1
0
mirror of https://github.com/goreleaser/goreleaser.git synced 2024-12-27 01:33:39 +02:00
goreleaser/go.mod

327 lines
16 KiB
Modula-2
Raw Normal View History

2018-10-29 02:54:15 +02:00
module github.com/goreleaser/goreleaser
go 1.22
toolchain go1.22.1
2018-10-29 02:54:15 +02:00
require (
chore(deps): bump code.gitea.io/sdk/gitea from 0.17.1 to 0.18.0 (#4790) Bumps code.gitea.io/sdk/gitea from 0.17.1 to 0.18.0. [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=code.gitea.io/sdk/gitea&package-manager=go_modules&previous-version=0.17.1&new-version=0.18.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-17 16:29:01 +02:00
code.gitea.io/sdk/gitea v0.18.0
2023-07-31 18:32:36 +02:00
dario.cat/mergo v1.0.0
feat(deps): bump github.com/Masterminds/semver/v3 from 3.2.0 to 3.2.1 (#3927) Bumps [github.com/Masterminds/semver/v3](https://github.com/Masterminds/semver) from 3.2.0 to 3.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Masterminds/semver/releases">github.com/Masterminds/semver/v3's releases</a>.</em></p> <blockquote> <h2>v3.2.1</h2> <h3>Changed</h3> <ul> <li><a href="https://redirect.github.com/Masterminds/semver/issues/198">#198</a>: Improved testing around pre-release names</li> <li><a href="https://redirect.github.com/Masterminds/semver/issues/200">#200</a>: Improved code scanning with addition of CodeQL</li> <li><a href="https://redirect.github.com/Masterminds/semver/issues/201">#201</a>: Testing now includes Go 1.20. Go 1.17 has been dropped</li> <li><a href="https://redirect.github.com/Masterminds/semver/issues/202">#202</a>: Migrated Fuzz testing to Go built-in Fuzzing. CI runs daily</li> <li><a href="https://redirect.github.com/Masterminds/semver/issues/203">#203</a>: Docs updated for security details</li> </ul> <h3>Fixed</h3> <ul> <li><a href="https://redirect.github.com/Masterminds/semver/issues/199">#199</a>: Fixed issue with range transformations</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Masterminds/semver/compare/v3.2.0...v3.2.1">https://github.com/Masterminds/semver/compare/v3.2.0...v3.2.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Masterminds/semver/blob/master/CHANGELOG.md">github.com/Masterminds/semver/v3's changelog</a>.</em></p> <blockquote> <h2>3.2.1 (2023-04-10)</h2> <h3>Changed</h3> <ul> <li><a href="https://redirect.github.com/Masterminds/semver/issues/198">#198</a>: Improved testing around pre-release names</li> <li><a href="https://redirect.github.com/Masterminds/semver/issues/200">#200</a>: Improved code scanning with addition of CodeQL</li> <li><a href="https://redirect.github.com/Masterminds/semver/issues/201">#201</a>: Testing now includes Go 1.20. Go 1.17 has been dropped</li> <li><a href="https://redirect.github.com/Masterminds/semver/issues/202">#202</a>: Migrated Fuzz testing to Go built-in Fuzzing. CI runs daily</li> <li><a href="https://redirect.github.com/Masterminds/semver/issues/203">#203</a>: Docs updated for security details</li> </ul> <h3>Fixed</h3> <ul> <li><a href="https://redirect.github.com/Masterminds/semver/issues/199">#199</a>: Fixed issue with range transformations</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Masterminds/semver/commit/e06051f8fcc4c8b4a4990c337b9862a2448722e5"><code>e06051f</code></a> Merge pull request <a href="https://redirect.github.com/Masterminds/semver/issues/203">#203</a> from mattfarina/update-readme-fuzz</li> <li><a href="https://github.com/Masterminds/semver/commit/36ea773e91f1694fd18f8579d4ea331b6808abf7"><code>36ea773</code></a> Updating docs for security, fuzz, codeql, gosec</li> <li><a href="https://github.com/Masterminds/semver/commit/e683c4bc93bf35ff810cb0eab188e8e8e9f72fda"><code>e683c4b</code></a> Merge pull request <a href="https://redirect.github.com/Masterminds/semver/issues/202">#202</a> from mattfarina/move-fuzz</li> <li><a href="https://github.com/Masterminds/semver/commit/e485a0d5ffd5c94376b8b4a94a4cad3797c18009"><code>e485a0d</code></a> Migrating Fuzz testing to Go built-in testing</li> <li><a href="https://github.com/Masterminds/semver/commit/4e0f582ff0c63c1f59c5e1cae1a21def0d05d923"><code>4e0f582</code></a> Merge pull request <a href="https://redirect.github.com/Masterminds/semver/issues/201">#201</a> from mattfarina/bump-go-1.20</li> <li><a href="https://github.com/Masterminds/semver/commit/0605d1d86a75a6473619b995afc80469919dbf03"><code>0605d1d</code></a> Updating Go for 1.20</li> <li><a href="https://github.com/Masterminds/semver/commit/cc175775be019f549ae70c9c371bc6e2214af450"><code>cc17577</code></a> Merge pull request <a href="https://redirect.github.com/Masterminds/semver/issues/200">#200</a> from mattfarina/codeql</li> <li><a href="https://github.com/Masterminds/semver/commit/bf2d1900137bc4f5dfc2a3e222066e7725b6d1b0"><code>bf2d190</code></a> Adding CodeQL scanning</li> <li><a href="https://github.com/Masterminds/semver/commit/2c5535be35664eef2e4a4e3253b4f4cb9bc8c22e"><code>2c5535b</code></a> Merge pull request <a href="https://redirect.github.com/Masterminds/semver/issues/199">#199</a> from mattfarina/bug-197</li> <li><a href="https://github.com/Masterminds/semver/commit/b1bb76193b9e8c97a10a4cb1d37d94a7b17e8482"><code>b1bb761</code></a> Fix issue with - ranges being transformed to something imparsible</li> <li>Additional commits viewable in <a href="https://github.com/Masterminds/semver/compare/v3.2.0...v3.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/Masterminds/semver/v3&package-manager=go_modules&previous-version=3.2.0&new-version=3.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-04-23 18:52:42 +02:00
github.com/Masterminds/semver/v3 v3.2.1
github.com/anchore/quill v0.4.1
chore(deps): bump github.com/atc0005/go-teams-notify/v2 from 2.9.0 to 2.10.0 (#4645) Bumps [github.com/atc0005/go-teams-notify/v2](https://github.com/atc0005/go-teams-notify) from 2.9.0 to 2.10.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/atc0005/go-teams-notify/releases">github.com/atc0005/go-teams-notify/v2's releases</a>.</em></p> <blockquote> <h2>v2.10.0</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <h3>New Features or Enhancements 🎉</h3> <ul> <li>Add <code>IsSublte</code> and <code>HorizontalAlignment</code> to <code>Element</code> by <a href="https://github.com/codello"><code>@​codello</code></a> in <a href="https://redirect.github.com/atc0005/go-teams-notify/pull/255">atc0005/go-teams-notify#255</a></li> </ul> <h3>Dependency Updates</h3> <ul> <li>Update Dependabot PR prefixes by <a href="https://github.com/atc0005"><code>@​atc0005</code></a> in <a href="https://redirect.github.com/atc0005/go-teams-notify/pull/256">atc0005/go-teams-notify#256</a></li> </ul> <h3>Other Changes</h3> <ul> <li>Update CHANGELOG for v2.10.0 release by <a href="https://github.com/atc0005"><code>@​atc0005</code></a> in <a href="https://redirect.github.com/atc0005/go-teams-notify/pull/257">atc0005/go-teams-notify#257</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/codello"><code>@​codello</code></a> made their first contribution in <a href="https://redirect.github.com/atc0005/go-teams-notify/pull/255">atc0005/go-teams-notify#255</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/atc0005/go-teams-notify/compare/v2.9.0...v2.10.0">https://github.com/atc0005/go-teams-notify/compare/v2.9.0...v2.10.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/atc0005/go-teams-notify/blob/master/CHANGELOG.md">github.com/atc0005/go-teams-notify/v2's changelog</a>.</em></p> <blockquote> <h2>[v2.10.0] - 2024-02-22</h2> <h3>Added</h3> <ul> <li>(<a href="https://redirect.github.com/atc0005/go-teams-notify/issues/255">GH-255</a>) Add <code>IsSublte</code> and <code>HorizontalAlignment</code> to <code>Element</code> <ul> <li>credit: <a href="https://github.com/codello"><code>@​codello</code></a></li> </ul> </li> </ul> <h3>Changed</h3> <h4>Dependency Updates</h4> <ul> <li>(<a href="https://redirect.github.com/atc0005/go-teams-notify/issues/256">GH-256</a>) Update Dependabot PR prefixes</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/atc0005/go-teams-notify/commit/2601751590eba249e7d0917c8ca1a2b8a151c4cf"><code>2601751</code></a> Merge pull request <a href="https://redirect.github.com/atc0005/go-teams-notify/issues/257">#257</a> from atc0005/update-changelog-for-v2.10.0-release</li> <li><a href="https://github.com/atc0005/go-teams-notify/commit/976ac3dc024b7650c1c873f313cd0b342592b9be"><code>976ac3d</code></a> Update CHANGELOG for v2.10.0 release</li> <li><a href="https://github.com/atc0005/go-teams-notify/commit/5e4d43cde1ebb5ec830f64806978a976f6201ff5"><code>5e4d43c</code></a> Merge pull request <a href="https://redirect.github.com/atc0005/go-teams-notify/issues/256">#256</a> from atc0005/update-dependabot-pr-prefixes</li> <li><a href="https://github.com/atc0005/go-teams-notify/commit/81a51fe81c9124f887495ebdde6b5cb26e8355f0"><code>81a51fe</code></a> Update Dependabot PR prefixes</li> <li><a href="https://github.com/atc0005/go-teams-notify/commit/84950e72756a9f1bd1cc101239e95969348f212e"><code>84950e7</code></a> Merge pull request <a href="https://redirect.github.com/atc0005/go-teams-notify/issues/255">#255</a> from codello/master</li> <li><a href="https://github.com/atc0005/go-teams-notify/commit/62369585e9caf08d27c078fdc88f51232057a941"><code>6236958</code></a> Add <code>IsSublte</code> and <code>HorizontalAlignment</code> to <code>Element</code></li> <li>See full diff in <a href="https://github.com/atc0005/go-teams-notify/compare/v2.9.0...v2.10.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/atc0005/go-teams-notify/v2&package-manager=go_modules&previous-version=2.9.0&new-version=2.10.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-23 20:52:38 +02:00
github.com/atc0005/go-teams-notify/v2 v2.10.0
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.0.0-20231024185945-8841054dbdb8
github.com/bluesky-social/indigo v0.0.0-20240411170459-440932307e0d
github.com/caarlos0/ctrlc v1.2.0
github.com/caarlos0/env/v11 v11.0.0
github.com/caarlos0/go-reddit/v3 v3.0.1
github.com/caarlos0/go-shellwords v1.0.12
github.com/caarlos0/go-version v0.1.1
feat(deps): bump github.com/caarlos0/log from 0.4.3 to 0.4.4 (#4372) Bumps [github.com/caarlos0/log](https://github.com/caarlos0/log) from 0.4.3 to 0.4.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/caarlos0/log/releases">github.com/caarlos0/log's releases</a>.</em></p> <blockquote> <h2>v0.4.4</h2> <h2>Changelog</h2> <hr /> <p><em>Released with <a href="https://goreleaser.com/pro">GoReleaser Pro</a>!</em></p> <h2>v0.4.4</h2> <h2>Changelog</h2> <hr /> <p><em>Released with <a href="https://goreleaser.com/pro">GoReleaser Pro</a>!</em></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/caarlos0/log/commit/614b0a8e4b542760fb69222d5787f9d0e380b08f"><code>614b0a8</code></a> chore(deps): bump github.com/charmbracelet/lipgloss from 0.9.0 to 0.9.1 (<a href="https://redirect.github.com/caarlos0/log/issues/25">#25</a>)</li> <li>See full diff in <a href="https://github.com/caarlos0/log/compare/v0.4.3...v0.4.4">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/caarlos0/log&package-manager=go_modules&previous-version=0.4.3&new-version=0.4.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-16 13:18:55 +02:00
github.com/caarlos0/log v0.4.4
github.com/charmbracelet/keygen v0.5.0
chore(deps): bump github.com/charmbracelet/lipgloss from 0.9.1 to 0.10.0 (#4672) Bumps [github.com/charmbracelet/lipgloss](https://github.com/charmbracelet/lipgloss) from 0.9.1 to 0.10.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/charmbracelet/lipgloss/releases">github.com/charmbracelet/lipgloss's releases</a>.</em></p> <blockquote> <h2>v0.10.0</h2> <h1>String Transforms 💄</h1> <p>Lip Gloss <code>v0.10.0</code> features a brand new <code>Transform</code> function for Styles to alter strings at render time. As well as some bug fixes, like ANSI-aware table cell truncation. 🧹</p> <p>Simply define a <code>Transform</code> function as <code>func (string) string</code> and apply it to any style:</p> <pre lang="go"><code>// Example: s := NewStyle().Transform(strings.ToUpper) fmt.Println(s.Render(&quot;raow!&quot;) // &quot;RAOW!&quot; </code></pre> <p>Or, if you prefer:</p> <pre lang="go"><code>// Example: reverse := func(s string) string { n := 0 rune := make([]rune, len(s)) for _, r := range s { rune[n] = r n++ } rune = rune[0:n] for i := 0; i &lt; n/2; i++ { rune[i], rune[n-1-i] = rune[n-1-i], rune[i] } return string(rune) } <p>s := NewStyle().Transform(reverse) fmt.Println(s.Render(&quot;The quick brown 狐 jumped over the lazy 犬&quot;) // &quot;犬 yzal eht revo depmuj 狐 nworb kciuq ehT&quot;, </code></pre></p> <h2>What's Changed?</h2> <ul> <li>Corrected border shorthand functions explanation by <a href="https://github.com/ReidMason"><code>@​ReidMason</code></a> in <a href="https://redirect.github.com/charmbracelet/lipgloss/pull/237">charmbracelet/lipgloss#237</a></li> <li>Align help by <a href="https://github.com/schmurfy"><code>@​schmurfy</code></a> in <a href="https://redirect.github.com/charmbracelet/lipgloss/pull/239">charmbracelet/lipgloss#239</a></li> <li><code>Style.Transform</code> for altering strings at render time by <a href="https://github.com/meowgorithm"><code>@​meowgorithm</code></a> in <a href="https://redirect.github.com/charmbracelet/lipgloss/pull/232">charmbracelet/lipgloss#232</a></li> <li>Adding right padding to empty string by <a href="https://github.com/mikelorant"><code>@​mikelorant</code></a> in <a href="https://redirect.github.com/charmbracelet/lipgloss/pull/253">charmbracelet/lipgloss#253</a></li> <li>Refactor padding functions by <a href="https://github.com/mikelorant"><code>@​mikelorant</code></a> in <a href="https://redirect.github.com/charmbracelet/lipgloss/pull/254">charmbracelet/lipgloss#254</a></li> <li>Fix truncate of table cells containing ANSI by <a href="https://github.com/mikelorant"><code>@​mikelorant</code></a> in <a href="https://redirect.github.com/charmbracelet/lipgloss/pull/256">charmbracelet/lipgloss#256</a></li> <li>Improve maximum width of characters in a string by <a href="https://github.com/mikelorant"><code>@​mikelorant</code></a> in <a href="https://redirect.github.com/charmbracelet/lipgloss/pull/257">charmbracelet/lipgloss#257</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ReidMason"><code>@​ReidMason</code></a> made their first contribution in <a href="https://redirect.github.com/charmbracelet/lipgloss/pull/237">charmbracelet/lipgloss#237</a></li> <li><a href="https://github.com/schmurfy"><code>@​schmurfy</code></a> made their first contribution in <a href="https://redirect.github.com/charmbracelet/lipgloss/pull/239">charmbracelet/lipgloss#239</a></li> <li><a href="https://github.com/mikelorant"><code>@​mikelorant</code></a> made their first contribution in <a href="https://redirect.github.com/charmbracelet/lipgloss/pull/253">charmbracelet/lipgloss#253</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/charmbracelet/lipgloss/commit/439c06fae64d2f53261b692fcfcbe464d8e18d89"><code>439c06f</code></a> docs(table): ANSI-aware cell example</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/652c37dd07489c7c484711c8e21f4b221f57d056"><code>652c37d</code></a> feat(deps): bump github.com/rivo/uniseg from 0.4.6 to 0.4.7 (<a href="https://redirect.github.com/charmbracelet/lipgloss/issues/262">#262</a>)</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/8464a7c90b02905ea471be3bc20951dce981b3ff"><code>8464a7c</code></a> chore(deps): bump golangci/golangci-lint-action from 3 to 4 (<a href="https://redirect.github.com/charmbracelet/lipgloss/issues/259">#259</a>)</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/207eb25c9f720e48e2d46b5c2f213d07b2006052"><code>207eb25</code></a> Create CODEOWNERS</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/13584f26deeb5f6188fa1e80e43aa2ca04f297cb"><code>13584f2</code></a> chore: go mod tidy</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/bb7ffe226d40ba75dda2bf62dd5577af3c635b66"><code>bb7ffe2</code></a> fix(ci): update coverage workflow</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/2745d8a3d83029e649b21bf6bf26298b3c51ce3a"><code>2745d8a</code></a> Improve maximum width of characters in a string (<a href="https://redirect.github.com/charmbracelet/lipgloss/issues/257">#257</a>)</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/de4601232b791a1397d6c645904b001a311a5693"><code>de46012</code></a> Fix truncate of table cells containing ANSI (<a href="https://redirect.github.com/charmbracelet/lipgloss/issues/256">#256</a>)</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/92946d34c2342f6e061d72cf6bec57526c9da3d2"><code>92946d3</code></a> chore: refactor padding functions (<a href="https://redirect.github.com/charmbracelet/lipgloss/issues/254">#254</a>)</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/59874c2afabe9d8b65123ef2279ce4e61c113181"><code>59874c2</code></a> chore: apply gofumpt to all files (<a href="https://redirect.github.com/charmbracelet/lipgloss/issues/255">#255</a>)</li> <li>Additional commits viewable in <a href="https://github.com/charmbracelet/lipgloss/compare/v0.9.1...v0.10.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/charmbracelet/lipgloss&package-manager=go_modules&previous-version=0.9.1&new-version=0.10.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-08 18:39:53 +02:00
github.com/charmbracelet/lipgloss v0.10.0
2023-10-11 04:16:27 +02:00
github.com/charmbracelet/x/exp/ordered v0.0.0-20231010190216-1cb11efc897d
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/chrismellard/docker-credential-acr-env v0.0.0-20230304212654-82a0ddb27589
github.com/dghubble/go-twitter v0.0.0-20211115160449-93a8679adecb
chore(deps): bump github.com/dghubble/oauth1 from 0.7.2 to 0.7.3 (#4650) Bumps [github.com/dghubble/oauth1](https://github.com/dghubble/oauth1) from 0.7.2 to 0.7.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/dghubble/oauth1/releases">github.com/dghubble/oauth1's releases</a>.</em></p> <blockquote> <h2>v0.7.3</h2> <h2>Changes</h2> <ul> <li>Percent encode special characters in HMAC-SHA1 secrets (<a href="https://redirect.github.com/dghubble/oauth1/pull/72">#72</a>)</li> <li>Strip whitespace from request token body (<a href="https://redirect.github.com/dghubble/oauth1/pull/56">#56</a>)</li> <li>Update Go module dependencies</li> </ul> <h2>Contributions</h2> <ul> <li>Use a centrally managed GitHub Workflow for go tests by <a href="https://github.com/dghubble"><code>@​dghubble</code></a> in <a href="https://redirect.github.com/dghubble/oauth1/pull/68">dghubble/oauth1#68</a></li> <li>Allow Go test Workflow to run on PRs by <a href="https://github.com/dghubble"><code>@​dghubble</code></a> in <a href="https://redirect.github.com/dghubble/oauth1/pull/69">dghubble/oauth1#69</a></li> <li>Fix HMAC-SHA1 key creation. by <a href="https://github.com/jerryryle"><code>@​jerryryle</code></a> in <a href="https://redirect.github.com/dghubble/oauth1/pull/72">dghubble/oauth1#72</a></li> <li>Fix oauth_callback_confirmed comparison when server returns extra whitespace by <a href="https://github.com/pscohn"><code>@​pscohn</code></a> in <a href="https://redirect.github.com/dghubble/oauth1/pull/56">dghubble/oauth1#56</a></li> <li>Add changelog for new release by <a href="https://github.com/dghubble"><code>@​dghubble</code></a> in <a href="https://redirect.github.com/dghubble/oauth1/pull/73A">dghubble/oauth1#73</a></li> </ul> <h2>Dependencies</h2> <ul> <li>Bump github.com/stretchr/testify from 1.8.1 to 1.8.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/dghubble/oauth1/pull/67">dghubble/oauth1#67</a></li> <li>Bump github.com/stretchr/testify from 1.8.2 to 1.8.3 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/dghubble/oauth1/pull/70">dghubble/oauth1#70</a></li> <li>Bump github.com/stretchr/testify from 1.8.3 to 1.8.4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/dghubble/oauth1/pull/71">dghubble/oauth1#71</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/jerryryle"><code>@​jerryryle</code></a> made their first contribution in <a href="https://redirect.github.com/dghubble/oauth1/pull/72">dghubble/oauth1#72</a></li> <li><a href="https://github.com/pscohn"><code>@​pscohn</code></a> made their first contribution in <a href="https://redirect.github.com/dghubble/oauth1/pull/56">dghubble/oauth1#56</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/dghubble/oauth1/compare/v0.7.2...v0.7.3">https://github.com/dghubble/oauth1/compare/v0.7.2...v0.7.3</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/dghubble/oauth1/blob/main/CHANGES.md">github.com/dghubble/oauth1's changelog</a>.</em></p> <blockquote> <h2>v0.7.3</h2> <ul> <li>Percent encode special characters in HMAC-SHA1 secrets (<a href="https://redirect.github.com/dghubble/oauth1/pull/72">#72</a>)</li> <li>Strip whitespace from request token body (<a href="https://redirect.github.com/dghubble/oauth1/pull/56">#56</a>)</li> <li>Update Go module dependencies</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/dghubble/oauth1/commit/1f002e0d15d39ff470e50757a5f07403fcdb759d"><code>1f002e0</code></a> Add changelog for new release</li> <li><a href="https://github.com/dghubble/oauth1/commit/ef868072a599cf57fae2c86353c586dead2a8a57"><code>ef86807</code></a> Fix oauth_callback_confirmed comparison when server returns extra whitespace</li> <li><a href="https://github.com/dghubble/oauth1/commit/bb5618856237e63c3cb37534b7a8b738d518801b"><code>bb56188</code></a> Fix HMAC-SHA1 key creation.</li> <li><a href="https://github.com/dghubble/oauth1/commit/79e2ef8bf593ad9fcda570e35cfbb6e7b7f9206c"><code>79e2ef8</code></a> Bump github.com/stretchr/testify from 1.8.3 to 1.8.4</li> <li><a href="https://github.com/dghubble/oauth1/commit/e7f7a93e50be011b21c74ca86e0f0c4bd341ed77"><code>e7f7a93</code></a> Bump github.com/stretchr/testify from 1.8.2 to 1.8.3</li> <li><a href="https://github.com/dghubble/oauth1/commit/74c61479f9208cf0507b307b7379ca8279653d71"><code>74c6147</code></a> Allow Go test Workflow to run on PRs</li> <li><a href="https://github.com/dghubble/oauth1/commit/43ba0f7195a61293aaaf4b33190a217874f0a1bc"><code>43ba0f7</code></a> Bump github.com/stretchr/testify from 1.8.1 to 1.8.2</li> <li><a href="https://github.com/dghubble/oauth1/commit/2ceed997d3ed5779f03135a3268bb8acf1baaf4c"><code>2ceed99</code></a> Use a centrally managed GitHub Workflow for go tests</li> <li>See full diff in <a href="https://github.com/dghubble/oauth1/compare/v0.7.2...v0.7.3">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/dghubble/oauth1&package-manager=go_modules&previous-version=0.7.2&new-version=0.7.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-27 14:57:24 +02:00
github.com/dghubble/oauth1 v0.7.3
chore(deps): bump github.com/distribution/distribution/v3 from 3.0.0-20221021092657-c47a966fded8 to 3.0.0-alpha.1 (#4604) Bumps [github.com/distribution/distribution/v3](https://github.com/distribution/distribution) from 3.0.0-20221021092657-c47a966fded8 to 3.0.0-alpha.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/distribution/distribution/releases">github.com/distribution/distribution/v3's releases</a>.</em></p> <blockquote> <h2>v3.0.0-alpha.1</h2> <p>This is the first major release in years!</p> <p>It's an accumulation of effort that's bringing major improvements in performance, security and general code quality!</p> <p>See the abridged changelog below and the full release log <a href="https://github.com/distribution/distribution/blob/576d93fee39c22ef1e4735d932ccef32ee49f7fd/releases/v3.0.0.toml">here</a>.</p> <h3>Deprecations</h3> <ul> <li>Image Manifest v2 Schema v1</li> <li><code>oss</code> and <code>swift</code> storage drivers</li> <li><a href="https://github.com/docker/libtrust"><code>docker/libtrust</code></a> has been replaced with <a href="https://github.com/go-jose/go-jose"><code>go-jose/go-jose</code></a></li> <li><code>reference</code> package has been moved to a dedicated repository (see <a href="https://github.com/distribution/reference">here</a>)</li> <li><code>client</code> is no longer supported as a standalone package</li> </ul> <h3>Notable Changes</h3> <ul> <li><code>reference</code> package has been moved to its own dedicated <a href="https://github.com/distribution/reference">repository</a></li> <li>Go module has changed from <code>docker/distribution</code> to <code>distribution/distribution/v3</code></li> <li>Major performance improvements across all supported storage drivers</li> <li>Major dependencies updates (see the full list below)</li> <li>Online documentation is available at <a href="https://distribution.github.io/distribution/">https://distribution.github.io/distribution/</a></li> </ul> <h2>What's Changed</h2> <ul> <li>default autoredirect to false by <a href="https://github.com/davidswu"><code>@​davidswu</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2800">distribution/distribution#2800</a></li> <li>Add docs for autoredirect config parameter by <a href="https://github.com/caervs"><code>@​caervs</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2801">distribution/distribution#2801</a></li> <li>Registry - make minimum TLS version user configurable by <a href="https://github.com/gregrebholz"><code>@​gregrebholz</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2808">distribution/distribution#2808</a></li> <li>Support BYOK for OSS storage driver by <a href="https://github.com/denverdino"><code>@​denverdino</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2791">distribution/distribution#2791</a></li> <li>Add reference. ParseDockerRef utility function by <a href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2786">distribution/distribution#2786</a></li> <li>Fix gometalint errors by <a href="https://github.com/manishtomar"><code>@​manishtomar</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2840">distribution/distribution#2840</a></li> <li>registry: fix binary JSON content-type by <a href="https://github.com/lucab"><code>@​lucab</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2813">distribution/distribution#2813</a></li> <li>Log authorized username by <a href="https://github.com/manishtomar"><code>@​manishtomar</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2854">distribution/distribution#2854</a></li> <li>Fix cloudfront middleware by <a href="https://github.com/vishesh92"><code>@​vishesh92</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2837">distribution/distribution#2837</a></li> <li>support Alibaba Cloud CDN storage middleware by <a href="https://github.com/Shawnpku"><code>@​Shawnpku</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2849">distribution/distribution#2849</a></li> <li>replace rsc.io/letsencrypt in favour of golang.org/x/crypto by <a href="https://github.com/tariq1890"><code>@​tariq1890</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2926">distribution/distribution#2926</a></li> <li>migrate to go modules from vndr by <a href="https://github.com/tariq1890"><code>@​tariq1890</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2941">distribution/distribution#2941</a></li> <li>Fix typo: offest -&gt; offset by <a href="https://github.com/jabrown85"><code>@​jabrown85</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2894">distribution/distribution#2894</a></li> <li>Fix s3 driver for supporting ceph radosgw by <a href="https://github.com/tbe"><code>@​tbe</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2879">distribution/distribution#2879</a></li> <li>Fixes <a href="https://redirect.github.com/distribution/distribution/issues/2835">#2835</a> Process Accept header MIME types in case-insensitive way by <a href="https://github.com/yuwaMSFT2"><code>@​yuwaMSFT2</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2861">distribution/distribution#2861</a></li> <li>change default Dockerfile to install ssl utils by <a href="https://github.com/andyzhangx"><code>@​andyzhangx</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2809">distribution/distribution#2809</a></li> <li>Append the written bytes to the blob writer's size by <a href="https://github.com/dmathieu"><code>@​dmathieu</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2920">distribution/distribution#2920</a></li> <li>fix no error returned in fetchTokenWithOAuth by <a href="https://github.com/sevki"><code>@​sevki</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2900">distribution/distribution#2900</a></li> <li>use latest version of alpine when building the Docker container by <a href="https://github.com/tariq1890"><code>@​tariq1890</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2946">distribution/distribution#2946</a></li> <li>Extract blob upload resume into its own method by <a href="https://github.com/dmathieu"><code>@​dmathieu</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2930">distribution/distribution#2930</a></li> <li>Handle Blob Create when the underlying registry doesn't provide 'Docker-Upload-UUID' by <a href="https://github.com/dmathieu"><code>@​dmathieu</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2927">distribution/distribution#2927</a></li> <li>Implement Repository ServeBlob by <a href="https://github.com/dmathieu"><code>@​dmathieu</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2921">distribution/distribution#2921</a></li> <li>Add notification metrics by <a href="https://github.com/tifayuki"><code>@​tifayuki</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2522">distribution/distribution#2522</a></li> <li>Update the versions of several dependencies by <a href="https://github.com/tariq1890"><code>@​tariq1890</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2947">distribution/distribution#2947</a></li> <li>Implement Repository Blobs upload resuming by <a href="https://github.com/dmathieu"><code>@​dmathieu</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2917">distribution/distribution#2917</a></li> <li>allow for VERSION and REVISION to be passed in during docker builds by <a href="https://github.com/alex-laties"><code>@​alex-laties</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2955">distribution/distribution#2955</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/distribution/distribution/commits/v3.0.0-alpha.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/distribution/distribution/v3&package-manager=go_modules&previous-version=3.0.0-20221021092657-c47a966fded8&new-version=3.0.0-alpha.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-08 15:22:12 +02:00
github.com/distribution/distribution/v3 v3.0.0-alpha.1
github.com/go-telegram-bot-api/telegram-bot-api/v5 v5.5.1
chore(deps): bump github.com/google/go-containerregistry from 0.19.0 to 0.19.1 (#4698) Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.19.0 to 0.19.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-containerregistry/releases">github.com/google/go-containerregistry's releases</a>.</em></p> <blockquote> <h2>v0.19.1</h2> <h2>What's Changed</h2> <ul> <li>Bump golang.org/x/net from 0.10.0 to 0.17.0 in /pkg/authn/k8schain by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/1815">google/go-containerregistry#1815</a></li> <li>Bump golang.org/x/ packages by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/1892">google/go-containerregistry#1892</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/google/go-containerregistry/compare/v0.19.0...v0.19.1">https://github.com/google/go-containerregistry/compare/v0.19.0...v0.19.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-containerregistry/commit/8b3c3036d612bcb3c1147fe11c2d1818dc432329"><code>8b3c303</code></a> Bump golang.org/x/ packages (<a href="https://redirect.github.com/google/go-containerregistry/issues/1892">#1892</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/afec664936902d4a1fca8e208a0b585f82264b21"><code>afec664</code></a> Bump golang.org/x/net from 0.10.0 to 0.17.0 in /pkg/authn/k8schain (<a href="https://redirect.github.com/google/go-containerregistry/issues/1815">#1815</a>)</li> <li>See full diff in <a href="https://github.com/google/go-containerregistry/compare/v0.19.0...v0.19.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/go-containerregistry&package-manager=go_modules&previous-version=0.19.0&new-version=0.19.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-15 14:50:34 +02:00
github.com/google/go-containerregistry v0.19.1
2024-04-02 13:22:48 +02:00
github.com/google/go-github/v61 v61.0.0
github.com/google/ko v0.15.2
chore(deps): bump github.com/google/uuid from 1.5.0 to 1.6.0 (#4571) Bumps [github.com/google/uuid](https://github.com/google/uuid) from 1.5.0 to 1.6.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/uuid/releases">github.com/google/uuid's releases</a>.</em></p> <blockquote> <h2>v1.6.0</h2> <h2><a href="https://github.com/google/uuid/compare/v1.5.0...v1.6.0">1.6.0</a> (2024-01-16)</h2> <h3>Features</h3> <ul> <li>add Max UUID constant (<a href="https://redirect.github.com/google/uuid/issues/149">#149</a>) (<a href="https://github.com/google/uuid/commit/c58770eb495f55fe2ced6284f93c5158a62e53e3">c58770e</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>fix typo in version 7 uuid documentation (<a href="https://redirect.github.com/google/uuid/issues/153">#153</a>) (<a href="https://github.com/google/uuid/commit/016b199544692f745ffc8867b914129ecb47ef06">016b199</a>)</li> <li>Monotonicity in UUIDv7 (<a href="https://redirect.github.com/google/uuid/issues/150">#150</a>) (<a href="https://github.com/google/uuid/commit/a2b2b32373ff0b1a312b7fdf6d38a977099698a6">a2b2b32</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/google/uuid/blob/master/CHANGELOG.md">github.com/google/uuid's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/google/uuid/compare/v1.5.0...v1.6.0">1.6.0</a> (2024-01-16)</h2> <h3>Features</h3> <ul> <li>add Max UUID constant (<a href="https://redirect.github.com/google/uuid/issues/149">#149</a>) (<a href="https://github.com/google/uuid/commit/c58770eb495f55fe2ced6284f93c5158a62e53e3">c58770e</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>fix typo in version 7 uuid documentation (<a href="https://redirect.github.com/google/uuid/issues/153">#153</a>) (<a href="https://github.com/google/uuid/commit/016b199544692f745ffc8867b914129ecb47ef06">016b199</a>)</li> <li>Monotonicity in UUIDv7 (<a href="https://redirect.github.com/google/uuid/issues/150">#150</a>) (<a href="https://github.com/google/uuid/commit/a2b2b32373ff0b1a312b7fdf6d38a977099698a6">a2b2b32</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/uuid/commit/0f11ee6918f41a04c201eceeadf612a377bc7fbc"><code>0f11ee6</code></a> chore(master): release 1.6.0 (<a href="https://redirect.github.com/google/uuid/issues/151">#151</a>)</li> <li><a href="https://github.com/google/uuid/commit/16939dafc37a38d2743810a8bdf60fdad6a0f3a3"><code>16939da</code></a> chore(tests): add strict monotonicity test case for uuid v7. (<a href="https://redirect.github.com/google/uuid/issues/154">#154</a>)</li> <li><a href="https://github.com/google/uuid/commit/016b199544692f745ffc8867b914129ecb47ef06"><code>016b199</code></a> fix: fix typo in version 7 uuid documentation (<a href="https://redirect.github.com/google/uuid/issues/153">#153</a>)</li> <li><a href="https://github.com/google/uuid/commit/1d8b6ea0990d688105843a9a67b1d07222350502"><code>1d8b6ea</code></a> ci: set token permissions to github workflows (<a href="https://redirect.github.com/google/uuid/issues/143">#143</a>)</li> <li><a href="https://github.com/google/uuid/commit/a2b2b32373ff0b1a312b7fdf6d38a977099698a6"><code>a2b2b32</code></a> fix: Monotonicity in UUIDv7 (<a href="https://redirect.github.com/google/uuid/issues/150">#150</a>)</li> <li><a href="https://github.com/google/uuid/commit/c58770eb495f55fe2ced6284f93c5158a62e53e3"><code>c58770e</code></a> feat: add Max UUID constant (<a href="https://redirect.github.com/google/uuid/issues/149">#149</a>)</li> <li>See full diff in <a href="https://github.com/google/uuid/compare/v1.5.0...v1.6.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/uuid&package-manager=go_modules&previous-version=1.5.0&new-version=1.6.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-24 16:37:02 +02:00
github.com/google/uuid v1.6.0
github.com/goreleaser/fileglob v1.3.0
github.com/goreleaser/nfpm/v2 v2.37.0
github.com/hashicorp/go-multierror v1.1.1
feat(deps): bump github.com/invopop/jsonschema from 0.11.0 to 0.12.0 (#4348) Bumps [github.com/invopop/jsonschema](https://github.com/invopop/jsonschema) from 0.11.0 to 0.12.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/invopop/jsonschema/commit/9b6bb6e8f15aa557c1df053de86d4e5043365ca9"><code>9b6bb6e</code></a> Merge pull request <a href="https://redirect.github.com/invopop/jsonschema/issues/108">#108</a> from invopop/schema-property-alias</li> <li><a href="https://github.com/invopop/jsonschema/commit/f45517cf07169cf4e35eae0a4e47ad8086098583"><code>f45517c</code></a> Typo</li> <li><a href="https://github.com/invopop/jsonschema/commit/ab81e2aa6405fefd82b6958075d64d2de1844bcd"><code>ab81e2a</code></a> Fixing linting</li> <li><a href="https://github.com/invopop/jsonschema/commit/933814a23a0b8401d90625df47f4be2a0c9a3039"><code>933814a</code></a> support for JSONSchemaAlias y JSONSchemaProperty methods</li> <li><a href="https://github.com/invopop/jsonschema/commit/0108689b9f4e04f64a5986ea21650f07673c21cf"><code>0108689</code></a> Support for JSONSchemaAlias method</li> <li><a href="https://github.com/invopop/jsonschema/commit/12cbc49539c8deac9baeae7811fdcab42fd5def0"><code>12cbc49</code></a> Updating test output with new number parsing</li> <li><a href="https://github.com/invopop/jsonschema/commit/cada51da5649ccf919c51225dd8e2260a388b883"><code>cada51d</code></a> Merge pull request <a href="https://redirect.github.com/invopop/jsonschema/issues/96">#96</a> from Hotdawg/regex_with_equals</li> <li><a href="https://github.com/invopop/jsonschema/commit/9d905a25553837495e11ecb6d61f5348110dc49f"><code>9d905a2</code></a> Limit split on genericKeywords</li> <li><a href="https://github.com/invopop/jsonschema/commit/080d97dda979ca9544cc362b9f1c7c02cfc03697"><code>080d97d</code></a> Merge branch 'invopop:main' into regex_with_equals</li> <li><a href="https://github.com/invopop/jsonschema/commit/8a098cbcb66558b5c55fccd24c7cc42825d906d6"><code>8a098cb</code></a> Fix linter issue</li> <li>See full diff in <a href="https://github.com/invopop/jsonschema/compare/v0.11.0...v0.12.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/invopop/jsonschema&package-manager=go_modules&previous-version=0.11.0&new-version=0.12.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-05 14:48:15 +02:00
github.com/invopop/jsonschema v0.12.0
feat(deps): bump github.com/jarcoal/httpmock from 1.3.0 to 1.3.1 (#4253) Bumps [github.com/jarcoal/httpmock](https://github.com/jarcoal/httpmock) from 1.3.0 to 1.3.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jarcoal/httpmock/releases">github.com/jarcoal/httpmock's releases</a>.</em></p> <blockquote> <h2>v1.3.1</h2> <p>Fix:</p> <ul> <li><a href="https://pkg.go.dev/github.com/jarcoal/httpmock#BodyContainsBytes">BodyContainsBytes</a> &amp; <a href="https://pkg.go.dev/github.com/jarcoal/httpmock#BodyContainsString">BodyContainsString</a> used with <a href="https://pkg.go.dev/github.com/jarcoal/httpmock#Matcher.And">And</a>/<a href="https://pkg.go.dev/github.com/jarcoal/httpmock#Matcher.Or">Or</a> by <a href="https://github.com/maxatome"><code>@​maxatome</code></a> in <a href="https://redirect.github.com/jarcoal/httpmock/issues/146">#146</a> thanks to <a href="https://github.com/Moon1706"><code>@​Moon1706</code></a> for the report → <a href="https://redirect.github.com/jarcoal/httpmock/issues/145">#145</a>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jarcoal/httpmock/commit/8b32cd6f52e32195f15b55c5217c12c29d6004b5"><code>8b32cd6</code></a> fix: BodyContainsBytes &amp; BodyContainsString used with And/Or</li> <li><a href="https://github.com/jarcoal/httpmock/commit/497153dd46a496640fe99428b2c833ddab93f119"><code>497153d</code></a> ci: test against go 1.21 &amp; use golangci-lint 1.54.1</li> <li><a href="https://github.com/jarcoal/httpmock/commit/070d3c85e0739c5ef0230c40f7b48b16d24c44ff"><code>070d3c8</code></a> ci: switch to install-go v3.4</li> <li><a href="https://github.com/jarcoal/httpmock/commit/1ddb9fa5c42c84afdca30c98914b42fda3005a57"><code>1ddb9fa</code></a> refactor: make golangci-lint v1.52.2 happy</li> <li><a href="https://github.com/jarcoal/httpmock/commit/507a05e8629b1661bbf08df649775319a6bde5d4"><code>507a05e</code></a> ci: add workflow_dispatch as event trigger</li> <li>See full diff in <a href="https://github.com/jarcoal/httpmock/compare/v1.3.0...v1.3.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/jarcoal/httpmock&package-manager=go_modules&previous-version=1.3.0&new-version=1.3.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-08-17 13:33:17 +02:00
github.com/jarcoal/httpmock v1.3.1
github.com/klauspost/pgzip v1.2.6
github.com/mattn/go-mastodon v0.0.6
