chore(deps): bump the go_modules group across 2 directories with 11 updates#140
Open
dependabot[bot] wants to merge 1 commit intomainfrom
Open
chore(deps): bump the go_modules group across 2 directories with 11 updates#140dependabot[bot] wants to merge 1 commit intomainfrom
dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
…pdates Bumps the go_modules group with 1 update in the /api directory: [golang.org/x/net](https://github.com/golang/net). Bumps the go_modules group with 2 updates in the /grype-server directory: [golang.org/x/net](https://github.com/golang/net) and [github.com/anchore/grype](https://github.com/anchore/grype). Updates `golang.org/x/net` from 0.23.0 to 0.38.0 - [Commits](golang/net@v0.23.0...v0.38.0) Updates `golang.org/x/net` from 0.30.0 to 0.38.0 - [Commits](golang/net@v0.23.0...v0.38.0) Updates `github.com/anchore/grype` from 0.82.2 to 0.104.1 - [Release notes](https://github.com/anchore/grype/releases) - [Changelog](https://github.com/anchore/grype/blob/main/RELEASE.md) - [Commits](anchore/grype@v0.82.2...v0.104.1) Updates `github.com/cloudflare/circl` from 1.3.8 to 1.6.1 - [Release notes](https://github.com/cloudflare/circl/releases) - [Commits](cloudflare/circl@v1.3.8...v1.6.1) Updates `github.com/containerd/containerd` from 1.7.23 to 1.7.29 - [Release notes](https://github.com/containerd/containerd/releases) - [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md) - [Commits](containerd/containerd@v1.7.23...v1.7.29) Updates `github.com/docker/docker` from 27.3.1+incompatible to 28.5.2+incompatible - [Release notes](https://github.com/docker/docker/releases) - [Commits](moby/moby@v27.3.1...v28.5.2) Updates `github.com/go-git/go-git/v5` from 5.12.0 to 5.16.3 - [Release notes](https://github.com/go-git/go-git/releases) - [Commits](go-git/go-git@v5.12.0...v5.16.3) Updates `github.com/hashicorp/go-getter` from 1.7.6 to 1.8.3 - [Release notes](https://github.com/hashicorp/go-getter/releases) - [Commits](hashicorp/go-getter@v1.7.6...v1.8.3) Updates `github.com/opencontainers/selinux` from 1.11.0 to 1.13.0 - [Release notes](https://github.com/opencontainers/selinux/releases) - [Commits](opencontainers/selinux@v1.11.0...v1.13.0) Updates `github.com/ulikunitz/xz` from 0.5.12 to 0.5.15 - [Commits](ulikunitz/xz@v0.5.12...v0.5.15) Updates `golang.org/x/crypto` from 0.31.0 to 0.45.0 - [Commits](golang/crypto@v0.31.0...v0.45.0) Updates `golang.org/x/oauth2` from 0.19.0 to 0.30.0 - [Commits](golang/oauth2@v0.19.0...v0.30.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.38.0 dependency-type: direct:production dependency-group: go_modules - dependency-name: golang.org/x/net dependency-version: 0.38.0 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/anchore/grype dependency-version: 0.104.1 dependency-type: direct:production dependency-group: go_modules - dependency-name: github.com/cloudflare/circl dependency-version: 1.6.1 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/containerd/containerd dependency-version: 1.7.29 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/docker/docker dependency-version: 28.5.2+incompatible dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/go-git/go-git/v5 dependency-version: 5.16.3 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/hashicorp/go-getter dependency-version: 1.8.3 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/opencontainers/selinux dependency-version: 1.13.0 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/ulikunitz/xz dependency-version: 0.5.15 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/crypto dependency-version: 0.45.0 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/oauth2 dependency-version: 0.30.0 dependency-type: indirect dependency-group: go_modules ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
dependabot
bot
added
dependencies
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the go_modules group with 1 update in the /api directory: golang.org/x/net.
Bumps the go_modules group with 2 updates in the /grype-server directory: golang.org/x/net and github.com/anchore/grype.
