go/goreleaser
go/goreleaser
1
0
Fork 0
mirror of https://github.com/goreleaser/goreleaser.git synced 2025-01-04 03:11:55 +02:00
Code Issues Releases Activity
b6c6fb39ae
goreleaser/go.mod

273 lines
14 KiB
Modula-2
Raw Normal View History

chore: go modules
2018-10-29 02:54:15 +02:00
module github.com/goreleaser/goreleaser
feat: update to go 1.21 (#4244) update to go 1.21 --------- Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>
2023-08-15 16:15:04 +02:00
go 1.21
fix: invalid pseudo version for github.com/go-macaron/cors (#1138)
2019-09-09 15:17:30 +02:00
chore: go modules
2018-10-29 02:54:15 +02:00
require (
fix(deps): bump code.gitea.io/sdk/gitea from 0.17.0 to 0.17.1 (#4512) Bumps code.gitea.io/sdk/gitea from 0.17.0 to 0.17.1. [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=code.gitea.io/sdk/gitea&package-manager=go_modules&previous-version=0.17.0&new-version=0.17.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-06 14:10:04 +02:00
code.gitea.io/sdk/gitea v0.17.1
feat(deps): use mergo 1.0.0
2023-07-31 18:32:36 +02:00
dario.cat/mergo v1.0.0
feat(deps): bump github.com/Masterminds/semver/v3 from 3.2.0 to 3.2.1 (#3927) Bumps [github.com/Masterminds/semver/v3](https://github.com/Masterminds/semver) from 3.2.0 to 3.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Masterminds/semver/releases">github.com/Masterminds/semver/v3's releases</a>.</em></p> <blockquote> <h2>v3.2.1</h2> <h3>Changed</h3> <ul> <li><a href="https://redirect.github.com/Masterminds/semver/issues/198">#198</a>: Improved testing around pre-release names</li> <li><a href="https://redirect.github.com/Masterminds/semver/issues/200">#200</a>: Improved code scanning with addition of CodeQL</li> <li><a href="https://redirect.github.com/Masterminds/semver/issues/201">#201</a>: Testing now includes Go 1.20. Go 1.17 has been dropped</li> <li><a href="https://redirect.github.com/Masterminds/semver/issues/202">#202</a>: Migrated Fuzz testing to Go built-in Fuzzing. CI runs daily</li> <li><a href="https://redirect.github.com/Masterminds/semver/issues/203">#203</a>: Docs updated for security details</li> </ul> <h3>Fixed</h3> <ul> <li><a href="https://redirect.github.com/Masterminds/semver/issues/199">#199</a>: Fixed issue with range transformations</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Masterminds/semver/compare/v3.2.0...v3.2.1">https://github.com/Masterminds/semver/compare/v3.2.0...v3.2.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Masterminds/semver/blob/master/CHANGELOG.md">github.com/Masterminds/semver/v3's changelog</a>.</em></p> <blockquote> <h2>3.2.1 (2023-04-10)</h2> <h3>Changed</h3> <ul> <li><a href="https://redirect.github.com/Masterminds/semver/issues/198">#198</a>: Improved testing around pre-release names</li> <li><a href="https://redirect.github.com/Masterminds/semver/issues/200">#200</a>: Improved code scanning with addition of CodeQL</li> <li><a href="https://redirect.github.com/Masterminds/semver/issues/201">#201</a>: Testing now includes Go 1.20. Go 1.17 has been dropped</li> <li><a href="https://redirect.github.com/Masterminds/semver/issues/202">#202</a>: Migrated Fuzz testing to Go built-in Fuzzing. CI runs daily</li> <li><a href="https://redirect.github.com/Masterminds/semver/issues/203">#203</a>: Docs updated for security details</li> </ul> <h3>Fixed</h3> <ul> <li><a href="https://redirect.github.com/Masterminds/semver/issues/199">#199</a>: Fixed issue with range transformations</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Masterminds/semver/commit/e06051f8fcc4c8b4a4990c337b9862a2448722e5"><code>e06051f</code></a> Merge pull request <a href="https://redirect.github.com/Masterminds/semver/issues/203">#203</a> from mattfarina/update-readme-fuzz</li> <li><a href="https://github.com/Masterminds/semver/commit/36ea773e91f1694fd18f8579d4ea331b6808abf7"><code>36ea773</code></a> Updating docs for security, fuzz, codeql, gosec</li> <li><a href="https://github.com/Masterminds/semver/commit/e683c4bc93bf35ff810cb0eab188e8e8e9f72fda"><code>e683c4b</code></a> Merge pull request <a href="https://redirect.github.com/Masterminds/semver/issues/202">#202</a> from mattfarina/move-fuzz</li> <li><a href="https://github.com/Masterminds/semver/commit/e485a0d5ffd5c94376b8b4a94a4cad3797c18009"><code>e485a0d</code></a> Migrating Fuzz testing to Go built-in testing</li> <li><a href="https://github.com/Masterminds/semver/commit/4e0f582ff0c63c1f59c5e1cae1a21def0d05d923"><code>4e0f582</code></a> Merge pull request <a href="https://redirect.github.com/Masterminds/semver/issues/201">#201</a> from mattfarina/bump-go-1.20</li> <li><a href="https://github.com/Masterminds/semver/commit/0605d1d86a75a6473619b995afc80469919dbf03"><code>0605d1d</code></a> Updating Go for 1.20</li> <li><a href="https://github.com/Masterminds/semver/commit/cc175775be019f549ae70c9c371bc6e2214af450"><code>cc17577</code></a> Merge pull request <a href="https://redirect.github.com/Masterminds/semver/issues/200">#200</a> from mattfarina/codeql</li> <li><a href="https://github.com/Masterminds/semver/commit/bf2d1900137bc4f5dfc2a3e222066e7725b6d1b0"><code>bf2d190</code></a> Adding CodeQL scanning</li> <li><a href="https://github.com/Masterminds/semver/commit/2c5535be35664eef2e4a4e3253b4f4cb9bc8c22e"><code>2c5535b</code></a> Merge pull request <a href="https://redirect.github.com/Masterminds/semver/issues/199">#199</a> from mattfarina/bug-197</li> <li><a href="https://github.com/Masterminds/semver/commit/b1bb76193b9e8c97a10a4cb1d37d94a7b17e8482"><code>b1bb761</code></a> Fix issue with - ranges being transformed to something imparsible</li> <li>Additional commits viewable in <a href="https://github.com/Masterminds/semver/compare/v3.2.0...v3.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/Masterminds/semver/v3&package-manager=go_modules&previous-version=3.2.0&new-version=3.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-04-23 18:52:42 +02:00
github.com/Masterminds/semver/v3 v3.2.1
chore(deps): bump github.com/atc0005/go-teams-notify/v2 from 2.9.0 to 2.10.0 (#4645) Bumps [github.com/atc0005/go-teams-notify/v2](https://github.com/atc0005/go-teams-notify) from 2.9.0 to 2.10.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/atc0005/go-teams-notify/releases">github.com/atc0005/go-teams-notify/v2's releases</a>.</em></p> <blockquote> <h2>v2.10.0</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <h3>New Features or Enhancements 🎉</h3> <ul> <li>Add <code>IsSublte</code> and <code>HorizontalAlignment</code> to <code>Element</code> by <a href="https://github.com/codello"><code>@​codello</code></a> in <a href="https://redirect.github.com/atc0005/go-teams-notify/pull/255">atc0005/go-teams-notify#255</a></li> </ul> <h3>Dependency Updates</h3> <ul> <li>Update Dependabot PR prefixes by <a href="https://github.com/atc0005"><code>@​atc0005</code></a> in <a href="https://redirect.github.com/atc0005/go-teams-notify/pull/256">atc0005/go-teams-notify#256</a></li> </ul> <h3>Other Changes</h3> <ul> <li>Update CHANGELOG for v2.10.0 release by <a href="https://github.com/atc0005"><code>@​atc0005</code></a> in <a href="https://redirect.github.com/atc0005/go-teams-notify/pull/257">atc0005/go-teams-notify#257</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/codello"><code>@​codello</code></a> made their first contribution in <a href="https://redirect.github.com/atc0005/go-teams-notify/pull/255">atc0005/go-teams-notify#255</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/atc0005/go-teams-notify/compare/v2.9.0...v2.10.0">https://github.com/atc0005/go-teams-notify/compare/v2.9.0...v2.10.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/atc0005/go-teams-notify/blob/master/CHANGELOG.md">github.com/atc0005/go-teams-notify/v2's changelog</a>.</em></p> <blockquote> <h2>[v2.10.0] - 2024-02-22</h2> <h3>Added</h3> <ul> <li>(<a href="https://redirect.github.com/atc0005/go-teams-notify/issues/255">GH-255</a>) Add <code>IsSublte</code> and <code>HorizontalAlignment</code> to <code>Element</code> <ul> <li>credit: <a href="https://github.com/codello"><code>@​codello</code></a></li> </ul> </li> </ul> <h3>Changed</h3> <h4>Dependency Updates</h4> <ul> <li>(<a href="https://redirect.github.com/atc0005/go-teams-notify/issues/256">GH-256</a>) Update Dependabot PR prefixes</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/atc0005/go-teams-notify/commit/2601751590eba249e7d0917c8ca1a2b8a151c4cf"><code>2601751</code></a> Merge pull request <a href="https://redirect.github.com/atc0005/go-teams-notify/issues/257">#257</a> from atc0005/update-changelog-for-v2.10.0-release</li> <li><a href="https://github.com/atc0005/go-teams-notify/commit/976ac3dc024b7650c1c873f313cd0b342592b9be"><code>976ac3d</code></a> Update CHANGELOG for v2.10.0 release</li> <li><a href="https://github.com/atc0005/go-teams-notify/commit/5e4d43cde1ebb5ec830f64806978a976f6201ff5"><code>5e4d43c</code></a> Merge pull request <a href="https://redirect.github.com/atc0005/go-teams-notify/issues/256">#256</a> from atc0005/update-dependabot-pr-prefixes</li> <li><a href="https://github.com/atc0005/go-teams-notify/commit/81a51fe81c9124f887495ebdde6b5cb26e8355f0"><code>81a51fe</code></a> Update Dependabot PR prefixes</li> <li><a href="https://github.com/atc0005/go-teams-notify/commit/84950e72756a9f1bd1cc101239e95969348f212e"><code>84950e7</code></a> Merge pull request <a href="https://redirect.github.com/atc0005/go-teams-notify/issues/255">#255</a> from codello/master</li> <li><a href="https://github.com/atc0005/go-teams-notify/commit/62369585e9caf08d27c078fdc88f51232057a941"><code>6236958</code></a> Add <code>IsSublte</code> and <code>HorizontalAlignment</code> to <code>Element</code></li> <li>See full diff in <a href="https://github.com/atc0005/go-teams-notify/compare/v2.9.0...v2.10.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/atc0005/go-teams-notify/v2&package-manager=go_modules&previous-version=2.9.0&new-version=2.10.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-23 20:52:38 +02:00
github.com/atc0005/go-teams-notify/v2 v2.10.0
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.0.0-20231024185945-8841054dbdb8
feat(deps): bump github.com/caarlos0/ctrlc from 1.1.0 to 1.2.0 (#3316) Bumps [github.com/caarlos0/ctrlc](https://github.com/caarlos0/ctrlc) from 1.1.0 to 1.2.0. - [Release notes](https://github.com/caarlos0/ctrlc/releases) - [Changelog](https://github.com/caarlos0/ctrlc/blob/main/.goreleaser.yml) - [Commits](https://github.com/caarlos0/ctrlc/compare/v1.1.0...v1.2.0) --- updated-dependencies: - dependency-name: github.com/caarlos0/ctrlc dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-08-17 15:58:18 +02:00
github.com/caarlos0/ctrlc v1.2.0
feat(deps): update env to v9 Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>
2023-06-28 18:29:19 +02:00
github.com/caarlos0/env/v9 v9.0.0
fix: go install and go-reddit (#2823) Signed-off-by: Carlos A Becker <caarlos0@gmail.com>
2022-01-10 16:10:35 +02:00
github.com/caarlos0/go-reddit/v3 v3.0.1
fix: remove replace closes #2080 Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com>
2021-03-22 13:45:18 +02:00
github.com/caarlos0/go-shellwords v1.0.12
feat: new --version output (#3962) using the same output as most cloud-native Go-written CLI's use, i.e. using [sigs.k8s.io/release-utils](https://github.com/kubernetes-sigs/release-utils). --------- Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>
2023-04-30 19:19:55 +02:00
github.com/caarlos0/go-version v0.1.1
feat(deps): bump github.com/caarlos0/log from 0.4.3 to 0.4.4 (#4372) Bumps [github.com/caarlos0/log](https://github.com/caarlos0/log) from 0.4.3 to 0.4.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/caarlos0/log/releases">github.com/caarlos0/log's releases</a>.</em></p> <blockquote> <h2>v0.4.4</h2> <h2>Changelog</h2> <hr /> <p><em>Released with <a href="https://goreleaser.com/pro">GoReleaser Pro</a>!</em></p> <h2>v0.4.4</h2> <h2>Changelog</h2> <hr /> <p><em>Released with <a href="https://goreleaser.com/pro">GoReleaser Pro</a>!</em></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/caarlos0/log/commit/614b0a8e4b542760fb69222d5787f9d0e380b08f"><code>614b0a8</code></a> chore(deps): bump github.com/charmbracelet/lipgloss from 0.9.0 to 0.9.1 (<a href="https://redirect.github.com/caarlos0/log/issues/25">#25</a>)</li> <li>See full diff in <a href="https://github.com/caarlos0/log/compare/v0.4.3...v0.4.4">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/caarlos0/log&package-manager=go_modules&previous-version=0.4.3&new-version=0.4.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-16 13:18:55 +02:00
github.com/caarlos0/log v0.4.4
feat(deps): update charmbracelet/keygen Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>
2023-10-07 17:17:16 +02:00
github.com/charmbracelet/keygen v0.5.0