feat: add gitlab for releases (#1038) * outlines gitlab client integration * makes client parameter more explicit * adds gitlab url to config * changes releaseID to string to adapt to gitlab * updates to latest gitlab client lib 0.18 * fixes copy paster in gitlab upload func * fixes gitlab typo in config * adds gitlab token to env and context * release now uses the client factory method * skips brew pipe if it is not a github release * add github tokentype to publish tests * skips scoop pipe if it is not a github release * corrects brew skip msg * adds gitlab token to main test * adds gitlab to release docs * validates config and errors accordingly * adapt release pipe name to include gitlab * fixes gitlab client after testing * moves not-configured brew and scoop pipe checks as first check * adds more debug to gitlab client * adapts changelog generation for gitlab markdown * adds debug log for gitlab changelog * env needs to run before changelog pipe * moves gitlab default download url to default pipe * moves multiple releases check to from config to release pipe * release differs now for github and gitlab * adds debug gitlab release update msgs * moves env pipe as second after before because it determines the token type other pipes depend on * adaptes error check on gitlab release creation * Revert "adaptes error check on gitlab release creation" This reverts commit 032024571c76140f8e2207ee01cc08088f37594b. * simplifies gitlab client logic. removes comments * skips tls verification for gitlab client if specified in config * updates the docs * adds clarification that brew and scoop are not supported if it is a gitlab release * fixes copy paster in release.md * adds missing blob pipe in defaults and publish due to missing in merge * updates comment in gitlab client
2019-06-29 16:02:40 +02:00
github.com/mitchellh/go-homedir v1.1.0
github.com/muesli/mango-cobra v1.2.0
github.com/muesli/roff v0.1.0
feat(deps): bump github.com/muesli/termenv from 0.15.1 to 0.15.2 (#4148) Bumps [github.com/muesli/termenv](https://github.com/muesli/termenv) from 0.15.1 to 0.15.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/muesli/termenv/releases">github.com/muesli/termenv's releases</a>.</em></p> <blockquote> <h2>v0.15.2</h2> <h2>What's Changed</h2> <ul> <li>build(deps): bump actions/setup-go from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/muesli/termenv/pull/126">muesli/termenv#126</a></li> <li>build(deps): bump github.com/mattn/go-isatty from 0.0.17 to 0.0.18 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/muesli/termenv/pull/128">muesli/termenv#128</a></li> <li>fix: Cloud Shell supports RGB colors by <a href="https://github.com/muesli"><code>@​muesli</code></a> in <a href="https://redirect.github.com/muesli/termenv/pull/127">muesli/termenv#127</a></li> <li>build(deps): bump golang.org/x/sys from 0.6.0 to 0.7.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/muesli/termenv/pull/129">muesli/termenv#129</a></li> <li>fix: wezterm is truecolor by <a href="https://github.com/caarlos0"><code>@​caarlos0</code></a> in <a href="https://redirect.github.com/muesli/termenv/pull/139">muesli/termenv#139</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/muesli/termenv/compare/v0.15.1...v0.15.2">https://github.com/muesli/termenv/compare/v0.15.1...v0.15.2</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/muesli/termenv/commit/51d72d34e2b9778a31aa5dd79fbdd8cdac50b4d5"><code>51d72d3</code></a> fix: wezterm is truecolor (<a href="https://redirect.github.com/muesli/termenv/issues/139">#139</a>)</li> <li><a href="https://github.com/muesli/termenv/commit/b57cbb11093e11f08bdeb3d54234909b8fa079fe"><code>b57cbb1</code></a> fix: lint</li> <li><a href="https://github.com/muesli/termenv/commit/e02986697d716017087dc725465e3d8691d317e4"><code>e029866</code></a> build(deps): bump golang.org/x/sys from 0.6.0 to 0.7.0</li> <li><a href="https://github.com/muesli/termenv/commit/9b3e79975a48df063aa7a7c1ca0c20c3c868332c"><code>9b3e799</code></a> fix: Cloud Shell supports RGB colors</li> <li><a href="https://github.com/muesli/termenv/commit/73a40463ff25452432bd4e588150285c6aeca58e"><code>73a4046</code></a> build(deps): bump github.com/mattn/go-isatty from 0.0.17 to 0.0.18</li> <li><a href="https://github.com/muesli/termenv/commit/39f5d6e77915ccc34a9e752ad0b7a3443b393058"><code>39f5d6e</code></a> build(deps): bump actions/setup-go from 3 to 4</li> <li>See full diff in <a href="https://github.com/muesli/termenv/compare/v0.15.1...v0.15.2">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/muesli/termenv&package-manager=go_modules&previous-version=0.15.1&new-version=0.15.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-28 14:46:00 +02:00
github.com/muesli/termenv v0.15.2
feat(deps): bump github.com/ory/dockertest/v3 from 3.9.1 to 3.10.0 (#3947) Bumps [github.com/ory/dockertest/v3](https://github.com/ory/dockertest) from 3.9.1 to 3.10.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ory/dockertest/commit/0d540538ba862768f4cf01a550f3b0e5dfcf83e1"><code>0d54053</code></a> chore(deps): bump actions/stale from 4 to 8 (<a href="https://redirect.github.com/ory/dockertest/issues/430">#430</a>)</li> <li><a href="https://github.com/ory/dockertest/commit/355d9264da44939c85aacc49c990e7d5fab46a4b"><code>355d926</code></a> chore(deps): bump actions/setup-node from 2.pre.beta to 3.6.0 (<a href="https://redirect.github.com/ory/dockertest/issues/429">#429</a>)</li> <li><a href="https://github.com/ory/dockertest/commit/afee4d2c072fd28b9d5def5a9dd96f7cb789ac71"><code>afee4d2</code></a> Replace pkg/errors with native error wrapping (<a href="https://redirect.github.com/ory/dockertest/issues/433">#433</a>)</li> <li><a href="https://github.com/ory/dockertest/commit/5d9a022f39dec2056eed8b0ccca2961f5de5ed8a"><code>5d9a022</code></a> docs: fix typo in FakeGoogleCloudStorage example (<a href="https://redirect.github.com/ory/dockertest/issues/434">#434</a>)</li> <li><a href="https://github.com/ory/dockertest/commit/e733223e5349f34edddbebf4852aabae1964e476"><code>e733223</code></a> fix: use std context lib (<a href="https://redirect.github.com/ory/dockertest/issues/404">#404</a>)</li> <li><a href="https://github.com/ory/dockertest/commit/51627a024572d83a084aebe75e89823e84fc7e01"><code>51627a0</code></a> chore(deps): bump golang.org/x/sys from 0.6.0 to 0.7.0 (<a href="https://redirect.github.com/ory/dockertest/issues/432">#432</a>)</li> <li><a href="https://github.com/ory/dockertest/commit/7b0c8dc1f6dcef51b5ee7c64a1bdd9dbe4b300b5"><code>7b0c8dc</code></a> chore: bump workflow actions; configure dependabot (<a href="https://redirect.github.com/ory/dockertest/issues/424">#424</a>)</li> <li><a href="https://github.com/ory/dockertest/commit/1b74b04e7dee8be3c18f5c204770d7771fc65215"><code>1b74b04</code></a> refactor: replace deprecated ioutil with io and os (<a href="https://redirect.github.com/ory/dockertest/issues/423">#423</a>)</li> <li><a href="https://github.com/ory/dockertest/commit/87ce1b953729aff6f379bb27d4df0a46521567ae"><code>87ce1b9</code></a> ci: ignore wrongly reported CVE (<a href="https://redirect.github.com/ory/dockertest/issues/425">#425</a>)</li> <li><a href="https://github.com/ory/dockertest/commit/7bcb18d4d98ba92ec04e5baa3911bc28f98c5691"><code>7bcb18d</code></a> fix: explicitly convert s.Rdev to uint64 (<a href="https://redirect.github.com/ory/dockertest/issues/420">#420</a>)</li> <li>Additional commits viewable in <a href="https://github.com/ory/dockertest/compare/v3.9.1...v3.10.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/ory/dockertest/v3&package-manager=go_modules&previous-version=3.9.1&new-version=3.10.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-04-23 19:09:35 +02:00
github.com/ory/dockertest/v3 v3.10.0
chore(deps): bump github.com/slack-go/slack from 0.12.4 to 0.12.5 (#4654) Bumps [github.com/slack-go/slack](https://github.com/slack-go/slack) from 0.12.4 to 0.12.5. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/slack-go/slack/releases">github.com/slack-go/slack's releases</a>.</em></p> <blockquote> <h2>v0.12.5</h2> <h2>What's Changed</h2> <p>BUGFIX - deal with &quot;true&quot;, true, &quot;false&quot;, false.</p> <ul> <li>Parse string or boolean for SlashCommand.IsEnterpriseInstall by <a href="https://github.com/kpaulisse"><code>@​kpaulisse</code></a> in <a href="https://redirect.github.com/slack-go/slack/pull/1266">slack-go/slack#1266</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/slack-go/slack/compare/v0.12.4...v0.12.5">https://github.com/slack-go/slack/compare/v0.12.4...v0.12.5</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/slack-go/slack/commit/af783b3055b15b0ea99c0e956716e1d7d94e76c2"><code>af783b3</code></a> Merge pull request <a href="https://redirect.github.com/slack-go/slack/issues/1266">#1266</a> from kpaulisse/kpaulisse-is-enterprise-install</li> <li><a href="https://github.com/slack-go/slack/commit/9a23f7a387bea2de34ad1e22bd83cfdb6f91e6dd"><code>9a23f7a</code></a> Parse string or boolean for SlashCommand.IsEnterpriseInstall</li> <li>See full diff in <a href="https://github.com/slack-go/slack/compare/v0.12.4...v0.12.5">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/slack-go/slack&package-manager=go_modules&previous-version=0.12.4&new-version=0.12.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-27 14:54:25 +02:00
github.com/slack-go/slack v0.12.5
feat(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (#4410) Bumps [github.com/spf13/cobra](https://github.com/spf13/cobra) from 1.7.0 to 1.8.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/spf13/cobra/releases">github.com/spf13/cobra's releases</a>.</em></p> <blockquote> <h2>v1.8.0</h2> <h2>✨ Features</h2> <ul> <li>Support usage as plugin for tools like kubectl by <a href="https://github.com/nirs"><code>@​nirs</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2018">spf13/cobra#2018</a> - this means that programs that utilize a &quot;plugin-like&quot; structure have much better support and usage (like for completions, command paths, etc.)</li> <li>Move documentation sources to site/content by <a href="https://github.com/umarcor"><code>@​umarcor</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1428">spf13/cobra#1428</a></li> <li>Add 'one required flag' group by <a href="https://github.com/marevers"><code>@​marevers</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1952">spf13/cobra#1952</a> - this includes a new <code>MarkFlagsOneRequired</code> API for flags which can be used to mark a flag group as required and cause command failure if at least one is not used when invoked.</li> <li>Customizable error message prefix by <a href="https://github.com/5ouma"><code>@​5ouma</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2023">spf13/cobra#2023</a> - This adds the <code>SetErrPrefix</code> and <code>ErrPrefix</code> APIs on the <code>Command</code> struct to allow for setting a custom prefix for errors</li> <li>feat: add getters for flag completions by <a href="https://github.com/avirtopeanu-ionos"><code>@​avirtopeanu-ionos</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1943">spf13/cobra#1943</a></li> <li>Feature: allow running persistent run hooks of all parents by <a href="https://github.com/vkhoroz"><code>@​vkhoroz</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2044">spf13/cobra#2044</a></li> <li>Improve API to get flag completion function by <a href="https://github.com/marckhouzam"><code>@​marckhouzam</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2063">spf13/cobra#2063</a></li> </ul> <h2>🐛 Bug fixes</h2> <ul> <li>Fix typo in fish completions by <a href="https://github.com/twpayne"><code>@​twpayne</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1945">spf13/cobra#1945</a></li> <li>Fix grammar: 'allows to' by <a href="https://github.com/supertassu"><code>@​supertassu</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1978">spf13/cobra#1978</a></li> <li>powershell: escape variable with curly brackets by <a href="https://github.com/Luap99"><code>@​Luap99</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1960">spf13/cobra#1960</a></li> <li>Don't complete --help flag when flag parsing disabled by <a href="https://github.com/marckhouzam"><code>@​marckhouzam</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2061">spf13/cobra#2061</a></li> <li>Replace all non-alphanumerics in active help env var program prefix by <a href="https://github.com/scop"><code>@​scop</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1940">spf13/cobra#1940</a></li> </ul> <h2>🔧 Maintenance</h2> <ul> <li>build(deps): bump golangci/golangci-lint-action from 3.4.0 to 3.5.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1971">spf13/cobra#1971</a></li> <li>build(deps): bump golangci/golangci-lint-action from 3.5.0 to 3.6.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1976">spf13/cobra#1976</a></li> <li>build(deps): bump golangci/golangci-lint-action from 3.6.0 to 3.7.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2021">spf13/cobra#2021</a></li> <li>build(deps): bump actions/setup-go from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1934">spf13/cobra#1934</a></li> <li>build(deps): bump github.com/cpuguy83/go-md2man/v2 from 2.0.2 to 2.0.3 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2047">spf13/cobra#2047</a></li> <li>build(deps): bump actions/checkout from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2028">spf13/cobra#2028</a></li> <li>command: temporarily disable G602 due to <a href="https://redirect.github.com/securego/gosec/issues/1005">securego/gosec#1005</a> by <a href="https://github.com/umarcor"><code>@​umarcor</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2022">spf13/cobra#2022</a></li> </ul> <h2>🧪 Testing &amp; CI/CD</h2> <ul> <li>test: make fish_completions_test more robust by <a href="https://github.com/branchvincent"><code>@​branchvincent</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1980">spf13/cobra#1980</a></li> <li>golangci: enable 'unused' and disable deprecated replaced by it by <a href="https://github.com/umarcor"><code>@​umarcor</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1983">spf13/cobra#1983</a></li> <li>cleanup: minor corrections to unit tests by <a href="https://github.com/JunNishimura"><code>@​JunNishimura</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2003">spf13/cobra#2003</a></li> <li>ci: test golang 1.21 by <a href="https://github.com/nunoadrego"><code>@​nunoadrego</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2024">spf13/cobra#2024</a></li> <li>Fix linter errors by <a href="https://github.com/marckhouzam"><code>@​marckhouzam</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2052">spf13/cobra#2052</a></li> <li>Add tests for flag completion registration by <a href="https://github.com/marckhouzam"><code>@​marckhouzam</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2053">spf13/cobra#2053</a></li> </ul> <h2>✏️ Documentation</h2> <ul> <li>doc: fix typo, Deperecated -&gt; Deprecated by <a href="https://github.com/callthingsoff"><code>@​callthingsoff</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2000">spf13/cobra#2000</a></li> <li>Add notes to doc about the execution condition of *PreRun and *PostRun functions by <a href="https://github.com/haoming29"><code>@​haoming29</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2041">spf13/cobra#2041</a></li> </ul> <hr /> <p>Thank you everyone who contributed to this release and all your hard work! Cobra and this community would never be possible without all of you!!!! 🐍</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/spf13/cobra/compare/v1.7.0...v1.8.0">https://github.com/spf13/cobra/compare/v1.7.0...v1.8.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/spf13/cobra/commit/a0a6ae020bb3899ff0276067863e50523f897370"><code>a0a6ae0</code></a> Improve API to get flag completion function (<a href="https://redirect.github.com/spf13/cobra/issues/2063">#2063</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/890302a35f578311404a462b3cdd404f34db3720"><code>890302a</code></a> Support usage as plugin for tools like kubectl (<a href="https://redirect.github.com/spf13/cobra/issues/2018">#2018</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/48cea5c87b5299b68c3f5b7f2c67ea948717276f"><code>48cea5c</code></a> build(deps): bump actions/checkout from 3 to 4 (<a href="https://redirect.github.com/spf13/cobra/issues/2028">#2028</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/22953d88453ec9343b4a78b9d67400a3326f3138"><code>22953d8</code></a> Replace all non-alphanumerics in active help env var program prefix (<a href="https://redirect.github.com/spf13/cobra/issues/1940">#1940</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/00b68a1c260eaf2b9bcb10a3178d36cec81548ca"><code>00b68a1</code></a> Add tests for flag completion registration (<a href="https://redirect.github.com/spf13/cobra/issues/2053">#2053</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/b711e8760b73c6aa1b4aa1bef3a26da5926f175d"><code>b711e87</code></a> Don't complete --help flag when flag parsing disabled (<a href="https://redirect.github.com/spf13/cobra/issues/2061">#2061</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/8b1eba47616566fc4d258a93da48d5d8741865f0"><code>8b1eba4</code></a> Fix linter errors (<a href="https://redirect.github.com/spf13/cobra/issues/2052">#2052</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/4cafa37bc4bb85633b4245aa118280fe5a9edcd5"><code>4cafa37</code></a> Allow running persistent run hooks of all parents (<a href="https://redirect.github.com/spf13/cobra/issues/2044">#2044</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/5c962a221e70fd6b12296e5d7075f28b422f98b2"><code>5c962a2</code></a> build(deps): bump github.com/cpuguy83/go-md2man/v2 from 2.0.2 to 2.0.3 (<a href="https://redirect.github.com/spf13/cobra/issues/2047">#2047</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/efe8fa3e4453e41d6419b26c9769a51e42825632"><code>efe8fa3</code></a> build(deps): bump actions/setup-go from 3 to 4 (<a href="https://redirect.github.com/spf13/cobra/issues/1934">#1934</a>)</li> <li>Additional commits viewable in <a href="https://github.com/spf13/cobra/compare/v1.7.0...v1.8.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/spf13/cobra&package-manager=go_modules&previous-version=1.7.0&new-version=1.8.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) Dependabot will merge this PR once CI passes on it, as requested by @caarlos0. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-06 17:44:28 +02:00
github.com/spf13/cobra v1.8.0
chore(deps): bump github.com/stretchr/testify from 1.8.4 to 1.9.0 (#4663) Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.8.4 to 1.9.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/stretchr/testify/releases">github.com/stretchr/testify's releases</a>.</em></p> <blockquote> <h2>v1.9.0</h2> <h2>What's Changed</h2> <ul> <li>Fix Go modules version by <a href="https://github.com/SuperQ"><code>@​SuperQ</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1394">stretchr/testify#1394</a></li> <li>Document that require is not safe to call in created goroutines by <a href="https://github.com/programmer04"><code>@​programmer04</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1392">stretchr/testify#1392</a></li> <li>Remove myself from MAINTAINERS.md by <a href="https://github.com/mvdkleijn"><code>@​mvdkleijn</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1367">stretchr/testify#1367</a></li> <li>Correct spelling/grammar by <a href="https://github.com/echarrod"><code>@​echarrod</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1389">stretchr/testify#1389</a></li> <li>docs: Update URLs in README by <a href="https://github.com/davidjb"><code>@​davidjb</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1349">stretchr/testify#1349</a></li> <li>Update mockery link to Github Pages in README by <a href="https://github.com/LandonTClipp"><code>@​LandonTClipp</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1346">stretchr/testify#1346</a></li> <li>docs: Fix typos in tests and comments by <a href="https://github.com/alexandear"><code>@​alexandear</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1410">stretchr/testify#1410</a></li> <li>CI: tests from go1.17 by <a href="https://github.com/SuperQ"><code>@​SuperQ</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1409">stretchr/testify#1409</a></li> <li>Fix adding ? when no values passed by <a href="https://github.com/lesichkovm"><code>@​lesichkovm</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1320">stretchr/testify#1320</a></li> <li>codegen: use standard header for generated files by <a href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1406">stretchr/testify#1406</a></li> <li>mock: AssertExpectations log reason only on failure by <a href="https://github.com/hikyaru-suzuki"><code>@​hikyaru-suzuki</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1360">stretchr/testify#1360</a></li> <li>assert: fix flaky TestNeverTrue by <a href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1417">stretchr/testify#1417</a></li> <li>README: fix typos &quot;set up&quot; vs &quot;setup&quot; by <a href="https://github.com/ossan-dev"><code>@​ossan-dev</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1428">stretchr/testify#1428</a></li> <li>mock: move regexp compilation outside of <code>Called</code> by <a href="https://github.com/aud10slave"><code>@​aud10slave</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/631">stretchr/testify#631</a></li> <li>assert: refactor internal func getLen() by <a href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1445">stretchr/testify#1445</a></li> <li>mock: deprecate type AnythingOfTypeArgument (<a href="https://redirect.github.com/stretchr/testify/issues/1434">#1434</a>) by <a href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1441">stretchr/testify#1441</a></li> <li>Remove no longer needed assert.canConvert by <a href="https://github.com/alexandear"><code>@​alexandear</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1470">stretchr/testify#1470</a></li> <li>assert: ObjectsAreEqual: use time.Equal for time.Time types by <a href="https://github.com/tscales"><code>@​tscales</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1464">stretchr/testify#1464</a></li> <li>Bump actions/checkout from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1466">stretchr/testify#1466</a></li> <li>Bump actions/setup-go from 3.2.0 to 4.1.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1451">stretchr/testify#1451</a></li> <li>fix: make EventuallyWithT concurrency safe by <a href="https://github.com/czeslavo"><code>@​czeslavo</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1395">stretchr/testify#1395</a></li> <li>assert: fix httpCode and HTTPBody occur panic when http.Handler read Body by <a href="https://github.com/hidu"><code>@​hidu</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1484">stretchr/testify#1484</a></li> <li>assert.EqualExportedValues: fix handling of arrays by <a href="https://github.com/zrbecker"><code>@​zrbecker</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1473">stretchr/testify#1473</a></li> <li>.github: use latest Go versions by <a href="https://github.com/kevinburkesegment"><code>@​kevinburkesegment</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1489">stretchr/testify#1489</a></li> <li>assert: Deprecate EqualExportedValues by <a href="https://github.com/HaraldNordgren"><code>@​HaraldNordgren</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1488">stretchr/testify#1488</a></li> <li>suite: refactor test assertions by <a href="https://github.com/alexandear"><code>@​alexandear</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1474">stretchr/testify#1474</a></li> <li>suite: fix SetupSubTest and TearDownSubTest execution order by <a href="https://github.com/linusbarth"><code>@​linusbarth</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1471">stretchr/testify#1471</a></li> <li>docs: Fix deprecation comments for http package by <a href="https://github.com/alexandear"><code>@​alexandear</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1335">stretchr/testify#1335</a></li> <li>Add map support doc comments to Subset and NotSubset by <a href="https://github.com/jedevc"><code>@​jedevc</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1306">stretchr/testify#1306</a></li> <li>TestErrorIs/TestNotErrorIs: check error message contents by <a href="https://github.com/craig65535"><code>@​craig65535</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1435">stretchr/testify#1435</a></li> <li>suite: fix subtest names (fix <a href="https://redirect.github.com/stretchr/testify/issues/1501">#1501</a>) by <a href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1504">stretchr/testify#1504</a></li> <li>assert: improve unsafe.Pointer tests by <a href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1505">stretchr/testify#1505</a></li> <li>assert: simplify isNil implementation by <a href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1506">stretchr/testify#1506</a></li> <li>assert.InEpsilonSlice: fix expected/actual order and other improvements by <a href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1483">stretchr/testify#1483</a></li> <li>Fix dependency cycle with objx <a href="https://redirect.github.com/stretchr/testify/issues/1292">#1292</a> by <a href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1453">stretchr/testify#1453</a></li> <li>mock: refactor TestIsArgsEqual by <a href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1444">stretchr/testify#1444</a></li> <li>mock: optimize argument matching checks by <a href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1416">stretchr/testify#1416</a></li> <li>assert: fix TestEventuallyTimeout by <a href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1412">stretchr/testify#1412</a></li> <li>CI: add go 1.21 in GitHub Actions by <a href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1450">stretchr/testify#1450</a></li> <li>suite: fix recoverAndFailOnPanic to report test failure at the right location by <a href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1502">stretchr/testify#1502</a></li> <li>Update maintainers by <a href="https://github.com/brackendawson"><code>@​brackendawson</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1533">stretchr/testify#1533</a></li> <li>assert: Fix EqualValues to handle overflow/underflow by <a href="https://github.com/arjunmahishi"><code>@​arjunmahishi</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1531">stretchr/testify#1531</a></li> <li>assert: better formatting for Len() error by <a href="https://github.com/kevinburkesegment"><code>@​kevinburkesegment</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1485">stretchr/testify#1485</a></li> <li>Ensure AssertExpectations does not fail in skipped tests by <a href="https://github.com/ianrose14"><code>@​ianrose14</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1331">stretchr/testify#1331</a></li> <li>suite: fix deadlock in suite.Require()/Assert() by <a href="https://github.com/arjunmahishi"><code>@​arjunmahishi</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1535">stretchr/testify#1535</a></li> <li>Revert &quot;assert: ObjectsAreEqual: use time.Equal for time.Time type&quot; by <a href="https://github.com/brackendawson"><code>@​brackendawson</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1537">stretchr/testify#1537</a></li> <li>[chore] Add issue templates by <a href="https://github.com/arjunmahishi"><code>@​arjunmahishi</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1538">stretchr/testify#1538</a></li> <li>Update the build status badge by <a href="https://github.com/brackendawson"><code>@​brackendawson</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1540">stretchr/testify#1540</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/stretchr/testify/commit/bb548d0473d4e1c9b7bbfd6602c7bf12f7a84dd2"><code>bb548d0</code></a> Merge pull request <a href="https://redirect.github.com/stretchr/testify/issues/1552">#1552</a> from stretchr/dependabot/go_modules/github.com/stret...</li> <li><a href="https://github.com/stretchr/testify/commit/814075f391adffd2bf2b5110a74c51827ba132c4"><code>814075f</code></a> build(deps): bump github.com/stretchr/objx from 0.5.1 to 0.5.2</li> <li><a href="https://github.com/stretchr/testify/commit/e0456122451b1839c8d58d32df6364e4d0f0a709"><code>e045612</code></a> Merge pull request <a href="https://redirect.github.com/stretchr/testify/issues/1339">#1339</a> from bogdandrutu/uintptr</li> <li><a href="https://github.com/stretchr/testify/commit/5b6926d686d412518f50e888b9ae9b938355e011"><code>5b6926d</code></a> Merge pull request <a href="https://redirect.github.com/stretchr/testify/issues/1385">#1385</a> from hslatman/not-implements</li> <li><a href="https://github.com/stretchr/testify/commit/9f97d67703eff02136d487e6c907e76fdea31a8b"><code>9f97d67</code></a> Merge pull request <a href="https://redirect.github.com/stretchr/testify/issues/1550">#1550</a> from stretchr/release-notes</li> <li><a href="https://github.com/stretchr/testify/commit/bcb0d3fe49ff300fb78288cc144bc61a881f58ec"><code>bcb0d3f</code></a> Include the auto-release notes in releases</li> <li><a href="https://github.com/stretchr/testify/commit/fb770f8238261aa22f8e0c56f18168ccb90f4a09"><code>fb770f8</code></a> Merge pull request <a href="https://redirect.github.com/stretchr/testify/issues/1247">#1247</a> from ccoVeille/typos</li> <li><a href="https://github.com/stretchr/testify/commit/85d8bb6eea715dcbbb68f7c87b50e1956e20f892"><code>85d8bb6</code></a> fix typos in comments, tests and github templates</li> <li><a href="https://github.com/stretchr/testify/commit/e2741fa4e9bf2fdfe3ed48d976a7eeebe76c5009"><code>e2741fa</code></a> Merge pull request <a href="https://redirect.github.com/stretchr/testify/issues/1548">#1548</a> from arjunmahishi/msgAndArgs</li> <li><a href="https://github.com/stretchr/testify/commit/6e59f20c0d3883d2bdc589a9e48374ea30601851"><code>6e59f20</code></a> http_assertions: assert that the msgAndArgs actually works in tests</li> <li>Additional commits viewable in <a href="https://github.com/stretchr/testify/compare/v1.8.4...v1.9.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/stretchr/testify&package-manager=go_modules&previous-version=1.8.4&new-version=1.9.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-04 13:56:06 +02:00
github.com/stretchr/testify v1.9.0
chore(deps): bump github.com/ulikunitz/xz from 0.5.11 to 0.5.12 (#4751) Bumps [github.com/ulikunitz/xz](https://github.com/ulikunitz/xz) from 0.5.11 to 0.5.12. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ulikunitz/xz/commit/4f11dce79b9977ec2976a978d6c594ea1c23cf29"><code>4f11dce</code></a> Update README.md and SECURITY.md to address security questions</li> <li><a href="https://github.com/ulikunitz/xz/commit/f56ebbfaa2400067dcda8ade26ce912c2873ca08"><code>f56ebbf</code></a> TODO.md: fix a typo</li> <li>See full diff in <a href="https://github.com/ulikunitz/xz/compare/v0.5.11...v0.5.12">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/ulikunitz/xz&package-manager=go_modules&previous-version=0.5.11&new-version=0.5.12)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-04 14:35:29 +02:00
github.com/ulikunitz/xz v0.5.12
chore(deps): bump github.com/xanzy/go-gitlab from 0.104.0 to 0.104.1 (#4842) Bumps [github.com/xanzy/go-gitlab](https://github.com/xanzy/go-gitlab) from 0.104.0 to 0.104.1. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/xanzy/go-gitlab/commit/aee1e19c70e08b54c9b3fda59621523c3745bd3d"><code>aee1e19</code></a> Merge pull request <a href="https://redirect.github.com/xanzy/go-gitlab/issues/1935">#1935</a> from heidiberry/main</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/a13465b38201031ef9003d1a7f706aa99d73c9e3"><code>a13465b</code></a> Reinstate missing fields for emails on push integration</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/db7c13540f8a25318f7133069b3afe9cbe0eba82"><code>db7c135</code></a> Merge pull request <a href="https://redirect.github.com/xanzy/go-gitlab/issues/1934">#1934</a> from heidiberry/main</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/50bbab241353f900b84ec4ddea23c1cec2a52cab"><code>50bbab2</code></a> Remove deprecated field removed in GitLab 9.0</li> <li>See full diff in <a href="https://github.com/xanzy/go-gitlab/compare/v0.104.0...v0.104.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/xanzy/go-gitlab&package-manager=go_modules&previous-version=0.104.0&new-version=0.104.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-07 13:54:41 +02:00
github.com/xanzy/go-gitlab v0.104.1
chore(deps): bump gocloud.dev from 0.36.0 to 0.37.0 (#4688) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.36.0&new-version=0.37.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) Dependabot will merge this PR once it's up-to-date and CI passes on it, as requested by @caarlos0. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-13 19:59:13 +02:00
gocloud.dev v0.37.0
chore(deps): bump golang.org/x/tools from 0.20.0 to 0.21.0 (#4840) Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.20.0 to 0.21.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/tools/commit/cc29c91ba3acb47c1793da56d919cc40def4ea41"><code>cc29c91</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/tools/commit/397fef9629377c5179518414e4502009dc0918a2"><code>397fef9</code></a> gopls/internal/protocol: add links to LSP spec</li> <li><a href="https://github.com/golang/tools/commit/e2a352c850a52c32b9bfdb78fbfb97882b7c1424"><code>e2a352c</code></a> internal/refactor/inline: extensible API</li> <li><a href="https://github.com/golang/tools/commit/c16c816ac486df69471674bcaf6f1a8f76f2bdcf"><code>c16c816</code></a> go/analysis/passes/stdversion: test *.go &lt; go.mod version</li> <li><a href="https://github.com/golang/tools/commit/629a7be6d0a4808cd8e7af805986652d81bb975f"><code>629a7be</code></a> go/analysis/analysistest: stricter errors and GOWORK setting</li> <li><a href="https://github.com/golang/tools/commit/4db16973aa22c2c1a5a873261a68949f351efe2b"><code>4db1697</code></a> go/packages/packagestest: fold modules_111.go into modules.go</li> <li><a href="https://github.com/golang/tools/commit/ccdef3cc2699ea2a30a2931a43a1774bd974000a"><code>ccdef3c</code></a> gopls/internal/golang: fix nil panic in InlayHint</li> <li><a href="https://github.com/golang/tools/commit/74c9cfe4d22faa696baabeea02df6493b15e8c79"><code>74c9cfe</code></a> go/analysis: add Pass.ReadFile</li> <li><a href="https://github.com/golang/tools/commit/5ef4fc9014e76bcc56324b24218c0216a7146306"><code>5ef4fc9</code></a> gopls/internal/golang/completion: fix the isEmptyInterface predicate</li> <li><a href="https://github.com/golang/tools/commit/77f691badad098462fed0a46c9a3f5f3d178b633"><code>77f691b</code></a> internal/gcimporter: use Alias.Rhs, not unsafe hack</li> <li>Additional commits viewable in <a href="https://github.com/golang/tools/compare/v0.20.0...v0.21.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/tools&package-manager=go_modules&previous-version=0.20.0&new-version=0.21.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-07 13:44:58 +02:00
golang.org/x/crypto v0.23.0
chore(deps): bump golang.org/x/oauth2 from 0.19.0 to 0.20.0 (#4837) Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from 0.19.0 to 0.20.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/oauth2/commit/84cb9f7f5c5a639955cd501bfdd54f0e63997e61"><code>84cb9f7</code></a> oauth2: fix typo in comment</li> <li><a href="https://github.com/golang/oauth2/commit/4b7f0bdbc7c30d05383d2597847300fbb870608b"><code>4b7f0bd</code></a> go.mod: update cloud.google.com/go/compute/metadata dependency</li> <li><a href="https://github.com/golang/oauth2/commit/e11eea88a89331c1fae3d38a37f484363a8d597d"><code>e11eea8</code></a> microsoft: added DeviceAuthURL to AzureADEndpoint</li> <li>See full diff in <a href="https://github.com/golang/oauth2/compare/v0.19.0...v0.20.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/oauth2&package-manager=go_modules&previous-version=0.19.0&new-version=0.20.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-06 14:23:56 +02:00
golang.org/x/oauth2 v0.20.0
chore(deps): bump golang.org/x/tools from 0.19.0 to 0.20.0 (#4762) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/tools&package-manager=go_modules&previous-version=0.19.0&new-version=0.20.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-08 04:05:31 +02:00
golang.org/x/sync v0.7.0
chore(deps): bump golang.org/x/text from 0.14.0 to 0.15.0 (#4836) Bumps [golang.org/x/text](https://github.com/golang/text) from 0.14.0 to 0.15.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/text/commit/8d533a0c40adec778a7d09ac6c8aa640d3c883f4"><code>8d533a0</code></a> encoding/charmap: update UCM spec file URL prefix</li> <li>See full diff in <a href="https://github.com/golang/text/compare/v0.14.0...v0.15.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/text&package-manager=go_modules&previous-version=0.14.0&new-version=0.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-06 14:28:12 +02:00
golang.org/x/text v0.15.0
chore(deps): bump golang.org/x/tools from 0.20.0 to 0.21.0 (#4840) Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.20.0 to 0.21.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/tools/commit/cc29c91ba3acb47c1793da56d919cc40def4ea41"><code>cc29c91</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/tools/commit/397fef9629377c5179518414e4502009dc0918a2"><code>397fef9</code></a> gopls/internal/protocol: add links to LSP spec</li> <li><a href="https://github.com/golang/tools/commit/e2a352c850a52c32b9bfdb78fbfb97882b7c1424"><code>e2a352c</code></a> internal/refactor/inline: extensible API</li> <li><a href="https://github.com/golang/tools/commit/c16c816ac486df69471674bcaf6f1a8f76f2bdcf"><code>c16c816</code></a> go/analysis/passes/stdversion: test *.go &lt; go.mod version</li> <li><a href="https://github.com/golang/tools/commit/629a7be6d0a4808cd8e7af805986652d81bb975f"><code>629a7be</code></a> go/analysis/analysistest: stricter errors and GOWORK setting</li> <li><a href="https://github.com/golang/tools/commit/4db16973aa22c2c1a5a873261a68949f351efe2b"><code>4db1697</code></a> go/packages/packagestest: fold modules_111.go into modules.go</li> <li><a href="https://github.com/golang/tools/commit/ccdef3cc2699ea2a30a2931a43a1774bd974000a"><code>ccdef3c</code></a> gopls/internal/golang: fix nil panic in InlayHint</li> <li><a href="https://github.com/golang/tools/commit/74c9cfe4d22faa696baabeea02df6493b15e8c79"><code>74c9cfe</code></a> go/analysis: add Pass.ReadFile</li> <li><a href="https://github.com/golang/tools/commit/5ef4fc9014e76bcc56324b24218c0216a7146306"><code>5ef4fc9</code></a> gopls/internal/golang/completion: fix the isEmptyInterface predicate</li> <li><a href="https://github.com/golang/tools/commit/77f691badad098462fed0a46c9a3f5f3d178b633"><code>77f691b</code></a> internal/gcimporter: use Alias.Rhs, not unsafe hack</li> <li>Additional commits viewable in <a href="https://github.com/golang/tools/compare/v0.20.0...v0.21.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/tools&package-manager=go_modules&previous-version=0.20.0&new-version=0.21.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-07 13:44:58 +02:00
golang.org/x/tools v0.21.0
gopkg.in/mail.v2 v2.3.1
gopkg.in/yaml.v3 v3.0.1
)
require (
chore(deps): bump gocloud.dev from 0.36.0 to 0.37.0 (#4688) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.36.0&new-version=0.37.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) Dependabot will merge this PR once it's up-to-date and CI passes on it, as requested by @caarlos0. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-13 19:59:13 +02:00
cloud.google.com/go v0.112.1 // indirect
chore(deps): bump golang.org/x/oauth2 from 0.19.0 to 0.20.0 (#4837) Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from 0.19.0 to 0.20.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/oauth2/commit/84cb9f7f5c5a639955cd501bfdd54f0e63997e61"><code>84cb9f7</code></a> oauth2: fix typo in comment</li> <li><a href="https://github.com/golang/oauth2/commit/4b7f0bdbc7c30d05383d2597847300fbb870608b"><code>4b7f0bd</code></a> go.mod: update cloud.google.com/go/compute/metadata dependency</li> <li><a href="https://github.com/golang/oauth2/commit/e11eea88a89331c1fae3d38a37f484363a8d597d"><code>e11eea8</code></a> microsoft: added DeviceAuthURL to AzureADEndpoint</li> <li>See full diff in <a href="https://github.com/golang/oauth2/compare/v0.19.0...v0.20.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/oauth2&package-manager=go_modules&previous-version=0.19.0&new-version=0.20.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-06 14:23:56 +02:00
cloud.google.com/go/compute/metadata v0.3.0 // indirect
chore(deps): bump gocloud.dev from 0.36.0 to 0.37.0 (#4688) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.36.0&new-version=0.37.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) Dependabot will merge this PR once it's up-to-date and CI passes on it, as requested by @caarlos0. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-13 19:59:13 +02:00
cloud.google.com/go/iam v1.1.6 // indirect
cloud.google.com/go/kms v1.15.8 // indirect
chore(deps): bump gocloud.dev from 0.36.0 to 0.37.0 (#4688) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.36.0&new-version=0.37.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) Dependabot will merge this PR once it's up-to-date and CI passes on it, as requested by @caarlos0. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-13 19:59:13 +02:00
cloud.google.com/go/storage v1.39.1 // indirect
github.com/AlekSi/pointer v1.2.0 // indirect
