates #396

dependabot bot commented on behalf of github Apr 19, 2024

CVE	Component	Fix version	Severity
CVE-2024-21626	runc	1.1.12	High, CVSS 8.6
CVE-2024-24557	Docker Engine	24.0.9	Medium, CVSS 6.9

Bump the go_modules group across 9 directories with 13 updates #396

Are you sure you want to change the base?

Bump the go_modules group across 9 directories with 13 updates #396

Conversation

dependabot bot commented on behalf of github Apr 19, 2024

v24.0.9

24.0.9

Security

Packaging updates

v24.0.8

24.0.8

Bug fixes and enhancements

v2.8.2

What's Changed

v2.8.2-beta.2

What's Changed

v2.8.2-beta.1

NOTE: This is a pre-release that does not contain any artifacts!

What's Changed

4.18.2 (March 4, 2024)

4.18.1 (February 27, 2023)

4.18.0 (February 11, 2023)

Release 1.56.3

Security

Release 1.56.2

Release 1.56.1

Release 1.56.0

New Features

Bug Fixes

API Changes

Release 1.55.1

Release 1.55.0

Behavior Changes

v1.9.1

Changelog

BUG FIXES

SECURITY

ENHANCEMENTS

DOCS

v1.9.0

Changelog

BREAK CHANGES

BUG FIXES

SECURITY

ENHANCEMENTS

Gin v1.9.1

BUG FIXES

SECURITY

ENHANCEMENTS

DOCS

Gin v1.9.0

BREAK CHANGES

BUG FIXES

SECURITY

ENHANCEMENTS

Release 1.56.3

Security

Release 1.56.2

Release 1.56.1

Release 1.56.0

New Features

Bug Fixes

API Changes

Release 1.55.1