feat(deps): bump github.com/charmbracelet/lipgloss from 0.9.0 to 0.9.1 (#4367) Bumps [github.com/charmbracelet/lipgloss](https://github.com/charmbracelet/lipgloss) from 0.9.0 to 0.9.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/charmbracelet/lipgloss/releases">github.com/charmbracelet/lipgloss's releases</a>.</em></p> <blockquote> <h2>v0.9.1</h2> <p>This bugfix release changes the Table <code>Headers</code> API to accept <code>[]string</code> for consistency with <code>Row</code> / <code>Rows</code> and downgrades Lip Gloss to Go version <code>v1.17</code>.</p> <h2>What's Changed</h2> <ul> <li>Table Headers type from <code>[]any</code> → <code>[]string</code> by <a href="https://github.com/maaslalani"><code>@​maaslalani</code></a> in <a href="https://redirect.github.com/charmbracelet/lipgloss/pull/234">charmbracelet/lipgloss#234</a></li> <li>Downgrade Lip Gloss to <code>v1.17</code> by <a href="https://github.com/maaslalani"><code>@​maaslalani</code></a> in <a href="https://redirect.github.com/charmbracelet/lipgloss/pull/234">charmbracelet/lipgloss#234</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/charmbracelet/lipgloss/compare/v0.9.0...v0.9.1">https://github.com/charmbracelet/lipgloss/compare/v0.9.0...v0.9.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/charmbracelet/lipgloss/commit/f093bc15098a6f7ea879f4345445684fdb458601"><code>f093bc1</code></a> Make headers <code>[]string</code> (<a href="https://redirect.github.com/charmbracelet/lipgloss/issues/234">#234</a>)</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/42db8736172b8e35766ae630f04d0be3b16951aa"><code>42db873</code></a> test(table): ensure README example works</li> <li>See full diff in <a href="https://github.com/charmbracelet/lipgloss/compare/v0.9.0...v0.9.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/charmbracelet/lipgloss&package-manager=go_modules&previous-version=0.9.0&new-version=0.9.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-14 23:57:21 +02:00
github.com/charmbracelet/lipgloss v0.9.1
refactor: use ordered.First (#4362)
2023-10-11 04:16:27 +02:00
github.com/charmbracelet/x/exp/ordered v0.0.0-20231010190216-1cb11efc897d
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/chrismellard/docker-credential-acr-env v0.0.0-20230304212654-82a0ddb27589
feat: update deps Signed-off-by: Carlos A Becker <caarlos0@gmail.com>
2021-12-21 05:03:48 +02:00
github.com/dghubble/go-twitter v0.0.0-20211115160449-93a8679adecb
chore(deps): bump github.com/dghubble/oauth1 from 0.7.2 to 0.7.3 (#4650) Bumps [github.com/dghubble/oauth1](https://github.com/dghubble/oauth1) from 0.7.2 to 0.7.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/dghubble/oauth1/releases">github.com/dghubble/oauth1's releases</a>.</em></p> <blockquote> <h2>v0.7.3</h2> <h2>Changes</h2> <ul> <li>Percent encode special characters in HMAC-SHA1 secrets (<a href="https://redirect.github.com/dghubble/oauth1/pull/72">#72</a>)</li> <li>Strip whitespace from request token body (<a href="https://redirect.github.com/dghubble/oauth1/pull/56">#56</a>)</li> <li>Update Go module dependencies</li> </ul> <h2>Contributions</h2> <ul> <li>Use a centrally managed GitHub Workflow for go tests by <a href="https://github.com/dghubble"><code>@​dghubble</code></a> in <a href="https://redirect.github.com/dghubble/oauth1/pull/68">dghubble/oauth1#68</a></li> <li>Allow Go test Workflow to run on PRs by <a href="https://github.com/dghubble"><code>@​dghubble</code></a> in <a href="https://redirect.github.com/dghubble/oauth1/pull/69">dghubble/oauth1#69</a></li> <li>Fix HMAC-SHA1 key creation. by <a href="https://github.com/jerryryle"><code>@​jerryryle</code></a> in <a href="https://redirect.github.com/dghubble/oauth1/pull/72">dghubble/oauth1#72</a></li> <li>Fix oauth_callback_confirmed comparison when server returns extra whitespace by <a href="https://github.com/pscohn"><code>@​pscohn</code></a> in <a href="https://redirect.github.com/dghubble/oauth1/pull/56">dghubble/oauth1#56</a></li> <li>Add changelog for new release by <a href="https://github.com/dghubble"><code>@​dghubble</code></a> in <a href="https://redirect.github.com/dghubble/oauth1/pull/73A">dghubble/oauth1#73</a></li> </ul> <h2>Dependencies</h2> <ul> <li>Bump github.com/stretchr/testify from 1.8.1 to 1.8.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/dghubble/oauth1/pull/67">dghubble/oauth1#67</a></li> <li>Bump github.com/stretchr/testify from 1.8.2 to 1.8.3 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/dghubble/oauth1/pull/70">dghubble/oauth1#70</a></li> <li>Bump github.com/stretchr/testify from 1.8.3 to 1.8.4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/dghubble/oauth1/pull/71">dghubble/oauth1#71</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/jerryryle"><code>@​jerryryle</code></a> made their first contribution in <a href="https://redirect.github.com/dghubble/oauth1/pull/72">dghubble/oauth1#72</a></li> <li><a href="https://github.com/pscohn"><code>@​pscohn</code></a> made their first contribution in <a href="https://redirect.github.com/dghubble/oauth1/pull/56">dghubble/oauth1#56</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/dghubble/oauth1/compare/v0.7.2...v0.7.3">https://github.com/dghubble/oauth1/compare/v0.7.2...v0.7.3</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/dghubble/oauth1/blob/main/CHANGES.md">github.com/dghubble/oauth1's changelog</a>.</em></p> <blockquote> <h2>v0.7.3</h2> <ul> <li>Percent encode special characters in HMAC-SHA1 secrets (<a href="https://redirect.github.com/dghubble/oauth1/pull/72">#72</a>)</li> <li>Strip whitespace from request token body (<a href="https://redirect.github.com/dghubble/oauth1/pull/56">#56</a>)</li> <li>Update Go module dependencies</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/dghubble/oauth1/commit/1f002e0d15d39ff470e50757a5f07403fcdb759d"><code>1f002e0</code></a> Add changelog for new release</li> <li><a href="https://github.com/dghubble/oauth1/commit/ef868072a599cf57fae2c86353c586dead2a8a57"><code>ef86807</code></a> Fix oauth_callback_confirmed comparison when server returns extra whitespace</li> <li><a href="https://github.com/dghubble/oauth1/commit/bb5618856237e63c3cb37534b7a8b738d518801b"><code>bb56188</code></a> Fix HMAC-SHA1 key creation.</li> <li><a href="https://github.com/dghubble/oauth1/commit/79e2ef8bf593ad9fcda570e35cfbb6e7b7f9206c"><code>79e2ef8</code></a> Bump github.com/stretchr/testify from 1.8.3 to 1.8.4</li> <li><a href="https://github.com/dghubble/oauth1/commit/e7f7a93e50be011b21c74ca86e0f0c4bd341ed77"><code>e7f7a93</code></a> Bump github.com/stretchr/testify from 1.8.2 to 1.8.3</li> <li><a href="https://github.com/dghubble/oauth1/commit/74c61479f9208cf0507b307b7379ca8279653d71"><code>74c6147</code></a> Allow Go test Workflow to run on PRs</li> <li><a href="https://github.com/dghubble/oauth1/commit/43ba0f7195a61293aaaf4b33190a217874f0a1bc"><code>43ba0f7</code></a> Bump github.com/stretchr/testify from 1.8.1 to 1.8.2</li> <li><a href="https://github.com/dghubble/oauth1/commit/2ceed997d3ed5779f03135a3268bb8acf1baaf4c"><code>2ceed99</code></a> Use a centrally managed GitHub Workflow for go tests</li> <li>See full diff in <a href="https://github.com/dghubble/oauth1/compare/v0.7.2...v0.7.3">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/dghubble/oauth1&package-manager=go_modules&previous-version=0.7.2&new-version=0.7.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-27 14:57:24 +02:00
github.com/dghubble/oauth1 v0.7.3
chore(deps): bump github.com/distribution/distribution/v3 from 3.0.0-20221021092657-c47a966fded8 to 3.0.0-alpha.1 (#4604) Bumps [github.com/distribution/distribution/v3](https://github.com/distribution/distribution) from 3.0.0-20221021092657-c47a966fded8 to 3.0.0-alpha.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/distribution/distribution/releases">github.com/distribution/distribution/v3's releases</a>.</em></p> <blockquote> <h2>v3.0.0-alpha.1</h2> <p>This is the first major release in years!</p> <p>It's an accumulation of effort that's bringing major improvements in performance, security and general code quality!</p> <p>See the abridged changelog below and the full release log <a href="https://github.com/distribution/distribution/blob/576d93fee39c22ef1e4735d932ccef32ee49f7fd/releases/v3.0.0.toml">here</a>.</p> <h3>Deprecations</h3> <ul> <li>Image Manifest v2 Schema v1</li> <li><code>oss</code> and <code>swift</code> storage drivers</li> <li><a href="https://github.com/docker/libtrust"><code>docker/libtrust</code></a> has been replaced with <a href="https://github.com/go-jose/go-jose"><code>go-jose/go-jose</code></a></li> <li><code>reference</code> package has been moved to a dedicated repository (see <a href="https://github.com/distribution/reference">here</a>)</li> <li><code>client</code> is no longer supported as a standalone package</li> </ul> <h3>Notable Changes</h3> <ul> <li><code>reference</code> package has been moved to its own dedicated <a href="https://github.com/distribution/reference">repository</a></li> <li>Go module has changed from <code>docker/distribution</code> to <code>distribution/distribution/v3</code></li> <li>Major performance improvements across all supported storage drivers</li> <li>Major dependencies updates (see the full list below)</li> <li>Online documentation is available at <a href="https://distribution.github.io/distribution/">https://distribution.github.io/distribution/</a></li> </ul> <h2>What's Changed</h2> <ul> <li>default autoredirect to false by <a href="https://github.com/davidswu"><code>@​davidswu</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2800">distribution/distribution#2800</a></li> <li>Add docs for autoredirect config parameter by <a href="https://github.com/caervs"><code>@​caervs</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2801">distribution/distribution#2801</a></li> <li>Registry - make minimum TLS version user configurable by <a href="https://github.com/gregrebholz"><code>@​gregrebholz</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2808">distribution/distribution#2808</a></li> <li>Support BYOK for OSS storage driver by <a href="https://github.com/denverdino"><code>@​denverdino</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2791">distribution/distribution#2791</a></li> <li>Add reference. ParseDockerRef utility function by <a href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2786">distribution/distribution#2786</a></li> <li>Fix gometalint errors by <a href="https://github.com/manishtomar"><code>@​manishtomar</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2840">distribution/distribution#2840</a></li> <li>registry: fix binary JSON content-type by <a href="https://github.com/lucab"><code>@​lucab</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2813">distribution/distribution#2813</a></li> <li>Log authorized username by <a href="https://github.com/manishtomar"><code>@​manishtomar</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2854">distribution/distribution#2854</a></li> <li>Fix cloudfront middleware by <a href="https://github.com/vishesh92"><code>@​vishesh92</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2837">distribution/distribution#2837</a></li> <li>support Alibaba Cloud CDN storage middleware by <a href="https://github.com/Shawnpku"><code>@​Shawnpku</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2849">distribution/distribution#2849</a></li> <li>replace rsc.io/letsencrypt in favour of golang.org/x/crypto by <a href="https://github.com/tariq1890"><code>@​tariq1890</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2926">distribution/distribution#2926</a></li> <li>migrate to go modules from vndr by <a href="https://github.com/tariq1890"><code>@​tariq1890</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2941">distribution/distribution#2941</a></li> <li>Fix typo: offest -&gt; offset by <a href="https://github.com/jabrown85"><code>@​jabrown85</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2894">distribution/distribution#2894</a></li> <li>Fix s3 driver for supporting ceph radosgw by <a href="https://github.com/tbe"><code>@​tbe</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2879">distribution/distribution#2879</a></li> <li>Fixes <a href="https://redirect.github.com/distribution/distribution/issues/2835">#2835</a> Process Accept header MIME types in case-insensitive way by <a href="https://github.com/yuwaMSFT2"><code>@​yuwaMSFT2</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2861">distribution/distribution#2861</a></li> <li>change default Dockerfile to install ssl utils by <a href="https://github.com/andyzhangx"><code>@​andyzhangx</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2809">distribution/distribution#2809</a></li> <li>Append the written bytes to the blob writer's size by <a href="https://github.com/dmathieu"><code>@​dmathieu</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2920">distribution/distribution#2920</a></li> <li>fix no error returned in fetchTokenWithOAuth by <a href="https://github.com/sevki"><code>@​sevki</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2900">distribution/distribution#2900</a></li> <li>use latest version of alpine when building the Docker container by <a href="https://github.com/tariq1890"><code>@​tariq1890</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2946">distribution/distribution#2946</a></li> <li>Extract blob upload resume into its own method by <a href="https://github.com/dmathieu"><code>@​dmathieu</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2930">distribution/distribution#2930</a></li> <li>Handle Blob Create when the underlying registry doesn't provide 'Docker-Upload-UUID' by <a href="https://github.com/dmathieu"><code>@​dmathieu</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2927">distribution/distribution#2927</a></li> <li>Implement Repository ServeBlob by <a href="https://github.com/dmathieu"><code>@​dmathieu</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2921">distribution/distribution#2921</a></li> <li>Add notification metrics by <a href="https://github.com/tifayuki"><code>@​tifayuki</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2522">distribution/distribution#2522</a></li> <li>Update the versions of several dependencies by <a href="https://github.com/tariq1890"><code>@​tariq1890</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2947">distribution/distribution#2947</a></li> <li>Implement Repository Blobs upload resuming by <a href="https://github.com/dmathieu"><code>@​dmathieu</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2917">distribution/distribution#2917</a></li> <li>allow for VERSION and REVISION to be passed in during docker builds by <a href="https://github.com/alex-laties"><code>@​alex-laties</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2955">distribution/distribution#2955</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/distribution/distribution/commits/v3.0.0-alpha.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/distribution/distribution/v3&package-manager=go_modules&previous-version=3.0.0-20221021092657-c47a966fded8&new-version=3.0.0-alpha.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-08 15:22:12 +02:00