feat(deps): bump github.com/google/ko from 0.12.0 to 0.13.0 (#3880) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.12.0 to 0.13.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.13.0</h2> <h2>What's Changed</h2> <ul> <li>SPDX: Fix package manager label by <a href="https://github.com/puerco"><code>@​puerco</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/801">ko-build/ko#801</a></li> <li>SPDX 2.3 support by <a href="https://github.com/puerco"><code>@​puerco</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/803">ko-build/ko#803</a></li> <li>ci: build and test using 1.18 and 1.19 (drop 1.17) by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/812">ko-build/ko#812</a></li> <li>removes repo move message by <a href="https://github.com/mchmarny"><code>@​mchmarny</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/814">ko-build/ko#814</a></li> <li>feat: write sbom result to disk by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/822">ko-build/ko#822</a></li> <li>feat: adding support for using multiple keychain for sending sbom results to a different repository by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/821">ko-build/ko#821</a></li> <li>Move docs to ko.build by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/749">ko-build/ko#749</a></li> <li>Update setup-ko version by <a href="https://github.com/ianlewis"><code>@​ianlewis</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/836">ko-build/ko#836</a></li> <li>Add -- usage in readme by <a href="https://github.com/jwcesign"><code>@​jwcesign</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/840">ko-build/ko#840</a></li> <li>add CONTRIBUTING, code of conduct, roadmap by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/837">ko-build/ko#837</a></li> <li>attempt to fix GH Pages publishing by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/843">ko-build/ko#843</a></li> <li>doc: fix link to Installation page in Getting Started by <a href="https://github.com/antoineco"><code>@​antoineco</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/846">ko-build/ko#846</a></li> <li>.ko.yaml: bump golang 1.18 -&gt; 1.19 by <a href="https://github.com/srenatus"><code>@​srenatus</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/848">ko-build/ko#848</a></li> <li>truncate -image-refs file by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/855">ko-build/ko#855</a></li> <li>update docs: fix broken links, align with README by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/854">ko-build/ko#854</a></li> <li>Handle KO_DOCKER_REPO=ko.local/repo and --bare correctly by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/820">ko-build/ko#820</a></li> <li>another docs update by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/856">ko-build/ko#856</a></li> <li>ko.build: support some common shortlinks by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/872">ko-build/ko#872</a></li> <li>install: fail with 404 instead of gzip error when url was wrong by <a href="https://github.com/grosser"><code>@​grosser</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/879">ko-build/ko#879</a></li> <li>feat: deduplicate tags by <a href="https://github.com/bluebrown"><code>@​bluebrown</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/884">ko-build/ko#884</a></li> <li>install mkdocs-redirect when publishing site by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/873">ko-build/ko#873</a></li> <li>nit: replace one-item slice with const by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/885">ko-build/ko#885</a></li> <li>Temp fix for SLSA generators by <a href="https://github.com/laurentsimon"><code>@​laurentsimon</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/886">ko-build/ko#886</a></li> <li>Fix verifier by <a href="https://github.com/laurentsimon"><code>@​laurentsimon</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/891">ko-build/ko#891</a></li> <li>Fix link in static-assets.md by <a href="https://github.com/yuryu"><code>@​yuryu</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/893">ko-build/ko#893</a></li> <li>add KO_DEFAULTBASEIMAGE usage to docs by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/895">ko-build/ko#895</a></li> <li>Publish an tagged image on release by <a href="https://github.com/vdemeester"><code>@​vdemeester</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/868">ko-build/ko#868</a></li> <li>Add option to configure default platforms by <a href="https://github.com/ReToCode"><code>@​ReToCode</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/897">ko-build/ko#897</a></li> <li>Fix broken SLSA link by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/899">ko-build/ko#899</a></li> <li>add MAINTAINERS.md by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/905">ko-build/ko#905</a></li> <li>fix: possible race condition when applying templates to flags/ldflags by <a href="https://github.com/caarlos0"><code>@​caarlos0</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/913">ko-build/ko#913</a></li> <li>update docs to reflect actual default base image by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/903">ko-build/ko#903</a></li> <li>remove repeated error message on failure by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/921">ko-build/ko#921</a></li> <li>website: update CNCF announcement by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/920">ko-build/ko#920</a></li> <li>fix KO_CONFIG_PATH pointing to a file by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/923">ko-build/ko#923</a></li> <li>upgrade to cosign v2.0.0-rc.0 by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/933">ko-build/ko#933</a></li> <li>Feature: Add ECR presubmit testing. by <a href="https://github.com/mattmoor"><code>@​mattmoor</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/934">ko-build/ko#934</a></li> <li>remove 'ko deps' by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/937">ko-build/ko#937</a></li> <li>feat: Add KO_GO_PATH env var by <a href="https://github.com/embano1"><code>@​embano1</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/930">ko-build/ko#930</a></li> <li>add ko.build/slack short link by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/945">ko-build/ko#945</a></li> <li>update link to ko goreleaser docs by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/936">ko-build/ko#936</a></li> <li>add ko community meeting details by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/938">ko-build/ko#938</a></li> <li>fix cosign by adding --yes by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/973">ko-build/ko#973</a></li> <li>fix: handle docker's unknown/unknown platform in index manifests by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/975">ko-build/ko#975</a></li> <li>fix file extension for cyclonedx by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/974">ko-build/ko#974</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ianlewis"><code>@​ianlewis</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/836">ko-build/ko#836</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/e22e7a15ffb988adc14c3fc6a964f61ed711812f"><code>e22e7a1</code></a> bump ggcr dep to <a href="https://github.com/main"><code>@​main</code></a> (<a href="https://redirect.github.com/google/ko/issues/976">#976</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/8e075ae1f1822bb61a871f11197566b362c342f0"><code>8e075ae</code></a> fix file extension for cyclonedx (<a href="https://redirect.github.com/google/ko/issues/974">#974</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/11670b7498be63bc0e04e7ba36433fd22f9654ce"><code>11670b7</code></a> fix: handle docker's unknown/unknown platform in index manifests (<a href="https://redirect.github.com/google/ko/issues/975">#975</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/7ce947817e2f59942cb181aa833bfd13533bcc19"><code>7ce9478</code></a> fix cosign by adding --yes (<a href="https://redirect.github.com/google/ko/issues/973">#973</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/9302da78dc995b2b2dd70c044708c3c4c6a056b6"><code>9302da7</code></a> Bump k8s.io/apimachinery from 0.26.1 to 0.26.2 (<a href="https://redirect.github.com/google/ko/issues/972">#972</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/a1588838ba1698c3ca3f6785363a1a9f82ed4baa"><code>a158883</code></a> Bump sigstore/cosign-installer from 2.8.1 to 3.0.1 (<a href="https://redirect.github.com/google/ko/issues/971">#971</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/86b6c2854f8a7c321ce1b8ea121938ce9cc79475"><code>86b6c28</code></a> Bump actions/checkout from 2 to 3 (<a href="https://redirect.github.com/google/ko/issues/966">#966</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/0bd12fb106ed9d03994a6b8883f8a5d834a2aa15"><code>0bd12fb</code></a> Bump slsa-framework/slsa-github-generator from 1.2.1 to 1.5.0 (<a href="https://redirect.github.com/google/ko/issues/967">#967</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/d5125daacd07306d3814a6910cc54422824331e6"><code>d5125da</code></a> Bump github.com/sigstore/cosign/v2 from 2.0.0-rc.2 to 2.0.0 (<a href="https://redirect.github.com/google/ko/issues/965">#965</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/03f4aed68268fb320b32195c80292300056b264c"><code>03f4aed</code></a> add ko community meeting details (<a href="https://redirect.github.com/google/ko/issues/938">#938</a>)</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.12.0...v0.13.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.12.0&new-version=0.13.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Carlos A Becker <caarlos0@users.noreply.github.com>
2023-03-29 19:38:57 +02:00
github.com/Azure/azure-sdk-for-go v68.0.0+incompatible // indirect
chore(deps): bump gocloud.dev from 0.36.0 to 0.37.0 (#4688) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.36.0&new-version=0.37.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) Dependabot will merge this PR once it's up-to-date and CI passes on it, as requested by @caarlos0. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-13 19:59:13 +02:00
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.10.0 // indirect
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.5.1 // indirect
chore(deps): bump gocloud.dev from 0.36.0 to 0.37.0 (#4688) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.36.0&new-version=0.37.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) Dependabot will merge this PR once it's up-to-date and CI passes on it, as requested by @caarlos0. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-13 19:59:13 +02:00
github.com/Azure/azure-sdk-for-go/sdk/internal v1.5.2 // indirect
feat(deps): bump gocloud.dev from 0.29.0 to 0.30.0 (#4129) Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.29.0 to 0.30.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-cloud/releases">gocloud.dev's releases</a>.</em></p> <blockquote> <h2>v0.30.0</h2> <p><strong>blob</strong></p> <ul> <li><strong>all</strong>: Add <code>Upload</code> and <code>Download</code> methods that may be more efficient for some drivers.</li> <li><strong>s3blob</strong>: Add support for per-request <code>s3v2.Options</code>.</li> <li><strong>s3blob</strong>: Stop escaping second <code>/</code> in <code>//</code>; it's no longer necessary.</li> </ul> <p><strong>pubsub</strong></p> <ul> <li><strong>gcppubsub</strong>: Make it possible to configure <code>max_send_batch_size</code>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-cloud/commit/d2d5bedb50683e2a6b893b75aafc193eca2715db"><code>d2d5bed</code></a> all: prep for release (<a href="https://redirect.github.com/google/go-cloud/issues/3263">#3263</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/c2e172b5a78def74973f7f3a8ece7c0bd6967432"><code>c2e172b</code></a> all: update dependencies (<a href="https://redirect.github.com/google/go-cloud/issues/3262">#3262</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/098177a48cae1bebfc90f88ed43d319444cab804"><code>098177a</code></a> blob/s3blob: fix the 'awssdk' argument examples</li> <li><a href="https://github.com/google/go-cloud/commit/2e4fad43f0b2606833b6a0de3e18628c70e11398"><code>2e4fad4</code></a> all: remove refs to deprecated xerrors</li> <li><a href="https://github.com/google/go-cloud/commit/1db413f1b3c4e344618b36401ba7e6dca3892929"><code>1db413f</code></a> pubsub/gcppubsub: make it possible to configure max_send_batch_size</li> <li><a href="https://github.com/google/go-cloud/commit/0c8428bf433136e7a4d96de0841f6373c6eacb53"><code>0c8428b</code></a> blob: Add Upload and Download methods that may be more efficient for some dri...</li> <li><a href="https://github.com/google/go-cloud/commit/54c71241a56f4c89eb64f587e5dc55667eaa40a3"><code>54c7124</code></a> all: cleanup duplicate import statements</li> <li><a href="https://github.com/google/go-cloud/commit/28b1328ae4fee939441faa5ee2e4eeba74c88ce7"><code>28b1328</code></a> all: minor code simplifications for returned boolean expressions</li> <li><a href="https://github.com/google/go-cloud/commit/2a407f5e6a71951384531445e25c58194f235062"><code>2a407f5</code></a> blob/gcsblob: Refresh goldens</li> <li><a href="https://github.com/google/go-cloud/commit/0cc16c8ae11e47028df24c4973debd6c56d29729"><code>0cc16c8</code></a> all: update goldens (<a href="https://redirect.github.com/google/go-cloud/issues/3252">#3252</a>)</li> <li>Additional commits viewable in <a href="https://github.com/google/go-cloud/compare/v0.29.0...v0.30.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.29.0&new-version=0.30.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-20 14:04:08 +02:00
github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys v0.10.0 // indirect
feat(deps): bump gocloud.dev from 0.27.0 to 0.28.0 (#3689) Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.27.0 to 0.28.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-cloud/releases">gocloud.dev's releases</a>.</em></p> <blockquote> <h2>v0.28.0</h2> <p><strong>BREAKING CHANGES</strong>:</p> <ul> <li><strong>secrets/azurekeyvault</strong>: Updated to latest Azure SDK.</li> <li><strong>blob/azureblob</strong>: Updated to match recent breaking changes in the Azure packages (yes, again).</li> <li><strong>pubsub/awssnssqs</strong>: Fixed <code>BeforeSend</code> to take a pointer to the <code>SendMessageBatchRequestEntry</code> struct, so that it can be modified.</li> </ul> <p><strong>blob</strong></p> <ul> <li><strong>memblob</strong>: Fixed bug where use of <code>BeforeCopy</code> callback would drop the actual copying.</li> <li><strong>azureblob</strong>: Updated to match recent breaking changes in the Azure packages.</li> </ul> <p><strong>pubsub</strong></p> <ul> <li><strong>all</strong>: Simplified and improved batch sizing, should resolve issues with too-frequent polling in some situations.</li> <li><strong>azurepubsub</strong>: Made <code>ListenerTimeout</code> configurable.</li> <li><strong>gcppubsub</strong> and <strong>awssnssqs</strong>: Support lazy mode for <code>Nack</code> (where no explicit <code>Nack</code> is sent).</li> <li><strong>awssnssqs</strong>: Fixed <code>BeforeSend</code> to take a pointer to the <code>SendMessageBatchRequestEntry</code> struct, so that it can be modified.</li> </ul> <p><strong>secrets</strong></p> <ul> <li><strong>secrets/azurekeyvault</strong>: Updated to latest Azure SDK. Use azidentity.NewDefaultAzureCredential.</li> </ul> <p><strong>sql</strong></p> <ul> <li><strong>gcp/cloudsql</strong>: Fixed IAM login.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-cloud/commit/24166090495b8e084a23aa7d11fcc81ec33e4729"><code>2416609</code></a> all: prep for v0.28.0 (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3207">#3207</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/13f46eb8065d5ea62b757f5f0f11a56f48faf7cc"><code>13f46eb</code></a> pubsub: simplify and improve batch sizing, especially for low message rates</li> <li><a href="https://github.com/google/go-cloud/commit/8f2c2b9a392a8e4a3d7a4942f88f3df607f8f6d0"><code>8f2c2b9</code></a> pubsub/memsub: Add Options for batching (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3205">#3205</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/fe0a3d75fe43c039258df25ebf102602526e3052"><code>fe0a3d7</code></a> pubsub/awssqs: Fix BeforeSend/As to enable changes to the sqs input message (...</li> <li><a href="https://github.com/google/go-cloud/commit/dfaf95af34dd9022a69a061028e0ceec98e9c670"><code>dfaf95a</code></a> secrets/azurekeyvault: Use azidentity.NewDefaultAzureCredential to support ot...</li> <li><a href="https://github.com/google/go-cloud/commit/1e26311532928f060c490a7fbf2be92b55ee12c4"><code>1e26311</code></a> blob: Remove some debug logging (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3197">#3197</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/43ed5a499864c08b7b6549ff7085f19634a1f02c"><code>43ed5a4</code></a> pubsub/gcppubsub: Support lazy mode for Nacks (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3195">#3195</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/be80e70b3dcf7a6b86481881c7ac0b44a8095178"><code>be80e70</code></a> pubsub/awssnssqs: Support lazy mode for Nacks (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3194">#3194</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/7d690993a53cf8cc2e7af07872876d58601f1261"><code>7d69099</code></a> blob/azblob: Update to latest, and restore As for dirlist (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3191">#3191</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/e942f3c339f0eb617ac4dbc7f37cc4e5920ee7cc"><code>e942f3c</code></a> blob/azblob: Restore As for List entry (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3188">#3188</a>)</li> <li>Additional commits viewable in <a href="https://github.com/google/go-cloud/compare/v0.27.0...v0.28.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.27.0&new-version=0.28.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-01-11 14:09:51 +02:00
github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal v0.7.1 // indirect
chore(deps): bump gocloud.dev from 0.36.0 to 0.37.0 (#4688) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.36.0&new-version=0.37.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) Dependabot will merge this PR once it's up-to-date and CI passes on it, as requested by @caarlos0. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-13 19:59:13 +02:00
github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.3.1 // indirect
feat(deps): bump github.com/google/ko from 0.13.0 to 0.14.1 (#4132) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.13.0 to 0.14.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.14.1</h2> <h2>What's Changed</h2> <ul> <li>fix: Use attestation-name output by <a href="https://github.com/ianlewis"><code>@​ianlewis</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/980">ko-build/ko#980</a></li> <li>Upgrade to go120 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/984">ko-build/ko#984</a></li> <li>fix release workflow by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/977">ko-build/ko#977</a></li> <li>fix deprecated attestation name by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/983">ko-build/ko#983</a></li> <li>refactor release job by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/986">ko-build/ko#986</a></li> <li>use git hash instead of git tag by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/988">ko-build/ko#988</a></li> <li>Correct a typo in resolver.go by <a href="https://github.com/felixonmars"><code>@​felixonmars</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/989">ko-build/ko#989</a></li> <li>feat: add riscv64 to goreleaser goarch by <a href="https://github.com/ernado"><code>@​ernado</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/990">ko-build/ko#990</a></li> <li>try to fix codeql workflow by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/994">ko-build/ko#994</a></li> <li>Push images faster by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1005">ko-build/ko#1005</a></li> <li>Don't publish tags twice by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1010">ko-build/ko#1010</a></li> <li>Add context to many gobuild errors by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1016">ko-build/ko#1016</a></li> <li>Fix --local with KO_DOCKER_REPO by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1017">ko-build/ko#1017</a></li> <li>Fix: Incorporate platform architecture by <a href="https://github.com/mattmoor"><code>@​mattmoor</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1029">ko-build/ko#1029</a></li> <li>Update community.md by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1035">ko-build/ko#1035</a></li> <li>mention ko tekton task by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1039">ko-build/ko#1039</a></li> <li>Update community.md by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1037">ko-build/ko#1037</a></li> <li>Fix kind image loading for MacOS by <a href="https://github.com/aidy"><code>@​aidy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1026">ko-build/ko#1026</a></li> <li>Revert &quot;Fix kind image loading for MacOS&quot; by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1054">ko-build/ko#1054</a></li> <li>update boilerplate file to be KO Build Authors by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1056">ko-build/ko#1056</a></li> <li>Pin setup-ko to previous release by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1082">ko-build/ko#1082</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/felixonmars"><code>@​felixonmars</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/989">ko-build/ko#989</a></li> <li><a href="https://github.com/ernado"><code>@​ernado</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/990">ko-build/ko#990</a></li> <li><a href="https://github.com/aidy"><code>@​aidy</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1026">ko-build/ko#1026</a></li> <li><a href="https://github.com/luhring"><code>@​luhring</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1073">ko-build/ko#1073</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ko-build/ko/compare/v0.13.0...v0.14.1">https://github.com/ko-build/ko/compare/v0.13.0...v0.14.1</a></p> <h2>v0.14.0</h2> <p>No release notes provided.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/200db7243f02b5c0303e21d8ab8e3b4ad3a229d0"><code>200db72</code></a> Pin setup-ko to previous release (<a href="https://redirect.github.com/google/ko/issues/1082">#1082</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/4366ded82cdda05ef85bc5483d19daa241d08f38"><code>4366ded</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1079">#1079</a> from ko-build/dependabot/github_actions/slsa-framewo...</li> <li><a href="https://github.com/ko-build/ko/commit/adbea950c10e2c69c7bf0589a6bf0b4e7ceafbfa"><code>adbea95</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1078">#1078</a> from ko-build/dependabot/github_actions/goreleaser/g...</li> <li><a href="https://github.com/ko-build/ko/commit/6175237fe6539a48206da87c239ad98b4f7d7312"><code>6175237</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1077">#1077</a> from ko-build/dependabot/go_modules/github.com/spf13...</li> <li><a href="https://github.com/ko-build/ko/commit/5e5fe2e703c1f0c9186975b06090ae563283f48d"><code>5e5fe2e</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1076">#1076</a> from ko-build/dependabot/github_actions/aws-actions/...</li> <li><a href="https://github.com/ko-build/ko/commit/dc9b3eebef9818e2efab17cec8dd3eebff72e074"><code>dc9b3ee</code></a> Bump github.com/spf13/viper from 1.15.0 to 1.16.0</li> <li><a href="https://github.com/ko-build/ko/commit/ed445128e25c7bd0b6643b58ac44383a583d84f5"><code>ed44512</code></a> Bump golang.org/x/tools from 0.9.3 to 0.10.0 (<a href="https://redirect.github.com/google/ko/issues/1080">#1080</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/fcd95ec958cad910b4746245662506b1f974f40e"><code>fcd95ec</code></a> Bump slsa-framework/slsa-github-generator from 1.6.0 to 1.7.0</li> <li><a href="https://github.com/ko-build/ko/commit/974f09cdeacd7042c3db573366768ecbb32246a5"><code>974f09c</code></a> Bump goreleaser/goreleaser-action from 4.2.0 to 4.3.0</li> <li><a href="https://github.com/ko-build/ko/commit/893f6e877f7c352261c13e078bb8fc9709bb285c"><code>893f6e8</code></a> Bump aws-actions/configure-aws-credentials from 2.1.0 to 2.2.0</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.13.0...v0.14.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.13.0&new-version=0.14.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-26 18:56:50 +02:00
github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
github.com/Azure/go-autorest v14.2.0+incompatible // indirect
feat(deps): bump github.com/sigstore/rekor from 1.1.1 to 1.2.0 (#4044) Bumps [github.com/sigstore/rekor](https://github.com/sigstore/rekor) from 1.1.1 to 1.2.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/rekor/blob/main/CHANGELOG.md">github.com/sigstore/rekor's changelog</a>.</em></p> <blockquote> <h1>v1.2.0</h1> <h2>Functional Enhancements</h2> <ul> <li>add client method to generate TLE struct (<a href="https://redirect.github.com/sigstore/rekor/issues/1498">#1498</a>)</li> <li>add dsse type (<a href="https://redirect.github.com/sigstore/rekor/issues/1487">#1487</a>)</li> <li>support other KMS providers (AWS, Azure, Hashicorp) in addition to GCP (<a href="https://redirect.github.com/sigstore/rekor/issues/1488">#1488</a>)</li> <li>Add concurrency to backfill-redis (<a href="https://redirect.github.com/sigstore/rekor/issues/1504">#1504</a>)</li> <li>omit informational message if machine-parseable output has been requested (<a href="https://redirect.github.com/sigstore/rekor/issues/1486">#1486</a>)</li> <li>Publish stable checkpoint periodically to Redis (<a href="https://redirect.github.com/sigstore/rekor/issues/1461">#1461</a>)</li> <li>Add intoto v0.0.2 to backfill script (<a href="https://redirect.github.com/sigstore/rekor/issues/1500">#1500</a>)</li> <li>add new method to test insertability of proposed entries into log (<a href="https://redirect.github.com/sigstore/rekor/issues/1410">#1410</a>)</li> </ul> <h2>Quality Enhancements</h2> <ul> <li>use t.Skip() in fuzzers (<a href="https://redirect.github.com/sigstore/rekor/issues/1506">#1506</a>)</li> <li>improve fuzzing coverage (<a href="https://redirect.github.com/sigstore/rekor/issues/1499">#1499</a>)</li> <li>Remove watcher script (<a href="https://redirect.github.com/sigstore/rekor/issues/1484">#1484</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-frqx-jfcm-6jjr</li> <li>Remove requirement of PayloadHash for intoto 0.0.1 (<a href="https://redirect.github.com/sigstore/rekor/issues/1490">#1490</a>)</li> <li>fix lint errors, bump linter up to 1.52 (<a href="https://redirect.github.com/sigstore/rekor/issues/1485">#1485</a>)</li> <li>Remove dependencies from pkg/util (<a href="https://redirect.github.com/sigstore/rekor/issues/1469">#1469</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>Bob Callaway</li> <li>Carlos Tadeu Panato Junior</li> <li>Ceridwen Coghlan</li> <li>Cody Soyland</li> <li>Hayden B</li> <li>Miloslav Trmač</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/rekor/commit/20a995116b1548b79e62ba0ad9c29800387e8641"><code>20a9951</code></a> update for v1.2.0 (<a href="https://redirect.github.com/sigstore/rekor/issues/1507">#1507</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/140c5add105179e5ffd9e3e114fd1b6b93aebbd4"><code>140c5ad</code></a> Merge pull request from GHSA-frqx-jfcm-6jjr</li> <li><a href="https://github.com/sigstore/rekor/commit/85bb2bc7a35dcc94cd94e18984711806f437dcb6"><code>85bb2bc</code></a> use t.Skip() in fuzzers (<a href="https://redirect.github.com/sigstore/rekor/issues/1506">#1506</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/3adca0d2528699d2ff93bf78babef8b5cac46122"><code>3adca0d</code></a> Add concurrency to backfill-redis (<a href="https://redirect.github.com/sigstore/rekor/issues/1504">#1504</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/795a23619d5db1c9625a71f776474033c6712b56"><code>795a236</code></a> add client method to generate TLE struct (<a href="https://redirect.github.com/sigstore/rekor/issues/1498">#1498</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/161a796f91d7255443aa6ce98e7981e6926762f0"><code>161a796</code></a> build(deps): bump github/codeql-action from 2.3.3 to 2.3.4 (<a href="https://redirect.github.com/sigstore/rekor/issues/1505">#1505</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/35c4489abcff256298f1bc9f7caaf5a946750dac"><code>35c4489</code></a> add dsse type (<a href="https://redirect.github.com/sigstore/rekor/issues/1487">#1487</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/d318e2bf433d398d95923f3509557777a2fe5abb"><code>d318e2b</code></a> support other KMS providers (AWS, Azure, Hashicorp) in addition to GCP (<a href="https://redirect.github.com/sigstore/rekor/issues/1488">#1488</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/d508ebad91ef4e39d8e0dd3543cebe20321dc752"><code>d508eba</code></a> Remove requirement of PayloadHash for intoto 0.0.1 (<a href="https://redirect.github.com/sigstore/rekor/issues/1490">#1490</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/b387701f27aace3e3396ad4fdbb8d3ccc869fb5f"><code>b387701</code></a> Add intoto v0.0.2 to backfill script (<a href="https://redirect.github.com/sigstore/rekor/issues/1500">#1500</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/rekor/compare/v1.1.1...v1.2.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/rekor&package-manager=go_modules&previous-version=1.1.1&new-version=1.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-05-27 05:24:50 +02:00
github.com/Azure/go-autorest/autorest v0.11.29 // indirect
feat(deps): bump gocloud.dev from 0.29.0 to 0.30.0 (#4129) Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.29.0 to 0.30.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-cloud/releases">gocloud.dev's releases</a>.</em></p> <blockquote> <h2>v0.30.0</h2> <p><strong>blob</strong></p> <ul> <li><strong>all</strong>: Add <code>Upload</code> and <code>Download</code> methods that may be more efficient for some drivers.</li> <li><strong>s3blob</strong>: Add support for per-request <code>s3v2.Options</code>.</li> <li><strong>s3blob</strong>: Stop escaping second <code>/</code> in <code>//</code>; it's no longer necessary.</li> </ul> <p><strong>pubsub</strong></p> <ul> <li><strong>gcppubsub</strong>: Make it possible to configure <code>max_send_batch_size</code>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-cloud/commit/d2d5bedb50683e2a6b893b75aafc193eca2715db"><code>d2d5bed</code></a> all: prep for release (<a href="https://redirect.github.com/google/go-cloud/issues/3263">#3263</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/c2e172b5a78def74973f7f3a8ece7c0bd6967432"><code>c2e172b</code></a> all: update dependencies (<a href="https://redirect.github.com/google/go-cloud/issues/3262">#3262</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/098177a48cae1bebfc90f88ed43d319444cab804"><code>098177a</code></a> blob/s3blob: fix the 'awssdk' argument examples</li> <li><a href="https://github.com/google/go-cloud/commit/2e4fad43f0b2606833b6a0de3e18628c70e11398"><code>2e4fad4</code></a> all: remove refs to deprecated xerrors</li> <li><a href="https://github.com/google/go-cloud/commit/1db413f1b3c4e344618b36401ba7e6dca3892929"><code>1db413f</code></a> pubsub/gcppubsub: make it possible to configure max_send_batch_size</li> <li><a href="https://github.com/google/go-cloud/commit/0c8428bf433136e7a4d96de0841f6373c6eacb53"><code>0c8428b</code></a> blob: Add Upload and Download methods that may be more efficient for some dri...</li> <li><a href="https://github.com/google/go-cloud/commit/54c71241a56f4c89eb64f587e5dc55667eaa40a3"><code>54c7124</code></a> all: cleanup duplicate import statements</li> <li><a href="https://github.com/google/go-cloud/commit/28b1328ae4fee939441faa5ee2e4eeba74c88ce7"><code>28b1328</code></a> all: minor code simplifications for returned boolean expressions</li> <li><a href="https://github.com/google/go-cloud/commit/2a407f5e6a71951384531445e25c58194f235062"><code>2a407f5</code></a> blob/gcsblob: Refresh goldens</li> <li><a href="https://github.com/google/go-cloud/commit/0cc16c8ae11e47028df24c4973debd6c56d29729"><code>0cc16c8</code></a> all: update goldens (<a href="https://redirect.github.com/google/go-cloud/issues/3252">#3252</a>)</li> <li>Additional commits viewable in <a href="https://github.com/google/go-cloud/compare/v0.29.0...v0.30.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.29.0&new-version=0.30.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-20 14:04:08 +02:00
github.com/Azure/go-autorest/autorest/adal v0.9.23 // indirect
feat(deps): bump github.com/google/ko from 0.12.0 to 0.13.0 (#3880) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.12.0 to 0.13.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.13.0</h2> <h2>What's Changed</h2> <ul> <li>SPDX: Fix package manager label by <a href="https://github.com/puerco"><code>@​puerco</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/801">ko-build/ko#801</a></li> <li>SPDX 2.3 support by <a href="https://github.com/puerco"><code>@​puerco</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/803">ko-build/ko#803</a></li> <li>ci: build and test using 1.18 and 1.19 (drop 1.17) by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/812">ko-build/ko#812</a></li> <li>removes repo move message by <a href="https://github.com/mchmarny"><code>@​mchmarny</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/814">ko-build/ko#814</a></li> <li>feat: write sbom result to disk by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/822">ko-build/ko#822</a></li> <li>feat: adding support for using multiple keychain for sending sbom results to a different repository by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/821">ko-build/ko#821</a></li> <li>Move docs to ko.build by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/749">ko-build/ko#749</a></li> <li>Update setup-ko version by <a href="https://github.com/ianlewis"><code>@​ianlewis</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/836">ko-build/ko#836</a></li> <li>Add -- usage in readme by <a href="https://github.com/jwcesign"><code>@​jwcesign</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/840">ko-build/ko#840</a></li> <li>add CONTRIBUTING, code of conduct, roadmap by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/837">ko-build/ko#837</a></li> <li>attempt to fix GH Pages publishing by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/843">ko-build/ko#843</a></li> <li>doc: fix link to Installation page in Getting Started by <a href="https://github.com/antoineco"><code>@​antoineco</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/846">ko-build/ko#846</a></li> <li>.ko.yaml: bump golang 1.18 -&gt; 1.19 by <a href="https://github.com/srenatus"><code>@​srenatus</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/848">ko-build/ko#848</a></li> <li>truncate -image-refs file by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/855">ko-build/ko#855</a></li> <li>update docs: fix broken links, align with README by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/854">ko-build/ko#854</a></li> <li>Handle KO_DOCKER_REPO=ko.local/repo and --bare correctly by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/820">ko-build/ko#820</a></li> <li>another docs update by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/856">ko-build/ko#856</a></li> <li>ko.build: support some common shortlinks by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/872">ko-build/ko#872</a></li> <li>install: fail with 404 instead of gzip error when url was wrong by <a href="https://github.com/grosser"><code>@​grosser</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/879">ko-build/ko#879</a></li> <li>feat: deduplicate tags by <a href="https://github.com/bluebrown"><code>@​bluebrown</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/884">ko-build/ko#884</a></li> <li>install mkdocs-redirect when publishing site by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/873">ko-build/ko#873</a></li> <li>nit: replace one-item slice with const by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/885">ko-build/ko#885</a></li> <li>Temp fix for SLSA generators by <a href="https://github.com/laurentsimon"><code>@​laurentsimon</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/886">ko-build/ko#886</a></li> <li>Fix verifier by <a href="https://github.com/laurentsimon"><code>@​laurentsimon</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/891">ko-build/ko#891</a></li> <li>Fix link in static-assets.md by <a href="https://github.com/yuryu"><code>@​yuryu</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/893">ko-build/ko#893</a></li> <li>add KO_DEFAULTBASEIMAGE usage to docs by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/895">ko-build/ko#895</a></li> <li>Publish an tagged image on release by <a href="https://github.com/vdemeester"><code>@​vdemeester</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/868">ko-build/ko#868</a></li> <li>Add option to configure default platforms by <a href="https://github.com/ReToCode"><code>@​ReToCode</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/897">ko-build/ko#897</a></li> <li>Fix broken SLSA link by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/899">ko-build/ko#899</a></li> <li>add MAINTAINERS.md by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/905">ko-build/ko#905</a></li> <li>fix: possible race condition when applying templates to flags/ldflags by <a href="https://github.com/caarlos0"><code>@​caarlos0</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/913">ko-build/ko#913</a></li> <li>update docs to reflect actual default base image by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/903">ko-build/ko#903</a></li> <li>remove repeated error message on failure by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/921">ko-build/ko#921</a></li> <li>website: update CNCF announcement by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/920">ko-build/ko#920</a></li> <li>fix KO_CONFIG_PATH pointing to a file by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/923">ko-build/ko#923</a></li> <li>upgrade to cosign v2.0.0-rc.0 by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/933">ko-build/ko#933</a></li> <li>Feature: Add ECR presubmit testing. by <a href="https://github.com/mattmoor"><code>@​mattmoor</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/934">ko-build/ko#934</a></li> <li>remove 'ko deps' by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/937">ko-build/ko#937</a></li> <li>feat: Add KO_GO_PATH env var by <a href="https://github.com/embano1"><code>@​embano1</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/930">ko-build/ko#930</a></li> <li>add ko.build/slack short link by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/945">ko-build/ko#945</a></li> <li>update link to ko goreleaser docs by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/936">ko-build/ko#936</a></li> <li>add ko community meeting details by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/938">ko-build/ko#938</a></li> <li>fix cosign by adding --yes by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/973">ko-build/ko#973</a></li> <li>fix: handle docker's unknown/unknown platform in index manifests by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/975">ko-build/ko#975</a></li> <li>fix file extension for cyclonedx by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/974">ko-build/ko#974</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ianlewis"><code>@​ianlewis</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/836">ko-build/ko#836</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/e22e7a15ffb988adc14c3fc6a964f61ed711812f"><code>e22e7a1</code></a> bump ggcr dep to <a href="https://github.com/main"><code>@​main</code></a> (<a href="https://redirect.github.com/google/ko/issues/976">#976</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/8e075ae1f1822bb61a871f11197566b362c342f0"><code>8e075ae</code></a> fix file extension for cyclonedx (<a href="https://redirect.github.com/google/ko/issues/974">#974</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/11670b7498be63bc0e04e7ba36433fd22f9654ce"><code>11670b7</code></a> fix: handle docker's unknown/unknown platform in index manifests (<a href="https://redirect.github.com/google/ko/issues/975">#975</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/7ce947817e2f59942cb181aa833bfd13533bcc19"><code>7ce9478</code></a> fix cosign by adding --yes (<a href="https://redirect.github.com/google/ko/issues/973">#973</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/9302da78dc995b2b2dd70c044708c3c4c6a056b6"><code>9302da7</code></a> Bump k8s.io/apimachinery from 0.26.1 to 0.26.2 (<a href="https://redirect.github.com/google/ko/issues/972">#972</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/a1588838ba1698c3ca3f6785363a1a9f82ed4baa"><code>a158883</code></a> Bump sigstore/cosign-installer from 2.8.1 to 3.0.1 (<a href="https://redirect.github.com/google/ko/issues/971">#971</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/86b6c2854f8a7c321ce1b8ea121938ce9cc79475"><code>86b6c28</code></a> Bump actions/checkout from 2 to 3 (<a href="https://redirect.github.com/google/ko/issues/966">#966</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/0bd12fb106ed9d03994a6b8883f8a5d834a2aa15"><code>0bd12fb</code></a> Bump slsa-framework/slsa-github-generator from 1.2.1 to 1.5.0 (<a href="https://redirect.github.com/google/ko/issues/967">#967</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/d5125daacd07306d3814a6910cc54422824331e6"><code>d5125da</code></a> Bump github.com/sigstore/cosign/v2 from 2.0.0-rc.2 to 2.0.0 (<a href="https://redirect.github.com/google/ko/issues/965">#965</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/03f4aed68268fb320b32195c80292300056b264c"><code>03f4aed</code></a> add ko community meeting details (<a href="https://redirect.github.com/google/ko/issues/938">#938</a>)</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.12.0...v0.13.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.12.0&new-version=0.13.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Carlos A Becker <caarlos0@users.noreply.github.com>