Updates
golang.org/x/netfrom 0.23.0 to 0.38.0Commits
e1fcd82html: properly handle trailing solidus in unquoted attribute value in foreign...ebed060internal/http3: fix build of tests with GOEXPERIMENT=nosynctest1f1fa29publicsuffix: regenerate table1215081http2: improve error when server sends HTTP/1312450ehtml: ensure <search> tag closes <p> and update tests09731f9http2: improve handling of lost PING in Server55989e2http2/h2c: use ResponseController for hijacking connections2914f46websocket: re-recommend gorilla/websocket99b3ae0go.mod: update golang.org/x dependencies85d1d54go.mod: update golang.org/x dependenciesUpdates
golang.org/x/netfrom 0.30.0 to 0.38.0Commits
e1fcd82html: properly handle trailing solidus in unquoted attribute value in foreign...ebed060internal/http3: fix build of tests with GOEXPERIMENT=nosynctest1f1fa29publicsuffix: regenerate table1215081http2: improve error when server sends HTTP/1312450ehtml: ensure <search> tag closes <p> and update tests09731f9http2: improve handling of lost PING in Server55989e2http2/h2c: use ResponseController for hijacking connections2914f46websocket: re-recommend gorilla/websocket99b3ae0go.mod: update golang.org/x dependencies85d1d54go.mod: update golang.org/x dependenciesUpdates
github.com/anchore/grypefrom 0.82.2 to 0.104.1Release notes
Sourced from github.com/anchore/grype's releases.
... (truncated)
Commits
39f7fa1fix: redact during file output (#3068)029bd47fix: unaffected package ignore rules (#3066)947857achore: migrate grype to use mholt/archives instead of anchore fork (#3036)12b72abchore(deps): update tools to latest versions (#3051)68c4672chore(deps): bump actions/checkout from 5.0.0 to 5.0.1 (#3059)aa54c0cchore(deps): bump anchore/sbom-action from 0.20.9 to 0.20.10 (#3060)50d343dchore(deps): bump github/codeql-action from 4.31.2 to 4.31.4 (#3061)99a1d80chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0 (#3063)644e571chore(deps): bump actions/setup-go in /.github/actions/bootstrap (#3064)b1706cachore(deps): update anchore dependencies (#3055)Updates
github.com/cloudflare/circlfrom 1.3.8 to 1.6.1Release notes
Sourced from github.com/cloudflare/circl's releases.
... (truncated)
Commits
c6d33e3Release v1.6.10c3868ecurve4q: Shared must fail with low order points.9fd570dcurve4q: Test showing DH does not fails on identity point.c988cebfourq: Correctly unmarshalling point.ef2611dfourq: Test showing point unmarshal fails.05eba44fourq: Handle the case of Z=0 for IsOnCurve and IsEqual.eef0878fourq: Test showing isEqual and IsOnCurve fail.2298474goldilocks; Handling points with z=0.5a940a1goldilocks: Test for IsEqual must fail with Z=048c3b6aed25519: Fix isEqual to handle points with Z=0.Updates
github.com/containerd/containerdfrom 1.7.23 to 1.7.29Release notes
Sourced from github.com/containerd/containerd's releases.
... (truncated)
Commits
442cb34Merge commit from forke5cb6ddMerge commit from fork9772966Merge pull request #12486 from dmcgowan/prepare-v1.7.291fc2daaPrepare release notes for v1.7.2993f710aMerge pull request #12480 from k8s-infra-cherrypick-robot/cherry-pick-12475-t...68d04beMerge pull request #12471 from austinvazquez/1_7_update_ci_go_and_images3f5f9f8runc: Update runc binary to v1.3.3667409fci: bump Go 1.24.9, 1.25.3294f8c0Update GHA runners to use latest images for basic binaries buildcf66b41Update GHA runners to use latest image for most jobsUpdates
github.com/docker/dockerfrom 27.3.1+incompatible to 28.5.2+incompatibleRelease notes
Sourced from github.com/docker/docker's releases.
... (truncated)
Commits
89c5e8fMerge pull request #51396 from thaJeztah/28.x_backport_api_docs9b93878Merge pull request #51395 from thaJeztah/28.x_backport_rootless_reject6178456Merge pull request #51398 from vvoland/51397-28.x0cae4e5vendor: github.com/moby/buildkit v0.25.233cc06fMerge pull request #51394 from vvoland/51393-28.xd525277api/docs: remove BuildCache.Parent field for API v1.42 and up2fbc51bdockerd-rootless.sh: reject DOCKERD_ROOTLESS_ROOTLESSKIT_NET=hostbd98008integration-cli: Adjust nofile limits1967515Dockerfile: update runc binary to v1.3.34489660Merge pull request #51387 from thaJeztah/28.x_bump_goUpdates
github.com/go-git/go-git/v5from 5.12.0 to 5.16.3Release notes
Sourced from github.com/go-git/go-git/v5's releases.