github.com/distribution/distribution/v3 v3.0.0-alpha.1
chore: go mod tidy
2021-10-29 19:02:33 +02:00
github.com/go-telegram-bot-api/telegram-bot-api v4.6.4+incompatible
chore(deps): bump github.com/google/go-containerregistry from 0.18.0 to 0.19.0 (#4589) Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.18.0 to 0.19.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-containerregistry/releases">github.com/google/go-containerregistry's releases</a>.</em></p> <blockquote> <h2>v0.19.0</h2> <h2>What's Changed</h2> <ul> <li>Work around docker v25 tarballs by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/1872">google/go-containerregistry#1872</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/google/go-containerregistry/compare/v0.18.0...v0.19.0">https://github.com/google/go-containerregistry/compare/v0.18.0...v0.19.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-containerregistry/commit/8dadbe76ff8c20d0e509406f04b7eade43baa6c1"><code>8dadbe7</code></a> Work around docker v25 tarballs (<a href="https://redirect.github.com/google/go-containerregistry/issues/1872">#1872</a>)</li> <li>See full diff in <a href="https://github.com/google/go-containerregistry/compare/v0.18.0...v0.19.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/go-containerregistry&package-manager=go_modules&previous-version=0.18.0&new-version=0.19.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-30 12:51:25 +02:00
github.com/google/go-containerregistry v0.19.0
chore(deps): update go-github to v59 (#4622) <!-- Hi, thanks for contributing! Please make sure you read our CONTRIBUTING guide. Also, add tests and the respective documentation changes as well. --> <!-- If applied, this commit will... --> ... <!-- Why is this change being made? --> ... <!-- # Provide links to any relevant tickets, URLs or other resources --> ... Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>
2024-02-09 20:43:19 +02:00
github.com/google/go-github/v59 v59.0.0
feat(deps): bump github.com/google/ko from 0.15.0 to 0.15.1 (#4435) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.15.0 to 0.15.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.15.1</h2> <h2>What's Changed</h2> <ul> <li>Don't AppendDescriptor until we've written config by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1175">ko-build/ko#1175</a></li> <li>Add more locking around on-disk image cache by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1176">ko-build/ko#1176</a></li> <li>Fix &quot;AM&quot; Time Typo by <a href="https://github.com/StephenGrider"><code>@​StephenGrider</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1179">ko-build/ko#1179</a></li> <li>docs: add MacPorts install info by <a href="https://github.com/herbygillot"><code>@​herbygillot</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1180">ko-build/ko#1180</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/StephenGrider"><code>@​StephenGrider</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1179">ko-build/ko#1179</a></li> <li><a href="https://github.com/herbygillot"><code>@​herbygillot</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1180">ko-build/ko#1180</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ko-build/ko/compare/v0.15.0...v0.15.1">https://github.com/ko-build/ko/compare/v0.15.0...v0.15.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/2e9e58b187e1092534fbfc9889a04725da4a403d"><code>2e9e58b</code></a> Bump k8s.io/apimachinery from 0.28.3 to 0.28.4</li> <li><a href="https://github.com/ko-build/ko/commit/84d3803370e7adf419c594cb210d1171307a4446"><code>84d3803</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1177">#1177</a> from ko-build/dependabot/go_modules/github.com/sigst...</li> <li><a href="https://github.com/ko-build/ko/commit/512ca9c0fbb7f766cf2dda1b8046adf146a70bd5"><code>512ca9c</code></a> Bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1</li> <li><a href="https://github.com/ko-build/ko/commit/4aceae1ddfa57badea67a533d6505ffa8226aff8"><code>4aceae1</code></a> update test</li> <li><a href="https://github.com/ko-build/ko/commit/a271b54fe5f4774a65741f945490c32fe160f0d1"><code>a271b54</code></a> Bump github.com/google/go-containerregistry from 0.15.2 to 0.16.1</li> <li><a href="https://github.com/ko-build/ko/commit/cfc13deeb6417d7e1582f0314a6009cc0c53f26f"><code>cfc13de</code></a> Bump golang.org/x/tools from 0.14.0 to 0.15.0</li> <li><a href="https://github.com/ko-build/ko/commit/59038b983fc131ebcd702dfb64ab9289e07d4e76"><code>59038b9</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1180">#1180</a> from herbygillot/patch-1</li> <li><a href="https://github.com/ko-build/ko/commit/63cd51141203d881f4f1cbf542bbcb2ab8ec9bea"><code>63cd511</code></a> docs: add MacPorts install info</li> <li><a href="https://github.com/ko-build/ko/commit/f1f5fb3afb7fe563ad71dfdc50887f156cfde703"><code>f1f5fb3</code></a> Update community.md (<a href="https://redirect.github.com/google/ko/issues/1179">#1179</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/c92ea35f27f271c1ca29ad67454e7ad083026b43"><code>c92ea35</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1178">#1178</a> from ko-build/dependabot/github_actions/sigstore/cos...</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.15.0...v0.15.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.15.0&new-version=0.15.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) Dependabot will merge this PR once CI passes on it, as requested by @caarlos0. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-23 22:38:08 +02:00
github.com/google/ko v0.15.1
chore(deps): bump github.com/google/uuid from 1.5.0 to 1.6.0 (#4571) Bumps [github.com/google/uuid](https://github.com/google/uuid) from 1.5.0 to 1.6.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/uuid/releases">github.com/google/uuid's releases</a>.</em></p> <blockquote> <h2>v1.6.0</h2> <h2><a href="https://github.com/google/uuid/compare/v1.5.0...v1.6.0">1.6.0</a> (2024-01-16)</h2> <h3>Features</h3> <ul> <li>add Max UUID constant (<a href="https://redirect.github.com/google/uuid/issues/149">#149</a>) (<a href="https://github.com/google/uuid/commit/c58770eb495f55fe2ced6284f93c5158a62e53e3">c58770e</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>fix typo in version 7 uuid documentation (<a href="https://redirect.github.com/google/uuid/issues/153">#153</a>) (<a href="https://github.com/google/uuid/commit/016b199544692f745ffc8867b914129ecb47ef06">016b199</a>)</li> <li>Monotonicity in UUIDv7 (<a href="https://redirect.github.com/google/uuid/issues/150">#150</a>) (<a href="https://github.com/google/uuid/commit/a2b2b32373ff0b1a312b7fdf6d38a977099698a6">a2b2b32</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/google/uuid/blob/master/CHANGELOG.md">github.com/google/uuid's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/google/uuid/compare/v1.5.0...v1.6.0">1.6.0</a> (2024-01-16)</h2> <h3>Features</h3> <ul> <li>add Max UUID constant (<a href="https://redirect.github.com/google/uuid/issues/149">#149</a>) (<a href="https://github.com/google/uuid/commit/c58770eb495f55fe2ced6284f93c5158a62e53e3">c58770e</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>fix typo in version 7 uuid documentation (<a href="https://redirect.github.com/google/uuid/issues/153">#153</a>) (<a href="https://github.com/google/uuid/commit/016b199544692f745ffc8867b914129ecb47ef06">016b199</a>)</li> <li>Monotonicity in UUIDv7 (<a href="https://redirect.github.com/google/uuid/issues/150">#150</a>) (<a href="https://github.com/google/uuid/commit/a2b2b32373ff0b1a312b7fdf6d38a977099698a6">a2b2b32</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/uuid/commit/0f11ee6918f41a04c201eceeadf612a377bc7fbc"><code>0f11ee6</code></a> chore(master): release 1.6.0 (<a href="https://redirect.github.com/google/uuid/issues/151">#151</a>)</li> <li><a href="https://github.com/google/uuid/commit/16939dafc37a38d2743810a8bdf60fdad6a0f3a3"><code>16939da</code></a> chore(tests): add strict monotonicity test case for uuid v7. (<a href="https://redirect.github.com/google/uuid/issues/154">#154</a>)</li> <li><a href="https://github.com/google/uuid/commit/016b199544692f745ffc8867b914129ecb47ef06"><code>016b199</code></a> fix: fix typo in version 7 uuid documentation (<a href="https://redirect.github.com/google/uuid/issues/153">#153</a>)</li> <li><a href="https://github.com/google/uuid/commit/1d8b6ea0990d688105843a9a67b1d07222350502"><code>1d8b6ea</code></a> ci: set token permissions to github workflows (<a href="https://redirect.github.com/google/uuid/issues/143">#143</a>)</li> <li><a href="https://github.com/google/uuid/commit/a2b2b32373ff0b1a312b7fdf6d38a977099698a6"><code>a2b2b32</code></a> fix: Monotonicity in UUIDv7 (<a href="https://redirect.github.com/google/uuid/issues/150">#150</a>)</li> <li><a href="https://github.com/google/uuid/commit/c58770eb495f55fe2ced6284f93c5158a62e53e3"><code>c58770e</code></a> feat: add Max UUID constant (<a href="https://redirect.github.com/google/uuid/issues/149">#149</a>)</li> <li>See full diff in <a href="https://github.com/google/uuid/compare/v1.5.0...v1.6.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/uuid&package-manager=go_modules&previous-version=1.5.0&new-version=1.6.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-24 16:37:02 +02:00
github.com/google/uuid v1.6.0
feat(deps): bump github.com/goreleaser/fileglob from 1.2.0 to 1.3.0 (#2896) Bumps [github.com/goreleaser/fileglob](https://github.com/goreleaser/fileglob) from 1.2.0 to 1.3.0. - [Release notes](https://github.com/goreleaser/fileglob/releases) - [Changelog](https://github.com/goreleaser/fileglob/blob/main/.goreleaser.yml) - [Commits](https://github.com/goreleaser/fileglob/compare/v1.2.0...v1.3.0) --- updated-dependencies: - dependency-name: github.com/goreleaser/fileglob dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-02-12 04:17:13 +02:00
github.com/goreleaser/fileglob v1.3.0