2023-03-29 19:38:57 +02:00
github.com/Azure/go-autorest/autorest/azure/auth v0.5.12 // indirect
github.com/Azure/go-autorest/autorest/azure/cli v0.4.6 // indirect
github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
github.com/Azure/go-autorest/autorest/to v0.4.0 // indirect
github.com/Azure/go-autorest/logger v0.2.1 // indirect
github.com/Azure/go-autorest/tracing v0.6.0 // indirect
chore(deps): bump gocloud.dev from 0.36.0 to 0.37.0 (#4688) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.36.0&new-version=0.37.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) Dependabot will merge this PR once it's up-to-date and CI passes on it, as requested by @caarlos0. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-13 19:59:13 +02:00
github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2 // indirect
feat(deps): bump github.com/google/ko from 0.13.0 to 0.14.1 (#4132) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.13.0 to 0.14.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.14.1</h2> <h2>What's Changed</h2> <ul> <li>fix: Use attestation-name output by <a href="https://github.com/ianlewis"><code>@​ianlewis</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/980">ko-build/ko#980</a></li> <li>Upgrade to go120 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/984">ko-build/ko#984</a></li> <li>fix release workflow by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/977">ko-build/ko#977</a></li> <li>fix deprecated attestation name by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/983">ko-build/ko#983</a></li> <li>refactor release job by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/986">ko-build/ko#986</a></li> <li>use git hash instead of git tag by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/988">ko-build/ko#988</a></li> <li>Correct a typo in resolver.go by <a href="https://github.com/felixonmars"><code>@​felixonmars</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/989">ko-build/ko#989</a></li> <li>feat: add riscv64 to goreleaser goarch by <a href="https://github.com/ernado"><code>@​ernado</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/990">ko-build/ko#990</a></li> <li>try to fix codeql workflow by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/994">ko-build/ko#994</a></li> <li>Push images faster by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1005">ko-build/ko#1005</a></li> <li>Don't publish tags twice by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1010">ko-build/ko#1010</a></li> <li>Add context to many gobuild errors by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1016">ko-build/ko#1016</a></li> <li>Fix --local with KO_DOCKER_REPO by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1017">ko-build/ko#1017</a></li> <li>Fix: Incorporate platform architecture by <a href="https://github.com/mattmoor"><code>@​mattmoor</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1029">ko-build/ko#1029</a></li> <li>Update community.md by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1035">ko-build/ko#1035</a></li> <li>mention ko tekton task by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1039">ko-build/ko#1039</a></li> <li>Update community.md by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1037">ko-build/ko#1037</a></li> <li>Fix kind image loading for MacOS by <a href="https://github.com/aidy"><code>@​aidy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1026">ko-build/ko#1026</a></li> <li>Revert &quot;Fix kind image loading for MacOS&quot; by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1054">ko-build/ko#1054</a></li> <li>update boilerplate file to be KO Build Authors by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1056">ko-build/ko#1056</a></li> <li>Pin setup-ko to previous release by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1082">ko-build/ko#1082</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/felixonmars"><code>@​felixonmars</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/989">ko-build/ko#989</a></li> <li><a href="https://github.com/ernado"><code>@​ernado</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/990">ko-build/ko#990</a></li> <li><a href="https://github.com/aidy"><code>@​aidy</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1026">ko-build/ko#1026</a></li> <li><a href="https://github.com/luhring"><code>@​luhring</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1073">ko-build/ko#1073</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ko-build/ko/compare/v0.13.0...v0.14.1">https://github.com/ko-build/ko/compare/v0.13.0...v0.14.1</a></p> <h2>v0.14.0</h2> <p>No release notes provided.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/200db7243f02b5c0303e21d8ab8e3b4ad3a229d0"><code>200db72</code></a> Pin setup-ko to previous release (<a href="https://redirect.github.com/google/ko/issues/1082">#1082</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/4366ded82cdda05ef85bc5483d19daa241d08f38"><code>4366ded</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1079">#1079</a> from ko-build/dependabot/github_actions/slsa-framewo...</li> <li><a href="https://github.com/ko-build/ko/commit/adbea950c10e2c69c7bf0589a6bf0b4e7ceafbfa"><code>adbea95</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1078">#1078</a> from ko-build/dependabot/github_actions/goreleaser/g...</li> <li><a href="https://github.com/ko-build/ko/commit/6175237fe6539a48206da87c239ad98b4f7d7312"><code>6175237</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1077">#1077</a> from ko-build/dependabot/go_modules/github.com/spf13...</li> <li><a href="https://github.com/ko-build/ko/commit/5e5fe2e703c1f0c9186975b06090ae563283f48d"><code>5e5fe2e</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1076">#1076</a> from ko-build/dependabot/github_actions/aws-actions/...</li> <li><a href="https://github.com/ko-build/ko/commit/dc9b3eebef9818e2efab17cec8dd3eebff72e074"><code>dc9b3ee</code></a> Bump github.com/spf13/viper from 1.15.0 to 1.16.0</li> <li><a href="https://github.com/ko-build/ko/commit/ed445128e25c7bd0b6643b58ac44383a583d84f5"><code>ed44512</code></a> Bump golang.org/x/tools from 0.9.3 to 0.10.0 (<a href="https://redirect.github.com/google/ko/issues/1080">#1080</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/fcd95ec958cad910b4746245662506b1f974f40e"><code>fcd95ec</code></a> Bump slsa-framework/slsa-github-generator from 1.6.0 to 1.7.0</li> <li><a href="https://github.com/ko-build/ko/commit/974f09cdeacd7042c3db573366768ecbb32246a5"><code>974f09c</code></a> Bump goreleaser/goreleaser-action from 4.2.0 to 4.3.0</li> <li><a href="https://github.com/ko-build/ko/commit/893f6e877f7c352261c13e078bb8fc9709bb285c"><code>893f6e8</code></a> Bump aws-actions/configure-aws-credentials from 2.1.0 to 2.2.0</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.13.0...v0.14.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.13.0&new-version=0.14.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-26 18:56:50 +02:00
github.com/BurntSushi/toml v1.2.1 // indirect
github.com/Masterminds/goutils v1.1.1 // indirect
github.com/Masterminds/sprig/v3 v3.2.3 // indirect
feat(deps): bump github.com/google/ko from 0.13.0 to 0.14.1 (#4132) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.13.0 to 0.14.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.14.1</h2> <h2>What's Changed</h2> <ul> <li>fix: Use attestation-name output by <a href="https://github.com/ianlewis"><code>@​ianlewis</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/980">ko-build/ko#980</a></li> <li>Upgrade to go120 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/984">ko-build/ko#984</a></li> <li>fix release workflow by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/977">ko-build/ko#977</a></li> <li>fix deprecated attestation name by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/983">ko-build/ko#983</a></li> <li>refactor release job by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/986">ko-build/ko#986</a></li> <li>use git hash instead of git tag by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/988">ko-build/ko#988</a></li> <li>Correct a typo in resolver.go by <a href="https://github.com/felixonmars"><code>@​felixonmars</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/989">ko-build/ko#989</a></li> <li>feat: add riscv64 to goreleaser goarch by <a href="https://github.com/ernado"><code>@​ernado</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/990">ko-build/ko#990</a></li> <li>try to fix codeql workflow by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/994">ko-build/ko#994</a></li> <li>Push images faster by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1005">ko-build/ko#1005</a></li> <li>Don't publish tags twice by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1010">ko-build/ko#1010</a></li> <li>Add context to many gobuild errors by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1016">ko-build/ko#1016</a></li> <li>Fix --local with KO_DOCKER_REPO by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1017">ko-build/ko#1017</a></li> <li>Fix: Incorporate platform architecture by <a href="https://github.com/mattmoor"><code>@​mattmoor</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1029">ko-build/ko#1029</a></li> <li>Update community.md by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1035">ko-build/ko#1035</a></li> <li>mention ko tekton task by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1039">ko-build/ko#1039</a></li> <li>Update community.md by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1037">ko-build/ko#1037</a></li> <li>Fix kind image loading for MacOS by <a href="https://github.com/aidy"><code>@​aidy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1026">ko-build/ko#1026</a></li> <li>Revert &quot;Fix kind image loading for MacOS&quot; by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1054">ko-build/ko#1054</a></li> <li>update boilerplate file to be KO Build Authors by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1056">ko-build/ko#1056</a></li> <li>Pin setup-ko to previous release by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1082">ko-build/ko#1082</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/felixonmars"><code>@​felixonmars</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/989">ko-build/ko#989</a></li> <li><a href="https://github.com/ernado"><code>@​ernado</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/990">ko-build/ko#990</a></li> <li><a href="https://github.com/aidy"><code>@​aidy</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1026">ko-build/ko#1026</a></li> <li><a href="https://github.com/luhring"><code>@​luhring</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1073">ko-build/ko#1073</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ko-build/ko/compare/v0.13.0...v0.14.1">https://github.com/ko-build/ko/compare/v0.13.0...v0.14.1</a></p> <h2>v0.14.0</h2> <p>No release notes provided.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/200db7243f02b5c0303e21d8ab8e3b4ad3a229d0"><code>200db72</code></a> Pin setup-ko to previous release (<a href="https://redirect.github.com/google/ko/issues/1082">#1082</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/4366ded82cdda05ef85bc5483d19daa241d08f38"><code>4366ded</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1079">#1079</a> from ko-build/dependabot/github_actions/slsa-framewo...</li> <li><a href="https://github.com/ko-build/ko/commit/adbea950c10e2c69c7bf0589a6bf0b4e7ceafbfa"><code>adbea95</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1078">#1078</a> from ko-build/dependabot/github_actions/goreleaser/g...</li> <li><a href="https://github.com/ko-build/ko/commit/6175237fe6539a48206da87c239ad98b4f7d7312"><code>6175237</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1077">#1077</a> from ko-build/dependabot/go_modules/github.com/spf13...</li> <li><a href="https://github.com/ko-build/ko/commit/5e5fe2e703c1f0c9186975b06090ae563283f48d"><code>5e5fe2e</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1076">#1076</a> from ko-build/dependabot/github_actions/aws-actions/...</li> <li><a href="https://github.com/ko-build/ko/commit/dc9b3eebef9818e2efab17cec8dd3eebff72e074"><code>dc9b3ee</code></a> Bump github.com/spf13/viper from 1.15.0 to 1.16.0</li> <li><a href="https://github.com/ko-build/ko/commit/ed445128e25c7bd0b6643b58ac44383a583d84f5"><code>ed44512</code></a> Bump golang.org/x/tools from 0.9.3 to 0.10.0 (<a href="https://redirect.github.com/google/ko/issues/1080">#1080</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/fcd95ec958cad910b4746245662506b1f974f40e"><code>fcd95ec</code></a> Bump slsa-framework/slsa-github-generator from 1.6.0 to 1.7.0</li> <li><a href="https://github.com/ko-build/ko/commit/974f09cdeacd7042c3db573366768ecbb32246a5"><code>974f09c</code></a> Bump goreleaser/goreleaser-action from 4.2.0 to 4.3.0</li> <li><a href="https://github.com/ko-build/ko/commit/893f6e877f7c352261c13e078bb8fc9709bb285c"><code>893f6e8</code></a> Bump aws-actions/configure-aws-credentials from 2.1.0 to 2.2.0</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.13.0...v0.14.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.13.0&new-version=0.14.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-26 18:56:50 +02:00
github.com/Microsoft/go-winio v0.6.1 // indirect
github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 // indirect
chore(deps): bump github.com/goreleaser/nfpm/v2 from 2.35.2 to 2.35.3 (#4596) Bumps [github.com/goreleaser/nfpm/v2](https://github.com/goreleaser/nfpm) from 2.35.2 to 2.35.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/goreleaser/nfpm/releases">github.com/goreleaser/nfpm/v2's releases</a>.</em></p> <blockquote> <h2>v2.35.3</h2> <h2>Changelog</h2> <h3>Bug fixes</h3> <ul> <li>f8ccc9df94eb9a4c91c3a1c78d4759a65f156731: fix: file mode when type: tree (<a href="https://redirect.github.com/goreleaser/nfpm/issues/779">#779</a>) (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> <li>e1ebfdad10ef98fe6c9d424efe3f97d7b2322f04: fix: honor SOURCE_DATE_EPOCH for files (<a href="https://redirect.github.com/goreleaser/nfpm/issues/775">#775</a>) (<a href="https://github.com/osm"><code>@​osm</code></a>)</li> </ul> <h3>Dependency updates</h3> <ul> <li>9c48b79596993dd653087f91861794b7da6267e6: feat(deps): bump github.com/ProtonMail/go-crypto (<a href="https://redirect.github.com/goreleaser/nfpm/issues/771">#771</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li> <li>d7a5dc79573e4bf5d65c3f00d9cac81736f12597: feat(deps): bump github.com/cloudflare/circl from 1.3.3 to 1.3.7 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/765">#765</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li> <li>fbc55c56be14ac5de4207becb98c908c615dee7e: feat(deps): bump github.com/klauspost/compress from 1.17.4 to 1.17.5 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/774">#774</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li> <li>9bb94d758ce739fc27c19bbe04bf1c1d33ce3fa9: fix(deps): update go-rpmutils (<a href="https://redirect.github.com/goreleaser/nfpm/issues/764">#764</a>) (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> </ul> <h3>Build process updates</h3> <ul> <li>5ace4da2fd3162383a16218e2ef405dc2676bdfc: ci: update changelog (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> </ul> <h3>Other work</h3> <ul> <li>cd6b94108561b9ef1b06e1db8bfe9e3b3f643253: docs: update cmd docs (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> <li>672f8c6537228848062786d7ad2d2956f6808986: docs: update starchart url (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/goreleaser/nfpm/compare/v2.35.2...v2.35.3">https://github.com/goreleaser/nfpm/compare/v2.35.2...v2.35.3</a></p> <h2>Helping out</h2> <p>This release is only possible thanks to <strong>all</strong> the support of <strong>awesome people</strong>!</p> <p>Want to be one of them? You can <a href="https://goreleaser.com/sponsors/">sponsor</a> or <a href="https://goreleaser.com/contributing">contribute with code</a>.</p> <h2>Where to go next?</h2> <ul> <li>nFPM is a satellite project from GoReleaser. <a href="https://goreleaser.com">Check it out</a>!</li> <li>Find examples and commented usage of all options in our <a href="https://nfpm.goreleaser.com/">website</a>.</li> <li>Reach out on <a href="https://discord.gg/RGEBtg8vQ6">Discord</a> and <a href="https://twitter.com/goreleaser">Twitter</a>!</li> </ul> <p><!-- raw HTML omitted --><!-- raw HTML omitted --><!-- raw HTML omitted --></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/goreleaser/nfpm/commit/5ace4da2fd3162383a16218e2ef405dc2676bdfc"><code>5ace4da</code></a> ci: update changelog</li> <li><a href="https://github.com/goreleaser/nfpm/commit/f8ccc9df94eb9a4c91c3a1c78d4759a65f156731"><code>f8ccc9d</code></a> fix: file mode when type: tree (<a href="https://redirect.github.com/goreleaser/nfpm/issues/779">#779</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/48d1a19eb6c3b6fa7cf69295aa2e7bf8d2b2f520"><code>48d1a19</code></a> chore(deps): bump anchore/sbom-action from 0.15.6 to 0.15.7 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/778">#778</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/e1ebfdad10ef98fe6c9d424efe3f97d7b2322f04"><code>e1ebfda</code></a> fix: honor SOURCE_DATE_EPOCH for files (<a href="https://redirect.github.com/goreleaser/nfpm/issues/775">#775</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/25f6f2b7368585e0534b668ef76094f107e1fe4f"><code>25f6f2b</code></a> chore(deps): bump anchore/sbom-action from 0.15.5 to 0.15.6 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/776">#776</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/fbc55c56be14ac5de4207becb98c908c615dee7e"><code>fbc55c5</code></a> feat(deps): bump github.com/klauspost/compress from 1.17.4 to 1.17.5 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/774">#774</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/d83a6724284364757db5b61c7b2bd9bf0918264e"><code>d83a672</code></a> chore(deps): bump anchore/sbom-action from 0.15.4 to 0.15.5 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/773">#773</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/995a27a6fb5009a2a7e13e7747c9a7ef5a3e8098"><code>995a27a</code></a> chore(deps): bump anchore/sbom-action from 0.15.3 to 0.15.4 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/772">#772</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/9c48b79596993dd653087f91861794b7da6267e6"><code>9c48b79</code></a> feat(deps): bump github.com/ProtonMail/go-crypto (<a href="https://redirect.github.com/goreleaser/nfpm/issues/771">#771</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/e8832cc97b405ce3af1a6026f010d19e521bb1ff"><code>e8832cc</code></a> chore(deps): bump actions/cache from 3.3.3 to 4.0.0 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/770">#770</a>)</li> <li>Additional commits viewable in <a href="https://github.com/goreleaser/nfpm/compare/v2.35.2...v2.35.3">compare view</a></li> </ul> </details> <br /> <details> <summary>Most Recent Ignore Conditions Applied to This Pull Request</summary> | Dependency Name | Ignore Conditions | | --- | --- | | github.com/goreleaser/nfpm/v2 | [>= 2.24.a, < 2.25] | </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/goreleaser/nfpm/v2&package-manager=go_modules&previous-version=2.35.2&new-version=2.35.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) Dependabot will merge this PR once it's up-to-date and CI passes on it, as requested by @caarlos0. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-01 20:56:17 +02:00
github.com/ProtonMail/go-crypto v1.0.0 // indirect
github.com/alessio/shellescape v1.4.1 // indirect
github.com/anchore/bubbly v0.0.0-20230518153401-87b6af8ccf22 // indirect
github.com/anchore/go-logger v0.0.0-20230725134548-c21dafa1ec5a // indirect
github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb // indirect
feat(deps): bump github.com/sigstore/rekor from 1.0.1 to 1.1.1 (#3979) Bumps [github.com/sigstore/rekor](https://github.com/sigstore/rekor) from 1.0.1 to 1.1.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/rekor/releases">github.com/sigstore/rekor's releases</a>.</em></p> <blockquote> <h1>v1.1.1</h1> <h2>Functional Enhancements</h2> <ul> <li>Refactor Trillian client with exported methods (<a href="https://redirect.github.com/sigstore/rekor/issues/1454">#1454</a>)</li> <li>Switch to official redis-go client (<a href="https://redirect.github.com/sigstore/rekor/issues/1459">#1459</a>)</li> <li>Remove replace in go.mod (<a href="https://redirect.github.com/sigstore/rekor/issues/1444">#1444</a>)</li> <li>Add Rekor OID info. (<a href="https://redirect.github.com/sigstore/rekor/issues/1390">#1390</a>)</li> </ul> <h2>Quality Enhancements</h2> <ul> <li>remove legacy encrypted cosign key (<a href="https://redirect.github.com/sigstore/rekor/issues/1446">#1446</a>)</li> <li>swap cjson dependency (<a href="https://redirect.github.com/sigstore/rekor/issues/1441">#1441</a>)</li> <li>Update release readme (<a href="https://redirect.github.com/sigstore/rekor/issues/1456">#1456</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-2h5h-59f5-c5x9</li> </ul> <h2>Contributors</h2> <ul> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Carlos Tadeu Panato Junior</li> <li>Ceridwen Coghlan</li> <li>Hayden B</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/rekor/compare/v1.1.0...v1.1.1">https://github.com/sigstore/rekor/compare/v1.1.0...v1.1.1</a></p> <h1>v1.1.0</h1> <h2>Functional Enhancements</h2> <ul> <li>improve validation on intoto v0.0.2 type (<a href="https://redirect.github.com/sigstore/rekor/issues/1351">#1351</a>)</li> <li>add feature to limit HTTP request body length to process (<a href="https://redirect.github.com/sigstore/rekor/issues/1334">#1334</a>)</li> <li>add information about the file size limit (<a href="https://redirect.github.com/sigstore/rekor/issues/1313">#1313</a>)</li> <li>Add script to backfill Redis from Rekor (<a href="https://redirect.github.com/sigstore/rekor/issues/1163">#1163</a>)</li> <li>Feature: add search support for sha512 (<a href="https://redirect.github.com/sigstore/rekor/issues/1142">#1142</a>)</li> </ul> <h2>Quality Enhancements</h2> <ul> <li>fuzzing: refactor OSS-Fuzz build script (<a href="https://redirect.github.com/sigstore/rekor/issues/1377">#1377</a>)</li> <li>Update cloudbuild for cosign 2.0 (<a href="https://redirect.github.com/sigstore/rekor/issues/1375">#1375</a>)</li> <li>Tests - Additional sharding tests (<a href="https://redirect.github.com/sigstore/rekor/issues/1180">#1180</a>)</li> <li>jar type: add fuzzer for 3rd-party dep (<a href="https://redirect.github.com/sigstore/rekor/issues/1360">#1360</a>)</li> <li>update cosign to 2.0.0 and builder image and also cosign flags (<a href="https://redirect.github.com/sigstore/rekor/issues/1368">#1368</a>)</li> <li>fuzzing: move alpine utils to fuzz utils (<a href="https://redirect.github.com/sigstore/rekor/issues/1335">#1335</a>)</li> <li>fuzzing: add seed for alpine fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1342">#1342</a>)</li> <li>jar: add v001 fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1327">#1327</a>)</li> <li>fuzzing: open writer later in fuzz utils (<a href="https://redirect.github.com/sigstore/rekor/issues/1326">#1326</a>)</li> <li>fuzzing: remove tar operations in alpine fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1322">#1322</a>)</li> <li>alpine: add v001 fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1316">#1316</a>)</li> <li>hashedrekord: add v001 fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1315">#1315</a>)</li> <li>fuzzing: add call to IndexKeys in multiple fuzzers (<a href="https://redirect.github.com/sigstore/rekor/issues/1302">#1302</a>)</li> <li>fuzzing: improve cose fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1300">#1300</a>)</li> <li>fuzzing: improve fuzz utils (<a href="https://redirect.github.com/sigstore/rekor/issues/1298">#1298</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/rekor/blob/main/CHANGELOG.md">github.com/sigstore/rekor's changelog</a>.</em></p> <blockquote> <h1>v1.1.1</h1> <h2>Functional Enhancements</h2> <ul> <li>Refactor Trillian client with exported methods (<a href="https://redirect.github.com/sigstore/rekor/issues/1454">#1454</a>)</li> <li>Switch to official redis-go client (<a href="https://redirect.github.com/sigstore/rekor/issues/1459">#1459</a>)</li> <li>Remove replace in go.mod (<a href="https://redirect.github.com/sigstore/rekor/issues/1444">#1444</a>)</li> <li>Add Rekor OID info. (<a href="https://redirect.github.com/sigstore/rekor/issues/1390">#1390</a>)</li> </ul> <h2>Quality Enhancements</h2> <ul> <li>remove legacy encrypted cosign key (<a href="https://redirect.github.com/sigstore/rekor/issues/1446">#1446</a>)</li> <li>swap cjson dependency (<a href="https://redirect.github.com/sigstore/rekor/issues/1441">#1441</a>)</li> <li>Update release readme (<a href="https://redirect.github.com/sigstore/rekor/issues/1456">#1456</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-2h5h-59f5-c5x9</li> </ul> <h2>Contributors</h2> <ul> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Carlos Tadeu Panato Junior</li> <li>Ceridwen Coghlan</li> <li>Hayden B</li> </ul> <h1>v1.1.0</h1> <h2>Functional Enhancements</h2> <ul> <li>improve validation on intoto v0.0.2 type (<a href="https://redirect.github.com/sigstore/rekor/issues/1351">#1351</a>)</li> <li>add feature to limit HTTP request body length to process (<a href="https://redirect.github.com/sigstore/rekor/issues/1334">#1334</a>)</li> <li>add information about the file size limit (<a href="https://redirect.github.com/sigstore/rekor/issues/1313">#1313</a>)</li> <li>Add script to backfill Redis from Rekor (<a href="https://redirect.github.com/sigstore/rekor/issues/1163">#1163</a>)</li> <li>Feature: add search support for sha512 (<a href="https://redirect.github.com/sigstore/rekor/issues/1142">#1142</a>)</li> </ul> <h2>Quality Enhancements</h2> <ul> <li>fuzzing: refactor OSS-Fuzz build script (<a href="https://redirect.github.com/sigstore/rekor/issues/1377">#1377</a>)</li> <li>Update cloudbuild for cosign 2.0 (<a href="https://redirect.github.com/sigstore/rekor/issues/1375">#1375</a>)</li> <li>Tests - Additional sharding tests (<a href="https://redirect.github.com/sigstore/rekor/issues/1180">#1180</a>)</li> <li>jar type: add fuzzer for 3rd-party dep (<a href="https://redirect.github.com/sigstore/rekor/issues/1360">#1360</a>)</li> <li>update cosign to 2.0.0 and builder image and also cosign flags (<a href="https://redirect.github.com/sigstore/rekor/issues/1368">#1368</a>)</li> <li>fuzzing: move alpine utils to fuzz utils (<a href="https://redirect.github.com/sigstore/rekor/issues/1335">#1335</a>)</li> <li>fuzzing: add seed for alpine fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1342">#1342</a>)</li> <li>jar: add v001 fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1327">#1327</a>)</li> <li>fuzzing: open writer later in fuzz utils (<a href="https://redirect.github.com/sigstore/rekor/issues/1326">#1326</a>)</li> <li>fuzzing: remove tar operations in alpine fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1322">#1322</a>)</li> <li>alpine: add v001 fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1316">#1316</a>)</li> <li>hashedrekord: add v001 fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1315">#1315</a>)</li> <li>fuzzing: add call to IndexKeys in multiple fuzzers (<a href="https://redirect.github.com/sigstore/rekor/issues/1302">#1302</a>)</li> <li>fuzzing: improve cose fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1300">#1300</a>)</li> <li>fuzzing: improve fuzz utils (<a href="https://redirect.github.com/sigstore/rekor/issues/1298">#1298</a>)</li> <li>fuzzing: improve alpine fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1273">#1273</a>)</li> <li>fuzzing: go mod edit go-fuzz-headers (<a href="https://redirect.github.com/sigstore/rekor/issues/1272">#1272</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/rekor/commit/0c1914e5e955cb9f514e32b222cf61a13e91ab08"><code>0c1914e</code></a> update CHANGELOG for v1.1.1 (<a href="https://redirect.github.com/sigstore/rekor/issues/1462">#1462</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/cf42ace82667025fe128f7a50cf6b4cdff51cc48"><code>cf42ace</code></a> Merge pull request from GHSA-2h5h-59f5-c5x9</li> <li><a href="https://github.com/sigstore/rekor/commit/46ac0b224e673b969457597b15af2d125ae8c5c2"><code>46ac0b2</code></a> Refactor Trillian client with exported methods (<a href="https://redirect.github.com/sigstore/rekor/issues/1454">#1454</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/5d6e9723b1d251001906c5583b0fd6fe7e3a1cb3"><code>5d6e972</code></a> build(deps): bump github.com/redis/go-redis/v9 from 9.0.3 to 9.0.4 (<a href="https://redirect.github.com/sigstore/rekor/issues/1460">#1460</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/baa14ce4ebe621399ff8330dd8ddc4a6ca2e2533"><code>baa14ce</code></a> Switch to official redis-go client (<a href="https://redirect.github.com/sigstore/rekor/issues/1459">#1459</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/059e097a0b6856ff6ed79c96cba171df691eb3d8"><code>059e097</code></a> build(deps): bump github.com/go-playground/validator/v10 (<a href="https://redirect.github.com/sigstore/rekor/issues/1457">#1457</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/1f75c792567e6a4b2fa0ebb5e12fe500434d33b1"><code>1f75c79</code></a> Update release readme (<a href="https://redirect.github.com/sigstore/rekor/issues/1456">#1456</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/98163f336ce3db11d776c0eabc4c7bccda7612dd"><code>98163f3</code></a> build(deps): bump github/codeql-action from 2.3.1 to 2.3.2 (<a href="https://redirect.github.com/sigstore/rekor/issues/1455">#1455</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/24cb647106d74051ba70ce867b5c7319ad29e3b9"><code>24cb647</code></a> Remove replace in go.mod (<a href="https://redirect.github.com/sigstore/rekor/issues/1444">#1444</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/39bd69bc7c474ff07fef392ff139d0c01c2e116a"><code>39bd69b</code></a> Add Rekor OID info. (<a href="https://redirect.github.com/sigstore/rekor/issues/1390">#1390</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/rekor/compare/v1.0.1...v1.1.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/rekor&package-manager=go_modules&previous-version=1.0.1&new-version=1.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-05-04 04:11:29 +02:00
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
chore(deps): bump github.com/aws/aws-sdk-go from 1.51.6 to 1.52.0 (#4824) Bumps [github.com/aws/aws-sdk-go](https://github.com/aws/aws-sdk-go) from 1.51.6 to 1.52.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/aws/aws-sdk-go/releases">github.com/aws/aws-sdk-go's releases</a>.</em></p> <blockquote> <h1>Release v1.52.0 (2024-05-01)</h1> <h3>Service Client Updates</h3> <ul> <li><code>service/bedrock-agent</code>: Updates service API and documentation</li> <li><code>service/ec2</code>: Updates service documentation <ul> <li>Documentation updates for Amazon EC2.</li> </ul> </li> <li><code>service/personalize-runtime</code>: Updates service API and documentation</li> <li><code>service/securityhub</code>: Updates service API and documentation</li> <li><code>service/sesv2</code>: Updates service API</li> </ul> <h3>SDK Features</h3> <ul> <li><code>service/alexaforbusiness</code>: Remove Alexaforbusiness <ul> <li>This change removes the Alexaforbusiness service, since it is deprecated.</li> </ul> </li> </ul> <h1>Release v1.51.32 (2024-04-30)</h1> <h3>Service Client Updates</h3> <ul> <li><code>service/chime-sdk-voice</code>: Updates service API and documentation</li> <li><code>service/codeartifact</code>: Updates service API and documentation</li> <li><code>service/fms</code>: Updates service API and documentation</li> <li><code>service/omics</code>: Updates service API and documentation</li> <li><code>service/opensearch</code>: Updates service API and documentation</li> <li><code>service/pinpoint-sms-voice-v2</code>: Updates service API, documentation, and paginators</li> <li><code>service/qbusiness</code>: Updates service API, documentation, and waiters</li> <li><code>service/quicksight</code>: Updates service API and documentation <ul> <li>New Q embedding supporting Generative Q&amp;A</li> </ul> </li> <li><code>service/route53resolver</code>: Updates service API and documentation</li> <li><code>service/sagemaker</code>: Updates service API and documentation <ul> <li>Amazon SageMaker Training now supports the use of attribute-based access control (ABAC) roles for training job execution roles. Amazon SageMaker Inference now supports G6 instance types.</li> </ul> </li> <li><code>service/signer</code>: Updates service API and documentation <ul> <li>Documentation updates for AWS Signer. Adds cross-account signing constraint and definitions for cross-account actions.</li> </ul> </li> </ul> <h1>Release v1.51.31 (2024-04-29)</h1> <h3>Service Client Updates</h3> <ul> <li><code>service/amplify</code>: Updates service API and documentation</li> <li><code>service/connectcases</code>: Updates service API and documentation</li> <li><code>service/inspector2</code>: Updates service API and documentation</li> <li><code>service/timestream-query</code>: Updates service API and documentation</li> <li><code>service/transcribe</code>: Updates service API and documentation</li> <li><code>service/trustedadvisor</code>: Updates service API and documentation</li> </ul> <h1>Release v1.51.30 (2024-04-26)</h1> <h3>Service Client Updates</h3> <ul> <li><code>service/codepipeline</code>: Updates service API and documentation</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/aws/aws-sdk-go/commit/09c0ee916a1cc843aa50899edddec5953457da0e"><code>09c0ee9</code></a> Release v1.52.0 (2024-05-01) (<a href="https://redirect.github.com/aws/aws-sdk-go/issues/5250">#5250</a>)</li> <li><a href="https://github.com/aws/aws-sdk-go/commit/debabd56846ebf3a3798b19c404dbf5bc4340ffd"><code>debabd5</code></a> Remove alexaforbusiness (<a href="https://redirect.github.com/aws/aws-sdk-go/issues/5249">#5249</a>)</li> <li><a href="https://github.com/aws/aws-sdk-go/commit/f9db156cdd2a021d97587d25426ca5ec2739f86f"><code>f9db156</code></a> Release v1.51.32 (2024-04-30) (<a href="https://redirect.github.com/aws/aws-sdk-go/issues/5248">#5248</a>)</li> <li><a href="https://github.com/aws/aws-sdk-go/commit/d5a952885e14fd1b7a5fbf7e46412131934bce9b"><code>d5a9528</code></a> Release v1.51.31 (2024-04-29) (<a href="https://redirect.github.com/aws/aws-sdk-go/issues/5245">#5245</a>)</li> <li><a href="https://github.com/aws/aws-sdk-go/commit/e267cf1aaa6182d8040e2d01d1c18625c7ceaad8"><code>e267cf1</code></a> Merge pull request <a href="https://redirect.github.com/aws/aws-sdk-go/issues/5244">#5244</a> from aws/lucix-aws-patch-1</li> <li><a href="https://github.com/aws/aws-sdk-go/commit/9e85d0ca8b53aef047e0e81085fe01fed7cc6099"><code>9e85d0c</code></a> Update PULL_REQUEST_TEMPLATE.md</li> <li><a href="https://github.com/aws/aws-sdk-go/commit/f62236fda5f8164e086a1a6d71a5e3971da799bb"><code>f62236f</code></a> Release v1.51.30 (2024-04-26) (<a href="https://redirect.github.com/aws/aws-sdk-go/issues/5243">#5243</a>)</li> <li><a href="https://github.com/aws/aws-sdk-go/commit/0b033bb478702f94000a7d4ab3f6cd8ddb6d0c43"><code>0b033bb</code></a> Release v1.51.29 (2024-04-25) (<a href="https://redirect.github.com/aws/aws-sdk-go/issues/5242">#5242</a>)</li> <li><a href="https://github.com/aws/aws-sdk-go/commit/1b3096a782166438858e53aac38f3406dd8d647e"><code>1b3096a</code></a> Release v1.51.28 (2024-04-24) (<a href="https://redirect.github.com/aws/aws-sdk-go/issues/5241">#5241</a>)</li> <li><a href="https://github.com/aws/aws-sdk-go/commit/d28620bd09d56585fa1ed2faa98dae9300fae9eb"><code>d28620b</code></a> Release v1.51.27 (2024-04-23) (<a href="https://redirect.github.com/aws/aws-sdk-go/issues/5240">#5240</a>)</li> <li>Additional commits viewable in <a href="https://github.com/aws/aws-sdk-go/compare/v1.51.6...v1.52.0">compare view</a></li> </ul> </details> <br /> <details> <summary>Most Recent Ignore Conditions Applied to This Pull Request</summary> | Dependency Name | Ignore Conditions | | --- | --- | | github.com/aws/aws-sdk-go | [< 1.52, > 1.51.1] | </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/aws/aws-sdk-go&package-manager=go_modules&previous-version=1.51.6&new-version=1.52.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- **Note:** Dependabot was ignoring updates to this dependency, but since you've updated it yourself we've started tracking it for you again. 🤖 <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-02 21:09:13 +02:00
github.com/aws/aws-sdk-go v1.52.0
github.com/aws/aws-sdk-go-v2 v1.26.0 // indirect
chore(deps): bump gocloud.dev from 0.36.0 to 0.37.0 (#4688) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.36.0&new-version=0.37.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) Dependabot will merge this PR once it's up-to-date and CI passes on it, as requested by @caarlos0. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-13 19:59:13 +02:00
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.1 // indirect
github.com/aws/aws-sdk-go-v2/config v1.27.9 // indirect
github.com/aws/aws-sdk-go-v2/credentials v1.17.9 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.0 // indirect
chore(deps): bump gocloud.dev from 0.36.0 to 0.37.0 (#4688) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.36.0&new-version=0.37.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) Dependabot will merge this PR once it's up-to-date and CI passes on it, as requested by @caarlos0. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-13 19:59:13 +02:00
github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.16.9 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.4 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.4 // indirect
chore(deps): bump gocloud.dev from 0.36.0 to 0.37.0 (#4688) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.36.0&new-version=0.37.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) Dependabot will merge this PR once it's up-to-date and CI passes on it, as requested by @caarlos0. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-13 19:59:13 +02:00
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect
github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.3 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/aws/aws-sdk-go-v2/service/ecr v1.20.2 // indirect
github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.18.2 // indirect
chore(deps): bump gocloud.dev from 0.36.0 to 0.37.0 (#4688) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.36.0&new-version=0.37.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) Dependabot will merge this PR once it's up-to-date and CI passes on it, as requested by @caarlos0. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-13 19:59:13 +02:00
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.1 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.5 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.6 // indirect
chore(deps): bump gocloud.dev from 0.36.0 to 0.37.0 (#4688) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.36.0&new-version=0.37.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) Dependabot will merge this PR once it's up-to-date and CI passes on it, as requested by @caarlos0. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-13 19:59:13 +02:00
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.3 // indirect
github.com/aws/aws-sdk-go-v2/service/kms v1.30.0 // indirect
chore(deps): bump gocloud.dev from 0.36.0 to 0.37.0 (#4688) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.36.0&new-version=0.37.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) Dependabot will merge this PR once it's up-to-date and CI passes on it, as requested by @caarlos0. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-13 19:59:13 +02:00
github.com/aws/aws-sdk-go-v2/service/s3 v1.51.4 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.20.3 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.3 // indirect
github.com/aws/aws-sdk-go-v2/service/sts v1.28.5 // indirect
chore(deps): bump gocloud.dev from 0.36.0 to 0.37.0 (#4688) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.36.0&new-version=0.37.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) Dependabot will merge this PR once it's up-to-date and CI passes on it, as requested by @caarlos0. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-13 19:59:13 +02:00
github.com/aws/smithy-go v1.20.1 // indirect
github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
github.com/bahlo/generic-list-go v0.2.0 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/blacktop/go-dwarf v1.0.9 // indirect
github.com/blacktop/go-macho v1.1.162 // indirect
github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb // indirect
