fix(deps): update go minor/patch updates#48
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
Contributor
Author
|
1c2add7 to
0415899
Compare
ac97065 to
3ff5376
Compare
8ea7f96 to
cca4f46
Compare
cca4f46 to
57b23f2
Compare
4d9a02c to
de30892
Compare
1ccad69 to
2e6a6d4
Compare
2e6a6d4 to
ccfe0da
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v4.15.1→v4.15.4v5.1.0→v5.2.1v7.0.100→v7.2.1v3.20.2→v3.21.2v4.1.4→v4.2.2v0.35.3→v0.36.2v0.35.3→v0.36.2v0.35.3→v0.36.2v0.35.3→v0.36.2v0.35.3→v0.36.2v0.23.3→v0.24.1Release Notes
labstack/echo (github.com/labstack/echo/v4)
v4.15.4Compare Source
Security
Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (
%2For%5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. BothStaticDirectoryHandler(used byStatic/StaticFS) and theStaticmiddleware are affected. Backport of the v5 fix (#3016, released in v5.2.1). Thanks to @a-tt-om and @oran-gugu for reporting.Make serving static file releated methods and middleware not unescape path by default - so how the way Router interprets paths and Static methods/middleware is consistent.
Given following situation:
Then requests to
/admin%2fprivate.txtwould not be matched toGET /admin/*route (routing does not look unescaped path) and static file serving will use unescaped path to serve the file.Note: this way of "guarding" subfolders will never work for for paths like
/assets/../admin%2fprivate.txtwhich willpath.Clean("/assets/../admin%2fprivate.txt")to/admin/private.txtand are servable if static file serving is configured to unescape paths.If you want to guard routes - use middlewares on
Static*methods and beforeStaticmiddleware.Breaking change / migration: If you serve files whose names contain URL-encoded characters (e.g.,
/hello%20world.txt→hello world.txt), you must now opt in:for static middleware
Full Changelog: labstack/echo@v4.15.3...v4.15.4
v4.15.3: - Static encoded-separator route bypass fix (GHSA-vfp3-v2gw-7wfq)Compare Source
Security
Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (
%2For%5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. BothStaticDirectoryHandler(used byStatic/StaticFS) and theStaticmiddleware are affected. Backport of the v5 fix (#3009, released in v5.2.0). Thanks to @a-tt-om and @oran-gugu for reporting.Full Changelog: labstack/echo@v4.15.2...v4.15.3
v4.15.2: - Context.Scheme() header validationCompare Source
Security
Context.Scheme()should validate values taken from header by @aldas in #2962Thanks to @shblue21 for reporting this issue.
Full Changelog: labstack/echo@v4.15.1...v4.15.2
minio/minio-go (github.com/minio/minio-go/v7)
v7.2.1Compare Source
v7.2.0Compare Source
What's Changed
Full Changelog: minio/minio-go@v7.1.0...v7.2.0
v7.1.0Compare Source
What's Changed
Full Changelog: minio/minio-go@v7.0.100...v7.1.0
helm/helm (helm.sh/helm/v3)
v3.21.2: Helm v3.21.2Compare Source
Helm v3.21.2 is a patch release to correct bump the Kubernetes client libraries (client-go, etc) to match the expected Kubernetes v1.36 release. Users are encouraged to upgrade for the best experience.
The community keeps growing, and we'd love to see you there!
Notable Changes
Installation and Upgrading
Download Helm v3.21.2. The common platform binaries are here:
This release was signed by @gjenkins8 with key BF88 8333 D96A 1C18 E268 2AAE D79D 67C9 EC01 6739, which can be found at https://keys.openpgp.org/vks/v1/by-fingerprint/BF888333D96A1C18E2682AAED79D67C9EC016739. Please use the attached signatures for verifying this release using gpg.
The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with
bash.What's Next
Changelog
1259634(dependabot[bot])b52e276(Matheus Pimenta)3342dbf(dependabot[bot])Full Changelog: helm/helm@v3.21.1...v3.21.2
v3.21.1: Helm v3.21.1Compare Source
Helm v3.21.1 is a patch release. Users are encouraged to upgrade for the best experience.
The community keeps growing, and we'd love to see you there!