chore(deps): bump github.com/goreleaser/nfpm/v2 from 2.35.2 to 2.35.3 (#4596) Bumps [github.com/goreleaser/nfpm/v2](https://github.com/goreleaser/nfpm) from 2.35.2 to 2.35.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/goreleaser/nfpm/releases">github.com/goreleaser/nfpm/v2's releases</a>.</em></p> <blockquote> <h2>v2.35.3</h2> <h2>Changelog</h2> <h3>Bug fixes</h3> <ul> <li>f8ccc9df94eb9a4c91c3a1c78d4759a65f156731: fix: file mode when type: tree (<a href="https://redirect.github.com/goreleaser/nfpm/issues/779">#779</a>) (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> <li>e1ebfdad10ef98fe6c9d424efe3f97d7b2322f04: fix: honor SOURCE_DATE_EPOCH for files (<a href="https://redirect.github.com/goreleaser/nfpm/issues/775">#775</a>) (<a href="https://github.com/osm"><code>@​osm</code></a>)</li> </ul> <h3>Dependency updates</h3> <ul> <li>9c48b79596993dd653087f91861794b7da6267e6: feat(deps): bump github.com/ProtonMail/go-crypto (<a href="https://redirect.github.com/goreleaser/nfpm/issues/771">#771</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li> <li>d7a5dc79573e4bf5d65c3f00d9cac81736f12597: feat(deps): bump github.com/cloudflare/circl from 1.3.3 to 1.3.7 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/765">#765</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li> <li>fbc55c56be14ac5de4207becb98c908c615dee7e: feat(deps): bump github.com/klauspost/compress from 1.17.4 to 1.17.5 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/774">#774</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li> <li>9bb94d758ce739fc27c19bbe04bf1c1d33ce3fa9: fix(deps): update go-rpmutils (<a href="https://redirect.github.com/goreleaser/nfpm/issues/764">#764</a>) (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> </ul> <h3>Build process updates</h3> <ul> <li>5ace4da2fd3162383a16218e2ef405dc2676bdfc: ci: update changelog (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> </ul> <h3>Other work</h3> <ul> <li>cd6b94108561b9ef1b06e1db8bfe9e3b3f643253: docs: update cmd docs (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> <li>672f8c6537228848062786d7ad2d2956f6808986: docs: update starchart url (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/goreleaser/nfpm/compare/v2.35.2...v2.35.3">https://github.com/goreleaser/nfpm/compare/v2.35.2...v2.35.3</a></p> <h2>Helping out</h2> <p>This release is only possible thanks to <strong>all</strong> the support of <strong>awesome people</strong>!</p> <p>Want to be one of them? You can <a href="https://goreleaser.com/sponsors/">sponsor</a> or <a href="https://goreleaser.com/contributing">contribute with code</a>.</p> <h2>Where to go next?</h2> <ul> <li>nFPM is a satellite project from GoReleaser. <a href="https://goreleaser.com">Check it out</a>!</li> <li>Find examples and commented usage of all options in our <a href="https://nfpm.goreleaser.com/">website</a>.</li> <li>Reach out on <a href="https://discord.gg/RGEBtg8vQ6">Discord</a> and <a href="https://twitter.com/goreleaser">Twitter</a>!</li> </ul> <p><!-- raw HTML omitted --><!-- raw HTML omitted --><!-- raw HTML omitted --></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/goreleaser/nfpm/commit/5ace4da2fd3162383a16218e2ef405dc2676bdfc"><code>5ace4da</code></a> ci: update changelog</li> <li><a href="https://github.com/goreleaser/nfpm/commit/f8ccc9df94eb9a4c91c3a1c78d4759a65f156731"><code>f8ccc9d</code></a> fix: file mode when type: tree (<a href="https://redirect.github.com/goreleaser/nfpm/issues/779">#779</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/48d1a19eb6c3b6fa7cf69295aa2e7bf8d2b2f520"><code>48d1a19</code></a> chore(deps): bump anchore/sbom-action from 0.15.6 to 0.15.7 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/778">#778</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/e1ebfdad10ef98fe6c9d424efe3f97d7b2322f04"><code>e1ebfda</code></a> fix: honor SOURCE_DATE_EPOCH for files (<a href="https://redirect.github.com/goreleaser/nfpm/issues/775">#775</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/25f6f2b7368585e0534b668ef76094f107e1fe4f"><code>25f6f2b</code></a> chore(deps): bump anchore/sbom-action from 0.15.5 to 0.15.6 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/776">#776</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/fbc55c56be14ac5de4207becb98c908c615dee7e"><code>fbc55c5</code></a> feat(deps): bump github.com/klauspost/compress from 1.17.4 to 1.17.5 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/774">#774</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/d83a6724284364757db5b61c7b2bd9bf0918264e"><code>d83a672</code></a> chore(deps): bump anchore/sbom-action from 0.15.4 to 0.15.5 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/773">#773</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/995a27a6fb5009a2a7e13e7747c9a7ef5a3e8098"><code>995a27a</code></a> chore(deps): bump anchore/sbom-action from 0.15.3 to 0.15.4 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/772">#772</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/9c48b79596993dd653087f91861794b7da6267e6"><code>9c48b79</code></a> feat(deps): bump github.com/ProtonMail/go-crypto (<a href="https://redirect.github.com/goreleaser/nfpm/issues/771">#771</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/e8832cc97b405ce3af1a6026f010d19e521bb1ff"><code>e8832cc</code></a> chore(deps): bump actions/cache from 3.3.3 to 4.0.0 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/770">#770</a>)</li> <li>Additional commits viewable in <a href="https://github.com/goreleaser/nfpm/compare/v2.35.2...v2.35.3">compare view</a></li> </ul> </details> <br /> <details> <summary>Most Recent Ignore Conditions Applied to This Pull Request</summary> | Dependency Name | Ignore Conditions | | --- | --- | | github.com/goreleaser/nfpm/v2 | [>= 2.24.a, < 2.25] | </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/goreleaser/nfpm/v2&package-manager=go_modules&previous-version=2.35.2&new-version=2.35.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) Dependabot will merge this PR once it's up-to-date and CI passes on it, as requested by @caarlos0. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-01 20:56:17 +02:00
github.com/goreleaser/nfpm/v2 v2.35.3
fix: only fail announcing phase in the end (#3666) This prevents one announce failure to skip all other announcers. The release will still report a failure in the end, but will not fail in the first failure. Also improved errors messages a little bit. closes #3663 Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com>
2022-12-28 17:24:21 +02:00
github.com/hashicorp/go-multierror v1.1.1
feat(deps): bump github.com/invopop/jsonschema from 0.11.0 to 0.12.0 (#4348) Bumps [github.com/invopop/jsonschema](https://github.com/invopop/jsonschema) from 0.11.0 to 0.12.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/invopop/jsonschema/commit/9b6bb6e8f15aa557c1df053de86d4e5043365ca9"><code>9b6bb6e</code></a> Merge pull request <a href="https://redirect.github.com/invopop/jsonschema/issues/108">#108</a> from invopop/schema-property-alias</li> <li><a href="https://github.com/invopop/jsonschema/commit/f45517cf07169cf4e35eae0a4e47ad8086098583"><code>f45517c</code></a> Typo</li> <li><a href="https://github.com/invopop/jsonschema/commit/ab81e2aa6405fefd82b6958075d64d2de1844bcd"><code>ab81e2a</code></a> Fixing linting</li> <li><a href="https://github.com/invopop/jsonschema/commit/933814a23a0b8401d90625df47f4be2a0c9a3039"><code>933814a</code></a> support for JSONSchemaAlias y JSONSchemaProperty methods</li> <li><a href="https://github.com/invopop/jsonschema/commit/0108689b9f4e04f64a5986ea21650f07673c21cf"><code>0108689</code></a> Support for JSONSchemaAlias method</li> <li><a href="https://github.com/invopop/jsonschema/commit/12cbc49539c8deac9baeae7811fdcab42fd5def0"><code>12cbc49</code></a> Updating test output with new number parsing</li> <li><a href="https://github.com/invopop/jsonschema/commit/cada51da5649ccf919c51225dd8e2260a388b883"><code>cada51d</code></a> Merge pull request <a href="https://redirect.github.com/invopop/jsonschema/issues/96">#96</a> from Hotdawg/regex_with_equals</li> <li><a href="https://github.com/invopop/jsonschema/commit/9d905a25553837495e11ecb6d61f5348110dc49f"><code>9d905a2</code></a> Limit split on genericKeywords</li> <li><a href="https://github.com/invopop/jsonschema/commit/080d97dda979ca9544cc362b9f1c7c02cfc03697"><code>080d97d</code></a> Merge branch 'invopop:main' into regex_with_equals</li> <li><a href="https://github.com/invopop/jsonschema/commit/8a098cbcb66558b5c55fccd24c7cc42825d906d6"><code>8a098cb</code></a> Fix linter issue</li> <li>See full diff in <a href="https://github.com/invopop/jsonschema/compare/v0.11.0...v0.12.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/invopop/jsonschema&package-manager=go_modules&previous-version=0.11.0&new-version=0.12.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-05 14:48:15 +02:00
github.com/invopop/jsonschema v0.12.0
feat(deps): bump github.com/jarcoal/httpmock from 1.3.0 to 1.3.1 (#4253) Bumps [github.com/jarcoal/httpmock](https://github.com/jarcoal/httpmock) from 1.3.0 to 1.3.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jarcoal/httpmock/releases">github.com/jarcoal/httpmock's releases</a>.</em></p> <blockquote> <h2>v1.3.1</h2> <p>Fix:</p> <ul> <li><a href="https://pkg.go.dev/github.com/jarcoal/httpmock#BodyContainsBytes">BodyContainsBytes</a> &amp; <a href="https://pkg.go.dev/github.com/jarcoal/httpmock#BodyContainsString">BodyContainsString</a> used with <a href="https://pkg.go.dev/github.com/jarcoal/httpmock#Matcher.And">And</a>/<a href="https://pkg.go.dev/github.com/jarcoal/httpmock#Matcher.Or">Or</a> by <a href="https://github.com/maxatome"><code>@​maxatome</code></a> in <a href="https://redirect.github.com/jarcoal/httpmock/issues/146">#146</a> thanks to <a href="https://github.com/Moon1706"><code>@​Moon1706</code></a> for the report → <a href="https://redirect.github.com/jarcoal/httpmock/issues/145">#145</a>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jarcoal/httpmock/commit/8b32cd6f52e32195f15b55c5217c12c29d6004b5"><code>8b32cd6</code></a> fix: BodyContainsBytes &amp; BodyContainsString used with And/Or</li> <li><a href="https://github.com/jarcoal/httpmock/commit/497153dd46a496640fe99428b2c833ddab93f119"><code>497153d</code></a> ci: test against go 1.21 &amp; use golangci-lint 1.54.1</li> <li><a href="https://github.com/jarcoal/httpmock/commit/070d3c85e0739c5ef0230c40f7b48b16d24c44ff"><code>070d3c8</code></a> ci: switch to install-go v3.4</li> <li><a href="https://github.com/jarcoal/httpmock/commit/1ddb9fa5c42c84afdca30c98914b42fda3005a57"><code>1ddb9fa</code></a> refactor: make golangci-lint v1.52.2 happy</li> <li><a href="https://github.com/jarcoal/httpmock/commit/507a05e8629b1661bbf08df649775319a6bde5d4"><code>507a05e</code></a> ci: add workflow_dispatch as event trigger</li> <li>See full diff in <a href="https://github.com/jarcoal/httpmock/compare/v1.3.0...v1.3.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/jarcoal/httpmock&package-manager=go_modules&previous-version=1.3.0&new-version=1.3.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-08-17 13:33:17 +02:00
github.com/jarcoal/httpmock v1.3.1
feat(deps): bump github.com/klauspost/pgzip from 1.2.5 to 1.2.6 (#3985)
2023-05-11 14:38:19 +02:00
github.com/klauspost/pgzip v1.2.6
feat: add mastodon (#3567) This PR adds [mastodon](https://joinmastodon.org/) as an announcement pipeline. 🥳 ![mastodon-announce](https://user-images.githubusercontent.com/42128690/202544345-d90d8f10-0818-4bc2-bc35-3dbcba4254b0.png) Resolves #3566 Signed-off-by: jolheiser <john.olheiser@gmail.com>
2022-11-18 01:40:00 +02:00
github.com/mattn/go-mastodon v0.0.6
feat: add gitlab for releases (#1038) * outlines gitlab client integration * makes client parameter more explicit * adds gitlab url to config * changes releaseID to string to adapt to gitlab * updates to latest gitlab client lib 0.18 * fixes copy paster in gitlab upload func * fixes gitlab typo in config * adds gitlab token to env and context * release now uses the client factory method * skips brew pipe if it is not a github release * add github tokentype to publish tests * skips scoop pipe if it is not a github release * corrects brew skip msg * adds gitlab token to main test * adds gitlab to release docs * validates config and errors accordingly * adapt release pipe name to include gitlab * fixes gitlab client after testing * moves not-configured brew and scoop pipe checks as first check * adds more debug to gitlab client * adapts changelog generation for gitlab markdown * adds debug log for gitlab changelog * env needs to run before changelog pipe * moves gitlab default download url to default pipe * moves multiple releases check to from config to release pipe * release differs now for github and gitlab * adds debug gitlab release update msgs * moves env pipe as second after before because it determines the token type other pipes depend on * adaptes error check on gitlab release creation * Revert "adaptes error check on gitlab release creation" This reverts commit 032024571c76140f8e2207ee01cc08088f37594b. * simplifies gitlab client logic. removes comments * skips tls verification for gitlab client if specified in config * updates the docs * adds clarification that brew and scoop are not supported if it is a gitlab release * fixes copy paster in release.md * adds missing blob pipe in defaults and publish due to missing in merge * updates comment in gitlab client
2019-06-29 16:02:40 +02:00
github.com/mitchellh/go-homedir v1.1.0
feat(deps): bump github.com/muesli/mango-cobra from 1.1.0 to 1.2.0 (#3181)
2022-06-22 13:46:38 +02:00
github.com/muesli/mango-cobra v1.2.0
feat: manpages (#2837) * feat: manpages Signed-off-by: Carlos A Becker <caarlos0@gmail.com> * fix: section Signed-off-by: Carlos A Becker <caarlos0@gmail.com> * feat: use mango instead Signed-off-by: Carlos A Becker <caarlos0@gmail.com> * fix: improvements Signed-off-by: Carlos A Becker <caarlos0@gmail.com> * fix: unused Signed-off-by: Carlos A Becker <caarlos0@gmail.com>
2022-01-18 15:17:52 +02:00
github.com/muesli/roff v0.1.0