github.com/buger/jsonparser v1.1.1 // indirect
github.com/carlmjohnson/versioninfo v0.22.5 // indirect
github.com/cavaliergopher/cpio v1.0.1 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/cenkalti/backoff/v4 v4.2.1 // indirect
feat(deps): bump gocloud.dev from 0.28.0 to 0.29.0 (#3837) Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.28.0 to 0.29.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-cloud/releases">gocloud.dev's releases</a>.</em></p> <blockquote> <h2>v0.29.0</h2> <p><strong>BREAKING CHANGES</strong></p> <ul> <li>Updated to latest <code>azureblob</code>, which had some non-backward-compatible changes (again).</li> </ul> <p><strong>all</strong></p> <ul> <li>Defaulting to <code>go</code> version <code>1.2</code>.</li> <li><strong>aws</strong>: Added support for custom endpoints for AWS SDK v2.</li> <li><strong>gcp</strong>: Updated imports for <code>credentialspb</code>.</li> </ul> <p><strong>blob</strong></p> <ul> <li><strong>azureblob</strong>: Updated to latest (breaking change).</li> </ul> <p><strong>pubsub</strong></p> <ul> <li><strong>kafkapub</strong>: Fixed nil Options pointer dereference.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-cloud/commit/62397121ec57013e925de45ec6fb7a7bacbf5799"><code>6239712</code></a> all: prep for release (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3236">#3236</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/973ec8737135d7bf2e2c21975ed871526e38ef8a"><code>973ec87</code></a> all: prep for release (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3235">#3235</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/3348a6a4a0ccbcc4cc179866ea682d54ba3e0276"><code>3348a6a</code></a> aws: fix typo on awssdk=v2 docstring</li> <li><a href="https://github.com/google/go-cloud/commit/ec0a2bbc3f48f58b707fcad9e1926044efb242cb"><code>ec0a2bb</code></a> pubsub/rabbitpubsub: give rabbitmq more time to come up (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3233">#3233</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/082a4958948e4a36875570f6ee931ebfe950e29c"><code>082a495</code></a> docstore/gcpfirestore: update proto import (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3229">#3229</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/53ba9013f0a1240e7266b64a1c8f37ac891a84f8"><code>53ba901</code></a> pubsub/gcppubsub: update proto import (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3230">#3230</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/b3612581b153f8ecbf63590c9087e746b5df9f8e"><code>b361258</code></a> runtimevar/gcpsecretmanager: update proto import (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3231">#3231</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/e5235d85eb9a1674f26984a068fcd91f445ef620"><code>e5235d8</code></a> blob/gcsblob: update proto import (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3228">#3228</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/7cd8b2b9f63cb8b15c114ea64fbef28aed00f0cc"><code>7cd8b2b</code></a> secrets/gcpkms: update proto import (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3227">#3227</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/8cddf16323d2af04a4bdd9b58fb85d9b28a1abee"><code>8cddf16</code></a> all: update deps BREAKING_CHANGE_OK (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3225">#3225</a>)</li> <li>Additional commits viewable in <a href="https://github.com/google/go-cloud/compare/v0.28.0...v0.29.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.28.0&new-version=0.29.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-03-06 18:07:00 +02:00
github.com/cespare/xxhash/v2 v2.2.0 // indirect
github.com/charmbracelet/bubbletea v0.22.1 // indirect
github.com/cloudflare/circl v1.3.7 // indirect
github.com/containerd/console v1.0.4 // indirect
github.com/containerd/continuity v0.3.0 // indirect
feat(deps): bump github.com/google/go-containerregistry from 0.13.0 to 0.14.0 (#3878) Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.13.0 to 0.14.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-containerregistry/releases">github.com/google/go-containerregistry's releases</a>.</em></p> <blockquote> <h2>v0.14.0</h2> <h2>Changelog</h2> <ul> <li>9306ebad Allow crane edit to generate non-image artifacts (<a href="https://redirect.github.com/google/go-containerregistry/issues/1545">#1545</a>)</li> <li>de35f0f7 Allow setting Content-Type in crane edit manifest (<a href="https://redirect.github.com/google/go-containerregistry/issues/1551">#1551</a>)</li> <li>4b081f80 Avoid v1.Manifest in crane edit config (<a href="https://redirect.github.com/google/go-containerregistry/issues/1583">#1583</a>)</li> <li>1cfe1fc2 Bump aws-actions/configure-aws-credentials from 1.7.0 to 2.0.0 (<a href="https://redirect.github.com/google/go-containerregistry/issues/1593">#1593</a>)</li> <li>da1008fb Bump golangci/golangci-lint-action from 3.3.1 to 3.4.0 (<a href="https://redirect.github.com/google/go-containerregistry/issues/1548">#1548</a>)</li> <li>86be45fb Bump goreleaser/goreleaser-action from 4.1.0 to 4.1.1 (<a href="https://redirect.github.com/google/go-containerregistry/issues/1547">#1547</a>)</li> <li>62f183e5 Bump goreleaser/goreleaser-action from 4.1.1 to 4.2.0 (<a href="https://redirect.github.com/google/go-containerregistry/issues/1556">#1556</a>)</li> <li>1b8dc2ba Bump slsa-framework/slsa-github-generator from 1.2.2 to 1.5.0 (<a href="https://redirect.github.com/google/go-containerregistry/issues/1580">#1580</a>)</li> <li>11843ba2 Enforce proper sha256 usage (<a href="https://redirect.github.com/google/go-containerregistry/issues/1544">#1544</a>)</li> <li>2ceebaaf Implement crane index subcommand (<a href="https://redirect.github.com/google/go-containerregistry/issues/1561">#1561</a>)</li> <li>9f42e028 Set mediaType for empty.ImageIndex in RawManifest (<a href="https://redirect.github.com/google/go-containerregistry/issues/1562">#1562</a>)</li> <li>759b19f7 Support artifactType, for images whose config.mediaType is not a config (<a href="https://redirect.github.com/google/go-containerregistry/issues/1541">#1541</a>)</li> <li>b3c23b4c Support for OCI 1.1+ referrers via API (<a href="https://redirect.github.com/google/go-containerregistry/issues/1546">#1546</a>)</li> <li>061ee6bf Support for OCI 1.1+ referrers via fallback tag (<a href="https://redirect.github.com/google/go-containerregistry/issues/1543">#1543</a>)</li> <li>67703048 Update descriptor &quot;data&quot; field (when valid) during &quot;crane edit config&quot; (<a href="https://redirect.github.com/google/go-containerregistry/issues/1584">#1584</a>)</li> <li>76bac933 Update release.yml (<a href="https://redirect.github.com/google/go-containerregistry/issues/1540">#1540</a>)</li> <li>eb7d746c authn: also read mount secrets (<a href="https://redirect.github.com/google/go-containerregistry/issues/1560">#1560</a>)</li> <li>e94d4089 bump deps using ./hack/bump-deps.sh (<a href="https://redirect.github.com/google/go-containerregistry/issues/1592">#1592</a>)</li> <li>4e95ae2b crane: add --flatten for index append (<a href="https://redirect.github.com/google/go-containerregistry/issues/1566">#1566</a>)</li> <li>ff810c18 crane: add serve subcommand (<a href="https://redirect.github.com/google/go-containerregistry/issues/1586">#1586</a>)</li> <li>8ea5e0e8 crane: support --omit-digest-tags in crane ls (<a href="https://redirect.github.com/google/go-containerregistry/issues/1528">#1528</a>)</li> <li>824efc77 fix(mutate): also set timestamps only present in some formats (<a href="https://redirect.github.com/google/go-containerregistry/issues/1550">#1550</a>)</li> <li>e04520bc fix: Fix the crane release url and add more steps (<a href="https://redirect.github.com/google/go-containerregistry/issues/1532">#1532</a>)</li> <li>d8722327 hash: use generic instantiation (<a href="https://redirect.github.com/google/go-containerregistry/issues/1538">#1538</a>)</li> <li>57f010d2 replace manual slsa-verifier installation with action (<a href="https://redirect.github.com/google/go-containerregistry/issues/1585">#1585</a>)</li> <li>9cd098e3 skip tls verification if default transport is used with insecure option (<a href="https://redirect.github.com/google/go-containerregistry/issues/1559">#1559</a>)</li> <li>36249683 tarball: pass imageToTags (<a href="https://redirect.github.com/google/go-containerregistry/issues/1563">#1563</a>)</li> </ul> <h3>Container Images</h3> <p><a href="https://gcr.io/go-containerregistry/crane:v0.14.0">https://gcr.io/go-containerregistry/crane:v0.14.0</a> <a href="https://gcr.io/go-containerregistry/gcrane:v0.14.0">https://gcr.io/go-containerregistry/gcrane:v0.14.0</a></p> <p>For example:</p> <pre><code>docker pull gcr.io/go-containerregistry/crane:v0.14.0 docker pull gcr.io/go-containerregistry/gcrane:v0.14.0 </code></pre> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-containerregistry/commit/4b081f801f399fa293f23e42ba4c4ac6a6003f2c"><code>4b081f8</code></a> Avoid v1.Manifest in crane edit config (<a href="https://redirect.github.com/google/go-containerregistry/issues/1583">#1583</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/1cfe1fc25f233b40aa5d3b0edd572ed5c3f854c9"><code>1cfe1fc</code></a> Bump aws-actions/configure-aws-credentials from 1.7.0 to 2.0.0 (<a href="https://redirect.github.com/google/go-containerregistry/issues/1593">#1593</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/e94d40893b2d013992192f8a1a04fd1984fd24dc"><code>e94d408</code></a> bump deps using ./hack/bump-deps.sh (<a href="https://redirect.github.com/google/go-containerregistry/issues/1592">#1592</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/ff810c186c772e1056aa4081278ee84ee3fb565b"><code>ff810c1</code></a> crane: add serve subcommand (<a href="https://redirect.github.com/google/go-containerregistry/issues/1586">#1586</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/57f010d26af871587be87f5aed2550893d564a8c"><code>57f010d</code></a> replace manual slsa-verifier installation with action (<a href="https://redirect.github.com/google/go-containerregistry/issues/1585">#1585</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/67703048992e9b025adf1a7b08f3bb195636be33"><code>6770304</code></a> Update descriptor &quot;data&quot; field (when valid) during &quot;crane edit config&quot; (<a href="https://redirect.github.com/google/go-containerregistry/issues/1584">#1584</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/1b8dc2babc55fd72d274e8f470f00e9e5ba43f1b"><code>1b8dc2b</code></a> Bump slsa-framework/slsa-github-generator from 1.2.2 to 1.5.0 (<a href="https://redirect.github.com/google/go-containerregistry/issues/1580">#1580</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/8ea5e0e8f045d827389d13bde5ae8269630e2e2e"><code>8ea5e0e</code></a> crane: support --omit-digest-tags in crane ls (<a href="https://redirect.github.com/google/go-containerregistry/issues/1528">#1528</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/4e95ae2b72dd3b58fccb4ed579dbddf5c884822c"><code>4e95ae2</code></a> crane: add --flatten for index append (<a href="https://redirect.github.com/google/go-containerregistry/issues/1566">#1566</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/4a0e0af4bf958c0bfb17bdfac71c38204b930623"><code>4a0e0af</code></a> docs: Update crane installation and verification instructions (<a href="https://redirect.github.com/google/go-containerregistry/issues/1567">#1567</a>)</li> <li>Additional commits viewable in <a href="https://github.com/google/go-containerregistry/compare/v0.13.0...v0.14.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/go-containerregistry&package-manager=go_modules&previous-version=0.13.0&new-version=0.14.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-03-20 14:58:29 +02:00
github.com/containerd/stargz-snapshotter/estargz v0.14.3 // indirect
feat(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (#4410) Bumps [github.com/spf13/cobra](https://github.com/spf13/cobra) from 1.7.0 to 1.8.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/spf13/cobra/releases">github.com/spf13/cobra's releases</a>.</em></p> <blockquote> <h2>v1.8.0</h2> <h2>✨ Features</h2> <ul> <li>Support usage as plugin for tools like kubectl by <a href="https://github.com/nirs"><code>@​nirs</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2018">spf13/cobra#2018</a> - this means that programs that utilize a &quot;plugin-like&quot; structure have much better support and usage (like for completions, command paths, etc.)</li> <li>Move documentation sources to site/content by <a href="https://github.com/umarcor"><code>@​umarcor</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1428">spf13/cobra#1428</a></li> <li>Add 'one required flag' group by <a href="https://github.com/marevers"><code>@​marevers</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1952">spf13/cobra#1952</a> - this includes a new <code>MarkFlagsOneRequired</code> API for flags which can be used to mark a flag group as required and cause command failure if at least one is not used when invoked.</li> <li>Customizable error message prefix by <a href="https://github.com/5ouma"><code>@​5ouma</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2023">spf13/cobra#2023</a> - This adds the <code>SetErrPrefix</code> and <code>ErrPrefix</code> APIs on the <code>Command</code> struct to allow for setting a custom prefix for errors</li> <li>feat: add getters for flag completions by <a href="https://github.com/avirtopeanu-ionos"><code>@​avirtopeanu-ionos</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1943">spf13/cobra#1943</a></li> <li>Feature: allow running persistent run hooks of all parents by <a href="https://github.com/vkhoroz"><code>@​vkhoroz</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2044">spf13/cobra#2044</a></li> <li>Improve API to get flag completion function by <a href="https://github.com/marckhouzam"><code>@​marckhouzam</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2063">spf13/cobra#2063</a></li> </ul> <h2>🐛 Bug fixes</h2> <ul> <li>Fix typo in fish completions by <a href="https://github.com/twpayne"><code>@​twpayne</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1945">spf13/cobra#1945</a></li> <li>Fix grammar: 'allows to' by <a href="https://github.com/supertassu"><code>@​supertassu</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1978">spf13/cobra#1978</a></li> <li>powershell: escape variable with curly brackets by <a href="https://github.com/Luap99"><code>@​Luap99</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1960">spf13/cobra#1960</a></li> <li>Don't complete --help flag when flag parsing disabled by <a href="https://github.com/marckhouzam"><code>@​marckhouzam</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2061">spf13/cobra#2061</a></li> <li>Replace all non-alphanumerics in active help env var program prefix by <a href="https://github.com/scop"><code>@​scop</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1940">spf13/cobra#1940</a></li> </ul> <h2>🔧 Maintenance</h2> <ul> <li>build(deps): bump golangci/golangci-lint-action from 3.4.0 to 3.5.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1971">spf13/cobra#1971</a></li> <li>build(deps): bump golangci/golangci-lint-action from 3.5.0 to 3.6.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1976">spf13/cobra#1976</a></li> <li>build(deps): bump golangci/golangci-lint-action from 3.6.0 to 3.7.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2021">spf13/cobra#2021</a></li> <li>build(deps): bump actions/setup-go from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1934">spf13/cobra#1934</a></li> <li>build(deps): bump github.com/cpuguy83/go-md2man/v2 from 2.0.2 to 2.0.3 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2047">spf13/cobra#2047</a></li> <li>build(deps): bump actions/checkout from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2028">spf13/cobra#2028</a></li> <li>command: temporarily disable G602 due to <a href="https://redirect.github.com/securego/gosec/issues/1005">securego/gosec#1005</a> by <a href="https://github.com/umarcor"><code>@​umarcor</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2022">spf13/cobra#2022</a></li> </ul> <h2>🧪 Testing &amp; CI/CD</h2> <ul> <li>test: make fish_completions_test more robust by <a href="https://github.com/branchvincent"><code>@​branchvincent</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1980">spf13/cobra#1980</a></li> <li>golangci: enable 'unused' and disable deprecated replaced by it by <a href="https://github.com/umarcor"><code>@​umarcor</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1983">spf13/cobra#1983</a></li> <li>cleanup: minor corrections to unit tests by <a href="https://github.com/JunNishimura"><code>@​JunNishimura</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2003">spf13/cobra#2003</a></li> <li>ci: test golang 1.21 by <a href="https://github.com/nunoadrego"><code>@​nunoadrego</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2024">spf13/cobra#2024</a></li> <li>Fix linter errors by <a href="https://github.com/marckhouzam"><code>@​marckhouzam</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2052">spf13/cobra#2052</a></li> <li>Add tests for flag completion registration by <a href="https://github.com/marckhouzam"><code>@​marckhouzam</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2053">spf13/cobra#2053</a></li> </ul> <h2>✏️ Documentation</h2> <ul> <li>doc: fix typo, Deperecated -&gt; Deprecated by <a href="https://github.com/callthingsoff"><code>@​callthingsoff</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2000">spf13/cobra#2000</a></li> <li>Add notes to doc about the execution condition of *PreRun and *PostRun functions by <a href="https://github.com/haoming29"><code>@​haoming29</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2041">spf13/cobra#2041</a></li> </ul> <hr /> <p>Thank you everyone who contributed to this release and all your hard work! Cobra and this community would never be possible without all of you!!!! 🐍</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/spf13/cobra/compare/v1.7.0...v1.8.0">https://github.com/spf13/cobra/compare/v1.7.0...v1.8.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/spf13/cobra/commit/a0a6ae020bb3899ff0276067863e50523f897370"><code>a0a6ae0</code></a> Improve API to get flag completion function (<a href="https://redirect.github.com/spf13/cobra/issues/2063">#2063</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/890302a35f578311404a462b3cdd404f34db3720"><code>890302a</code></a> Support usage as plugin for tools like kubectl (<a href="https://redirect.github.com/spf13/cobra/issues/2018">#2018</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/48cea5c87b5299b68c3f5b7f2c67ea948717276f"><code>48cea5c</code></a> build(deps): bump actions/checkout from 3 to 4 (<a href="https://redirect.github.com/spf13/cobra/issues/2028">#2028</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/22953d88453ec9343b4a78b9d67400a3326f3138"><code>22953d8</code></a> Replace all non-alphanumerics in active help env var program prefix (<a href="https://redirect.github.com/spf13/cobra/issues/1940">#1940</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/00b68a1c260eaf2b9bcb10a3178d36cec81548ca"><code>00b68a1</code></a> Add tests for flag completion registration (<a href="https://redirect.github.com/spf13/cobra/issues/2053">#2053</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/b711e8760b73c6aa1b4aa1bef3a26da5926f175d"><code>b711e87</code></a> Don't complete --help flag when flag parsing disabled (<a href="https://redirect.github.com/spf13/cobra/issues/2061">#2061</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/8b1eba47616566fc4d258a93da48d5d8741865f0"><code>8b1eba4</code></a> Fix linter errors (<a href="https://redirect.github.com/spf13/cobra/issues/2052">#2052</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/4cafa37bc4bb85633b4245aa118280fe5a9edcd5"><code>4cafa37</code></a> Allow running persistent run hooks of all parents (<a href="https://redirect.github.com/spf13/cobra/issues/2044">#2044</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/5c962a221e70fd6b12296e5d7075f28b422f98b2"><code>5c962a2</code></a> build(deps): bump github.com/cpuguy83/go-md2man/v2 from 2.0.2 to 2.0.3 (<a href="https://redirect.github.com/spf13/cobra/issues/2047">#2047</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/efe8fa3e4453e41d6419b26c9769a51e42825632"><code>efe8fa3</code></a> build(deps): bump actions/setup-go from 3 to 4 (<a href="https://redirect.github.com/spf13/cobra/issues/1934">#1934</a>)</li> <li>Additional commits viewable in <a href="https://github.com/spf13/cobra/compare/v1.7.0...v1.8.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/spf13/cobra&package-manager=go_modules&previous-version=1.7.0&new-version=1.8.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) Dependabot will merge this PR once CI passes on it, as requested by @caarlos0. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-06 17:44:28 +02:00
github.com/cpuguy83/go-md2man/v2 v2.0.3 // indirect
github.com/cyphar/filepath-securejoin v0.2.4 // indirect
feat(deps): bump github.com/google/ko from 0.14.1 to 0.15.0 (#4373) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.14.1 to 0.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.15.0</h2> <h2>What's Changed</h2> <ul> <li>implement dumb cache for images by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1102">ko-build/ko#1102</a></li> <li>fixed typo in configuration.md by <a href="https://github.com/samlaf"><code>@​samlaf</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li>pkg/commands: fix dropped errors by <a href="https://github.com/alrs"><code>@​alrs</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li>ci: add govulncheck by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1110">ko-build/ko#1110</a></li> <li>chore: remove refs to deprecated io/ioutil by <a href="https://github.com/testwill"><code>@​testwill</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li>Update install docs to install ko using Scoop by <a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> <li>include go build output in build error by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1127">ko-build/ko#1127</a></li> <li>Use go1.21, clean up ci and drop go1.19 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1137">ko-build/ko#1137</a></li> <li>Update e2e.yaml by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1141">ko-build/ko#1141</a></li> <li>handle newfound lint errors by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1142">ko-build/ko#1142</a></li> <li>fix test broken by lint fix by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1143">ko-build/ko#1143</a></li> <li>Bump actions/checkout from 3.6.0 to 4.0.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1136">ko-build/ko#1136</a></li> <li>fix env var for go env by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1140">ko-build/ko#1140</a></li> <li>docs: add docs for TF and Lambda by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1139">ko-build/ko#1139</a></li> <li>docs: add Lambda and TF pages to sidebar by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1144">ko-build/ko#1144</a></li> <li>include example using go packages by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1145">ko-build/ko#1145</a></li> <li>fix the release workflow and install instructions by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1150">ko-build/ko#1150</a></li> <li>update missing places that was using go1.20 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1163">ko-build/ko#1163</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/samlaf"><code>@​samlaf</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li><a href="https://github.com/alrs"><code>@​alrs</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li><a href="https://github.com/testwill"><code>@​testwill</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li><a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0">https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/31035ad2026bfbafaa4f009baefe72463af1b3a7"><code>31035ad</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1164">#1164</a> from ko-build/dependabot/go_modules/golang.org/x/net...</li> <li><a href="https://github.com/ko-build/ko/commit/ba952fd091f9d27ee5c136e842b5e94dd715100c"><code>ba952fd</code></a> Bump golang.org/x/net from 0.16.0 to 0.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/277f5d74353950c8663fc04b7546f66e57bd6aaf"><code>277f5d7</code></a> update missing places that was using go1.20 (<a href="https://redirect.github.com/google/ko/issues/1163">#1163</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/b8b3b21f8348d7cab863fe1b4eaa47dfc47632da"><code>b8b3b21</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1162">#1162</a> from ko-build/dependabot/go_modules/github.com/googl...</li> <li><a href="https://github.com/ko-build/ko/commit/4890ab2887b653d3c340de4d119bfd17b703f182"><code>4890ab2</code></a> Bump github.com/google/go-cmp from 0.5.9 to 0.6.0</li> <li><a href="https://github.com/ko-build/ko/commit/30b62aee3faf6866cee6513ea7eb13f5a27cd7ca"><code>30b62ae</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1161">#1161</a> from ko-build/dependabot/go_modules/github.com/spf13...</li> <li><a href="https://github.com/ko-build/ko/commit/449bcb61926cb3e3bcf191e8ca53fad5ab3a4e3c"><code>449bcb6</code></a> Bump github.com/spf13/viper from 1.16.0 to 1.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/c543dd83cc75cd849fb95637ea29e3c7c66d6f87"><code>c543dd8</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1160">#1160</a> from ko-build/dependabot/go_modules/golang.org/x/too...</li> <li><a href="https://github.com/ko-build/ko/commit/c1ae5f5ce4fe058830f24827c853d4db39a95250"><code>c1ae5f5</code></a> Bump golang.org/x/tools from 0.13.0 to 0.14.0</li> <li><a href="https://github.com/ko-build/ko/commit/e50d2fd5ff0ec88ac837ffe6f6c2f122eb54b9f8"><code>e50d2fd</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1159">#1159</a> from ko-build/dependabot/go_modules/golang.org/x/syn...</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.14.1...v0.15.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.14.1&new-version=0.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-17 17:47:47 +02:00
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
github.com/davidmz/go-pageant v1.0.2 // indirect
github.com/dghubble/sling v1.4.0 // indirect
github.com/dimchansky/utfbom v1.1.1 // indirect
github.com/distribution/reference v0.5.0 // indirect
github.com/docker/cli v25.0.4+incompatible // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/docker/distribution v2.8.3+incompatible // indirect
chore(deps): bump github.com/docker/docker from 25.0.3+incompatible to 25.0.5+incompatible (#4717) Bumps [github.com/docker/docker](https://github.com/docker/docker) from 25.0.3+incompatible to 25.0.5+incompatible. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/docker/releases">github.com/docker/docker's releases</a>.</em></p> <blockquote> <h2>25.0.5</h2> <p>For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:</p> <ul> <li><a href="https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A25.0.5">docker/cli, 25.0.5 milestone</a></li> <li><a href="https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A25.0.5">moby/moby, 25.0.5 milestone</a></li> <li>Deprecated and removed features, see <a href="https://github.com/docker/cli/blob/v25.0.5/docs/deprecated.md">Deprecated Features</a>.</li> <li>Changes to the Engine API, see <a href="https://github.com/moby/moby/blob/v25.0.5/docs/api/version-history.md">API version history</a>.</li> </ul> <h3>Security</h3> <p>This release contains a security fix for <a href="https://github.com/moby/moby/security/advisories/GHSA-mq39-4gv4-mvpx">CVE-2024-29018</a>, a potential data exfiltration from 'internal' networks via authoritative DNS servers.</p> <h3>Bug fixes and enhancements</h3> <ul> <li><a href="https://github.com/moby/moby/security/advisories/GHSA-mq39-4gv4-mvpx">CVE-2024-29018</a>: Do not forward requests to external DNS servers for a container that is only connected to an 'internal' network. Previously, requests were forwarded if the host's DNS server was running on a loopback address, like systemd's 127.0.0.53. <a href="https://redirect.github.com/moby/moby/pull/47589">moby/moby#47589</a></li> <li>plugin: fix mounting /etc/hosts when running in UserNS. <a href="https://redirect.github.com/moby/moby/pull/47588">moby/moby#47588</a></li> <li>rootless: fix <code>open /etc/docker/plugins: permission denied</code>. <a href="https://redirect.github.com/moby/moby/pull/47587">moby/moby#47587</a></li> <li>Fix multiple parallel <code>docker build</code> runs leaking disk space. <a href="https://redirect.github.com/moby/moby/pull/47527">moby/moby#47527</a></li> </ul> <h2>v25.0.4</h2> <p>For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:</p> <ul> <li><a href="https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A25.0.4">docker/cli, 25.0.4 milestone</a></li> <li><a href="https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A25.0.4">moby/moby, 25.0.4 milestone</a></li> <li>Deprecated and removed features, see <a href="https://github.com/docker/cli/blob/v25.0.4/docs/deprecated.md">Deprecated Features</a>.</li> <li>Changes to the Engine API, see <a href="https://github.com/moby/moby/blob/v25.0.4/docs/api/version-history.md">API version history</a>.</li> </ul> <h3>Bug fixes and enhancements</h3> <ul> <li>Restore DNS names for containers in the default &quot;nat&quot; network on Windows. <a href="https://redirect.github.com/moby/moby/pull/47490">moby/moby#47490</a></li> <li>Fix <code>docker start</code> failing when used with <code>--checkpoint</code> <a href="https://redirect.github.com/moby/moby/pull/47466">moby/moby#47466</a></li> <li>Don't enforce new validation rules for existing swarm networks <a href="https://redirect.github.com/moby/moby/pull/47482">moby/moby#47482</a></li> <li>Restore IP connectivity between the host and containers on an internal bridge network. <a href="https://redirect.github.com/moby/moby/pull/47481">moby/moby#47481</a></li> <li>Fix a regression introduced in v25.0 that prevented the classic builder from ADDing a tar archive with xattrs created on a non-Linux OS <a href="https://redirect.github.com/moby/moby/pull/47483">moby/moby#47483</a></li> <li>containerd image store: Fix image pull not emitting <code>Pulling fs layer</code> status <a href="https://redirect.github.com/moby/moby/pull/47484">moby/moby#47484</a></li> </ul> <h3>API</h3> <ul> <li>To preserve backwards compatibility, make read-only mounts not recursive by default when using older clients (API version &lt; v1.44). <a href="https://redirect.github.com/moby/moby/pull/47393">moby/moby#47393</a></li> <li><code>GET /images/{id}/json</code> omits the <code>Created</code> field (previously it was <code>0001-01-01T00:00:00Z</code>) if the <code>Created</code> field is missing from the image config. <a href="https://redirect.github.com/moby/moby/pull/47451">moby/moby#47451</a></li> <li>Populate a missing <code>Created</code> field in <code>GET /images/{id}/json</code> with <code>0001-01-01T00:00:00Z</code> for API version &lt;= 1.43. <a href="https://redirect.github.com/moby/moby/pull/47387">moby/moby#47387</a></li> <li>Fix a regression that caused API socket connection failures to report an API version negotiation failure instead. <a href="https://redirect.github.com/moby/moby/pull/47470">moby/moby#47470</a></li> <li>Preserve supplied endpoint configuration in a container-create API request, when a container-wide MAC address is specified, but <code>NetworkMode</code> name-or-id is not the same as the name-or-id used in <code>NetworkSettings.Networks</code>. <a href="https://redirect.github.com/moby/moby/pull/47510">moby/moby#47510</a></li> </ul> <h3>Packaging updates</h3> <ul> <li>Upgrade Go runtime to <a href="https://go.dev/doc/devel/release#go1.21.8">1.21.8</a>. <a href="https://redirect.github.com/moby/moby/pull/47503">moby/moby#47503</a></li> <li>Upgrade RootlessKit to <a href="https://github.com/rootless-containers/rootlesskit/releases/tag/v2.0.2">v2.0.2</a>. <a href="https://redirect.github.com/moby/moby/pull/47508">moby/moby#47508</a></li> <li>Upgrade Compose to <a href="https://github.com/docker/compose/releases/tag/v2.24.7">v2.24.7</a>. <a href="https://redirect.github.com/docker/docker-ce-packaging/pull/998">docker/docker-ce-packaging#998</a></li> <li>Upgrade Buildx to <a href="https://github.com/docker/buildx/releases/tag/v0.13.0">v0.13.0</a>. <a href="https://redirect.github.com/docker/docker-ce-packaging/pull/997">docker/docker-ce-packaging#997</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/moby/moby/commit/e63daec8672d77ac0b2b5c262ef525c7cf17fd20"><code>e63daec</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/47589">#47589</a> from vvoland/v25.0-47538</li> <li><a href="https://github.com/moby/moby/commit/817bccb1c65823f29eccf95b812ec9cf26da798c"><code>817bccb</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/47588">#47588</a> from vvoland/v25.0-47558</li> <li><a href="https://github.com/moby/moby/commit/2a0601e84e13514d7b94ab6687a33973eb0d80a0"><code>2a0601e</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/47587">#47587</a> from vvoland/v25.0-47559</li> <li><a href="https://github.com/moby/moby/commit/9df9ccc06fbcbb5ca9dc995f6075cc18341b3816"><code>9df9ccc</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/47586">#47586</a> from vvoland/v25.0-47569</li> <li><a href="https://github.com/moby/moby/commit/a987bc5ad06c54448454b5415dd70465d41c184e"><code>a987bc5</code></a> libnet: Don't forward to upstream resolvers on internal nw</li> <li><a href="https://github.com/moby/moby/commit/20c205fd3a0081d005958eff690e2b34df1c5e5e"><code>20c205f</code></a> Environment variable to override resolv.conf path.</li> <li><a href="https://github.com/moby/moby/commit/4be97233cc191bda476d8ecfcd6ee48446ddb3da"><code>4be9723</code></a> daemon: move getUnprivilegedMountFlags to internal package</li> <li><a href="https://github.com/moby/moby/commit/7ed7e6caf6c1605ba5fcc80c015b4afced7c8bfd"><code>7ed7e6c</code></a> plugin: fix mounting /etc/hosts when running in UserNS</li> <li><a href="https://github.com/moby/moby/commit/81ad7062f0299c4ebc9ac3f576a2c0c67d8b6ff8"><code>81ad706</code></a> rootless: fix <code>open /etc/docker/plugins: permission denied</code></li> <li><a href="https://github.com/moby/moby/commit/02d4ee3f9aea7e296ac3f3afb39d4428c38c6251"><code>02d4ee3</code></a> Makefile: generate-files: fix check for empty TMP_OUT</li> <li>Additional commits viewable in <a href="https://github.com/docker/docker/compare/v25.0.3...v25.0.5">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/docker/docker&package-manager=go_modules&previous-version=25.0.3+incompatible&new-version=25.0.5+incompatible)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-25 15:26:14 +02:00
github.com/docker/docker v25.0.5+incompatible // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/docker/docker-credential-helpers v0.8.0 // indirect
github.com/docker/go-connections v0.4.0 // indirect
github.com/docker/go-metrics v0.0.1 // indirect
feat(deps): bump github.com/xanzy/go-gitlab from 0.82.0 to 0.83.0 (#3955) Bumps [github.com/xanzy/go-gitlab](https://github.com/xanzy/go-gitlab) from 0.82.0 to 0.83.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/xanzy/go-gitlab/commit/9560b5bd1bf3fd02fe427e15c91ec7bfaecd51f9"><code>9560b5b</code></a> Merge pull request <a href="https://redirect.github.com/xanzy/go-gitlab/issues/1704">#1704</a> from cloudquery/master</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/5950ae0e1896664199337f50283cf936a3c30968"><code>5950ae0</code></a> newline</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/ad8af11b52f3d4cfe9f6590ee02c62e0c12eecb1"><code>ad8af11</code></a> ignore vendor</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/36a098515464b46cb9683ea684ff92d536951179"><code>36a0985</code></a> Merge pull request <a href="https://redirect.github.com/xanzy/go-gitlab/issues/1702">#1702</a> from cloudquery/feat/group_members/email</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/cc52c831af098fc64fe67675ba14d8d29e4d5536"><code>cc52c83</code></a> fix typo</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/12342600079f984cbcdb2fb7d2caebea6b05099b"><code>1234260</code></a> revert gitignore change</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/931c6625bcfa56e1279fede9b7b162940489518b"><code>931c662</code></a> Add <code>email</code> field to <code>GroupMember</code></li> <li><a href="https://github.com/xanzy/go-gitlab/commit/195295c1d3bb9f9ab754a2bcf0791d1c9d02ef31"><code>195295c</code></a> Merge pull request <a href="https://redirect.github.com/xanzy/go-gitlab/issues/1689">#1689</a> from smit-modi/issue-comment-event</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/f459ed34e662c06b6fed5dd248d67261d125b2bf"><code>f459ed3</code></a> Fixed order</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/e7028c3cfed78024bb6f0dfb96a468c6e5fa3413"><code>e7028c3</code></a> Merge pull request <a href="https://redirect.github.com/xanzy/go-gitlab/issues/1670">#1670</a> from skast96/feature/project_templates</li> <li>Additional commits viewable in <a href="https://github.com/xanzy/go-gitlab/compare/v0.82.0...v0.83.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/xanzy/go-gitlab&package-manager=go_modules&previous-version=0.82.0&new-version=0.83.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-04-24 13:47:21 +02:00
github.com/docker/go-units v0.5.0
github.com/dustin/go-humanize v1.0.1 // indirect
github.com/elliotchance/orderedmap/v2 v2.2.0 // indirect
github.com/emirpasic/gods v1.18.1 // indirect
github.com/evanphx/json-patch/v5 v5.6.0 // indirect
github.com/felixge/httpsnoop v1.0.4 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/fsnotify/fsnotify v1.7.0 // indirect
github.com/gabriel-vasile/mimetype v1.4.2 // indirect
github.com/github/smimesign v0.2.0 // indirect
github.com/go-fed/httpsig v1.1.0 // indirect
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
