chore(deps): Bump github.com/hashicorp/consul/api from 1.18.0 to 1.31.0

[dependabot]

Bumps github.com/hashicorp/consul/api from 1.18.0 to 1.31.0.

Release notes

Sourced from github.com/hashicorp/consul/api's releases.

v1.20.1

1.20.1 (October 29, 2024)

BREAKING CHANGES:

• mesh: Enable Envoy HttpConnectionManager.normalize_path by default on inbound traffic to mesh proxies. This resolves CVE-2024-10005. [GH-21816]

SECURITY:

• mesh: Add contains and ignoreCase to L7 Intentions HTTP header matching criteria to support configuration resilient to variable casing and multiple values. This resolves CVE-2024-10006. [GH-21816]
• mesh: Add http.incoming.requestNormalization to Mesh configuration entry to support inbound service traffic request normalization. This resolves CVE-2024-10005 and CVE-2024-10006. [GH-21816]

IMPROVEMENTS:

• api: remove dependency on proto-public, protobuf, and grpc [GH-21780]
• snapshot agent: (Enterprise only) Implement Service Principal Auth for snapshot agent on azure.
• xds: configures Envoy to load balance over all instances of an external service configured with hostnames when "envoy_dns_discovery_type" is set to "STRICT_DNS" [GH-21655]

v1.20.0

1.20.0 (October 14, 2024)

SECURITY:

• Explicitly set 'Content-Type' header to mitigate XSS vulnerability. [GH-21704]
• Implement HTML sanitization for user-generated content to prevent XSS attacks in the UI. [GH-21711]
• UI: Remove codemirror linting due to package dependency [GH-21726]
• Upgrade Go to use 1.22.7. This addresses CVE CVE-2024-34155 [GH-21705]
• Upgrade to support aws/aws-sdk-go v1.55.5 or higher. This resolves CVEs CVE-2020-8911 and CVE-2020-8912. [GH-21684]
• ui: Pin a newer resolution of Braces [GH-21710]
• ui: Pin a newer resolution of Codemirror [GH-21715]
• ui: Pin a newer resolution of Markdown-it [GH-21717]
• ui: Pin a newer resolution of ansi-html [GH-21735]

FEATURES:

• grafana: added the dashboards service-to-service dashboard, service dashboard, and consul dataplane dashboard [GH-21806]
• server: remove v2 tenancy, catalog, and mesh experiments [GH-21592]

IMPROVEMENTS:

• security: upgrade ubi base image to 9.4 [GH-21750]
• connect: Add Envoy 1.31 and 1.30 to support matrix [GH-21616]

BUG FIXES:

• jwt-provider: change dns lookup family from the default of AUTO which would prefer ipv6 to ALL if LOGICAL_DNS is used or PREFER_IPV4 if STRICT_DNS is used to gracefully handle transitions to ipv6. [GH-21703]

v1.20.0-rc1

... (truncated)

Changelog

Sourced from github.com/hashicorp/consul/api's changelog.

1.20.1 (October 29, 2024)

BREAKING CHANGES:

• mesh: Enable Envoy HttpConnectionManager.normalize_path by default on inbound traffic to mesh proxies. This resolves CVE-2024-10005. [GH-21816]

SECURITY:

• mesh: Add contains and ignoreCase to L7 Intentions HTTP header matching criteria to support configuration resilient to variable casing and multiple values. This resolves CVE-2024-10006. [GH-21816]
• mesh: Add http.incoming.requestNormalization to Mesh configuration entry to support inbound service traffic request normalization. This resolves CVE-2024-10005 and CVE-2024-10006. [GH-21816]

IMPROVEMENTS:

• api: remove dependency on proto-public, protobuf, and grpc [GH-21780]
• snapshot agent: (Enterprise only) Implement Service Principal Auth for snapshot agent on azure.
• xds: configures Envoy to load balance over all instances of an external service configured with hostnames when "envoy_dns_discovery_type" is set to "STRICT_DNS" [GH-21655]

1.20.0 (October 14, 2024)

SECURITY:

• Explicitly set 'Content-Type' header to mitigate XSS vulnerability. [GH-21704]
• Implement HTML sanitization for user-generated content to prevent XSS attacks in the UI. [GH-21711]
• UI: Remove codemirror linting due to package dependency [GH-21726]
• Upgrade Go to use 1.22.7. This addresses CVE CVE-2024-34155 [GH-21705]
• Upgrade to support aws/aws-sdk-go v1.55.5 or higher. This resolves CVEs CVE-2020-8911 and CVE-2020-8912. [GH-21684]
• ui: Pin a newer resolution of Braces [GH-21710]
• ui: Pin a newer resolution of Codemirror [GH-21715]
• ui: Pin a newer resolution of Markdown-it [GH-21717]
• ui: Pin a newer resolution of ansi-html [GH-21735]

FEATURES:

• grafana: added the dashboards service-to-service dashboard, service dashboard, and consul dataplane dashboard [GH-21806]
• server: remove v2 tenancy, catalog, and mesh experiments [GH-21592]

IMPROVEMENTS:

• security: upgrade ubi base image to 9.4 [GH-21750]
• connect: Add Envoy 1.31 and 1.30 to support matrix [GH-21616]

BUG FIXES:

• jwt-provider: change dns lookup family from the default of AUTO which would prefer ipv6 to ALL if LOGICAL_DNS is used or PREFER_IPV4 if STRICT_DNS is used to gracefully handle transitions to ipv6. [GH-21703]

1.20.0-rc1 (September 19, 2024)

SECURITY:

... (truncated)

Commits

• 8e194ac Backport of Update API Group under backendRefs into release/1.20.x (#21965)
• 730a556 Backport of docs: fix broken link into release/1.20.x (#21977)
• c3707ea Backport of sec: bump envoy patch versions into release/1.20.x (#22025)
• f8a0bd0 Backport of chore: remove staff codeowners now that it requires mandatory rev...
• b453677 Backport of Suppress redhat linux CVEs into release/1.20.x (#22029)
• edebd4d Backport of [Security] Bump net packages to resolve GO-2024-3333 into release...
• d6b9514 Backport of Bump golang.org/x/crypto from 0.22.0 to 0.31.0 in /testing/deploy...
• 3df3d08 Backport of [Security] Bump crypto libraries into release/1.20.x (#22007)
• 5c36f1a Backport of Update CODEOWNER into release/1.20.x (#22018)
• 14c1c95 Backport of Update UBI Image into release/1.20.x (#22012)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #156.