feat(deps): bump github.com/muesli/termenv from 0.15.1 to 0.15.2 (#4148) Bumps [github.com/muesli/termenv](https://github.com/muesli/termenv) from 0.15.1 to 0.15.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/muesli/termenv/releases">github.com/muesli/termenv's releases</a>.</em></p> <blockquote> <h2>v0.15.2</h2> <h2>What's Changed</h2> <ul> <li>build(deps): bump actions/setup-go from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/muesli/termenv/pull/126">muesli/termenv#126</a></li> <li>build(deps): bump github.com/mattn/go-isatty from 0.0.17 to 0.0.18 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/muesli/termenv/pull/128">muesli/termenv#128</a></li> <li>fix: Cloud Shell supports RGB colors by <a href="https://github.com/muesli"><code>@​muesli</code></a> in <a href="https://redirect.github.com/muesli/termenv/pull/127">muesli/termenv#127</a></li> <li>build(deps): bump golang.org/x/sys from 0.6.0 to 0.7.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/muesli/termenv/pull/129">muesli/termenv#129</a></li> <li>fix: wezterm is truecolor by <a href="https://github.com/caarlos0"><code>@​caarlos0</code></a> in <a href="https://redirect.github.com/muesli/termenv/pull/139">muesli/termenv#139</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/muesli/termenv/compare/v0.15.1...v0.15.2">https://github.com/muesli/termenv/compare/v0.15.1...v0.15.2</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/muesli/termenv/commit/51d72d34e2b9778a31aa5dd79fbdd8cdac50b4d5"><code>51d72d3</code></a> fix: wezterm is truecolor (<a href="https://redirect.github.com/muesli/termenv/issues/139">#139</a>)</li> <li><a href="https://github.com/muesli/termenv/commit/b57cbb11093e11f08bdeb3d54234909b8fa079fe"><code>b57cbb1</code></a> fix: lint</li> <li><a href="https://github.com/muesli/termenv/commit/e02986697d716017087dc725465e3d8691d317e4"><code>e029866</code></a> build(deps): bump golang.org/x/sys from 0.6.0 to 0.7.0</li> <li><a href="https://github.com/muesli/termenv/commit/9b3e79975a48df063aa7a7c1ca0c20c3c868332c"><code>9b3e799</code></a> fix: Cloud Shell supports RGB colors</li> <li><a href="https://github.com/muesli/termenv/commit/73a40463ff25452432bd4e588150285c6aeca58e"><code>73a4046</code></a> build(deps): bump github.com/mattn/go-isatty from 0.0.17 to 0.0.18</li> <li><a href="https://github.com/muesli/termenv/commit/39f5d6e77915ccc34a9e752ad0b7a3443b393058"><code>39f5d6e</code></a> build(deps): bump actions/setup-go from 3 to 4</li> <li>See full diff in <a href="https://github.com/muesli/termenv/compare/v0.15.1...v0.15.2">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/muesli/termenv&package-manager=go_modules&previous-version=0.15.1&new-version=0.15.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-28 14:46:00 +02:00
github.com/muesli/termenv v0.15.2
feat(deps): bump github.com/ory/dockertest/v3 from 3.9.1 to 3.10.0 (#3947) Bumps [github.com/ory/dockertest/v3](https://github.com/ory/dockertest) from 3.9.1 to 3.10.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ory/dockertest/commit/0d540538ba862768f4cf01a550f3b0e5dfcf83e1"><code>0d54053</code></a> chore(deps): bump actions/stale from 4 to 8 (<a href="https://redirect.github.com/ory/dockertest/issues/430">#430</a>)</li> <li><a href="https://github.com/ory/dockertest/commit/355d9264da44939c85aacc49c990e7d5fab46a4b"><code>355d926</code></a> chore(deps): bump actions/setup-node from 2.pre.beta to 3.6.0 (<a href="https://redirect.github.com/ory/dockertest/issues/429">#429</a>)</li> <li><a href="https://github.com/ory/dockertest/commit/afee4d2c072fd28b9d5def5a9dd96f7cb789ac71"><code>afee4d2</code></a> Replace pkg/errors with native error wrapping (<a href="https://redirect.github.com/ory/dockertest/issues/433">#433</a>)</li> <li><a href="https://github.com/ory/dockertest/commit/5d9a022f39dec2056eed8b0ccca2961f5de5ed8a"><code>5d9a022</code></a> docs: fix typo in FakeGoogleCloudStorage example (<a href="https://redirect.github.com/ory/dockertest/issues/434">#434</a>)</li> <li><a href="https://github.com/ory/dockertest/commit/e733223e5349f34edddbebf4852aabae1964e476"><code>e733223</code></a> fix: use std context lib (<a href="https://redirect.github.com/ory/dockertest/issues/404">#404</a>)</li> <li><a href="https://github.com/ory/dockertest/commit/51627a024572d83a084aebe75e89823e84fc7e01"><code>51627a0</code></a> chore(deps): bump golang.org/x/sys from 0.6.0 to 0.7.0 (<a href="https://redirect.github.com/ory/dockertest/issues/432">#432</a>)</li> <li><a href="https://github.com/ory/dockertest/commit/7b0c8dc1f6dcef51b5ee7c64a1bdd9dbe4b300b5"><code>7b0c8dc</code></a> chore: bump workflow actions; configure dependabot (<a href="https://redirect.github.com/ory/dockertest/issues/424">#424</a>)</li> <li><a href="https://github.com/ory/dockertest/commit/1b74b04e7dee8be3c18f5c204770d7771fc65215"><code>1b74b04</code></a> refactor: replace deprecated ioutil with io and os (<a href="https://redirect.github.com/ory/dockertest/issues/423">#423</a>)</li> <li><a href="https://github.com/ory/dockertest/commit/87ce1b953729aff6f379bb27d4df0a46521567ae"><code>87ce1b9</code></a> ci: ignore wrongly reported CVE (<a href="https://redirect.github.com/ory/dockertest/issues/425">#425</a>)</li> <li><a href="https://github.com/ory/dockertest/commit/7bcb18d4d98ba92ec04e5baa3911bc28f98c5691"><code>7bcb18d</code></a> fix: explicitly convert s.Rdev to uint64 (<a href="https://redirect.github.com/ory/dockertest/issues/420">#420</a>)</li> <li>Additional commits viewable in <a href="https://github.com/ory/dockertest/compare/v3.9.1...v3.10.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/ory/dockertest/v3&package-manager=go_modules&previous-version=3.9.1&new-version=3.10.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-04-23 19:09:35 +02:00
github.com/ory/dockertest/v3 v3.10.0
chore(deps): bump github.com/slack-go/slack from 0.12.4 to 0.12.5 (#4654) Bumps [github.com/slack-go/slack](https://github.com/slack-go/slack) from 0.12.4 to 0.12.5. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/slack-go/slack/releases">github.com/slack-go/slack's releases</a>.</em></p> <blockquote> <h2>v0.12.5</h2> <h2>What's Changed</h2> <p>BUGFIX - deal with &quot;true&quot;, true, &quot;false&quot;, false.</p> <ul> <li>Parse string or boolean for SlashCommand.IsEnterpriseInstall by <a href="https://github.com/kpaulisse"><code>@​kpaulisse</code></a> in <a href="https://redirect.github.com/slack-go/slack/pull/1266">slack-go/slack#1266</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/slack-go/slack/compare/v0.12.4...v0.12.5">https://github.com/slack-go/slack/compare/v0.12.4...v0.12.5</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/slack-go/slack/commit/af783b3055b15b0ea99c0e956716e1d7d94e76c2"><code>af783b3</code></a> Merge pull request <a href="https://redirect.github.com/slack-go/slack/issues/1266">#1266</a> from kpaulisse/kpaulisse-is-enterprise-install</li> <li><a href="https://github.com/slack-go/slack/commit/9a23f7a387bea2de34ad1e22bd83cfdb6f91e6dd"><code>9a23f7a</code></a> Parse string or boolean for SlashCommand.IsEnterpriseInstall</li> <li>See full diff in <a href="https://github.com/slack-go/slack/compare/v0.12.4...v0.12.5">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/slack-go/slack&package-manager=go_modules&previous-version=0.12.4&new-version=0.12.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-27 14:54:25 +02:00
github.com/slack-go/slack v0.12.5
feat(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (#4410) Bumps [github.com/spf13/cobra](https://github.com/spf13/cobra) from 1.7.0 to 1.8.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/spf13/cobra/releases">github.com/spf13/cobra's releases</a>.</em></p> <blockquote> <h2>v1.8.0</h2> <h2>✨ Features</h2> <ul> <li>Support usage as plugin for tools like kubectl by <a href="https://github.com/nirs"><code>@​nirs</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2018">spf13/cobra#2018</a> - this means that programs that utilize a &quot;plugin-like&quot; structure have much better support and usage (like for completions, command paths, etc.)</li> <li>Move documentation sources to site/content by <a href="https://github.com/umarcor"><code>@​umarcor</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1428">spf13/cobra#1428</a></li> <li>Add 'one required flag' group by <a href="https://github.com/marevers"><code>@​marevers</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1952">spf13/cobra#1952</a> - this includes a new <code>MarkFlagsOneRequired</code> API for flags which can be used to mark a flag group as required and cause command failure if at least one is not used when invoked.</li> <li>Customizable error message prefix by <a href="https://github.com/5ouma"><code>@​5ouma</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2023">spf13/cobra#2023</a> - This adds the <code>SetErrPrefix</code> and <code>ErrPrefix</code> APIs on the <code>Command</code> struct to allow for setting a custom prefix for errors</li> <li>feat: add getters for flag completions by <a href="https://github.com/avirtopeanu-ionos"><code>@​avirtopeanu-ionos</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1943">spf13/cobra#1943</a></li> <li>Feature: allow running persistent run hooks of all parents by <a href="https://github.com/vkhoroz"><code>@​vkhoroz</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2044">spf13/cobra#2044</a></li> <li>Improve API to get flag completion function by <a href="https://github.com/marckhouzam"><code>@​marckhouzam</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2063">spf13/cobra#2063</a></li> </ul> <h2>🐛 Bug fixes</h2> <ul> <li>Fix typo in fish completions by <a href="https://github.com/twpayne"><code>@​twpayne</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1945">spf13/cobra#1945</a></li> <li>Fix grammar: 'allows to' by <a href="https://github.com/supertassu"><code>@​supertassu</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1978">spf13/cobra#1978</a></li> <li>powershell: escape variable with curly brackets by <a href="https://github.com/Luap99"><code>@​Luap99</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1960">spf13/cobra#1960</a></li> <li>Don't complete --help flag when flag parsing disabled by <a href="https://github.com/marckhouzam"><code>@​marckhouzam</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2061">spf13/cobra#2061</a></li> <li>Replace all non-alphanumerics in active help env var program prefix by <a href="https://github.com/scop"><code>@​scop</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1940">spf13/cobra#1940</a></li> </ul> <h2>🔧 Maintenance</h2> <ul> <li>build(deps): bump golangci/golangci-lint-action from 3.4.0 to 3.5.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1971">spf13/cobra#1971</a></li> <li>build(deps): bump golangci/golangci-lint-action from 3.5.0 to 3.6.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1976">spf13/cobra#1976</a></li> <li>build(deps): bump golangci/golangci-lint-action from 3.6.0 to 3.7.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2021">spf13/cobra#2021</a></li> <li>build(deps): bump actions/setup-go from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1934">spf13/cobra#1934</a></li> <li>build(deps): bump github.com/cpuguy83/go-md2man/v2 from 2.0.2 to 2.0.3 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2047">spf13/cobra#2047</a></li> <li>build(deps): bump actions/checkout from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2028">spf13/cobra#2028</a></li> <li>command: temporarily disable G602 due to <a href="https://redirect.github.com/securego/gosec/issues/1005">securego/gosec#1005</a> by <a href="https://github.com/umarcor"><code>@​umarcor</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2022">spf13/cobra#2022</a></li> </ul> <h2>🧪 Testing &amp; CI/CD</h2> <ul> <li>test: make fish_completions_test more robust by <a href="https://github.com/branchvincent"><code>@​branchvincent</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1980">spf13/cobra#1980</a></li> <li>golangci: enable 'unused' and disable deprecated replaced by it by <a href="https://github.com/umarcor"><code>@​umarcor</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1983">spf13/cobra#1983</a></li> <li>cleanup: minor corrections to unit tests by <a href="https://github.com/JunNishimura"><code>@​JunNishimura</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2003">spf13/cobra#2003</a></li> <li>ci: test golang 1.21 by <a href="https://github.com/nunoadrego"><code>@​nunoadrego</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2024">spf13/cobra#2024</a></li> <li>Fix linter errors by <a href="https://github.com/marckhouzam"><code>@​marckhouzam</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2052">spf13/cobra#2052</a></li> <li>Add tests for flag completion registration by <a href="https://github.com/marckhouzam"><code>@​marckhouzam</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2053">spf13/cobra#2053</a></li> </ul> <h2>✏️ Documentation</h2> <ul> <li>doc: fix typo, Deperecated -&gt; Deprecated by <a href="https://github.com/callthingsoff"><code>@​callthingsoff</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2000">spf13/cobra#2000</a></li> <li>Add notes to doc about the execution condition of *PreRun and *PostRun functions by <a href="https://github.com/haoming29"><code>@​haoming29</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2041">spf13/cobra#2041</a></li> </ul> <hr /> <p>Thank you everyone who contributed to this release and all your hard work! Cobra and this community would never be possible without all of you!!!! 🐍</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/spf13/cobra/compare/v1.7.0...v1.8.0">https://github.com/spf13/cobra/compare/v1.7.0...v1.8.