sec(deps): bump github.com/go-git/go-git/v5 from 5.7.0 to 5.11.0 (#4505) Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.7.0 to 5.11.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's releases</a>.</em></p> <blockquote> <h2>v5.11.0</h2> <h2>What's Changed</h2> <ul> <li>git: validate reference names (<a href="https://redirect.github.com/go-git/go-git/issues/929">#929</a>) by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/950">go-git/go-git#950</a></li> <li>git: stop iterating at oldest shallow when pulling. Fixes <a href="https://redirect.github.com/go-git/go-git/issues/305">#305</a> by <a href="https://github.com/dhoizner"><code>@​dhoizner</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/939">go-git/go-git#939</a></li> <li>plumbing: object, enable renames in getFileStatsFromFilePatches by <a href="https://github.com/djmoch"><code>@​djmoch</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/941">go-git/go-git#941</a></li> <li>storage: filesystem, Add option to set a specific FS for alternates by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/953">go-git/go-git#953</a></li> <li>Align worktree validation with upstream and remove build warnings by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/958">go-git/go-git#958</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/dhoizner"><code>@​dhoizner</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/939">go-git/go-git#939</a></li> <li><a href="https://github.com/djmoch"><code>@​djmoch</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/941">go-git/go-git#941</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.10.1...v5.11.0">https://github.com/go-git/go-git/compare/v5.10.1...v5.11.0</a></p> <h2>v5.10.1</h2> <h2>What's Changed</h2> <ul> <li>Worktree, ignore ModeSocket files by <a href="https://github.com/steiler"><code>@​steiler</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/930">go-git/go-git#930</a></li> <li>git: add tracer package by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/916">go-git/go-git#916</a></li> <li>remote: Flip clause for fast-forward only check by <a href="https://github.com/adityasaky"><code>@​adityasaky</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/875">go-git/go-git#875</a></li> <li>plumbing: transport/ssh, Fix nil pointer dereference caused when an unreachable proxy server is set. Fixes <a href="https://redirect.github.com/go-git/go-git/issues/900">#900</a> by <a href="https://github.com/anandf"><code>@​anandf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/901">go-git/go-git#901</a></li> <li>plumbing: uppload-server-info, implement upload-server-info by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/896">go-git/go-git#896</a></li> <li>plumbing: optimise memory consumption for filesystem storage by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/799">go-git/go-git#799</a></li> <li>plumbing: format/packfile, Refactor patch delta by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/908">go-git/go-git#908</a></li> <li>plumbing: fix empty uploadpack request error by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/932">go-git/go-git#932</a></li> <li>plumbing: transport/git, Improve tests error message by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/752">go-git/go-git#752</a></li> <li>plumbing: format/pktline, Respect pktline error-line errors by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/936">go-git/go-git#936</a></li> <li>utils: remove ioutil.Pipe and use std library io.Pipe by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/922">go-git/go-git#922</a></li> <li>utils: move trace to utils by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/931">go-git/go-git#931</a></li> <li>cli: separate go module for cli by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/914">go-git/go-git#914</a></li> <li>build: bump github.com/google/go-cmp from 0.5.9 to 0.6.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/887">go-git/go-git#887</a></li> <li>build: bump actions/setup-go from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/891">go-git/go-git#891</a></li> <li>build: bump github.com/skeema/knownhosts from 1.2.0 to 1.2.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/888">go-git/go-git#888</a></li> <li>build: bump actions/checkout from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/890">go-git/go-git#890</a></li> <li>build: bump golang.org/x/sys from 0.13.0 to 0.14.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/907">go-git/go-git#907</a></li> <li>build: bump golang.org/x/text from 0.13.0 to 0.14.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/906">go-git/go-git#906</a></li> <li>build: bump golang.org/x/crypto from 0.14.0 to 0.15.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/917">go-git/go-git#917</a></li> <li>build: bump golang.org/x/net from 0.17.0 to 0.18.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/918">go-git/go-git#918</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/anandf"><code>@​anandf</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/901">go-git/go-git#901</a></li> <li><a href="https://github.com/steiler"><code>@​steiler</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/930">go-git/go-git#930</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.10.0...v5.10.1">https://github.com/go-git/go-git/compare/v5.10.0...v5.10.1</a></p> <h2>v5.10.0</h2> <h2>What's Changed</h2> <ul> <li>PlainInitOptions.Bare and allow using InitOptions with PlainInitWithOptions by <a href="https://github.com/ThinkChaos"><code>@​ThinkChaos</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/782">go-git/go-git#782</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-git/go-git/commit/5d08d3bd94c65a3b6c25c6fba6907d12b0dac4ca"><code>5d08d3b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/958">#958</a> from pjbgf/workval</li> <li><a href="https://github.com/go-git/go-git/commit/5bd1d8f4abcfbf1345a1e5a5ec9a96121f3746dc"><code>5bd1d8f</code></a> build: Ensure checkout is the first operation</li> <li><a href="https://github.com/go-git/go-git/commit/b2c19824771bbcbb21abb51abb319c1a610aa6b3"><code>b2c1982</code></a> git: worktree, Align validation with upstream rules</li> <li><a href="https://github.com/go-git/go-git/commit/cec7da63ca0412fce55a0bf0715b7ba44a41eaa2"><code>cec7da6</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/953">#953</a> from pjbgf/alternates</li> <li><a href="https://github.com/go-git/go-git/commit/8b47ceb1aa854f3c3bfa1c347157a04324fcd51e"><code>8b47ceb</code></a> storage: filesystem, Add option to set a specific FS for alternates</li> <li><a href="https://github.com/go-git/go-git/commit/4f614891047bae5d0f7a253f014175505b9821d7"><code>4f61489</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/941">#941</a> from djmoch/filestats-rename</li> <li><a href="https://github.com/go-git/go-git/commit/ae552ce0bf32cddb689727c4c9fa6bf4d3bd6499"><code>ae552ce</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/939">#939</a> from dhoizner/fix-pull-after-shallow</li> <li><a href="https://github.com/go-git/go-git/commit/cc1895b905ebadb09504d88444ff05932fa6e928"><code>cc1895b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/950">#950</a> from aymanbagabas/validate-ref</li> <li><a href="https://github.com/go-git/go-git/commit/de1d5a5978b9599ca3dacd58bbf699e4bb4cf6bd"><code>de1d5a5</code></a> git: validate reference names</li> <li><a href="https://github.com/go-git/go-git/commit/d87110b492c94d99ebdaea732b23a54b7efba94b"><code>d87110b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/948">#948</a> from go-git/dependabot/go_modules/cli/go-git/github.c...</li> <li>Additional commits viewable in <a href="https://github.com/go-git/go-git/compare/v5.7.0...v5.11.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.7.0&new-version=5.11.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-28 14:46:28 +02:00
github.com/go-git/go-billy/v5 v5.5.0 // indirect
github.com/go-git/go-git/v5 v5.11.0 // indirect
github.com/go-logr/logr v1.4.1 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-openapi/analysis v0.23.0 // indirect
github.com/go-openapi/errors v0.22.0 // indirect
github.com/go-openapi/jsonpointer v0.21.0 // indirect
github.com/go-openapi/jsonreference v0.21.0 // indirect
github.com/go-openapi/loads v0.22.0 // indirect
github.com/go-openapi/runtime v0.28.0 // indirect
github.com/go-openapi/spec v0.21.0 // indirect
github.com/go-openapi/strfmt v0.23.0 // indirect
github.com/go-openapi/swag v0.23.0 // indirect
github.com/go-openapi/validate v0.24.0 // indirect
github.com/go-restruct/restruct v1.2.0-alpha // indirect
github.com/gobwas/glob v0.2.3 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
feat(deps): bump github.com/sigstore/rekor from 1.1.1 to 1.2.0 (#4044) Bumps [github.com/sigstore/rekor](https://github.com/sigstore/rekor) from 1.1.1 to 1.2.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/rekor/blob/main/CHANGELOG.md">github.com/sigstore/rekor's changelog</a>.</em></p> <blockquote> <h1>v1.2.0</h1> <h2>Functional Enhancements</h2> <ul> <li>add client method to generate TLE struct (<a href="https://redirect.github.com/sigstore/rekor/issues/1498">#1498</a>)</li> <li>add dsse type (<a href="https://redirect.github.com/sigstore/rekor/issues/1487">#1487</a>)</li> <li>support other KMS providers (AWS, Azure, Hashicorp) in addition to GCP (<a href="https://redirect.github.com/sigstore/rekor/issues/1488">#1488</a>)</li> <li>Add concurrency to backfill-redis (<a href="https://redirect.github.com/sigstore/rekor/issues/1504">#1504</a>)</li> <li>omit informational message if machine-parseable output has been requested (<a href="https://redirect.github.com/sigstore/rekor/issues/1486">#1486</a>)</li> <li>Publish stable checkpoint periodically to Redis (<a href="https://redirect.github.com/sigstore/rekor/issues/1461">#1461</a>)</li> <li>Add intoto v0.0.2 to backfill script (<a href="https://redirect.github.com/sigstore/rekor/issues/1500">#1500</a>)</li> <li>add new method to test insertability of proposed entries into log (<a href="https://redirect.github.com/sigstore/rekor/issues/1410">#1410</a>)</li> </ul> <h2>Quality Enhancements</h2> <ul> <li>use t.Skip() in fuzzers (<a href="https://redirect.github.com/sigstore/rekor/issues/1506">#1506</a>)</li> <li>improve fuzzing coverage (<a href="https://redirect.github.com/sigstore/rekor/issues/1499">#1499</a>)</li> <li>Remove watcher script (<a href="https://redirect.github.com/sigstore/rekor/issues/1484">#1484</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-frqx-jfcm-6jjr</li> <li>Remove requirement of PayloadHash for intoto 0.0.1 (<a href="https://redirect.github.com/sigstore/rekor/issues/1490">#1490</a>)</li> <li>fix lint errors, bump linter up to 1.52 (<a href="https://redirect.github.com/sigstore/rekor/issues/1485">#1485</a>)</li> <li>Remove dependencies from pkg/util (<a href="https://redirect.github.com/sigstore/rekor/issues/1469">#1469</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>Bob Callaway</li> <li>Carlos Tadeu Panato Junior</li> <li>Ceridwen Coghlan</li> <li>Cody Soyland</li> <li>Hayden B</li> <li>Miloslav Trmač</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/rekor/commit/20a995116b1548b79e62ba0ad9c29800387e8641"><code>20a9951</code></a> update for v1.2.0 (<a href="https://redirect.github.com/sigstore/rekor/issues/1507">#1507</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/140c5add105179e5ffd9e3e114fd1b6b93aebbd4"><code>140c5ad</code></a> Merge pull request from GHSA-frqx-jfcm-6jjr</li> <li><a href="https://github.com/sigstore/rekor/commit/85bb2bc7a35dcc94cd94e18984711806f437dcb6"><code>85bb2bc</code></a> use t.Skip() in fuzzers (<a href="https://redirect.github.com/sigstore/rekor/issues/1506">#1506</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/3adca0d2528699d2ff93bf78babef8b5cac46122"><code>3adca0d</code></a> Add concurrency to backfill-redis (<a href="https://redirect.github.com/sigstore/rekor/issues/1504">#1504</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/795a23619d5db1c9625a71f776474033c6712b56"><code>795a236</code></a> add client method to generate TLE struct (<a href="https://redirect.github.com/sigstore/rekor/issues/1498">#1498</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/161a796f91d7255443aa6ce98e7981e6926762f0"><code>161a796</code></a> build(deps): bump github/codeql-action from 2.3.3 to 2.3.4 (<a href="https://redirect.github.com/sigstore/rekor/issues/1505">#1505</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/35c4489abcff256298f1bc9f7caaf5a946750dac"><code>35c4489</code></a> add dsse type (<a href="https://redirect.github.com/sigstore/rekor/issues/1487">#1487</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/d318e2bf433d398d95923f3509557777a2fe5abb"><code>d318e2b</code></a> support other KMS providers (AWS, Azure, Hashicorp) in addition to GCP (<a href="https://redirect.github.com/sigstore/rekor/issues/1488">#1488</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/d508ebad91ef4e39d8e0dd3543cebe20321dc752"><code>d508eba</code></a> Remove requirement of PayloadHash for intoto 0.0.1 (<a href="https://redirect.github.com/sigstore/rekor/issues/1490">#1490</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/b387701f27aace3e3396ad4fdbb8d3ccc869fb5f"><code>b387701</code></a> Add intoto v0.0.2 to backfill script (<a href="https://redirect.github.com/sigstore/rekor/issues/1500">#1500</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/rekor/compare/v1.1.1...v1.2.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/rekor&package-manager=go_modules&previous-version=1.1.1&new-version=1.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-05-27 05:24:50 +02:00
github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
chore(deps): bump gocloud.dev from 0.36.0 to 0.37.0 (#4688) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.36.0&new-version=0.37.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) Dependabot will merge this PR once it's up-to-date and CI passes on it, as requested by @caarlos0. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-13 19:59:13 +02:00
github.com/golang/protobuf v1.5.4 // indirect
github.com/google/go-querystring v1.1.0 // indirect
github.com/google/rpmpack v0.6.0 // indirect
feat(deps): bump github.com/google/ko from 0.14.1 to 0.15.0 (#4373) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.14.1 to 0.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.15.0</h2> <h2>What's Changed</h2> <ul> <li>implement dumb cache for images by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1102">ko-build/ko#1102</a></li> <li>fixed typo in configuration.md by <a href="https://github.com/samlaf"><code>@​samlaf</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li>pkg/commands: fix dropped errors by <a href="https://github.com/alrs"><code>@​alrs</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li>ci: add govulncheck by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1110">ko-build/ko#1110</a></li> <li>chore: remove refs to deprecated io/ioutil by <a href="https://github.com/testwill"><code>@​testwill</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li>Update install docs to install ko using Scoop by <a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> <li>include go build output in build error by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1127">ko-build/ko#1127</a></li> <li>Use go1.21, clean up ci and drop go1.19 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1137">ko-build/ko#1137</a></li> <li>Update e2e.yaml by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1141">ko-build/ko#1141</a></li> <li>handle newfound lint errors by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1142">ko-build/ko#1142</a></li> <li>fix test broken by lint fix by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1143">ko-build/ko#1143</a></li> <li>Bump actions/checkout from 3.6.0 to 4.0.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1136">ko-build/ko#1136</a></li> <li>fix env var for go env by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1140">ko-build/ko#1140</a></li> <li>docs: add docs for TF and Lambda by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1139">ko-build/ko#1139</a></li> <li>docs: add Lambda and TF pages to sidebar by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1144">ko-build/ko#1144</a></li> <li>include example using go packages by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1145">ko-build/ko#1145</a></li> <li>fix the release workflow and install instructions by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1150">ko-build/ko#1150</a></li> <li>update missing places that was using go1.20 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1163">ko-build/ko#1163</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/samlaf"><code>@​samlaf</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li><a href="https://github.com/alrs"><code>@​alrs</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li><a href="https://github.com/testwill"><code>@​testwill</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li><a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0">https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/31035ad2026bfbafaa4f009baefe72463af1b3a7"><code>31035ad</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1164">#1164</a> from ko-build/dependabot/go_modules/golang.org/x/net...</li> <li><a href="https://github.com/ko-build/ko/commit/ba952fd091f9d27ee5c136e842b5e94dd715100c"><code>ba952fd</code></a> Bump golang.org/x/net from 0.16.0 to 0.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/277f5d74353950c8663fc04b7546f66e57bd6aaf"><code>277f5d7</code></a> update missing places that was using go1.20 (<a href="https://redirect.github.com/google/ko/issues/1163">#1163</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/b8b3b21f8348d7cab863fe1b4eaa47dfc47632da"><code>b8b3b21</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1162">#1162</a> from ko-build/dependabot/go_modules/github.com/googl...</li> <li><a href="https://github.com/ko-build/ko/commit/4890ab2887b653d3c340de4d119bfd17b703f182"><code>4890ab2</code></a> Bump github.com/google/go-cmp from 0.5.9 to 0.6.0</li> <li><a href="https://github.com/ko-build/ko/commit/30b62aee3faf6866cee6513ea7eb13f5a27cd7ca"><code>30b62ae</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1161">#1161</a> from ko-build/dependabot/go_modules/github.com/spf13...</li> <li><a href="https://github.com/ko-build/ko/commit/449bcb61926cb3e3bcf191e8ca53fad5ab3a4e3c"><code>449bcb6</code></a> Bump github.com/spf13/viper from 1.16.0 to 1.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/c543dd83cc75cd849fb95637ea29e3c7c66d6f87"><code>c543dd8</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1160">#1160</a> from ko-build/dependabot/go_modules/golang.org/x/too...</li> <li><a href="https://github.com/ko-build/ko/commit/c1ae5f5ce4fe058830f24827c853d4db39a95250"><code>c1ae5f5</code></a> Bump golang.org/x/tools from 0.13.0 to 0.14.0</li> <li><a href="https://github.com/ko-build/ko/commit/e50d2fd5ff0ec88ac837ffe6f6c2f122eb54b9f8"><code>e50d2fd</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1159">#1159</a> from ko-build/dependabot/go_modules/golang.org/x/syn...</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.14.1...v0.15.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.14.1&new-version=0.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-17 17:47:47 +02:00
github.com/google/s2a-go v0.1.7 // indirect
feat(deps): bump github.com/google/ko from 0.12.0 to 0.13.0 (#3880) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.12.0 to 0.13.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.13.0</h2> <h2>What's Changed</h2> <ul> <li>SPDX: Fix package manager label by <a href="https://github.com/puerco"><code>@​puerco</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/801">ko-build/ko#801</a></li> <li>SPDX 2.3 support by <a href="https://github.com/puerco"><code>@​puerco</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/803">ko-build/ko#803</a></li> <li>ci: build and test using 1.18 and 1.19 (drop 1.17) by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/812">ko-build/ko#812</a></li> <li>removes repo move message by <a href="https://github.com/mchmarny"><code>@​mchmarny</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/814">ko-build/ko#814</a></li> <li>feat: write sbom result to disk by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/822">ko-build/ko#822</a></li> <li>feat: adding support for using multiple keychain for sending sbom results to a different repository by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/821">ko-build/ko#821</a></li> <li>Move docs to ko.build by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/749">ko-build/ko#749</a></li> <li>Update setup-ko version by <a href="https://github.com/ianlewis"><code>@​ianlewis</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/836">ko-build/ko#836</a></li> <li>Add -- usage in readme by <a href="https://github.com/jwcesign"><code>@​jwcesign</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/840">ko-build/ko#840</a></li> <li>add CONTRIBUTING, code of conduct, roadmap by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/837">ko-build/ko#837</a></li> <li>attempt to fix GH Pages publishing by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/843">ko-build/ko#843</a></li> <li>doc: fix link to Installation page in Getting Started by <a href="https://github.com/antoineco"><code>@​antoineco</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/846">ko-build/ko#846</a></li> <li>.ko.yaml: bump golang 1.18 -&gt; 1.19 by <a href="https://github.com/srenatus"><code>@​srenatus</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/848">ko-build/ko#848</a></li> <li>truncate -image-refs file by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/855">ko-build/ko#855</a></li> <li>update docs: fix broken links, align with README by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/854">ko-build/ko#854</a></li> <li>Handle KO_DOCKER_REPO=ko.local/repo and --bare correctly by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/820">ko-build/ko#820</a></li> <li>another docs update by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/856">ko-build/ko#856</a></li> <li>ko.build: support some common shortlinks by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/872">ko-build/ko#872</a></li> <li>install: fail with 404 instead of gzip error when url was wrong by <a href="https://github.com/grosser"><code>@​grosser</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/879">ko-build/ko#879</a></li> <li>feat: deduplicate tags by <a href="https://github.com/bluebrown"><code>@​bluebrown</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/884">ko-build/ko#884</a></li> <li>install mkdocs-redirect when publishing site by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/873">ko-build/ko#873</a></li> <li>nit: replace one-item slice with const by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/885">ko-build/ko#885</a></li> <li>Temp fix for SLSA generators by <a href="https://github.com/laurentsimon"><code>@​laurentsimon</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/886">ko-build/ko#886</a></li> <li>Fix verifier by <a href="https://github.com/laurentsimon"><code>@​laurentsimon</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/891">ko-build/ko#891</a></li> <li>Fix link in static-assets.md by <a href="https://github.com/yuryu"><code>@​yuryu</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/893">ko-build/ko#893</a></li> <li>add KO_DEFAULTBASEIMAGE usage to docs by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/895">ko-build/ko#895</a></li> <li>Publish an tagged image on release by <a href="https://github.com/vdemeester"><code>@​vdemeester</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/868">ko-build/ko#868</a></li> <li>Add option to configure default platforms by <a href="https://github.com/ReToCode"><code>@​ReToCode</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/897">ko-build/ko#897</a></li> <li>Fix broken SLSA link by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/899">ko-build/ko#899</a></li> <li>add MAINTAINERS.md by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/905">ko-build/ko#905</a></li> <li>fix: possible race condition when applying templates to flags/ldflags by <a href="https://github.com/caarlos0"><code>@​caarlos0</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/913">ko-build/ko#913</a></li> <li>update docs to reflect actual default base image by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/903">ko-build/ko#903</a></li> <li>remove repeated error message on failure by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/921">ko-build/ko#921</a></li> <li>website: update CNCF announcement by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/920">ko-build/ko#920</a></li> <li>fix KO_CONFIG_PATH pointing to a file by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/923">ko-build/ko#923</a></li> <li>upgrade to cosign v2.0.0-rc.0 by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/933">ko-build/ko#933</a></li> <li>Feature: Add ECR presubmit testing. by <a href="https://github.com/mattmoor"><code>@​mattmoor</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/934">ko-build/ko#934</a></li> <li>remove 'ko deps' by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/937">ko-build/ko#937</a></li> <li>feat: Add KO_GO_PATH env var by <a href="https://github.com/embano1"><code>@​embano1</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/930">ko-build/ko#930</a></li> <li>add ko.build/slack short link by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/945">ko-build/ko#945</a></li> <li>update link to ko goreleaser docs by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/936">ko-build/ko#936</a></li> <li>add ko community meeting details by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/938">ko-build/ko#938</a></li> <li>fix cosign by adding --yes by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/973">ko-build/ko#973</a></li> <li>fix: handle docker's unknown/unknown platform in index manifests by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/975">ko-build/ko#975</a></li> <li>fix file extension for cyclonedx by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/974">ko-build/ko#974</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ianlewis"><code>@​ianlewis</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/836">ko-build/ko#836</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/e22e7a15ffb988adc14c3fc6a964f61ed711812f"><code>e22e7a1</code></a> bump ggcr dep to <a href="https://github.com/main"><code>@​main</code></a> (<a href="https://redirect.github.com/google/ko/issues/976">#976</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/8e075ae1f1822bb61a871f11197566b362c342f0"><code>8e075ae</code></a> fix file extension for cyclonedx (<a href="https://redirect.github.com/google/ko/issues/974">#974</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/11670b7498be63bc0e04e7ba36433fd22f9654ce"><code>11670b7</code></a> fix: handle docker's unknown/unknown platform in index manifests (<a href="https://redirect.github.com/google/ko/issues/975">#975</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/7ce947817e2f59942cb181aa833bfd13533bcc19"><code>7ce9478</code></a> fix cosign by adding --yes (<a href="https://redirect.github.com/google/ko/issues/973">#973</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/9302da78dc995b2b2dd70c044708c3c4c6a056b6"><code>9302da7</code></a> Bump k8s.io/apimachinery from 0.26.1 to 0.26.2 (<a href="https://redirect.github.com/google/ko/issues/972">#972</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/a1588838ba1698c3ca3f6785363a1a9f82ed4baa"><code>a158883</code></a> Bump sigstore/cosign-installer from 2.8.1 to 3.0.1 (<a href="https://redirect.github.com/google/ko/issues/971">#971</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/86b6c2854f8a7c321ce1b8ea121938ce9cc79475"><code>86b6c28</code></a> Bump actions/checkout from 2 to 3 (<a href="https://redirect.github.com/google/ko/issues/966">#966</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/0bd12fb106ed9d03994a6b8883f8a5d834a2aa15"><code>0bd12fb</code></a> Bump slsa-framework/slsa-github-generator from 1.2.1 to 1.5.0 (<a href="https://redirect.github.com/google/ko/issues/967">#967</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/d5125daacd07306d3814a6910cc54422824331e6"><code>d5125da</code></a> Bump github.com/sigstore/cosign/v2 from 2.0.0-rc.2 to 2.0.0 (<a href="https://redirect.github.com/google/ko/issues/965">#965</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/03f4aed68268fb320b32195c80292300056b264c"><code>03f4aed</code></a> add ko community meeting details (<a href="https://redirect.github.com/google/ko/issues/938">#938</a>)</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.12.0...v0.13.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.12.0&new-version=0.13.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Carlos A Becker <caarlos0@users.noreply.github.com>
2023-03-29 19:38:57 +02:00
github.com/google/safetext v0.0.0-20220905092116-b49f7bc46da2 // indirect
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
chore(deps): bump gocloud.dev from 0.36.0 to 0.37.0 (#4688) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.36.0&new-version=0.37.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) Dependabot will merge this PR once it's up-to-date and CI passes on it, as requested by @caarlos0. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-13 19:59:13 +02:00
github.com/google/wire v0.6.0 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
github.com/googleapis/gax-go/v2 v2.12.3 // indirect
github.com/goreleaser/chglog v0.5.0 // indirect
chore(deps): bump github.com/distribution/distribution/v3 from 3.0.0-20221021092657-c47a966fded8 to 3.0.0-alpha.1 (#4604) Bumps [github.com/distribution/distribution/v3](https://github.com/distribution/distribution) from 3.0.0-20221021092657-c47a966fded8 to 3.0.0-alpha.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/distribution/distribution/releases">github.com/distribution/distribution/v3's releases</a>.</em></p> <blockquote> <h2>v3.0.0-alpha.1</h2> <p>This is the first major release in years!</p> <p>It's an accumulation of effort that's bringing major improvements in performance, security and general code quality!</p> <p>See the abridged changelog below and the full release log <a href="https://github.com/distribution/distribution/blob/576d93fee39c22ef1e4735d932ccef32ee49f7fd/releases/v3.0.0.toml">here</a>.</p> <h3>Deprecations</h3> <ul> <li>Image Manifest v2 Schema v1</li> <li><code>oss</code> and <code>swift</code> storage drivers</li> <li><a href="https://github.com/docker/libtrust"><code>docker/libtrust</code></a> has been replaced with <a href="https://github.com/go-jose/go-jose"><code>go-jose/go-jose</code></a></li> <li><code>reference</code> package has been moved to a dedicated repository (see <a href="https://github.com/distribution/reference">here</a>)</li> <li><code>client</code> is no longer supported as a standalone package</li> </ul> <h3>Notable Changes</h3> <ul> <li><code>reference</code> package has been moved to its own dedicated <a href="https://github.com/distribution/reference">repository</a></li> <li>Go module has changed from <code>docker/distribution</code> to <code>distribution/distribution/v3</code></li> <li>Major performance improvements across all supported storage drivers</li> <li>Major dependencies updates (see the full list below)</li> <li>Online documentation is available at <a href="https://distribution.github.io/distribution/">https://distribution.github.io/distribution/</a></li> </ul> <h2>What's Changed</h2> <ul> <li>default autoredirect to false by <a href="https://github.com/davidswu"><code>@​davidswu</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2800">distribution/distribution#2800</a></li> <li>Add docs for autoredirect config parameter by <a href="https://github.com/caervs"><code>@​caervs</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2801">distribution/distribution#2801</a></li> <li>Registry - make minimum TLS version user configurable by <a href="https://github.com/gregrebholz"><code>@​gregrebholz</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2808">distribution/distribution#2808</a></li> <li>Support BYOK for OSS storage driver by <a href="https://github.com/denverdino"><code>@​denverdino</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2791">distribution/distribution#2791</a></li> <li>Add reference. ParseDockerRef utility function by <a href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2786">distribution/distribution#2786</a></li> <li>Fix gometalint errors by <a href="https://github.com/manishtomar"><code>@​manishtomar</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2840">distribution/distribution#2840</a></li> <li>registry: fix binary JSON content-type by <a href="https://github.com/lucab"><code>@​lucab</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2813">distribution/distribution#2813</a></li> <li>Log authorized username by <a href="https://github.com/manishtomar"><code>@​manishtomar</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2854">distribution/distribution#2854</a></li> <li>Fix cloudfront middleware by <a href="https://github.com/vishesh92"><code>@​vishesh92</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2837">distribution/distribution#2837</a></li> <li>support Alibaba Cloud CDN storage middleware by <a href="https://github.com/Shawnpku"><code>@​Shawnpku</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2849">distribution/distribution#2849</a></li> <li>replace rsc.io/letsencrypt in favour of golang.org/x/crypto by <a href="https://github.com/tariq1890"><code>@​tariq1890</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2926">distribution/distribution#2926</a></li> <li>migrate to go modules from vndr by <a href="https://github.com/tariq1890"><code>@​tariq1890</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2941">distribution/distribution#2941</a></li> <li>Fix typo: offest -&gt; offset by <a href="https://github.com/jabrown85"><code>@​jabrown85</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2894">distribution/distribution#2894</a></li> <li>Fix s3 driver for supporting ceph radosgw by <a href="https://github.com/tbe"><code>@​tbe</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2879">distribution/distribution#2879</a></li> <li>Fixes <a href="https://redirect.github.com/distribution/distribution/issues/2835">#2835</a> Process Accept header MIME types in case-insensitive way by <a href="https://github.com/yuwaMSFT2"><code>@​yuwaMSFT2</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2861">distribution/distribution#2861</a></li> <li>change default Dockerfile to install ssl utils by <a href="https://github.com/andyzhangx"><code>@​andyzhangx</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2809">distribution/distribution#2809</a></li> <li>Append the written bytes to the blob writer's size by <a href="https://github.com/dmathieu"><code>@​dmathieu</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2920">distribution/distribution#2920</a></li> <li>fix no error returned in fetchTokenWithOAuth by <a href="https://github.com/sevki"><code>@​sevki</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2900">distribution/distribution#2900</a></li> <li>use latest version of alpine when building the Docker container by <a href="https://github.com/tariq1890"><code>@​tariq1890</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2946">distribution/distribution#2946</a></li> <li>Extract blob upload resume into its own method by <a href="https://github.com/dmathieu"><code>@​dmathieu</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2930">distribution/distribution#2930</a></li> <li>Handle Blob Create when the underlying registry doesn't provide 'Docker-Upload-UUID' by <a href="https://github.com/dmathieu"><code>@​dmathieu</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2927">distribution/distribution#2927</a></li> <li>Implement Repository ServeBlob by <a href="https://github.com/dmathieu"><code>@​dmathieu</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2921">distribution/distribution#2921</a></li> <li>Add notification metrics by <a href="https://github.com/tifayuki"><code>@​tifayuki</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2522">distribution/distribution#2522</a></li> <li>Update the versions of several dependencies by <a href="https://github.com/tariq1890"><code>@​tariq1890</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2947">distribution/distribution#2947</a></li> <li>Implement Repository Blobs upload resuming by <a href="https://github.com/dmathieu"><code>@​dmathieu</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2917">distribution/distribution#2917</a></li> <li>allow for VERSION and REVISION to be passed in during docker builds by <a href="https://github.com/alex-laties"><code>@​alex-laties</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2955">distribution/distribution#2955</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/distribution/distribution/commits/v3.0.0-alpha.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/distribution/distribution/v3&package-manager=go_modules&previous-version=3.0.0-20221021092657-c47a966fded8&new-version=3.0.0-alpha.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-08 15:22:12 +02:00
github.com/gorilla/mux v1.8.1 // indirect
feat(deps): bump github.com/disgoorg/disgo from 0.16.12 to 0.17.0 (#4434) Bumps [github.com/disgoorg/disgo](https://github.com/disgoorg/disgo) from 0.16.12 to 0.17.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/disgoorg/disgo/commit/c4ffb0537d5a1db28e68730eb4685434d4c9bbe6"><code>c4ffb05</code></a> fix checking timeouts when calculating permissions</li> <li><a href="https://github.com/disgoorg/disgo/commit/7e8c825d82051a11460aab8a80ea828fa46aa9aa"><code>7e8c825</code></a> Address Discord having shitty API design</li> <li><a href="https://github.com/disgoorg/disgo/commit/c9a23642bd7b45423361411c520ae5a8033d6306"><code>c9a2364</code></a> Add new expressions and events permissions (<a href="https://redirect.github.com/disgoorg/disgo/issues/292">#292</a>)</li> <li><a href="https://github.com/disgoorg/disgo/commit/f19739c45e4043e06728aa78557e128ee268f568"><code>f19739c</code></a> update dependencies</li> <li><a href="https://github.com/disgoorg/disgo/commit/0c2c0328fadb2426ff5b3349cc013bd9b1d7f18a"><code>0c2c032</code></a> migrate to slog &amp; go 1.21 (<a href="https://redirect.github.com/disgoorg/disgo/issues/294">#294</a>)</li> <li>See full diff in <a href="https://github.com/disgoorg/disgo/compare/v0.16.12...v0.17.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/disgoorg/disgo&package-manager=go_modules&previous-version=0.16.12&new-version=0.17.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-23 22:38:25 +02:00
github.com/gorilla/websocket v1.5.1 // indirect
github.com/hashicorp/errwrap v1.1.0 // indirect
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
github.com/hashicorp/go-retryablehttp v0.7.5 // indirect
github.com/hashicorp/go-version v1.6.0 // indirect
github.com/hashicorp/golang-lru v1.0.2 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/hashicorp/hcl v1.0.1-vault-5 // indirect
github.com/huandu/xstrings v1.3.3 // indirect
github.com/imdario/mergo v0.3.16 // indirect
feat(deps): bump github.com/google/go-containerregistry from 0.13.0 to 0.14.0 (#3878) Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.13.0 to 0.14.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-containerregistry/releases">github.com/google/go-containerregistry's releases</a>.</em></p> <blockquote> <h2>v0.14.0</h2> <h2>Changelog</h2> <ul> <li>9306ebad Allow crane edit to generate non-image artifacts (<a href="https://redirect.github.com/google/go-containerregistry/issues/1545">#1545</a>)</li> <li>de35f0f7 Allow setting Content-Type in crane edit manifest (<a href="https://redirect.github.com/google/go-containerregistry/issues/1551">#1551</a>)</li> <li>4b081f80 Avoid v1.Manifest in crane edit config (<a href="https://redirect.github.com/google/go-containerregistry/issues/1583">#1583</a>)</li> <li>1cfe1fc2 Bump aws-actions/configure-aws-credentials from 1.7.0 to 2.0.0 (<a href="https://redirect.github.com/google/go-containerregistry/issues/1593">#1593</a>)</li> <li>da1008fb Bump golangci/golangci-lint-action from 3.3.1 to 3.4.0 (<a href="https://redirect.github.com/google/go-containerregistry/issues/1548">#1548</a>)</li> <li>86be45fb Bump goreleaser/goreleaser-action from 4.1.0 to 4.1.1 (<a href="https://redirect.github.com/google/go-containerregistry/issues/1547">#1547</a>)</li> <li>62f183e5 Bump goreleaser/goreleaser-action from 4.1.1 to 4.2.0 (<a href="https://redirect.github.com/google/go-containerregistry/issues/1556">#1556</a>)</li> <li>1b8dc2ba Bump slsa-framework/slsa-github-generator from 1.2.2 to 1.5.0 (<a href="https://redirect.github.com/google/go-containerregistry/issues/1580">#1580</a>)</li> <li>11843ba2 Enforce proper sha256 usage (<a href="https://redirect.github.com/google/go-containerregistry/issues/1544">#1544</a>)</li> <li>2ceebaaf Implement crane index subcommand (<a href="https://redirect.github.com/google/go-containerregistry/issues/1561">#1561</a>)</li> <li>9f42e028 Set mediaType for empty.ImageIndex in RawManifest (<a href="https://redirect.github.com/google/go-containerregistry/issues/1562">#1562</a>)</li> <li>759b19f7 Support artifactType, for images whose config.mediaType is not a config (<a href="https://redirect.github.com/google/go-containerregistry/issues/1541">#1541</a>)</li> <li>b3c23b4c Support for OCI 1.1+ referrers via API (<a href="https://redirect.github.com/google/go-containerregistry/issues/1546">#1546</a>)</li> <li>061ee6bf Support for OCI 1.1+ referrers via fallback tag (<a href="https://redirect.github.com/google/go-containerregistry/issues/1543">#1543</a>)</li> <li>67703048 Update descriptor &quot;data&quot; field (when valid) during &quot;crane edit config&quot; (<a href="https://redirect.github.com/google/go-containerregistry/issues/1584">#1584</a>)</li> <li>76bac933 Update release.yml (<a href="https://redirect.github.com/google/go-containerregistry/issues/1540">#1540</a>)</li> <li>eb7d746c authn: also read mount secrets (<a href="https://redirect.github.com/google/go-containerregistry/issues/1560">#1560</a>)</li> <li>e94d4089 bump deps using ./hack/bump-deps.sh (<a href="https://redirect.github.com/google/go-containerregistry/issues/1592">#1592</a>)</li> <li>4e95ae2b crane: add --flatten for index append (<a href="https://redirect.github.com/google/go-containerregistry/issues/1566">#1566</a>)</li> <li>ff810c18 crane: add serve subcommand (<a href="https://redirect.github.com/google/go-containerregistry/issues/1586">#1586</a>)</li> <li>8ea5e0e8 crane: support --omit-digest-tags in crane ls (<a href="https://redirect.github.com/google/go-containerregistry/issues/1528">#1528</a>)</li> <li>824efc77 fix(mutate): also set timestamps only present in some formats (<a href="https://redirect.github.com/google/go-containerregistry/issues/1550">#1550</a>)</li> <li>e04520bc fix: Fix the crane release url and add more steps (<a href="https://redirect.github.com/google/go-containerregistry/issues/1532">#1532</a>)</li> <li>d8722327 hash: use generic instantiation (<a href="https://redirect.github.com/google/go-containerregistry/issues/1538">#1538</a>)</li> <li>57f010d2 replace manual slsa-verifier installation with action (<a href="https://redirect.github.com/google/go-containerregistry/issues/1585">#1585</a>)</li> <li>9cd098e3 skip tls verification if default transport is used with insecure option (<a href="https://redirect.github.com/google/go-containerregistry/issues/1559">#1559</a>)</li> <li>36249683 tarball: pass imageToTags (<a href="https://redirect.github.com/google/go-containerregistry/issues/1563">#1563</a>)</li> </ul> <h3>Container Images</h3> <p><a href="https://gcr.io/go-containerregistry/crane:v0.14.0">https://gcr.io/go-containerregistry/crane:v0.14.0</a> <a href="https://gcr.io/go-containerregistry/gcrane:v0.14.0">https://gcr.io/go-containerregistry/gcrane:v0.14.0</a></p> <p>For example:</p> <pre><code>docker pull gcr.io/go-containerregistry/crane:v0.14.0 docker pull gcr.io/go-containerregistry/gcrane:v0.14.0 </code></pre> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-containerregistry/commit/4b081f801f399fa293f23e42ba4c4ac6a6003f2c"><code>4b081f8</code></a> Avoid v1.Manifest in crane edit config (<a href="https://redirect.github.com/google/go-containerregistry/issues/1583">#1583</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/1cfe1fc25f233b40aa5d3b0edd572ed5c3f854c9"><code>1cfe1fc</code></a> Bump aws-actions/configure-aws-credentials from 1.7.0 to 2.0.0 (<a href="https://redirect.github.com/google/go-containerregistry/issues/1593">#1593</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/e94d40893b2d013992192f8a1a04fd1984fd24dc"><code>e94d408</code></a> bump deps using ./hack/bump-deps.sh (<a href="https://redirect.github.com/google/go-containerregistry/issues/1592">#1592</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/ff810c186c772e1056aa4081278ee84ee3fb565b"><code>ff810c1</code></a> crane: add serve subcommand (<a href="https://redirect.github.com/google/go-containerregistry/issues/1586">#1586</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/57f010d26af871587be87f5aed2550893d564a8c"><code>57f010d</code></a> replace manual slsa-verifier installation with action (<a href="https://redirect.github.com/google/go-containerregistry/issues/1585">#1585</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/67703048992e9b025adf1a7b08f3bb195636be33"><code>6770304</code></a> Update descriptor &quot;data&quot; field (when valid) during &quot;crane edit config&quot; (<a href="https://redirect.github.com/google/go-containerregistry/issues/1584">#1584</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/1b8dc2babc55fd72d274e8f470f00e9e5ba43f1b"><code>1b8dc2b</code></a> Bump slsa-framework/slsa-github-generator from 1.2.2 to 1.5.0 (<a href="https://redirect.github.com/google/go-containerregistry/issues/1580">#1580</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/8ea5e0e8f045d827389d13bde5ae8269630e2e2e"><code>8ea5e0e</code></a> crane: support --omit-digest-tags in crane ls (<a href="https://redirect.github.com/google/go-containerregistry/issues/1528">#1528</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/4e95ae2b72dd3b58fccb4ed579dbddf5c884822c"><code>4e95ae2</code></a> crane: add --flatten for index append (<a href="https://redirect.github.com/google/go-containerregistry/issues/1566">#1566</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/4a0e0af4bf958c0bfb17bdfac71c38204b930623"><code>4a0e0af</code></a> docs: Update crane installation and verification instructions (<a href="https://redirect.github.com/google/go-containerregistry/issues/1567">#1567</a>)</li> <li>Additional commits viewable in <a href="https://github.com/google/go-containerregistry/compare/v0.13.0...v0.14.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/go-containerregistry&package-manager=go_modules&previous-version=0.13.0&new-version=0.14.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-03-20 14:58:29 +02:00