... (truncated)
Commits
ad9a3a5Merge pull request #1633 from baloo/baloo/release-5.x/jj-signed-commitsf2c3467plumbing: support extra headers, support jujutsu signed commit [5.x]c12263dMerge pull request #1646 from baloo/baloo/release-5.x/fixup-windows-ci111f374build: disable fuzzing on maintenance branch15d46cebuild: raise timeouts for windows CI testsce83ba1Merge pull request #1644 from baloo/baloo/release-5.x/fixup-buildb486201internal: Expand regex to fix builded8216cMerge pull request #1567 from kane8n/backport-to-v5-patricsss/fix-14554f35ebaMerge pull request #1484 from patricsss/patricsss/fix-1455fd1a836Merge pull request #1561 from kane8n/backport-to-v5-fix-sparse-checkout-statusUpdates
github.com/hashicorp/go-getterfrom 1.7.6 to 1.8.3Release notes
Sourced from github.com/hashicorp/go-getter's releases.
... (truncated)
Commits
13f1bb2Merge pull request #564 from allisonlarson/b-chmod-failed-tarc0ef527close file before removingd1113d8Handle failed decompressed filescfc3a4fMerge pull request #563 from hashicorp/dependabot/github_actions/actions-e02f...0c1f668[chore] : Bump aws-actions/configure-aws-credentials5e2f62aMerge pull request #562 from hashicorp/dependabot/github_actions/actions-f175...5b4c45f[chore] : Bump actions/cache from 4.2.4 to 4.3.0 in the actions group60a3d53Ensure temporary directory symlinks do not cause errors (#560)d2e581e[fix] Windows junction handling (#557)928ae39[chore] : Bump actions/setup-go from 5.5.0 to 6.0.0 in the actions group (#558)Updates
github.com/opencontainers/selinuxfrom 1.11.0 to 1.13.0Release notes
Sourced from github.com/opencontainers/selinux's releases.
... (truncated)
Commits
4be9937Merge pull request #237 from cyphar/selinux-safe-procfsc8cfa6fselinux: migrate to pathrs-lite procfs APIf2424d8Merge pull request #236 from kolyshkin/modernize-ci648ce7fci: add go 1.25916cab9ci: bump golangci-lint to v2.5b42e5c8all: format sources with latest gofumpt74393eaMerge pull request #235 from cyphar/fix-keyring-err-check6ec194bkeyring: fix typo in EACCES check879a755Merge pull request #234 from opencontainers/dependabot/github_actions/actions...3c1bd9abuild(deps): bump actions/setup-go from 5 to 6Updates
github.com/ulikunitz/xzfrom 0.5.12 to 0.5.15Commits
7eee8a8v9.5.15: release notes and formatting235be8dlzma: Fix default for ReaderConfig.DictCap7184815Preparation of release v0.5.1488ddf1dAddress Security Issue GHSA-jc7w-c686-c4v9c8314b8Add new package xio with WriteCloserStackUpdates
golang.org/x/cryptofrom 0.31.0 to 0.45.0Commits
4e0068cgo.mod: update golang.org/x dependenciese79546essh: curb GSSAPI DoS risk by limiting number of specified OIDsf91f7a7ssh/agent: prevent panic on malformed constraint2df4153acme/autocert: let automatic renewal work with short lifetime certsbcf6a84acme: pass context to requestb4f2b62ssh: fix error message on unsupported cipher79ec3a5ssh: allow to bind to a hostname in remote forwarding122a78fgo.mod: update golang.org/x dependenciesc0531f9all: eliminate vet diagnostics0997000all: fix some commentsUpdates
golang.org/x/oauth2from 0.19.0 to 0.30.0Commits
cf14319oauth2: fix expiration time window check32d34efinternal: include clientID in auth style cache key2d34e30oauth2: replace a magic number with AuthStyleUnknown696f7b3all: modernize with doc links and any471209boauth2: drop dependency on go-cmp6968da2oauth2: sync Token.ExpiresIn from internal Tokend2c4e0aoauth2: context instead of golang.org/x/net/context in doc883dc3cendpoints: add various endpoints from stale CLs1c06e87all: make use of oauth.Token.ExpiresIn65c15a3oauth2: remove extra periodDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.