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/spf13/cobra/commit/a0a6ae020bb3899ff0276067863e50523f897370"><code>a0a6ae0</code></a> Improve API to get flag completion function (<a href="https://redirect.github.com/spf13/cobra/issues/2063">#2063</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/890302a35f578311404a462b3cdd404f34db3720"><code>890302a</code></a> Support usage as plugin for tools like kubectl (<a href="https://redirect.github.com/spf13/cobra/issues/2018">#2018</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/48cea5c87b5299b68c3f5b7f2c67ea948717276f"><code>48cea5c</code></a> build(deps): bump actions/checkout from 3 to 4 (<a href="https://redirect.github.com/spf13/cobra/issues/2028">#2028</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/22953d88453ec9343b4a78b9d67400a3326f3138"><code>22953d8</code></a> Replace all non-alphanumerics in active help env var program prefix (<a href="https://redirect.github.com/spf13/cobra/issues/1940">#1940</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/00b68a1c260eaf2b9bcb10a3178d36cec81548ca"><code>00b68a1</code></a> Add tests for flag completion registration (<a href="https://redirect.github.com/spf13/cobra/issues/2053">#2053</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/b711e8760b73c6aa1b4aa1bef3a26da5926f175d"><code>b711e87</code></a> Don't complete --help flag when flag parsing disabled (<a href="https://redirect.github.com/spf13/cobra/issues/2061">#2061</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/8b1eba47616566fc4d258a93da48d5d8741865f0"><code>8b1eba4</code></a> Fix linter errors (<a href="https://redirect.github.com/spf13/cobra/issues/2052">#2052</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/4cafa37bc4bb85633b4245aa118280fe5a9edcd5"><code>4cafa37</code></a> Allow running persistent run hooks of all parents (<a href="https://redirect.github.com/spf13/cobra/issues/2044">#2044</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/5c962a221e70fd6b12296e5d7075f28b422f98b2"><code>5c962a2</code></a> build(deps): bump github.com/cpuguy83/go-md2man/v2 from 2.0.2 to 2.0.3 (<a href="https://redirect.github.com/spf13/cobra/issues/2047">#2047</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/efe8fa3e4453e41d6419b26c9769a51e42825632"><code>efe8fa3</code></a> build(deps): bump actions/setup-go from 3 to 4 (<a href="https://redirect.github.com/spf13/cobra/issues/1934">#1934</a>)</li> <li>Additional commits viewable in <a href="https://github.com/spf13/cobra/compare/v1.7.0...v1.8.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/spf13/cobra&package-manager=go_modules&previous-version=1.7.0&new-version=1.8.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) Dependabot will merge this PR once CI passes on it, as requested by @caarlos0. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-06 17:44:28 +02:00
github.com/spf13/cobra v1.8.0
chore(deps): bump github.com/stretchr/testify from 1.8.4 to 1.9.0 (#4663) Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.8.4 to 1.9.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/stretchr/testify/releases">github.com/stretchr/testify's releases</a>.</em></p> <blockquote> <h2>v1.9.0</h2> <h2>What's Changed</h2> <ul> <li>Fix Go modules version by <a href="https://github.com/SuperQ"><code>@​SuperQ</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1394">stretchr/testify#1394</a></li> <li>Document that require is not safe to call in created goroutines by <a href="https://github.com/programmer04"><code>@​programmer04</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1392">stretchr/testify#1392</a></li> <li>Remove myself from MAINTAINERS.md by <a href="https://github.com/mvdkleijn"><code>@​mvdkleijn</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1367">stretchr/testify#1367</a></li> <li>Correct spelling/grammar by <a href="https://github.com/echarrod"><code>@​echarrod</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1389">stretchr/testify#1389</a></li> <li>docs: Update URLs in README by <a href="https://github.com/davidjb"><code>@​davidjb</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1349">stretchr/testify#1349</a></li> <li>Update mockery link to Github Pages in README by <a href="https://github.com/LandonTClipp"><code>@​LandonTClipp</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1346">stretchr/testify#1346</a></li> <li>docs: Fix typos in tests and comments by <a href="https://github.com/alexandear"><code>@​alexandear</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1410">stretchr/testify#1410</a></li> <li>CI: tests from go1.17 by <a href="https://github.com/SuperQ"><code>@​SuperQ</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1409">stretchr/testify#1409</a></li> <li>Fix adding ? when no values passed by <a href="https://github.com/lesichkovm"><code>@​lesichkovm</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1320">stretchr/testify#1320</a></li> <li>codegen: use standard header for generated files by <a href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1406">stretchr/testify#1406</a></li> <li>mock: AssertExpectations log reason only on failure by <a href="https://github.com/hikyaru-suzuki"><code>@​hikyaru-suzuki</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1360">stretchr/testify#1360</a></li> <li>assert: fix flaky TestNeverTrue by <a href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1417">stretchr/testify#1417</a></li> <li>README: fix typos &quot;set up&quot; vs &quot;setup&quot; by <a href="https://github.com/ossan-dev"><code>@​ossan-dev</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1428">stretchr/testify#1428</a></li> <li>mock: move regexp compilation outside of <code>Called</code> by <a href="https://github.com/aud10slave"><code>@​aud10slave</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/631">stretchr/testify#631</a></li> <li>assert: refactor internal func getLen() by <a href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1445">stretchr/testify#1445</a></li> <li>mock: deprecate type AnythingOfTypeArgument (<a href="https://redirect.github.com/stretchr/testify/issues/1434">#1434</a>) by <a href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1441">stretchr/testify#1441</a></li> <li>Remove no longer needed assert.canConvert by <a href="https://github.com/alexandear"><code>@​alexandear</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1470">stretchr/testify#1470</a></li> <li>assert: ObjectsAreEqual: use time.Equal for time.Time types by <a href="https://github.com/tscales"><code>@​tscales</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1464">stretchr/testify#1464</a></li> <li>Bump actions/checkout from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1466">stretchr/testify#1466</a></li> <li>Bump actions/setup-go from 3.2.0 to 4.1.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1451">stretchr/testify#1451</a></li> <li>fix: make EventuallyWithT concurrency safe by <a href="https://github.com/czeslavo"><code>@​czeslavo</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1395">stretchr/testify#1395</a></li> <li>assert: fix httpCode and HTTPBody occur panic when http.Handler read Body by <a href="https://github.com/hidu"><code>@​hidu</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1484">stretchr/testify#1484</a></li> <li>assert.EqualExportedValues: fix handling of arrays by <a href="https://github.com/zrbecker"><code>@​zrbecker</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1473">stretchr/testify#1473</a></li> <li>.github: use latest Go versions by <a href="https://github.com/kevinburkesegment"><code>@​kevinburkesegment</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1489">stretchr/testify#1489</a></li> <li>assert: Deprecate EqualExportedValues by <a href="https://github.com/HaraldNordgren"><code>@​HaraldNordgren</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1488">stretchr/testify#1488</a></li> <li>suite: refactor test assertions by <a href="https://github.com/alexandear"><code>@​alexandear</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1474">stretchr/testify#1474</a></li> <li>suite: fix SetupSubTest and TearDownSubTest execution order by <a href="https://github.com/linusbarth"><code>@​linusbarth</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1471">stretchr/testify#1471</a></li> <li>docs: Fix deprecation comments for http package by <a href="https://github.com/alexandear"><code>@​alexandear</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1335">stretchr/testify#1335</a></li> <li>Add map support doc comments to Subset and NotSubset by <a href="https://github.com/jedevc"><code>@​jedevc</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1306">stretchr/testify#1306</a></li> <li>TestErrorIs/TestNotErrorIs: check error message contents by <a href="https://github.com/craig65535"><code>@​craig65535</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1435">stretchr/testify#1435</a></li> <li>suite: fix subtest names (fix <a href="https://redirect.github.com/stretchr/testify/issues/1501">#1501</a>) by <a href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1504">stretchr/testify#1504</a></li> <li>assert: improve unsafe.Pointer tests by <a href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1505">stretchr/testify#1505</a></li> <li>assert: simplify isNil implementation by <a href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1506">stretchr/testify#1506</a></li> <li>assert.InEpsilonSlice: fix expected/actual order and other improvements by <a href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1483">stretchr/testify#1483</a></li> <li>Fix dependency cycle with objx <a href="https://redirect.github.com/stretchr/testify/issues/1292">#1292</a> by <a href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1453">stretchr/testify#1453</a></li> <li>mock: refactor TestIsArgsEqual by <a href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1444">stretchr/testify#1444</a></li> <li>mock: optimize argument matching checks by <a href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1416">stretchr/testify#1416</a></li> <li>assert: fix TestEventuallyTimeout by <a href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1412">stretchr/testify#1412</a></li> <li>CI: add go 1.21 in GitHub Actions by <a href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1450">stretchr/testify#1450</a></li> <li>suite: fix recoverAndFailOnPanic to report test failure at the right location by <a href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1502">stretchr/testify#1502</a></li> <li>Update maintainers by <a href="https://github.com/brackendawson"><code>@​brackendawson</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1533">stretchr/testify#1533</a></li> <li>assert: Fix EqualValues to handle overflow/underflow by <a href="https://github.com/arjunmahishi"><code>@​arjunmahishi</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1531">stretchr/testify#1531</a></li> <li>assert: better formatting for Len() error by <a href="https://github.com/kevinburkesegment"><code>@​kevinburkesegment</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1485">stretchr/testify#1485</a></li> <li>Ensure AssertExpectations does not fail in skipped tests by <a href="https://github.com/ianrose14"><code>@​ianrose14</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1331">stretchr/testify#1331</a></li> <li>suite: fix deadlock in suite.Require()/Assert() by <a href="https://github.com/arjunmahishi"><code>@​arjunmahishi</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1535">stretchr/testify#1535</a></li> <li>Revert &quot;assert: ObjectsAreEqual: use time.Equal for time.Time type&quot; by <a href="https://github.com/brackendawson"><code>@​brackendawson</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1537">stretchr/testify#1537</a></li> <li>[chore] Add issue templates by <a href="https://github.com/arjunmahishi"><code>@​arjunmahishi</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1538">stretchr/testify#1538</a></li> <li>Update the build status badge by <a href="https://github.com/brackendawson"><code>@​brackendawson</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1540">stretchr/testify#1540</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/stretchr/testify/commit/bb548d0473d4e1c9b7bbfd6602c7bf12f7a84dd2"><code>bb548d0</code></a> Merge pull request <a href="https://redirect.github.com/stretchr/testify/issues/1552">#1552</a> from stretchr/dependabot/go_modules/github.com/stret...</li> <li><a href="https://github.com/stretchr/testify/commit/814075f391adffd2bf2b5110a74c51827ba132c4"><code>814075f</code></a> build(deps): bump github.com/stretchr/objx from 0.5.1 to 0.5.2</li> <li><a href="https://github.com/stretchr/testify/commit/e0456122451b1839c8d58d32df6364e4d0f0a709"><code>e045612</code></a> Merge pull request <a href="https://redirect.github.com/stretchr/testify/issues/1339">#1339</a> from bogdandrutu/uintptr</li> <li><a href="https://github.com/stretchr/testify/commit/5b6926d686d412518f50e888b9ae9b938355e011"><code>5b6926d</code></a> Merge pull request <a href="https://redirect.github.com/stretchr/testify/issues/1385">#1385</a> from hslatman/not-implements</li> <li><a href="https://github.com/stretchr/testify/commit/9f97d67703eff02136d487e6c907e76fdea31a8b"><code>9f97d67</code></a> Merge pull request <a href="https://redirect.github.com/stretchr/testify/issues/1550">#1550</a> from stretchr/release-notes</li> <li><a href="https://github.com/stretchr/testify/commit/bcb0d3fe49ff300fb78288cc144bc61a881f58ec"><code>bcb0d3f</code></a> Include the auto-release notes in releases</li> <li><a href="https://github.com/stretchr/testify/commit/fb770f8238261aa22f8e0c56f18168ccb90f4a09"><code>fb770f8</code></a> Merge pull request <a href="https://redirect.github.com/stretchr/testify/issues/1247">#1247</a> from ccoVeille/typos</li> <li><a href="https://github.com/stretchr/testify/commit/85d8bb6eea715dcbbb68f7c87b50e1956e20f892"><code>85d8bb6</code></a> fix typos in comments, tests and github templates</li> <li><a href="https://github.com/stretchr/testify/commit/e2741fa4e9bf2fdfe3ed48d976a7eeebe76c5009"><code>e2741fa</code></a> Merge pull request <a href="https://redirect.github.com/stretchr/testify/issues/1548">#1548</a> from arjunmahishi/msgAndArgs</li> <li><a href="https://github.com/stretchr/testify/commit/6e59f20c0d3883d2bdc589a9e48374ea30601851"><code>6e59f20</code></a> http_assertions: assert that the msgAndArgs actually works in tests</li> <li>Additional commits viewable in <a href="https://github.com/stretchr/testify/compare/v1.8.4...v1.9.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/stretchr/testify&package-manager=go_modules&previous-version=1.8.4&new-version=1.9.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-04 13:56:06 +02:00