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/ipfs/bbloom v0.0.4 // indirect
github.com/ipfs/go-block-format v0.2.0 // indirect
github.com/ipfs/go-cid v0.4.1 // indirect
github.com/ipfs/go-datastore v0.6.0 // indirect
github.com/ipfs/go-ipfs-blockstore v1.3.1 // indirect
github.com/ipfs/go-ipfs-ds-help v1.1.1 // indirect
github.com/ipfs/go-ipfs-util v0.0.3 // indirect
github.com/ipfs/go-ipld-cbor v0.1.0 // indirect
github.com/ipfs/go-ipld-format v0.6.0 // indirect
github.com/ipfs/go-log v1.0.5 // indirect
github.com/ipfs/go-log/v2 v2.5.1 // indirect
github.com/ipfs/go-metrics-interface v0.0.1 // indirect
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
github.com/jbenet/goprocess v0.1.4 // indirect
github.com/jmespath/go-jmespath v0.4.0 // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/kevinburke/ssh_config v1.2.0 // indirect
chore(deps): bump github.com/klauspost/compress from 1.17.7 to 1.17.8 (#4835) Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress) from 1.17.7 to 1.17.8. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/klauspost/compress/releases">github.com/klauspost/compress's releases</a>.</em></p> <blockquote> <h2>v1.17.8</h2> <h2>What's Changed</h2> <ul> <li>zstd: Reject blocks where reserved values are not 0 by <a href="https://github.com/klauspost"><code>@​klauspost</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/885">klauspost/compress#885</a></li> <li>zstd: Add RLE detection+encoding by <a href="https://github.com/klauspost"><code>@​klauspost</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/938">klauspost/compress#938</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ankon"><code>@​ankon</code></a> made their first contribution in <a href="https://redirect.github.com/klauspost/compress/pull/932">klauspost/compress#932</a></li> <li><a href="https://github.com/kindhuge"><code>@​kindhuge</code></a> made their first contribution in <a href="https://redirect.github.com/klauspost/compress/pull/946">klauspost/compress#946</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/klauspost/compress/compare/v1.17.7...v1.17.8">https://github.com/klauspost/compress/compare/v1.17.7...v1.17.8</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/klauspost/compress/commit/c0ff47e262d13b2d48101344c6eff7204d8e6696"><code>c0ff47e</code></a> Update README.md</li> <li><a href="https://github.com/klauspost/compress/commit/657dc16a9a6667d91e73d44f301356048f0f90da"><code>657dc16</code></a> chore: remove repetitive words (<a href="https://redirect.github.com/klauspost/compress/issues/946">#946</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/3f77d8c9ab20e8d84a93c03c8434ada79aa14b7d"><code>3f77d8c</code></a> build(deps): bump the github-actions group with 1 update (<a href="https://redirect.github.com/klauspost/compress/issues/944">#944</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/de4073a3abdd00a2a95e608f9fcaf6ebf9141cc0"><code>de4073a</code></a> zstd: Add RLE detection+encoding (<a href="https://redirect.github.com/klauspost/compress/issues/938">#938</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/165be368c20e0a1184d5fd2cede0cd0920f233cc"><code>165be36</code></a> zstd: Reject blocks where reserved values are not 0 (<a href="https://redirect.github.com/klauspost/compress/issues/885">#885</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/4f3f95ba8e26a0fc4a19b981dd07776a41a65f19"><code>4f3f95b</code></a> ci: Add testing replacement (<a href="https://redirect.github.com/klauspost/compress/issues/935">#935</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/39763947c280d14a2b8355bf42da01d53a19706e"><code>3976394</code></a> build(deps): bump the github-actions group with 1 update (<a href="https://redirect.github.com/klauspost/compress/issues/934">#934</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/4d78e54b0172386e9eee40a7428f26678e94af96"><code>4d78e54</code></a> Remove sed for internal/fuzz/helpers.go (<a href="https://redirect.github.com/klauspost/compress/issues/933">#933</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/46c00caa8e63fd3960c37443c6c323d69512ba24"><code>46c00ca</code></a> doc: Remove an excess word in a documentation comment (<a href="https://redirect.github.com/klauspost/compress/issues/932">#932</a>)</li> <li>See full diff in <a href="https://github.com/klauspost/compress/compare/v1.17.7...v1.17.8">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/klauspost/compress&package-manager=go_modules&previous-version=1.17.7&new-version=1.17.8)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-06 14:27:33 +02:00
github.com/klauspost/compress v1.17.8
github.com/klauspost/cpuid/v2 v2.2.7 // indirect
feat(deps): bump gocloud.dev from 0.26.0 to 0.27.0 (#3430) Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.26.0 to 0.27.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-cloud/releases">gocloud.dev's releases</a>.</em></p> <blockquote> <h2>v0.27.0</h2> <p><strong>ANNOUNCEMENT</strong>: In the next release we plan to switch over from using OpenCensus to using OpenTelemetry; see <a href="https://github-redirect.dependabot.com/google/go-cloud/issues/2877">#2877</a> for discussion. Please comment on that issue if this is a concern for you.</p> <p><strong>BREAKING CHANGES</strong>: <strong>blob/azureblob, pubsub/azuresb</strong>: Switched over to using the new Azure beta release. Constructors and <code>As</code> types have changed.</p> <p><strong>pubsub</strong>: <strong>all</strong>: Added support for overriding batching for AWS, GCP, Azure.</p> <p><strong>blob</strong>: <strong>fileblob</strong>: Fixed file permissions on temporary files.</p> <p><strong>runtimevar</strong>: <strong>etcdvar</strong>: Brought back this package now that the upstream issues have been resolved.</p> <p><strong>secrets</strong>: <strong>awskms</strong>: Added support for EncryptionContext parameters.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-cloud/commit/3c635fdcb2e648272296b12a4b23d593a965609e"><code>3c635fd</code></a> all: prep for v0.27.0 release</li> <li><a href="https://github.com/google/go-cloud/commit/132c6952d06448b5325f6b856d742a2e535eaf65"><code>132c695</code></a> internal: remove unused package for tracing (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3167">#3167</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/b078f175bb3d0de54df4b2ff1497ce19f9583fce"><code>b078f17</code></a> Add a custom createTemp function that uses consistent file permissions. (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3166">#3166</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/2c69298b18a5e169e9b6b4f4fb338487006b5f47"><code>2c69298</code></a> pubsub/kafka: Allow overriding batching options for Topic (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3163">#3163</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/2ae6e177616a04b94100982ad9f1197af3c41d71"><code>2ae6e17</code></a> blob/azureblob: add storage_account query parameter (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3159">#3159</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/58fd16630bd7ce978bf53ec5a3974cac4299e105"><code>58fd166</code></a> blob/azureblob: Use azidentity.NewDefaultAzureCredential the default/fallback...</li> <li><a href="https://github.com/google/go-cloud/commit/bb5165b76b81ce64c0e769965c0eb293ccd938ac"><code>bb5165b</code></a> pubsub: Add support for overriding batching for AWS, GCP, Azure drivers (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3158">#3158</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/0c45fa60411312d52335c521a8a8411a15e1ce71"><code>0c45fa6</code></a> blob/azureblob: Update to new azblob package BREAKING_CHANGE_OK (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3156">#3156</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/cf4fa6ff18f951d45ec6f1997a3b70695f3a0b17"><code>cf4fa6f</code></a> runtimevar/etcdvar: Bring back runtimevar/etcdvar (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3157">#3157</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/8cd52867f0776832bdc91cc2f1151920351380b2"><code>8cd5286</code></a> all: update deps and regenerate goldens (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3153">#3153</a>)</li> <li>Additional commits viewable in <a href="https://github.com/google/go-cloud/compare/v0.26.0...v0.27.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.26.0&new-version=0.27.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-10-05 14:49:30 +02:00
github.com/kylelemons/godebug v1.1.0 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/letsencrypt/boulder v0.0.0-20231026200631-000cd05d5491 // indirect
github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
github.com/magiconair/properties v1.8.7 // indirect
github.com/mailru/easyjson v0.7.7 // indirect
github.com/mattn/go-isatty v0.0.20 // indirect
github.com/mattn/go-localereader v0.0.1 // indirect
feat(deps): bump github.com/charmbracelet/lipgloss from 0.8.0 to 0.9.0 (#4364) Bumps [github.com/charmbracelet/lipgloss](https://github.com/charmbracelet/lipgloss) from 0.8.0 to 0.9.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/charmbracelet/lipgloss/releases">github.com/charmbracelet/lipgloss's releases</a>.</em></p> <blockquote> <h2>v0.9.0</h2> <h1>My, how the tables have turned</h1> <p>Now you can draw <code>Table</code>s with Lip Gloss! 💅</p> <!-- raw HTML omitted --> <p>View <a href="https://github.com/charmbracelet/lipgloss/tree/master/examples/table/pokemon/main.go">the source code</a>.</p> <h2>Let's get started</h2> <pre lang="go"><code>import &quot;github.com/charmbracelet/lipgloss/table&quot; </code></pre> <p>Define some rows of data.</p> <pre lang="go"><code>rows := [][]string{ {&quot;Chinese&quot;, &quot;您好&quot;, &quot;你好&quot;}, {&quot;Japanese&quot;, &quot;こんにちは&quot;, &quot;やあ&quot;}, {&quot;Arabic&quot;, &quot;أهلين&quot;, &quot;أهلا&quot;}, {&quot;Russian&quot;, &quot;Здравствуйте&quot;, &quot;Привет&quot;}, {&quot;Spanish&quot;, &quot;Hola&quot;, &quot;¿Qué tal?&quot;}, } </code></pre> <p>Use the table package to style and render the table.</p> <pre lang="go"><code>t := table.New(). Border(lipgloss.NormalBorder()). BorderStyle(lipgloss.NewStyle().Foreground(lipgloss.Color(&quot;99&quot;))). StyleFunc(func(row, col int) lipgloss.Style { switch { case row == 0: return HeaderStyle case row%2 == 0: return EvenRowStyle default: return OddRowStyle } }). Headers(&quot;LANGUAGE&quot;, &quot;FORMAL&quot;, &quot;INFORMAL&quot;). Rows(rows...) <p>// You can also add tables row-by-row t.Row(&quot;English&quot;, &quot;You look absolutely fabulous.&quot;, &quot;How's it going?&quot;) </code></pre></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/charmbracelet/lipgloss/commit/4476263d0598a0799b48f75d1bfb394b4dce79f4"><code>4476263</code></a> Feature: Tables (<a href="https://redirect.github.com/charmbracelet/lipgloss/issues/218">#218</a>)</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/408dcf3b9ec535cddf7d343bf5b1a3dd0eba4a00"><code>408dcf3</code></a> feat: add <code>Middle</code> borders (<a href="https://redirect.github.com/charmbracelet/lipgloss/issues/230">#230</a>)</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/93cd5e0d35ae7fed6884560097b304cec79f0fc1"><code>93cd5e0</code></a> feat: bump minimum go version to 1.18 (<a href="https://redirect.github.com/charmbracelet/lipgloss/issues/216">#216</a>)</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/b766f24d454396ae75c1b0e86310dffadf4ceb77"><code>b766f24</code></a> feat(deps): bump github.com/mattn/go-runewidth from 0.0.14 to 0.0.15 (<a href="https://redirect.github.com/charmbracelet/lipgloss/issues/215">#215</a>)</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/b0eb95dbc18f712ad939ab7193cb69951a95361f"><code>b0eb95d</code></a> fix(border): both GetHorizontalBorderSize and GetVerticalBorderSize (<a href="https://redirect.github.com/charmbracelet/lipgloss/issues/225">#225</a>)</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/2d2a577e2d32c9b23e64be859b8af98599bba243"><code>2d2a577</code></a> fix(border): GetBorderRightSize (<a href="https://redirect.github.com/charmbracelet/lipgloss/issues/224">#224</a>)</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/18166eaa8adf46a03c4b732ab1dec81fad1c691b"><code>18166ea</code></a> chore(deps): bump actions/checkout from 3 to 4 (<a href="https://redirect.github.com/charmbracelet/lipgloss/issues/222">#222</a>)</li> <li>See full diff in <a href="https://github.com/charmbracelet/lipgloss/compare/v0.8.0...v0.9.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/charmbracelet/lipgloss&package-manager=go_modules&previous-version=0.8.0&new-version=0.9.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-11 14:05:53 +02:00
github.com/mattn/go-runewidth v0.0.15 // indirect
github.com/minio/sha256-simd v1.0.1 // indirect
github.com/mitchellh/copystructure v1.2.0 // indirect
github.com/mitchellh/mapstructure v1.5.0 // indirect
github.com/mitchellh/reflectwalk v1.0.2 // indirect
github.com/moby/sys/user v0.1.0 // indirect
feat(deps): bump github.com/google/ko from 0.14.1 to 0.15.0 (#4373) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.14.1 to 0.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.15.0</h2> <h2>What's Changed</h2> <ul> <li>implement dumb cache for images by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1102">ko-build/ko#1102</a></li> <li>fixed typo in configuration.md by <a href="https://github.com/samlaf"><code>@​samlaf</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li>pkg/commands: fix dropped errors by <a href="https://github.com/alrs"><code>@​alrs</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li>ci: add govulncheck by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1110">ko-build/ko#1110</a></li> <li>chore: remove refs to deprecated io/ioutil by <a href="https://github.com/testwill"><code>@​testwill</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li>Update install docs to install ko using Scoop by <a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> <li>include go build output in build error by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1127">ko-build/ko#1127</a></li> <li>Use go1.21, clean up ci and drop go1.19 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1137">ko-build/ko#1137</a></li> <li>Update e2e.yaml by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1141">ko-build/ko#1141</a></li> <li>handle newfound lint errors by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1142">ko-build/ko#1142</a></li> <li>fix test broken by lint fix by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1143">ko-build/ko#1143</a></li> <li>Bump actions/checkout from 3.6.0 to 4.0.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1136">ko-build/ko#1136</a></li> <li>fix env var for go env by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1140">ko-build/ko#1140</a></li> <li>docs: add docs for TF and Lambda by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1139">ko-build/ko#1139</a></li> <li>docs: add Lambda and TF pages to sidebar by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1144">ko-build/ko#1144</a></li> <li>include example using go packages by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1145">ko-build/ko#1145</a></li> <li>fix the release workflow and install instructions by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1150">ko-build/ko#1150</a></li> <li>update missing places that was using go1.20 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1163">ko-build/ko#1163</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/samlaf"><code>@​samlaf</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li><a href="https://github.com/alrs"><code>@​alrs</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li><a href="https://github.com/testwill"><code>@​testwill</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li><a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0">https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/31035ad2026bfbafaa4f009baefe72463af1b3a7"><code>31035ad</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1164">#1164</a> from ko-build/dependabot/go_modules/golang.org/x/net...</li> <li><a href="https://github.com/ko-build/ko/commit/ba952fd091f9d27ee5c136e842b5e94dd715100c"><code>ba952fd</code></a> Bump golang.org/x/net from 0.16.0 to 0.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/277f5d74353950c8663fc04b7546f66e57bd6aaf"><code>277f5d7</code></a> update missing places that was using go1.20 (<a href="https://redirect.github.com/google/ko/issues/1163">#1163</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/b8b3b21f8348d7cab863fe1b4eaa47dfc47632da"><code>b8b3b21</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1162">#1162</a> from ko-build/dependabot/go_modules/github.com/googl...</li> <li><a href="https://github.com/ko-build/ko/commit/4890ab2887b653d3c340de4d119bfd17b703f182"><code>4890ab2</code></a> Bump github.com/google/go-cmp from 0.5.9 to 0.6.0</li> <li><a href="https://github.com/ko-build/ko/commit/30b62aee3faf6866cee6513ea7eb13f5a27cd7ca"><code>30b62ae</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1161">#1161</a> from ko-build/dependabot/go_modules/github.com/spf13...</li> <li><a href="https://github.com/ko-build/ko/commit/449bcb61926cb3e3bcf191e8ca53fad5ab3a4e3c"><code>449bcb6</code></a> Bump github.com/spf13/viper from 1.16.0 to 1.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/c543dd83cc75cd849fb95637ea29e3c7c66d6f87"><code>c543dd8</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1160">#1160</a> from ko-build/dependabot/go_modules/golang.org/x/too...</li> <li><a href="https://github.com/ko-build/ko/commit/c1ae5f5ce4fe058830f24827c853d4db39a95250"><code>c1ae5f5</code></a> Bump golang.org/x/tools from 0.13.0 to 0.14.0</li> <li><a href="https://github.com/ko-build/ko/commit/e50d2fd5ff0ec88ac837ffe6f6c2f122eb54b9f8"><code>e50d2fd</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1159">#1159</a> from ko-build/dependabot/go_modules/golang.org/x/syn...</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.14.1...v0.15.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.14.1&new-version=0.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-17 17:47:47 +02:00
github.com/moby/term v0.5.0 // indirect
github.com/mr-tron/base58 v1.2.0 // indirect
github.com/muesli/ansi v0.0.0-20211031195517-c9f0611b6c70 // indirect
github.com/muesli/cancelreader v0.2.2 // indirect
github.com/muesli/mango v0.1.0 // indirect
github.com/muesli/mango-pflag v0.1.0 // indirect
github.com/muesli/reflow v0.3.0 // indirect
github.com/multiformats/go-base32 v0.1.0 // indirect
github.com/multiformats/go-base36 v0.2.0 // indirect
github.com/multiformats/go-multibase v0.2.0 // indirect
github.com/multiformats/go-multihash v0.2.3 // indirect
github.com/multiformats/go-varint v0.0.7 // indirect
github.com/oklog/ulid v1.3.1 // indirect
github.com/onsi/gomega v1.29.0 // indirect
github.com/opencontainers/go-digest v1.0.0 // indirect
github.com/opencontainers/image-spec v1.1.0 // indirect
github.com/opencontainers/runc v1.2.0-rc.1 // indirect
github.com/opentracing/opentracing-go v1.2.0 // indirect
github.com/pelletier/go-toml v1.9.5 // indirect
feat(deps): bump github.com/google/ko from 0.14.1 to 0.15.0 (#4373) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.14.1 to 0.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.15.0</h2> <h2>What's Changed</h2> <ul> <li>implement dumb cache for images by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1102">ko-build/ko#1102</a></li> <li>fixed typo in configuration.md by <a href="https://github.com/samlaf"><code>@​samlaf</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li>pkg/commands: fix dropped errors by <a href="https://github.com/alrs"><code>@​alrs</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li>ci: add govulncheck by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1110">ko-build/ko#1110</a></li> <li>chore: remove refs to deprecated io/ioutil by <a href="https://github.com/testwill"><code>@​testwill</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li>Update install docs to install ko using Scoop by <a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> <li>include go build output in build error by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1127">ko-build/ko#1127</a></li> <li>Use go1.21, clean up ci and drop go1.19 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1137">ko-build/ko#1137</a></li> <li>Update e2e.yaml by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1141">ko-build/ko#1141</a></li> <li>handle newfound lint errors by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1142">ko-build/ko#1142</a></li> <li>fix test broken by lint fix by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1143">ko-build/ko#1143</a></li> <li>Bump actions/checkout from 3.6.0 to 4.0.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1136">ko-build/ko#1136</a></li> <li>fix env var for go env by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1140">ko-build/ko#1140</a></li> <li>docs: add docs for TF and Lambda by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1139">ko-build/ko#1139</a></li> <li>docs: add Lambda and TF pages to sidebar by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1144">ko-build/ko#1144</a></li> <li>include example using go packages by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1145">ko-build/ko#1145</a></li> <li>fix the release workflow and install instructions by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1150">ko-build/ko#1150</a></li> <li>update missing places that was using go1.20 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1163">ko-build/ko#1163</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/samlaf"><code>@​samlaf</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li><a href="https://github.com/alrs"><code>@​alrs</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li><a href="https://github.com/testwill"><code>@​testwill</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li><a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0">https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/31035ad2026bfbafaa4f009baefe72463af1b3a7"><code>31035ad</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1164">#1164</a> from ko-build/dependabot/go_modules/golang.org/x/net...</li> <li><a href="https://github.com/ko-build/ko/commit/ba952fd091f9d27ee5c136e842b5e94dd715100c"><code>ba952fd</code></a> Bump golang.org/x/net from 0.16.0 to 0.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/277f5d74353950c8663fc04b7546f66e57bd6aaf"><code>277f5d7</code></a> update missing places that was using go1.20 (<a href="https://redirect.github.com/google/ko/issues/1163">#1163</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/b8b3b21f8348d7cab863fe1b4eaa47dfc47632da"><code>b8b3b21</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1162">#1162</a> from ko-build/dependabot/go_modules/github.com/googl...</li> <li><a href="https://github.com/ko-build/ko/commit/4890ab2887b653d3c340de4d119bfd17b703f182"><code>4890ab2</code></a> Bump github.com/google/go-cmp from 0.5.9 to 0.6.0</li> <li><a href="https://github.com/ko-build/ko/commit/30b62aee3faf6866cee6513ea7eb13f5a27cd7ca"><code>30b62ae</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1161">#1161</a> from ko-build/dependabot/go_modules/github.com/spf13...</li> <li><a href="https://github.com/ko-build/ko/commit/449bcb61926cb3e3bcf191e8ca53fad5ab3a4e3c"><code>449bcb6</code></a> Bump github.com/spf13/viper from 1.16.0 to 1.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/c543dd83cc75cd849fb95637ea29e3c7c66d6f87"><code>c543dd8</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1160">#1160</a> from ko-build/dependabot/go_modules/golang.org/x/too...</li> <li><a href="https://github.com/ko-build/ko/commit/c1ae5f5ce4fe058830f24827c853d4db39a95250"><code>c1ae5f5</code></a> Bump golang.org/x/tools from 0.13.0 to 0.14.0</li> <li><a href="https://github.com/ko-build/ko/commit/e50d2fd5ff0ec88ac837ffe6f6c2f122eb54b9f8"><code>e50d2fd</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1159">#1159</a> from ko-build/dependabot/go_modules/golang.org/x/syn...</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.14.1...v0.15.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.14.1&new-version=0.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-17 17:47:47 +02:00
github.com/pelletier/go-toml/v2 v2.1.0 // indirect
github.com/pjbgf/sha1cd v0.3.0 // indirect
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
github.com/pkg/errors v0.9.1 // indirect
feat(deps): bump github.com/google/ko from 0.14.1 to 0.15.0 (#4373) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.14.1 to 0.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.15.0</h2> <h2>What's Changed</h2> <ul> <li>implement dumb cache for images by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1102">ko-build/ko#1102</a></li> <li>fixed typo in configuration.md by <a href="https://github.com/samlaf"><code>@​samlaf</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li>pkg/commands: fix dropped errors by <a href="https://github.com/alrs"><code>@​alrs</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li>ci: add govulncheck by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1110">ko-build/ko#1110</a></li> <li>chore: remove refs to deprecated io/ioutil by <a href="https://github.com/testwill"><code>@​testwill</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li>Update install docs to install ko using Scoop by <a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> <li>include go build output in build error by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1127">ko-build/ko#1127</a></li> <li>Use go1.21, clean up ci and drop go1.19 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1137">ko-build/ko#1137</a></li> <li>Update e2e.yaml by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1141">ko-build/ko#1141</a></li> <li>handle newfound lint errors by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1142">ko-build/ko#1142</a></li> <li>fix test broken by lint fix by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1143">ko-build/ko#1143</a></li> <li>Bump actions/checkout from 3.6.0 to 4.0.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1136">ko-build/ko#1136</a></li> <li>fix env var for go env by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1140">ko-build/ko#1140</a></li> <li>docs: add docs for TF and Lambda by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1139">ko-build/ko#1139</a></li> <li>docs: add Lambda and TF pages to sidebar by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1144">ko-build/ko#1144</a></li> <li>include example using go packages by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1145">ko-build/ko#1145</a></li> <li>fix the release workflow and install instructions by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1150">ko-build/ko#1150</a></li> <li>update missing places that was using go1.20 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1163">ko-build/ko#1163</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/samlaf"><code>@​samlaf</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li><a href="https://github.com/alrs"><code>@​alrs</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li><a href="https://github.com/testwill"><code>@​testwill</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li><a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0">https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/31035ad2026bfbafaa4f009baefe72463af1b3a7"><code>31035ad</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1164">#1164</a> from ko-build/dependabot/go_modules/golang.org/x/net...</li> <li><a href="https://github.com/ko-build/ko/commit/ba952fd091f9d27ee5c136e842b5e94dd715100c"><code>ba952fd</code></a> Bump golang.org/x/net from 0.16.0 to 0.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/277f5d74353950c8663fc04b7546f66e57bd6aaf"><code>277f5d7</code></a> update missing places that was using go1.20 (<a href="https://redirect.github.com/google/ko/issues/1163">#1163</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/b8b3b21f8348d7cab863fe1b4eaa47dfc47632da"><code>b8b3b21</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1162">#1162</a> from ko-build/dependabot/go_modules/github.com/googl...</li> <li><a href="https://github.com/ko-build/ko/commit/4890ab2887b653d3c340de4d119bfd17b703f182"><code>4890ab2</code></a> Bump github.com/google/go-cmp from 0.5.9 to 0.6.0</li> <li><a href="https://github.com/ko-build/ko/commit/30b62aee3faf6866cee6513ea7eb13f5a27cd7ca"><code>30b62ae</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1161">#1161</a> from ko-build/dependabot/go_modules/github.com/spf13...</li> <li><a href="https://github.com/ko-build/ko/commit/449bcb61926cb3e3bcf191e8ca53fad5ab3a4e3c"><code>449bcb6</code></a> Bump github.com/spf13/viper from 1.16.0 to 1.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/c543dd83cc75cd849fb95637ea29e3c7c66d6f87"><code>c543dd8</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1160">#1160</a> from ko-build/dependabot/go_modules/golang.org/x/too...</li> <li><a href="https://github.com/ko-build/ko/commit/c1ae5f5ce4fe058830f24827c853d4db39a95250"><code>c1ae5f5</code></a> Bump golang.org/x/tools from 0.13.0 to 0.14.0</li> <li><a href="https://github.com/ko-build/ko/commit/e50d2fd5ff0ec88ac837ffe6f6c2f122eb54b9f8"><code>e50d2fd</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1159">#1159</a> from ko-build/dependabot/go_modules/golang.org/x/syn...</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.14.1...v0.15.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.14.1&new-version=0.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-17 17:47:47 +02:00
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/polydawn/refmt v0.89.1-0.20221221234430-40501e09de1f // indirect
github.com/prometheus/client_golang v1.19.0 // indirect
github.com/prometheus/client_model v0.6.0 // indirect
github.com/prometheus/common v0.51.1 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/prometheus/procfs v0.12.0 // indirect
chore(deps): bump github.com/charmbracelet/lipgloss from 0.9.1 to 0.10.0 (#4672) Bumps [github.com/charmbracelet/lipgloss](https://github.com/charmbracelet/lipgloss) from 0.9.1 to 0.10.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/charmbracelet/lipgloss/releases">github.com/charmbracelet/lipgloss's releases</a>.</em></p> <blockquote> <h2>v0.10.0</h2> <h1>String Transforms 💄</h1> <p>Lip Gloss <code>v0.10.0</code> features a brand new <code>Transform</code> function for Styles to alter strings at render time. As well as some bug fixes, like ANSI-aware table cell truncation. 🧹</p> <p>Simply define a <code>Transform</code> function as <code>func (string) string</code> and apply it to any style:</p> <pre lang="go"><code>// Example: s := NewStyle().Transform(strings.ToUpper) fmt.Println(s.Render(&quot;raow!&quot;) // &quot;RAOW!&quot; </code></pre> <p>Or, if you prefer:</p> <pre lang="go"><code>// Example: reverse := func(s string) string { n := 0 rune := make([]rune, len(s)) for _, r := range s { rune[n] = r n++ } rune = rune[0:n] for i := 0; i &lt; n/2; i++ { rune[i], rune[n-1-i] = rune[n-1-i], rune[i] } return string(rune) } <p>s := NewStyle().Transform(reverse) fmt.Println(s.Render(&quot;The quick brown 狐 jumped over the lazy 犬&quot;) // &quot;犬 yzal eht revo depmuj 狐 nworb kciuq ehT&quot;, </code></pre></p> <h2>What's Changed?</h2> <ul> <li>Corrected border shorthand functions explanation by <a href="https://github.com/ReidMason"><code>@​ReidMason</code></a> in <a href="https://redirect.github.com/charmbracelet/lipgloss/pull/237">charmbracelet/lipgloss#237</a></li> <li>Align help by <a href="https://github.com/schmurfy"><code>@​schmurfy</code></a> in <a href="https://redirect.github.com/charmbracelet/lipgloss/pull/239">charmbracelet/lipgloss#239</a></li> <li><code>Style.Transform</code> for altering strings at render time by <a href="https://github.com/meowgorithm"><code>@​meowgorithm</code></a> in <a href="https://redirect.github.com/charmbracelet/lipgloss/pull/232">charmbracelet/lipgloss#232</a></li> <li>Adding right padding to empty string by <a href="https://github.com/mikelorant"><code>@​mikelorant</code></a> in <a href="https://redirect.github.com/charmbracelet/lipgloss/pull/253">charmbracelet/lipgloss#253</a></li> <li>Refactor padding functions by <a href="https://github.com/mikelorant"><code>@​mikelorant</code></a> in <a href="https://redirect.github.com/charmbracelet/lipgloss/pull/254">charmbracelet/lipgloss#254</a></li> <li>Fix truncate of table cells containing ANSI by <a href="https://github.com/mikelorant"><code>@​mikelorant</code></a> in <a href="https://redirect.github.com/charmbracelet/lipgloss/pull/256">charmbracelet/lipgloss#256</a></li> <li>Improve maximum width of characters in a string by <a href="https://github.com/mikelorant"><code>@​mikelorant</code></a> in <a href="https://redirect.github.com/charmbracelet/lipgloss/pull/257">charmbracelet/lipgloss#257</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ReidMason"><code>@​ReidMason</code></a> made their first contribution in <a href="https://redirect.github.com/charmbracelet/lipgloss/pull/237">charmbracelet/lipgloss#237</a></li> <li><a href="https://github.com/schmurfy"><code>@​schmurfy</code></a> made their first contribution in <a href="https://redirect.github.com/charmbracelet/lipgloss/pull/239">charmbracelet/lipgloss#239</a></li> <li><a href="https://github.com/mikelorant"><code>@​mikelorant</code></a> made their first contribution in <a href="https://redirect.github.com/charmbracelet/lipgloss/pull/253">charmbracelet/lipgloss#253</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/charmbracelet/lipgloss/commit/439c06fae64d2f53261b692fcfcbe464d8e18d89"><code>439c06f</code></a> docs(table): ANSI-aware cell example</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/652c37dd07489c7c484711c8e21f4b221f57d056"><code>652c37d</code></a> feat(deps): bump github.com/rivo/uniseg from 0.4.6 to 0.4.7 (<a href="https://redirect.github.com/charmbracelet/lipgloss/issues/262">#262</a>)</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/8464a7c90b02905ea471be3bc20951dce981b3ff"><code>8464a7c</code></a> chore(deps): bump golangci/golangci-lint-action from 3 to 4 (<a href="https://redirect.github.com/charmbracelet/lipgloss/issues/259">#259</a>)</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/207eb25c9f720e48e2d46b5c2f213d07b2006052"><code>207eb25</code></a> Create CODEOWNERS</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/13584f26deeb5f6188fa1e80e43aa2ca04f297cb"><code>13584f2</code></a> chore: go mod tidy</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/bb7ffe226d40ba75dda2bf62dd5577af3c635b66"><code>bb7ffe2</code></a> fix(ci): update coverage workflow</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/2745d8a3d83029e649b21bf6bf26298b3c51ce3a"><code>2745d8a</code></a> Improve maximum width of characters in a string (<a href="https://redirect.github.com/charmbracelet/lipgloss/issues/257">#257</a>)</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/de4601232b791a1397d6c645904b001a311a5693"><code>de46012</code></a> Fix truncate of table cells containing ANSI (<a href="https://redirect.github.com/charmbracelet/lipgloss/issues/256">#256</a>)</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/92946d34c2342f6e061d72cf6bec57526c9da3d2"><code>92946d3</code></a> chore: refactor padding functions (<a href="https://redirect.github.com/charmbracelet/lipgloss/issues/254">#254</a>)</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/59874c2afabe9d8b65123ef2279ce4e61c113181"><code>59874c2</code></a> chore: apply gofumpt to all files (<a href="https://redirect.github.com/charmbracelet/lipgloss/issues/255">#255</a>)</li> <li>Additional commits viewable in <a href="https://github.com/charmbracelet/lipgloss/compare/v0.9.1...v0.10.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/charmbracelet/lipgloss&package-manager=go_modules&previous-version=0.9.1&new-version=0.10.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-08 18:39:53 +02:00
github.com/rivo/uniseg v0.4.7 // indirect
github.com/russross/blackfriday/v2 v2.1.0 // indirect
github.com/sagikazarmark/locafero v0.4.0 // indirect
github.com/sagikazarmark/slog-shim v0.1.0 // indirect
github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e // indirect
github.com/secure-systems-lab/go-securesystemslib v0.8.0 // indirect
github.com/sergi/go-diff v1.2.0 // indirect
github.com/shopspring/decimal v1.2.0 // indirect
github.com/sigstore/cosign/v2 v2.2.4 // indirect
github.com/sigstore/rekor v1.3.6 // indirect
github.com/sigstore/sigstore v1.8.3 // indirect