Notable Changes
Installation and Upgrading
Download Helm v3.21.1. The common platform binaries are here:
This release was signed with
208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155and can be found at @scottrigby keybase account. Please use the attached signatures for verifying this release usinggpg.The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with
bash.What's Next
Changelog
c56dd00(sergiochan)702529f(Terry Howe)178e120(dependabot[bot])dcf35f8(dependabot[bot])44aff8b(dependabot[bot])ae2f31f(dependabot[bot])402225f(Terry Howe)00eac21(Terry Howe)bec346a(Terry Howe)58b6ccf(dependabot[bot])30b9f51(dependabot[bot])858aa47(dependabot[bot])1af25d4(dependabot[bot])97e4bc3(dependabot[bot])29bdd1b(dependabot[bot])bad6cd4(Terry Howe)75c2e9b(dependabot[bot])cd4dac3(dependabot[bot])Full Changelog: helm/helm@v3.21.0...v3.21.1
v3.21.0: Helm v3.21.0Compare Source
Helm v3.21.0 is a feature release. Users are encouraged to upgrade for the best experience.
The community keeps growing, and we'd love to see you there!
Notable Changes
Installation and Upgrading
Download Helm v3.21.0. The common platform binaries are here:
This release was signed by @gjenkins8 with key
BF88 8333 D96A 1C18 E268 2AAE D79D 67C9 EC01 6739, which can be found at https://keys.openpgp.org/vks/v1/by-fingerprint/BF888333D96A1C18E2682AAED79D67C9EC016739. Please use the attached signatures for verifying this release using gpg.The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with
bash.What's Next
Changelog
e0878d4(George Jenkins)13d5fc4(Terry Howe)2552884(George Jenkins)ec05dd5(Terry Howe)b0dfec5(Pedro Tôrres)e629995(Pedro Tôrres)9c854fb(dependabot[bot])a692247(dependabot[bot])9f2a7f6(dependabot[bot])79f039b(dependabot[bot])45210d5(dependabot[bot])e2df39f(Evans Mungai)97affe0(Evans Mungai)c264166(Evans Mungai)d409df8(Evans Mungai)6fdd101(Evans Mungai)b13743c(Evans Mungai)703999d(dependabot[bot])a04be96(dependabot[bot])New Contributors
Full Changelog: helm/helm@v3.20.0...v3.21.0
kubernetes/api (k8s.io/api)
v0.36.2Compare Source
v0.36.1Compare Source
v0.36.0Compare Source
v0.35.6Compare Source
v0.35.5Compare Source
v0.35.4Compare Source
kubernetes/apiextensions-apiserver (k8s.io/apiextensions-apiserver)
v0.36.2Compare Source
v0.36.1Compare Source
v0.36.0Compare Source
v0.35.6Compare Source
v0.35.5Compare Source
v0.35.4Compare Source
kubernetes/apimachinery (k8s.io/apimachinery)
v0.36.2Compare Source
v0.36.1Compare Source
v0.36.0Compare Source
v0.35.6Compare Source
v0.35.5Compare Source
v0.35.4Compare Source
kubernetes/cli-runtime (k8s.io/cli-runtime)
v0.36.2Compare Source
v0.36.1Compare Source
v0.36.0Compare Source
v0.35.6Compare Source
v0.35.5Compare Source
v0.35.4Compare Source
kubernetes/client-go (k8s.io/client-go)
v0.36.2Compare Source
v0.36.1Compare Source
v0.36.0Compare Source
v0.35.6Compare Source
v0.35.5Compare Source
v0.35.4Compare Source
kubernetes-sigs/controller-runtime (sigs.k8s.io/controller-runtime)
v0.24.1Compare Source
What's Changed
Full Changelog: kubernetes-sigs/controller-runtime@v0.24.0...v0.24.1
v0.24.0Compare Source
🐛 Bug Fixes
🌱 Others
StartLoggingfor event debug logs (#3451)🌱 CI & linters
tools/setup-envtestsubmodule (#3476)📖 Additionally, there has been 1 contribution to our documentation. (#3477)
Dependencies
Added
Changed
8a7402a→944ab1f078029d→bd525daa0af3ef→8636f87200df99→8636f87f2248ac589584f→43fb72cbc988d5→b8788abRemoved
9bdfabeThanks to all our contributors! 😊
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.