github.com/stretchr/testify v1.9.0
feat(deps): bump github.com/ulikunitz/xz from 0.5.10 to 0.5.11 (#3639) Bumps [github.com/ulikunitz/xz](https://github.com/ulikunitz/xz) from 0.5.10 to 0.5.11. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ulikunitz/xz/commit/9d122a61c181b044e6b8b9c09979dfe7c513e2db"><code>9d122a6</code></a> release version v0.5.11</li> <li><a href="https://github.com/ulikunitz/xz/commit/4ce6f08566c86bf66a9bc1c2f811336ae2e462c0"><code>4ce6f08</code></a> lzma: fix handling of small dictionary sizes</li> <li><a href="https://github.com/ulikunitz/xz/commit/0b7c695d23f84aa7e968bbcaa1980847683d909a"><code>0b7c695</code></a> xz: add reader benchmark</li> <li><a href="https://github.com/ulikunitz/xz/commit/553507794087117cd9bdc95c924c1c5611bd991a"><code>5535077</code></a> xz: add compression reate to Writer benchmark</li> <li><a href="https://github.com/ulikunitz/xz/commit/886dc9acde193dec013d4812372011c64f6efbc2"><code>886dc9a</code></a> xz: add benchmark for Writer</li> <li><a href="https://github.com/ulikunitz/xz/commit/ae233692d6d4a3ff2f8c3152de489a2897fdb30a"><code>ae23369</code></a> Create codeql-analysis.yml</li> <li><a href="https://github.com/ulikunitz/xz/commit/057ed3994928010b6b9c90dcd1281d628023fa22"><code>057ed39</code></a> Remove codeql workflows</li> <li><a href="https://github.com/ulikunitz/xz/commit/d2624c667fd52b03d5f2b1d996c68f6d81b50ae2"><code>d2624c6</code></a> Add example_test.go</li> <li><a href="https://github.com/ulikunitz/xz/commit/fdaf408660c3ee2ba62ce0b356b39fdf9f7942e4"><code>fdaf408</code></a> README.md: small improvement to the documeation section</li> <li><a href="https://github.com/ulikunitz/xz/commit/060c89d64f5e88a2e57650dbd1fc1135065c5767"><code>060c89d</code></a> README.md: add link to pkg.go.dev</li> <li>See full diff in <a href="https://github.com/ulikunitz/xz/compare/v0.5.10...v0.5.11">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/ulikunitz/xz&package-manager=go_modules&previous-version=0.5.10&new-version=0.5.11)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-12-13 14:44:34 +02:00
github.com/ulikunitz/xz v0.5.11
feat(deps): bump github.com/xanzy/go-gitlab from 0.72.0 to 0.73.0 (#3335) Bumps github.com/xanzy/go-gitlab from 0.72.0 to 0.73.0. Commits 88c4146 Tweak PR just a little... 301e201 Merge pull request #1527 from vmg-ventures/feature/add-saml-group-links e3c59f9 Make variable names consistent c5ea6cc Merge pull request #1530 from timofurrer/get-issue-link b35c17a Merge pull request #1529 from timofurrer/group-hooks-pagination e2a9395 Implement API to get single issue link 142fdec Support pagination for listing group hooks 54f06ed Update to match API in master (15.3) d9e4486 Fix compile and test errors 7759ad9 Add Group SAML Links Additional commits viewable in compare view Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase. Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: @dependabot rebase will rebase this PR @dependabot recreate will recreate this PR, overwriting any edits that have been made to it @dependabot merge will merge this PR after your CI passes on it @dependabot squash and merge will squash and merge this PR after your CI passes on it @dependabot cancel merge will cancel a previously requested merge and block automerging @dependabot reopen will reopen this PR if it is closed @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-08-22 14:29:27 +02:00
github.com/withfig/autocomplete-tools/integrations/cobra v1.2.1
chore(deps): bump github.com/xanzy/go-gitlab from 0.97.0 to 0.98.0 (#4649) [//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [github.com/xanzy/go-gitlab](https://github.com/xanzy/go-gitlab) from 0.97.0 to 0.98.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/xanzy/go-gitlab/commit/ceac9862fe1dcc2f027257ed7a5ef8e0cf3fca3d"><code>ceac986</code></a> Merge pull request <a href="https://redirect.github.com/xanzy/go-gitlab/issues/1883">#1883</a> from KqLLL/feature/support-for-the-gitlab-for-slack-app</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/a8f2a843643ca70f27b370a9c0189daf72b49a9e"><code>a8f2a84</code></a> Support for the GitLab for Slack app</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/d2769882a4879fa4d04ed070f6ba6222e4d229f1"><code>d276988</code></a> Merge pull request <a href="https://redirect.github.com/xanzy/go-gitlab/issues/1886">#1886</a> from jmajaca/drone-integration-missing-set-fields</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/2f95cf4014b5cbba5692b065be01c7adcc1d8352"><code>2f95cf4</code></a> Add missing fields to SetDroneCIServiceOptions</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/d720e554a0d49c682fee9c173f1302e473d1883a"><code>d720e55</code></a> Merge pull request <a href="https://redirect.github.com/xanzy/go-gitlab/issues/1885">#1885</a> from jmajaca/jmajaca-jenkins-integration-enable-ssl-...</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/3b8b8b164a5549b78d41ff563bad9e2fbac91c92"><code>3b8b8b1</code></a> Change field type to bool</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/c9387f1f10bcb9af78c1e9940865663078d2b590"><code>c9387f1</code></a> Add EnableSSLVerification to SetJenkinsCIServiceOptions</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/fbde0597f1ef835b8330dd8c17b89f37488e3f56"><code>fbde059</code></a> Merge pull request <a href="https://redirect.github.com/xanzy/go-gitlab/issues/1884">#1884</a> from DaanRosendal/typo</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/b78f4bec831d2ed4aaeb58b96bf810a1c9402601"><code>b78f4be</code></a> Fix typo in Ptr function description</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/1fdce67c6a973c77c9b4288a1a593ff72d1fdf63"><code>1fdce67</code></a> Merge pull request <a href="https://redirect.github.com/xanzy/go-gitlab/issues/1882">#1882</a> from colinodell/project-ci_forward_deployment_rollba...</li> <li>Additional commits viewable in <a href="https://github.com/xanzy/go-gitlab/compare/v0.97.0...v0.98.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/xanzy/go-gitlab&package-manager=go_modules&previous-version=0.97.0&new-version=0.98.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-27 14:57:50 +02:00
github.com/xanzy/go-gitlab v0.98.0
fix(deps): bump gocloud.dev from 0.35.0 to 0.36.0 (#4506) Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.35.0 to 0.36.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-cloud/releases">gocloud.dev's releases</a>.</em></p> <blockquote> <h2>v0.36.0</h2> <p><strong>blob</strong></p> <ul> <li><strong>all</strong>: Allow disabling of <code>ContentType</code> auto-detection during writes.</li> </ul> <p><strong>pubsub</strong></p> <ul> <li><strong>azuresb</strong>: Added a new auth method to support Service principal/kubelet identity/Workload identity auth methods.</li> </ul> <p><strong>docstore</strong></p> <ul> <li><strong>all</strong>: Add in/not-in operators for Query.</li> <li><strong>gcpfirestore</strong>: Added a missing resource header when running query.</li> </ul> <p><strong>mysql</strong></p> <ul> <li>Pass TLS config directly to MySQL's config</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-cloud/commit/01064b751a87ca20722835090310a7034a9fc598"><code>01064b7</code></a> all: prerelease</li> <li><a href="https://github.com/google/go-cloud/commit/92114ef43337ed26acd851a050380d699bf036b6"><code>92114ef</code></a> mysql: pass TLS config directly to MySQL's config (<a href="https://redirect.github.com/google/go-cloud/issues/3348">#3348</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/97fe9d0425b25c43657f5676799c993e51cd39f0"><code>97fe9d0</code></a> docstore/all: Add in/not-in operators for Query</li> <li><a href="https://github.com/google/go-cloud/commit/4fe95eea2dfb0156514d0cb96fb12a8e0dd595c5"><code>4fe95ee</code></a> blob/all: Allow disabling of ContentType auto-detection during writes (<a href="https://redirect.github.com/google/go-cloud/issues/3371">#3371</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/1dbbbb3e6470abd60e1532af4278652d0a5cd908"><code>1dbbbb3</code></a> pubsub/azuresb: minor comments and fixes (<a href="https://redirect.github.com/google/go-cloud/issues/3370">#3370</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/20909842088ed5ddd1717473f32a9568515904f8"><code>2090984</code></a> all: update golang.org/x/crypto (<a href="https://redirect.github.com/google/go-cloud/issues/3369">#3369</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/ddc7b991019d4234928ba08ea211de3b8087abc2"><code>ddc7b99</code></a> pubsub/azuresb: new auth method to support Service principal/kubelet identit...</li> <li><a href="https://github.com/google/go-cloud/commit/c770de821742ef8c7dddf36b63625eae35899124"><code>c770de8</code></a> docstore/gcpfirestore: Add missing resource header when running query</li> <li><a href="https://github.com/google/go-cloud/commit/e86400ea404ee3bcd31b1253c5351071f3fc96a8"><code>e86400e</code></a> pubsub/awssnssqs: Remove hack for broken AWS error codes now that they've fix...</li> <li><a href="https://github.com/google/go-cloud/commit/8c8f558affc873a0f2abb1690b80e10f8028cff4"><code>8c8f558</code></a> all: postrelease (<a href="https://redirect.github.com/google/go-cloud/issues/3351">#3351</a>)</li> <li>See full diff in <a href="https://github.com/google/go-cloud/compare/v0.35.0...v0.36.0">compare view</a></li> </ul> </details> <br /> <details> <summary>Most Recent Ignore Conditions Applied to This Pull Request</summary> | Dependency Name | Ignore Conditions | | --- | --- | | gocloud.dev | [>= 0.25.a, < 0.26] | </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.35.0&new-version=0.36.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-06 17:49:45 +02:00
gocloud.dev v0.36.0
chore(deps): bump golang.org/x/oauth2 from 0.17.0 to 0.18.0 (#4668)
2024-03-05 13:57:00 +02:00
golang.org/x/crypto v0.21.0
golang.org/x/oauth2 v0.18.0
fix(deps): bump golang.org/x/sync from 0.5.0 to 0.6.0 (#4518) Bumps [golang.org/x/sync](https://github.com/golang/sync) from 0.5.0 to 0.6.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/sync/commit/59c1ca1e4661ed4452be4069ceea3c233f4deec1"><code>59c1ca1</code></a> errgroup: add reference to sync.WaitGroup</li> <li>See full diff in <a href="https://github.com/golang/sync/compare/v0.5.0...v0.6.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/sync&package-manager=go_modules&previous-version=0.5.0&new-version=0.6.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-06 17:35:37 +02:00
golang.org/x/sync v0.6.0
feat(deps): bump golang.org/x/text from 0.13.0 to 0.14.0 (#4409) Bumps [golang.org/x/text](https://github.com/golang/text) from 0.13.0 to 0.14.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/text/commit/6c97a165dd661335ff7bce6104a008558123c353"><code>6c97a16</code></a> all: update go directive to 1.18</li> <li>See full diff in <a href="https://github.com/golang/text/compare/v0.13.0...v0.14.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/text&package-manager=go_modules&previous-version=0.13.0&new-version=0.14.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) Dependabot will merge this PR once CI passes on it, as requested by @caarlos0. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-06 17:44:16 +02:00
golang.org/x/text v0.14.0