feat(deps): bump github.com/google/ko from 0.14.1 to 0.15.0 (#4373) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.14.1 to 0.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.15.0</h2> <h2>What's Changed</h2> <ul> <li>implement dumb cache for images by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1102">ko-build/ko#1102</a></li> <li>fixed typo in configuration.md by <a href="https://github.com/samlaf"><code>@​samlaf</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li>pkg/commands: fix dropped errors by <a href="https://github.com/alrs"><code>@​alrs</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li>ci: add govulncheck by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1110">ko-build/ko#1110</a></li> <li>chore: remove refs to deprecated io/ioutil by <a href="https://github.com/testwill"><code>@​testwill</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li>Update install docs to install ko using Scoop by <a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> <li>include go build output in build error by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1127">ko-build/ko#1127</a></li> <li>Use go1.21, clean up ci and drop go1.19 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1137">ko-build/ko#1137</a></li> <li>Update e2e.yaml by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1141">ko-build/ko#1141</a></li> <li>handle newfound lint errors by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1142">ko-build/ko#1142</a></li> <li>fix test broken by lint fix by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1143">ko-build/ko#1143</a></li> <li>Bump actions/checkout from 3.6.0 to 4.0.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1136">ko-build/ko#1136</a></li> <li>fix env var for go env by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1140">ko-build/ko#1140</a></li> <li>docs: add docs for TF and Lambda by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1139">ko-build/ko#1139</a></li> <li>docs: add Lambda and TF pages to sidebar by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1144">ko-build/ko#1144</a></li> <li>include example using go packages by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1145">ko-build/ko#1145</a></li> <li>fix the release workflow and install instructions by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1150">ko-build/ko#1150</a></li> <li>update missing places that was using go1.20 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1163">ko-build/ko#1163</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/samlaf"><code>@​samlaf</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li><a href="https://github.com/alrs"><code>@​alrs</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li><a href="https://github.com/testwill"><code>@​testwill</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li><a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0">https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/31035ad2026bfbafaa4f009baefe72463af1b3a7"><code>31035ad</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1164">#1164</a> from ko-build/dependabot/go_modules/golang.org/x/net...</li> <li><a href="https://github.com/ko-build/ko/commit/ba952fd091f9d27ee5c136e842b5e94dd715100c"><code>ba952fd</code></a> Bump golang.org/x/net from 0.16.0 to 0.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/277f5d74353950c8663fc04b7546f66e57bd6aaf"><code>277f5d7</code></a> update missing places that was using go1.20 (<a href="https://redirect.github.com/google/ko/issues/1163">#1163</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/b8b3b21f8348d7cab863fe1b4eaa47dfc47632da"><code>b8b3b21</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1162">#1162</a> from ko-build/dependabot/go_modules/github.com/googl...</li> <li><a href="https://github.com/ko-build/ko/commit/4890ab2887b653d3c340de4d119bfd17b703f182"><code>4890ab2</code></a> Bump github.com/google/go-cmp from 0.5.9 to 0.6.0</li> <li><a href="https://github.com/ko-build/ko/commit/30b62aee3faf6866cee6513ea7eb13f5a27cd7ca"><code>30b62ae</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1161">#1161</a> from ko-build/dependabot/go_modules/github.com/spf13...</li> <li><a href="https://github.com/ko-build/ko/commit/449bcb61926cb3e3bcf191e8ca53fad5ab3a4e3c"><code>449bcb6</code></a> Bump github.com/spf13/viper from 1.16.0 to 1.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/c543dd83cc75cd849fb95637ea29e3c7c66d6f87"><code>c543dd8</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1160">#1160</a> from ko-build/dependabot/go_modules/golang.org/x/too...</li> <li><a href="https://github.com/ko-build/ko/commit/c1ae5f5ce4fe058830f24827c853d4db39a95250"><code>c1ae5f5</code></a> Bump golang.org/x/tools from 0.13.0 to 0.14.0</li> <li><a href="https://github.com/ko-build/ko/commit/e50d2fd5ff0ec88ac837ffe6f6c2f122eb54b9f8"><code>e50d2fd</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1159">#1159</a> from ko-build/dependabot/go_modules/golang.org/x/syn...</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.14.1...v0.15.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.14.1&new-version=0.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-17 17:47:47 +02:00
github.com/sirupsen/logrus v1.9.3 // indirect
sec(deps): bump github.com/go-git/go-git/v5 from 5.7.0 to 5.11.0 (#4505) Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.7.0 to 5.11.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's releases</a>.</em></p> <blockquote> <h2>v5.11.0</h2> <h2>What's Changed</h2> <ul> <li>git: validate reference names (<a href="https://redirect.github.com/go-git/go-git/issues/929">#929</a>) by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/950">go-git/go-git#950</a></li> <li>git: stop iterating at oldest shallow when pulling. Fixes <a href="https://redirect.github.com/go-git/go-git/issues/305">#305</a> by <a href="https://github.com/dhoizner"><code>@​dhoizner</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/939">go-git/go-git#939</a></li> <li>plumbing: object, enable renames in getFileStatsFromFilePatches by <a href="https://github.com/djmoch"><code>@​djmoch</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/941">go-git/go-git#941</a></li> <li>storage: filesystem, Add option to set a specific FS for alternates by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/953">go-git/go-git#953</a></li> <li>Align worktree validation with upstream and remove build warnings by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/958">go-git/go-git#958</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/dhoizner"><code>@​dhoizner</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/939">go-git/go-git#939</a></li> <li><a href="https://github.com/djmoch"><code>@​djmoch</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/941">go-git/go-git#941</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.10.1...v5.11.0">https://github.com/go-git/go-git/compare/v5.10.1...v5.11.0</a></p> <h2>v5.10.1</h2> <h2>What's Changed</h2> <ul> <li>Worktree, ignore ModeSocket files by <a href="https://github.com/steiler"><code>@​steiler</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/930">go-git/go-git#930</a></li> <li>git: add tracer package by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/916">go-git/go-git#916</a></li> <li>remote: Flip clause for fast-forward only check by <a href="https://github.com/adityasaky"><code>@​adityasaky</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/875">go-git/go-git#875</a></li> <li>plumbing: transport/ssh, Fix nil pointer dereference caused when an unreachable proxy server is set. Fixes <a href="https://redirect.github.com/go-git/go-git/issues/900">#900</a> by <a href="https://github.com/anandf"><code>@​anandf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/901">go-git/go-git#901</a></li> <li>plumbing: uppload-server-info, implement upload-server-info by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/896">go-git/go-git#896</a></li> <li>plumbing: optimise memory consumption for filesystem storage by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/799">go-git/go-git#799</a></li> <li>plumbing: format/packfile, Refactor patch delta by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/908">go-git/go-git#908</a></li> <li>plumbing: fix empty uploadpack request error by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/932">go-git/go-git#932</a></li> <li>plumbing: transport/git, Improve tests error message by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/752">go-git/go-git#752</a></li> <li>plumbing: format/pktline, Respect pktline error-line errors by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/936">go-git/go-git#936</a></li> <li>utils: remove ioutil.Pipe and use std library io.Pipe by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/922">go-git/go-git#922</a></li> <li>utils: move trace to utils by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/931">go-git/go-git#931</a></li> <li>cli: separate go module for cli by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/914">go-git/go-git#914</a></li> <li>build: bump github.com/google/go-cmp from 0.5.9 to 0.6.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/887">go-git/go-git#887</a></li> <li>build: bump actions/setup-go from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/891">go-git/go-git#891</a></li> <li>build: bump github.com/skeema/knownhosts from 1.2.0 to 1.2.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/888">go-git/go-git#888</a></li> <li>build: bump actions/checkout from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/890">go-git/go-git#890</a></li> <li>build: bump golang.org/x/sys from 0.13.0 to 0.14.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/907">go-git/go-git#907</a></li> <li>build: bump golang.org/x/text from 0.13.0 to 0.14.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/906">go-git/go-git#906</a></li> <li>build: bump golang.org/x/crypto from 0.14.0 to 0.15.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/917">go-git/go-git#917</a></li> <li>build: bump golang.org/x/net from 0.17.0 to 0.18.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/918">go-git/go-git#918</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/anandf"><code>@​anandf</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/901">go-git/go-git#901</a></li> <li><a href="https://github.com/steiler"><code>@​steiler</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/930">go-git/go-git#930</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.10.0...v5.10.1">https://github.com/go-git/go-git/compare/v5.10.0...v5.10.1</a></p> <h2>v5.10.0</h2> <h2>What's Changed</h2> <ul> <li>PlainInitOptions.Bare and allow using InitOptions with PlainInitWithOptions by <a href="https://github.com/ThinkChaos"><code>@​ThinkChaos</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/782">go-git/go-git#782</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-git/go-git/commit/5d08d3bd94c65a3b6c25c6fba6907d12b0dac4ca"><code>5d08d3b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/958">#958</a> from pjbgf/workval</li> <li><a href="https://github.com/go-git/go-git/commit/5bd1d8f4abcfbf1345a1e5a5ec9a96121f3746dc"><code>5bd1d8f</code></a> build: Ensure checkout is the first operation</li> <li><a href="https://github.com/go-git/go-git/commit/b2c19824771bbcbb21abb51abb319c1a610aa6b3"><code>b2c1982</code></a> git: worktree, Align validation with upstream rules</li> <li><a href="https://github.com/go-git/go-git/commit/cec7da63ca0412fce55a0bf0715b7ba44a41eaa2"><code>cec7da6</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/953">#953</a> from pjbgf/alternates</li> <li><a href="https://github.com/go-git/go-git/commit/8b47ceb1aa854f3c3bfa1c347157a04324fcd51e"><code>8b47ceb</code></a> storage: filesystem, Add option to set a specific FS for alternates</li> <li><a href="https://github.com/go-git/go-git/commit/4f614891047bae5d0f7a253f014175505b9821d7"><code>4f61489</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/941">#941</a> from djmoch/filestats-rename</li> <li><a href="https://github.com/go-git/go-git/commit/ae552ce0bf32cddb689727c4c9fa6bf4d3bd6499"><code>ae552ce</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/939">#939</a> from dhoizner/fix-pull-after-shallow</li> <li><a href="https://github.com/go-git/go-git/commit/cc1895b905ebadb09504d88444ff05932fa6e928"><code>cc1895b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/950">#950</a> from aymanbagabas/validate-ref</li> <li><a href="https://github.com/go-git/go-git/commit/de1d5a5978b9599ca3dacd58bbf699e4bb4cf6bd"><code>de1d5a5</code></a> git: validate reference names</li> <li><a href="https://github.com/go-git/go-git/commit/d87110b492c94d99ebdaea732b23a54b7efba94b"><code>d87110b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/948">#948</a> from go-git/dependabot/go_modules/cli/go-git/github.c...</li> <li>Additional commits viewable in <a href="https://github.com/go-git/go-git/compare/v5.7.0...v5.11.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.7.0&new-version=5.11.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-28 14:46:28 +02:00
github.com/skeema/knownhosts v1.2.1 // indirect
github.com/sourcegraph/conc v0.3.0 // indirect
github.com/spaolacci/murmur3 v1.1.0 // indirect
github.com/spf13/afero v1.11.0 // indirect
github.com/spf13/cast v1.6.0 // indirect
github.com/spf13/pflag v1.0.5 // indirect
github.com/spf13/viper v1.18.2 // indirect
feat(deps): bump github.com/google/ko from 0.14.1 to 0.15.0 (#4373) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.14.1 to 0.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.15.0</h2> <h2>What's Changed</h2> <ul> <li>implement dumb cache for images by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1102">ko-build/ko#1102</a></li> <li>fixed typo in configuration.md by <a href="https://github.com/samlaf"><code>@​samlaf</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li>pkg/commands: fix dropped errors by <a href="https://github.com/alrs"><code>@​alrs</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li>ci: add govulncheck by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1110">ko-build/ko#1110</a></li> <li>chore: remove refs to deprecated io/ioutil by <a href="https://github.com/testwill"><code>@​testwill</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li>Update install docs to install ko using Scoop by <a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> <li>include go build output in build error by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1127">ko-build/ko#1127</a></li> <li>Use go1.21, clean up ci and drop go1.19 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1137">ko-build/ko#1137</a></li> <li>Update e2e.yaml by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1141">ko-build/ko#1141</a></li> <li>handle newfound lint errors by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1142">ko-build/ko#1142</a></li> <li>fix test broken by lint fix by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1143">ko-build/ko#1143</a></li> <li>Bump actions/checkout from 3.6.0 to 4.0.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1136">ko-build/ko#1136</a></li> <li>fix env var for go env by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1140">ko-build/ko#1140</a></li> <li>docs: add docs for TF and Lambda by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1139">ko-build/ko#1139</a></li> <li>docs: add Lambda and TF pages to sidebar by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1144">ko-build/ko#1144</a></li> <li>include example using go packages by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1145">ko-build/ko#1145</a></li> <li>fix the release workflow and install instructions by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1150">ko-build/ko#1150</a></li> <li>update missing places that was using go1.20 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1163">ko-build/ko#1163</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/samlaf"><code>@​samlaf</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li><a href="https://github.com/alrs"><code>@​alrs</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li><a href="https://github.com/testwill"><code>@​testwill</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li><a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0">https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/31035ad2026bfbafaa4f009baefe72463af1b3a7"><code>31035ad</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1164">#1164</a> from ko-build/dependabot/go_modules/golang.org/x/net...</li> <li><a href="https://github.com/ko-build/ko/commit/ba952fd091f9d27ee5c136e842b5e94dd715100c"><code>ba952fd</code></a> Bump golang.org/x/net from 0.16.0 to 0.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/277f5d74353950c8663fc04b7546f66e57bd6aaf"><code>277f5d7</code></a> update missing places that was using go1.20 (<a href="https://redirect.github.com/google/ko/issues/1163">#1163</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/b8b3b21f8348d7cab863fe1b4eaa47dfc47632da"><code>b8b3b21</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1162">#1162</a> from ko-build/dependabot/go_modules/github.com/googl...</li> <li><a href="https://github.com/ko-build/ko/commit/4890ab2887b653d3c340de4d119bfd17b703f182"><code>4890ab2</code></a> Bump github.com/google/go-cmp from 0.5.9 to 0.6.0</li> <li><a href="https://github.com/ko-build/ko/commit/30b62aee3faf6866cee6513ea7eb13f5a27cd7ca"><code>30b62ae</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1161">#1161</a> from ko-build/dependabot/go_modules/github.com/spf13...</li> <li><a href="https://github.com/ko-build/ko/commit/449bcb61926cb3e3bcf191e8ca53fad5ab3a4e3c"><code>449bcb6</code></a> Bump github.com/spf13/viper from 1.16.0 to 1.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/c543dd83cc75cd849fb95637ea29e3c7c66d6f87"><code>c543dd8</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1160">#1160</a> from ko-build/dependabot/go_modules/golang.org/x/too...</li> <li><a href="https://github.com/ko-build/ko/commit/c1ae5f5ce4fe058830f24827c853d4db39a95250"><code>c1ae5f5</code></a> Bump golang.org/x/tools from 0.13.0 to 0.14.0</li> <li><a href="https://github.com/ko-build/ko/commit/e50d2fd5ff0ec88ac837ffe6f6c2f122eb54b9f8"><code>e50d2fd</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1159">#1159</a> from ko-build/dependabot/go_modules/golang.org/x/syn...</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.14.1...v0.15.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.14.1&new-version=0.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-17 17:47:47 +02:00
github.com/subosito/gotenv v1.6.0 // indirect
github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
github.com/tomnomnom/linkheader v0.0.0-20180905144013-02ca5825eb80 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/vbatts/tar-split v0.11.5 // indirect
github.com/wagoodman/go-partybus v0.0.0-20230516145632-8ccac152c651 // indirect
github.com/wagoodman/go-progress v0.0.0-20220614130704-4b1c25a33c7c // indirect
github.com/whyrusleeping/cbor-gen v0.1.1-0.20240311221002-68b9f235c302 // indirect
github.com/wk8/go-ordered-map/v2 v2.1.8 // indirect
github.com/xanzy/ssh-agent v0.3.3 // indirect
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
github.com/xeipuuv/gojsonschema v1.2.0 // indirect
gitlab.com/digitalxero/go-conventional-commit v1.0.7 // indirect
go.mongodb.org/mongo-driver v1.14.0 // indirect
feat(deps): bump gocloud.dev from 0.27.0 to 0.28.0 (#3689) Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.27.0 to 0.28.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-cloud/releases">gocloud.dev's releases</a>.</em></p> <blockquote> <h2>v0.28.0</h2> <p><strong>BREAKING CHANGES</strong>:</p> <ul> <li><strong>secrets/azurekeyvault</strong>: Updated to latest Azure SDK.</li> <li><strong>blob/azureblob</strong>: Updated to match recent breaking changes in the Azure packages (yes, again).</li> <li><strong>pubsub/awssnssqs</strong>: Fixed <code>BeforeSend</code> to take a pointer to the <code>SendMessageBatchRequestEntry</code> struct, so that it can be modified.</li> </ul> <p><strong>blob</strong></p> <ul> <li><strong>memblob</strong>: Fixed bug where use of <code>BeforeCopy</code> callback would drop the actual copying.</li> <li><strong>azureblob</strong>: Updated to match recent breaking changes in the Azure packages.</li> </ul> <p><strong>pubsub</strong></p> <ul> <li><strong>all</strong>: Simplified and improved batch sizing, should resolve issues with too-frequent polling in some situations.</li> <li><strong>azurepubsub</strong>: Made <code>ListenerTimeout</code> configurable.</li> <li><strong>gcppubsub</strong> and <strong>awssnssqs</strong>: Support lazy mode for <code>Nack</code> (where no explicit <code>Nack</code> is sent).</li> <li><strong>awssnssqs</strong>: Fixed <code>BeforeSend</code> to take a pointer to the <code>SendMessageBatchRequestEntry</code> struct, so that it can be modified.</li> </ul> <p><strong>secrets</strong></p> <ul> <li><strong>secrets/azurekeyvault</strong>: Updated to latest Azure SDK. Use azidentity.NewDefaultAzureCredential.</li> </ul> <p><strong>sql</strong></p> <ul> <li><strong>gcp/cloudsql</strong>: Fixed IAM login.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-cloud/commit/24166090495b8e084a23aa7d11fcc81ec33e4729"><code>2416609</code></a> all: prep for v0.28.0 (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3207">#3207</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/13f46eb8065d5ea62b757f5f0f11a56f48faf7cc"><code>13f46eb</code></a> pubsub: simplify and improve batch sizing, especially for low message rates</li> <li><a href="https://github.com/google/go-cloud/commit/8f2c2b9a392a8e4a3d7a4942f88f3df607f8f6d0"><code>8f2c2b9</code></a> pubsub/memsub: Add Options for batching (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3205">#3205</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/fe0a3d75fe43c039258df25ebf102602526e3052"><code>fe0a3d7</code></a> pubsub/awssqs: Fix BeforeSend/As to enable changes to the sqs input message (...</li> <li><a href="https://github.com/google/go-cloud/commit/dfaf95af34dd9022a69a061028e0ceec98e9c670"><code>dfaf95a</code></a> secrets/azurekeyvault: Use azidentity.NewDefaultAzureCredential to support ot...</li> <li><a href="https://github.com/google/go-cloud/commit/1e26311532928f060c490a7fbf2be92b55ee12c4"><code>1e26311</code></a> blob: Remove some debug logging (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3197">#3197</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/43ed5a499864c08b7b6549ff7085f19634a1f02c"><code>43ed5a4</code></a> pubsub/gcppubsub: Support lazy mode for Nacks (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3195">#3195</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/be80e70b3dcf7a6b86481881c7ac0b44a8095178"><code>be80e70</code></a> pubsub/awssnssqs: Support lazy mode for Nacks (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3194">#3194</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/7d690993a53cf8cc2e7af07872876d58601f1261"><code>7d69099</code></a> blob/azblob: Update to latest, and restore As for dirlist (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3191">#3191</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/e942f3c339f0eb617ac4dbc7f37cc4e5920ee7cc"><code>e942f3c</code></a> blob/azblob: Restore As for List entry (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3188">#3188</a>)</li> <li>Additional commits viewable in <a href="https://github.com/google/go-cloud/compare/v0.27.0...v0.28.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.27.0&new-version=0.28.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-01-11 14:09:51 +02:00
go.opencensus.io v0.24.0 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 // indirect
go.opentelemetry.io/otel v1.24.0 // indirect
go.opentelemetry.io/otel/metric v1.24.0 // indirect
go.opentelemetry.io/otel/trace v1.24.0 // indirect
go.uber.org/atomic v1.11.0 // indirect
feat(deps): bump the gomod-deps group with 3 updates (#4200) Bumps the gomod-deps group with 3 updates: [github.com/xanzy/go-gitlab](https://github.com/xanzy/go-gitlab), [gocloud.dev](https://github.com/google/go-cloud) and [go.uber.org/automaxprocs](https://github.com/uber-go/automaxprocs). Updates `github.com/xanzy/go-gitlab` from 0.86.0 to 0.88.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/xanzy/go-gitlab/commit/7e3c23c9c221c0a334e11356503a99d41f206651"><code>7e3c23c</code></a> Update pipeline tests</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/2ac3eea05ffd9c096624ce3f88bf88132940b025"><code>2ac3eea</code></a> Merge pull request <a href="https://redirect.github.com/xanzy/go-gitlab/issues/1758">#1758</a> from billiechar/billiechar-snippet-moves</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/ddb5ca097455e3087ade383fec32ab07d24cb2c0"><code>ddb5ca0</code></a> Update the PR to make the code consistent</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/a4d27d6848beb49923d87d6201330f869f230f8b"><code>a4d27d6</code></a> Merge pull request <a href="https://redirect.github.com/xanzy/go-gitlab/issues/1759">#1759</a> from PatrickRice-KSC/add-missing-housekeeping-setting</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/a42af8593e45e5a55a6008e482ecbc3dc6f5d06b"><code>a42af85</code></a> Change PipelineTestCases.SystemOutput to interface{}</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/89486a0530374b782bb0267664a5bd49394fbb31"><code>89486a0</code></a> Add missing housekeeping setting</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/852645c7728d7a4284053806b68682b2905c856a"><code>852645c</code></a> Update tests</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/f2c344ca14c5829c55154263b6504d57b26126c3"><code>f2c344c</code></a> Use separate options for each schedule</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/86dd6321cdc296bc3f9a065718e58ea33cb1e686"><code>86dd632</code></a> Add snippet repository storage move APIs</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/3c1f9bfa0d349acfb0aba8991a1abdf62495ee81"><code>3c1f9bf</code></a> Use io.ReadAll instead of ioutil.ReadAll</li> <li>Additional commits viewable in <a href="https://github.com/xanzy/go-gitlab/compare/v0.86.0...v0.88.0">compare view</a></li> </ul> </details> <br /> Updates `gocloud.dev` from 0.30.0 to 0.32.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-cloud/releases">gocloud.dev's releases</a>.</em></p> <blockquote> <h2>v0.32.0</h2> <p>Redoing <code>v0.31.0</code> since I think I messed up the tags. Copying the release notes:</p> <p><strong>all</strong></p> <ul> <li>Update <code>go</code> version in <code>go.mod</code> to maintain cleaner <code>go.mod</code> and <code>go.sum</code> files.</li> </ul> <p><strong>blob</strong></p> <ul> <li><strong>all</strong>: Pass through reader/writer to <code>WriteTo</code>/<code>ReadFrom</code> if available (optimization).</li> <li><strong>all</strong>: Make <code>blob.Bucket</code> implement <code>io/fs.FS</code> and <code>io/fs.SubFS</code>.</li> <li><strong>gcsblob</strong>: Add support for forcing an unauthenticated client.</li> </ul> <p><strong>server</strong></p> <ul> <li>Make <code>requestlog</code> internal structs implement <code>http.Flusher</code>.</li> <li>Don't always read the full request in order to calculate the request size; use <code>Content-Length</code> when available.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-cloud/commit/728b7c1395cb35d23e85ee0a8e957744e2560183"><code>728b7c1</code></a> all: prerelease take 2 (<a href="https://redirect.github.com/google/go-cloud/issues/3278">#3278</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/838a8fd9b6b7efc90b55cb5ed10e19463cbb1262"><code>838a8fd</code></a> all: prerelease (<a href="https://redirect.github.com/google/go-cloud/issues/3277">#3277</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/0f33c81c8dbec9d5302d9615b95c5ba878e0ede9"><code>0f33c81</code></a> all: add dragonfly build to test suite (<a href="https://redirect.github.com/google/go-cloud/issues/3268">#3268</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/bfd1b284ad86ce55bd0a7bc3e1c27fc8814fb87a"><code>bfd1b28</code></a> all: update dependencies (<a href="https://redirect.github.com/google/go-cloud/issues/3276">#3276</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/8d4590ac1e51bca704bc85422cb0a2f2d0b1b7ba"><code>8d4590a</code></a> server/requestlog: Don't consume entire body just to get a request size (<a href="https://redirect.github.com/google/go-cloud/issues/3274">#3274</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/a1d9f4295c59f30b30a085682b47e314c6960673"><code>a1d9f42</code></a> server/requestlog: make responseStats implement http.Flusher (<a href="https://redirect.github.com/google/go-cloud/issues/3275">#3275</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/8cab06ea136cfdd73f67300332994f81234469bc"><code>8cab06e</code></a> blob/gcsblob: add support for forcing an authenticated client (<a href="https://redirect.github.com/google/go-cloud/issues/3273">#3273</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/0e5728dd337838e82e07e03dcef9f54dfc04cc52"><code>0e5728d</code></a> blob: make blob.Bucket implement io/fs.FS and io/fs.SubFS (<a href="https://redirect.github.com/google/go-cloud/issues/3272">#3272</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/a6551792237ccc995a6e95169210ac8e77dbcd94"><code>a655179</code></a> all: update go.mod files to go 1.19 (<a href="https://redirect.github.com/google/go-cloud/issues/3271">#3271</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/8385fc39c70f6589823ca019e399f5514feb377d"><code>8385fc3</code></a> blob: pass through reader/writer to <code>WriteTo</code>/<code>ReadFrom</code> if available (<a href="https://redirect.github.com/google/go-cloud/issues/3267">#3267</a>)</li> <li>Additional commits viewable in <a href="https://github.com/google/go-cloud/compare/v0.30.0...v0.32.0">compare view</a></li> </ul> </details> <br /> Updates `go.uber.org/automaxprocs` from 1.5.2 to 1.5.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/uber-go/automaxprocs/releases">go.uber.org/automaxprocs's releases</a>.</em></p> <blockquote> <h2>v1.5.3</h2> <ul> <li>Fix mountinfo parsing when super options have fields with spaces.</li> <li>Fix division by zero while parsing cgroups.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/uber-go/automaxprocs/blob/master/CHANGELOG.md">go.uber.org/automaxprocs's changelog</a>.</em></p> <blockquote> <h2>v1.5.3 (2023-07-19)</h2> <ul> <li>Fix mountinfo parsing when super options have fields with spaces.</li> <li>Fix division by zero while parsing cgroups.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/uber-go/automaxprocs/commit/e83e959d8845f659d02749ba5598fd62a7129e4e"><code>e83e959</code></a> Release v1.5.3 (<a href="https://redirect.github.com/uber-go/automaxprocs/issues/77">#77</a>)</li> <li><a href="https://github.com/uber-go/automaxprocs/commit/94404505e072633727945d6adc276be8759dadcf"><code>9440450</code></a> Update actions (<a href="https://redirect.github.com/uber-go/automaxprocs/issues/76">#76</a>)</li> <li><a href="https://github.com/uber-go/automaxprocs/commit/4b0a5c9c3c30af086d1251cecd4114b7d4b55a45"><code>4b0a5c9</code></a> set CI perms to readonly (<a href="https://redirect.github.com/uber-go/automaxprocs/issues/75">#75</a>)</li> <li><a href="https://github.com/uber-go/automaxprocs/commit/c64632e175f532a5fe994622797d70b06338337e"><code>c64632e</code></a> Drop Go 1.17 and Go 1.18 from CI (<a href="https://redirect.github.com/uber-go/automaxprocs/issues/74">#74</a>)</li> <li><a href="https://github.com/uber-go/automaxprocs/commit/60f22786b2d20055ca8d888ed455a25aed935bea"><code>60f2278</code></a> fix: mountinfo parsing (<a href="https://redirect.github.com/uber-go/automaxprocs/issues/73">#73</a>)</li> <li><a href="https://github.com/uber-go/automaxprocs/commit/d064ede19db88036b1a2fb6b41113717a84dfda2"><code>d064ede</code></a> Fix division by zero (<a href="https://redirect.github.com/uber-go/automaxprocs/issues/71">#71</a>)</li> <li>See full diff in <a href="https://github.com/uber-go/automaxprocs/compare/v1.5.2...v1.5.3">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-07-20 14:56:26 +02:00
go.uber.org/automaxprocs v1.5.3
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.27.0 // indirect
feat(deps): bump github.com/goreleaser/nfpm/v2 from 2.34.0 to 2.35.0 (#4492) Bumps [github.com/goreleaser/nfpm/v2](https://github.com/goreleaser/nfpm) from 2.34.0 to 2.35.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/goreleaser/nfpm/releases">github.com/goreleaser/nfpm/v2's releases</a>.</em></p> <blockquote> <h2>v2.35.0</h2> <h2>Changelog</h2> <h3>New Features</h3> <ul> <li>9c4fc0e886dabcd359967cdeca9107973e93c4b9: feat: reproducible packages (<a href="https://redirect.github.com/goreleaser/nfpm/issues/748">#748</a>) (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>3485ec3edaba34f90ab57c287ac71eaabfc816be: fix(deb): blank line in package description (<a href="https://redirect.github.com/goreleaser/nfpm/issues/742">#742</a>) (<a href="https://github.com/abemedia"><code>@​abemedia</code></a>)</li> <li>60cff806c953650d9bda31fda43452003552784b: fix: Ensure reproducable Deb package (<a href="https://redirect.github.com/goreleaser/nfpm/issues/747">#747</a>) (<a href="https://github.com/keliramu"><code>@​keliramu</code></a>)</li> <li>2c8f9e0d70ccc37e2eb6433daccc3ca2f67841a1: fix: config merge (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> <li>216b17ffff80a5faad835fc53cbe461322d4bf6a: fix: example should not have prefixed version (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> <li>cdd9a621e98bb5e1b41798b74b720a3273e743ab: fix: use parent owner/group on typedir (<a href="https://redirect.github.com/goreleaser/nfpm/issues/754">#754</a>) (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> </ul> <h3>Dependency updates</h3> <ul> <li>a8707cd42874f46a192ec2ef9918d3a75631afb6: feat(deps): bump github.com/klauspost/compress from 1.17.2 to 1.17.3 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/737">#737</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li> <li>6f2eb59cd263e4a8516ca6addb40e4a5d87b1084: feat(deps): bump github.com/klauspost/compress from 1.17.3 to 1.17.4 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/745">#745</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li> <li>6c241370ccdd5718730556f2b8c13e4733d0fda7: feat(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/732">#732</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li> <li>d56350e61f34f7a596d2383b365da633798aed97: feat(deps): bump golang.org/x/crypto from 0.14.0 to 0.17.0 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/756">#756</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li> </ul> <h3>Build process updates</h3> <ul> <li>560c42ca3c87a2938e3b9cc841ec6cde05c8984b: build: added shell.nix (<a href="https://redirect.github.com/goreleaser/nfpm/issues/743">#743</a>) (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> <li>29c85136454eabe774558c1b67e3ecf025269f55: build: setup nur and winget (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> </ul> <h3>Other work</h3> <ul> <li>c4f2da3568bdd0d2882a02a29b60101f944e0f33: docs: correct GOARCH docs (<a href="https://redirect.github.com/goreleaser/nfpm/issues/733">#733</a>) (<a href="https://github.com/cognifloyd"><code>@​cognifloyd</code></a>)</li> <li>aaaa3fbb8625a9fe03ba2cb5e2c0f050d2393e6b: docs: fix systemd note (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> <li>f0941db79b18d292a921e0ea778fcf5d1c282e0e: docs: update cmd docs (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> <li>7439013fb5dc9357e84aabb36823a21c1b97e8ba: docs: update cmd docs (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/goreleaser/nfpm/compare/v2.34.0...v2.35.0">https://github.com/goreleaser/nfpm/compare/v2.34.0...v2.35.0</a></p> <h2>Helping out</h2> <p>This release is only possible thanks to <strong>all</strong> the support of <strong>awesome people</strong>!</p> <p>Want to be one of them? You can <a href="https://goreleaser.com/sponsors/">sponsor</a> or <a href="https://goreleaser.com/contributing">contribute with code</a>.</p> <h2>Where to go next?</h2> <ul> <li>nFPM is a satellite project from GoReleaser. <a href="https://goreleaser.com">Check it out</a>!</li> <li>Find examples and commented usage of all options in our <a href="https://nfpm.goreleaser.com/">website</a>.</li> <li>Reach out on <a href="https://discord.gg/RGEBtg8vQ6">Discord</a> and <a href="https://twitter.com/goreleaser">Twitter</a>!</li> </ul> <p><!-- raw HTML omitted --><!-- raw HTML omitted --><!-- raw HTML omitted --></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/goreleaser/nfpm/commit/29c85136454eabe774558c1b67e3ecf025269f55"><code>29c8513</code></a> build: setup nur and winget</li> <li><a href="https://github.com/goreleaser/nfpm/commit/cdd9a621e98bb5e1b41798b74b720a3273e743ab"><code>cdd9a62</code></a> fix: use parent owner/group on typedir (<a href="https://redirect.github.com/goreleaser/nfpm/issues/754">#754</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/d56350e61f34f7a596d2383b365da633798aed97"><code>d56350e</code></a> feat(deps): bump golang.org/x/crypto from 0.14.0 to 0.17.0 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/756">#756</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/99bf0d0cf933113d23f200f6d4201f3cf3d93f22"><code>99bf0d0</code></a> test: testifylint fixes (<a href="https://redirect.github.com/goreleaser/nfpm/issues/753">#753</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/8c91e5ebefb281051472fe33c1f68dc3e1587a41"><code>8c91e5e</code></a> chore(deps): bump github/codeql-action from 2 to 3 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/752">#752</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/e43aa7f7d1ec6752af8af47987981cf882f22fa0"><code>e43aa7f</code></a> chore(deps): bump sigstore/cosign-installer from 3.2.0 to 3.3.0 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/751">#751</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/2c8f9e0d70ccc37e2eb6433daccc3ca2f67841a1"><code>2c8f9e0</code></a> fix: config merge</li> <li><a href="https://github.com/goreleaser/nfpm/commit/7439013fb5dc9357e84aabb36823a21c1b97e8ba"><code>7439013</code></a> docs: update cmd docs</li> <li><a href="https://github.com/goreleaser/nfpm/commit/9c4fc0e886dabcd359967cdeca9107973e93c4b9"><code>9c4fc0e</code></a> feat: reproducible packages (<a href="https://redirect.github.com/goreleaser/nfpm/issues/748">#748</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/c3142513c990e867c93c1acad256c9960a059fa1"><code>c314251</code></a> chore(deps): bump actions/setup-go from 4 to 5 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/749">#749</a>)</li> <li>Additional commits viewable in <a href="https://github.com/goreleaser/nfpm/compare/v2.34.0...v2.35.0">compare view</a></li> </ul> </details> <br /> <details> <summary>Most Recent Ignore Conditions Applied to This Pull Request</summary> | Dependency Name | Ignore Conditions | | --- | --- | | github.com/goreleaser/nfpm/v2 | [>= 2.24.a, < 2.25] | </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/goreleaser/nfpm/v2&package-manager=go_modules&previous-version=2.34.0&new-version=2.35.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-21 14:16:43 +02:00
golang.org/x/exp v0.0.0-20231206192017-f3f8817b8deb
chore(deps): bump golang.org/x/tools from 0.19.0 to 0.20.0 (#4762) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/tools&package-manager=go_modules&previous-version=0.19.0&new-version=0.20.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-08 04:05:31 +02:00
golang.org/x/mod v0.17.0 // indirect
chore(deps): bump golang.org/x/tools from 0.20.0 to 0.21.0 (#4840) Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.20.0 to 0.21.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/tools/commit/cc29c91ba3acb47c1793da56d919cc40def4ea41"><code>cc29c91</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/tools/commit/397fef9629377c5179518414e4502009dc0918a2"><code>397fef9</code></a> gopls/internal/protocol: add links to LSP spec</li> <li><a href="https://github.com/golang/tools/commit/e2a352c850a52c32b9bfdb78fbfb97882b7c1424"><code>e2a352c</code></a> internal/refactor/inline: extensible API</li> <li><a href="https://github.com/golang/tools/commit/c16c816ac486df69471674bcaf6f1a8f76f2bdcf"><code>c16c816</code></a> go/analysis/passes/stdversion: test *.go &lt; go.mod version</li> <li><a href="https://github.com/golang/tools/commit/629a7be6d0a4808cd8e7af805986652d81bb975f"><code>629a7be</code></a> go/analysis/analysistest: stricter errors and GOWORK setting</li> <li><a href="https://github.com/golang/tools/commit/4db16973aa22c2c1a5a873261a68949f351efe2b"><code>4db1697</code></a> go/packages/packagestest: fold modules_111.go into modules.go</li> <li><a href="https://github.com/golang/tools/commit/ccdef3cc2699ea2a30a2931a43a1774bd974000a"><code>ccdef3c</code></a> gopls/internal/golang: fix nil panic in InlayHint</li> <li><a href="https://github.com/golang/tools/commit/74c9cfe4d22faa696baabeea02df6493b15e8c79"><code>74c9cfe</code></a> go/analysis: add Pass.ReadFile</li> <li><a href="https://github.com/golang/tools/commit/5ef4fc9014e76bcc56324b24218c0216a7146306"><code>5ef4fc9</code></a> gopls/internal/golang/completion: fix the isEmptyInterface predicate</li> <li><a href="https://github.com/golang/tools/commit/77f691badad098462fed0a46c9a3f5f3d178b633"><code>77f691b</code></a> internal/gcimporter: use Alias.Rhs, not unsafe hack</li> <li>Additional commits viewable in <a href="https://github.com/golang/tools/compare/v0.20.0...v0.21.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/tools&package-manager=go_modules&previous-version=0.20.0&new-version=0.21.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-07 13:44:58 +02:00
golang.org/x/net v0.25.0 // indirect
golang.org/x/sys v0.20.0 // indirect
golang.org/x/term v0.20.0 // indirect
golang.org/x/time v0.5.0 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
google.golang.org/api v0.172.0 // indirect
chore(deps): bump gocloud.dev from 0.36.0 to 0.37.0 (#4688) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.36.0&new-version=0.37.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) Dependabot will merge this PR once it's up-to-date and CI passes on it, as requested by @caarlos0. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-13 19:59:13 +02:00
google.golang.org/genproto v0.0.0-20240311173647-c811ad7063a7 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20240311173647-c811ad7063a7 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20240318140521-94a12d6c2237 // indirect
chore(deps): bump gocloud.dev from 0.36.0 to 0.37.0 (#4688) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.36.0&new-version=0.37.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) Dependabot will merge this PR once it's up-to-date and CI passes on it, as requested by @caarlos0. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-13 19:59:13 +02:00
google.golang.org/grpc v1.62.1 // indirect
google.golang.org/protobuf v1.33.0 // indirect
gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
gopkg.in/go-jose/go-jose.v2 v2.6.3 // indirect
gopkg.in/ini.v1 v1.67.0 // indirect
gopkg.in/warnings.v0 v0.1.2 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
lukechampine.com/blake3 v1.2.1 // indirect
sigs.k8s.io/kind v0.22.0 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
sigs.k8s.io/yaml v1.4.0 // indirect
software.sslmate.com/src/go-pkcs12 v0.4.0 // indirect
)