chore(deps): bump golang.org/x/tools from 0.17.0 to 0.18.0 (#4628) Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.17.0 to 0.18.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/tools/commit/c5643e9baf7fed6936d70e3abf925f86fa895ca1"><code>c5643e9</code></a> gopls/internal/server: fix two bugs related to dynamic configuration</li> <li><a href="https://github.com/golang/tools/commit/50b4f1b124a3a03ca655a70817a9b95eedab863d"><code>50b4f1b</code></a> gopls/internal/golang: close open file</li> <li><a href="https://github.com/golang/tools/commit/f0ef3c690241cae5119135077dee723e50c1278d"><code>f0ef3c6</code></a> gopls: update x/telemetry dependency to fix crash</li> <li><a href="https://github.com/golang/tools/commit/8cf0a8e204a2438da431f503635abed925cbfb79"><code>8cf0a8e</code></a> gopls: record that v0.15 will be the last to support go1.18</li> <li><a href="https://github.com/golang/tools/commit/730dc3c170c3e54f0dc78e72a0943f7cd43bb425"><code>730dc3c</code></a> gopls/internal/settings: add a hidden option to disable zero config</li> <li><a href="https://github.com/golang/tools/commit/95f04f4ae85908c11fcb0f0cdb7d0e14ca318fe3"><code>95f04f4</code></a> gopls/internal/golang: add resolve support for inline refactorings</li> <li><a href="https://github.com/golang/tools/commit/9619683231abea86b02c3e2af49a1f5ee9fc5d1a"><code>9619683</code></a> gopls/internal/cache: treat local replaces as workspace modules</li> <li><a href="https://github.com/golang/tools/commit/a5af84e3f3e3a6f2652789eeba70253d6ea8cb4c"><code>a5af84e</code></a> gopls/internal/cache: check views on any on-disk change to go.mod files</li> <li><a href="https://github.com/golang/tools/commit/a7407facde3f3a9b2736a7306823549d2c24efae"><code>a7407fa</code></a> gopls: update telemetry</li> <li><a href="https://github.com/golang/tools/commit/314368ddf001d9629fdf2df9fce2b209f8890925"><code>314368d</code></a> go/analysis/passes/deepequalerrors: audit for types.Alias safety</li> <li>Additional commits viewable in <a href="https://github.com/golang/tools/compare/v0.17.0...v0.18.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/tools&package-manager=go_modules&previous-version=0.17.0&new-version=0.18.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-13 14:16:20 +02:00
golang.org/x/tools v0.18.0
feat(schema): add command that generates jsonschema (#2589) * feat(schema): Add command that generates the jsonschema for .goreleaser.yml files This commit adds the jsonschema/schema subcommand that generates a jsonschema doc based on the Project go struct. For the config types that alternatively allow you to specify a string via custom UnmarshalYAML function, this commit adds the JSONSchemaType function, so the type gets documented with an oneOf with string or itself. Add yaml key names for properties that are currently missing them, so alecthomas/jsonschema generates the keys with correct casing. Signed-off-by: Patrick Hahn <patricksilashahn@gmx.net> * fix: Add linguist-generated attribute to generated schema json to exclude this file from pull request size validation Signed-off-by: Patrick Hahn <patricksilashahn@gmx.net> * fix: run gofumpt Signed-off-by: Patrick Hahn <patricksilashahn@gmx.net> * chore(schema): update alecthomas/jsonschema and regenerate schema.json Signed-off-by: Patrick Hahn <patricksilashahn@gmx.net>
2021-10-26 20:02:03 +02:00
gopkg.in/mail.v2 v2.3.1
feat(deps): bump gopkg.in/yaml.v3 from 3.0.0 to 3.0.1 (#3135) Bumps [gopkg.in/yaml.v3](https://github.com/go-yaml/yaml) from 3.0.0 to 3.0.1. - [Release notes](https://github.com/go-yaml/yaml/releases) - [Commits](https://github.com/go-yaml/yaml/compare/v3.0.0...v3.0.1) --- updated-dependencies: - dependency-name: gopkg.in/yaml.v3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-06-02 14:01:47 +02:00
gopkg.in/yaml.v3 v3.0.1
feat(schema): add command that generates jsonschema (#2589) * feat(schema): Add command that generates the jsonschema for .goreleaser.yml files This commit adds the jsonschema/schema subcommand that generates a jsonschema doc based on the Project go struct. For the config types that alternatively allow you to specify a string via custom UnmarshalYAML function, this commit adds the JSONSchemaType function, so the type gets documented with an oneOf with string or itself. Add yaml key names for properties that are currently missing them, so alecthomas/jsonschema generates the keys with correct casing. Signed-off-by: Patrick Hahn <patricksilashahn@gmx.net> * fix: Add linguist-generated attribute to generated schema json to exclude this file from pull request size validation Signed-off-by: Patrick Hahn <patricksilashahn@gmx.net> * fix: run gofumpt Signed-off-by: Patrick Hahn <patricksilashahn@gmx.net> * chore(schema): update alecthomas/jsonschema and regenerate schema.json Signed-off-by: Patrick Hahn <patricksilashahn@gmx.net>
2021-10-26 20:02:03 +02:00
)
feat(deps): bump github.com/google/ko from 0.14.1 to 0.15.0 (#4373) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.14.1 to 0.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.15.0</h2> <h2>What's Changed</h2> <ul> <li>implement dumb cache for images by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1102">ko-build/ko#1102</a></li> <li>fixed typo in configuration.md by <a href="https://github.com/samlaf"><code>@​samlaf</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li>pkg/commands: fix dropped errors by <a href="https://github.com/alrs"><code>@​alrs</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li>ci: add govulncheck by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1110">ko-build/ko#1110</a></li> <li>chore: remove refs to deprecated io/ioutil by <a href="https://github.com/testwill"><code>@​testwill</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li>Update install docs to install ko using Scoop by <a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> <li>include go build output in build error by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1127">ko-build/ko#1127</a></li> <li>Use go1.21, clean up ci and drop go1.19 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1137">ko-build/ko#1137</a></li> <li>Update e2e.yaml by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1141">ko-build/ko#1141</a></li> <li>handle newfound lint errors by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1142">ko-build/ko#1142</a></li> <li>fix test broken by lint fix by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1143">ko-build/ko#1143</a></li> <li>Bump actions/checkout from 3.6.0 to 4.0.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1136">ko-build/ko#1136</a></li> <li>fix env var for go env by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1140">ko-build/ko#1140</a></li> <li>docs: add docs for TF and Lambda by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1139">ko-build/ko#1139</a></li> <li>docs: add Lambda and TF pages to sidebar by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1144">ko-build/ko#1144</a></li> <li>include example using go packages by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1145">ko-build/ko#1145</a></li> <li>fix the release workflow and install instructions by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1150">ko-build/ko#1150</a></li> <li>update missing places that was using go1.20 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1163">ko-build/ko#1163</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/samlaf"><code>@​samlaf</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li><a href="https://github.com/alrs"><code>@​alrs</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li><a href="https://github.com/testwill"><code>@​testwill</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li><a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0">https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/31035ad2026bfbafaa4f009baefe72463af1b3a7"><code>31035ad</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1164">#1164</a> from ko-build/dependabot/go_modules/golang.org/x/net...</li> <li><a href="https://github.com/ko-build/ko/commit/ba952fd091f9d27ee5c136e842b5e94dd715100c"><code>ba952fd</code></a> Bump golang.org/x/net from 0.16.0 to 0.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/277f5d74353950c8663fc04b7546f66e57bd6aaf"><code>277f5d7</code></a> update missing places that was using go1.20 (<a href="https://redirect.github.com/google/ko/issues/1163">#1163</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/b8b3b21f8348d7cab863fe1b4eaa47dfc47632da"><code>b8b3b21</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1162">#1162</a> from ko-build/dependabot/go_modules/github.com/googl...</li> <li><a href="https://github.com/ko-build/ko/commit/4890ab2887b653d3c340de4d119bfd17b703f182"><code>4890ab2</code></a> Bump github.com/google/go-cmp from 0.5.9 to 0.6.0</li> <li><a href="https://github.com/ko-build/ko/commit/30b62aee3faf6866cee6513ea7eb13f5a27cd7ca"><code>30b62ae</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1161">#1161</a> from ko-build/dependabot/go_modules/github.com/spf13...</li> <li><a href="https://github.com/ko-build/ko/commit/449bcb61926cb3e3bcf191e8ca53fad5ab3a4e3c"><code>449bcb6</code></a> Bump github.com/spf13/viper from 1.16.0 to 1.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/c543dd83cc75cd849fb95637ea29e3c7c66d6f87"><code>c543dd8</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1160">#1160</a> from ko-build/dependabot/go_modules/golang.org/x/too...</li> <li><a href="https://github.com/ko-build/ko/commit/c1ae5f5ce4fe058830f24827c853d4db39a95250"><code>c1ae5f5</code></a> Bump golang.org/x/tools from 0.13.0 to 0.14.0</li> <li><a href="https://github.com/ko-build/ko/commit/e50d2fd5ff0ec88ac837ffe6f6c2f122eb54b9f8"><code>e50d2fd</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1159">#1159</a> from ko-build/dependabot/go_modules/golang.org/x/syn...</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.14.1...v0.15.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.14.1&new-version=0.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-17 17:47:47 +02:00
require (
sec(deps): bump github.com/go-git/go-git/v5 from 5.7.0 to 5.11.0 (#4505) Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.7.0 to 5.11.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's releases</a>.</em></p> <blockquote> <h2>v5.11.0</h2> <h2>What's Changed</h2> <ul> <li>git: validate reference names (<a href="https://redirect.github.com/go-git/go-git/issues/929">#929</a>) by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/950">go-git/go-git#950</a></li> <li>git: stop iterating at oldest shallow when pulling. Fixes <a href="https://redirect.github.com/go-git/go-git/issues/305">#305</a> by <a href="https://github.com/dhoizner"><code>@​dhoizner</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/939">go-git/go-git#939</a></li> <li>plumbing: object, enable renames in getFileStatsFromFilePatches by <a href="https://github.com/djmoch"><code>@​djmoch</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/941">go-git/go-git#941</a></li> <li>storage: filesystem, Add option to set a specific FS for alternates by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/953">go-git/go-git#953</a></li> <li>Align worktree validation with upstream and remove build warnings by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/958">go-git/go-git#958</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/dhoizner"><code>@​dhoizner</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/939">go-git/go-git#939</a></li> <li><a href="https://github.com/djmoch"><code>@​djmoch</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/941">go-git/go-git#941</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.10.1...v5.11.0">https://github.com/go-git/go-git/compare/v5.10.1...v5.11.0</a></p> <h2>v5.10.1</h2> <h2>What's Changed</h2> <ul> <li>Worktree, ignore ModeSocket files by <a href="https://github.com/steiler"><code>@​steiler</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/930">go-git/go-git#930</a></li> <li>git: add tracer package by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/916">go-git/go-git#916</a></li> <li>remote: Flip clause for fast-forward only check by <a href="https://github.com/adityasaky"><code>@​adityasaky</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/875">go-git/go-git#875</a></li> <li>plumbing: transport/ssh, Fix nil pointer dereference caused when an unreachable proxy server is set. Fixes <a href="https://redirect.github.com/go-git/go-git/issues/900">#900</a> by <a href="https://github.com/anandf"><code>@​anandf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/901">go-git/go-git#901</a></li> <li>plumbing: uppload-server-info, implement upload-server-info by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/896">go-git/go-git#896</a></li> <li>plumbing: optimise memory consumption for filesystem storage by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/799">go-git/go-git#799</a></li> <li>plumbing: format/packfile, Refactor patch delta by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/908">go-git/go-git#908</a></li> <li>plumbing: fix empty uploadpack request error by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/932">go-git/go-git#932</a></li> <li>plumbing: transport/git, Improve tests error message by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/752">go-git/go-git#752</a></li> <li>plumbing: format/pktline, Respect pktline error-line errors by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/936">go-git/go-git#936</a></li> <li>utils: remove ioutil.Pipe and use std library io.Pipe by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/922">go-git/go-git#922</a></li> <li>utils: move trace to utils by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/931">go-git/go-git#931</a></li> <li>cli: separate go module for cli by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/914">go-git/go-git#914</a></li> <li>build: bump github.com/google/go-cmp from 0.5.9 to 0.6.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/887">go-git/go-git#887</a></li> <li>build: bump actions/setup-go from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/891">go-git/go-git#891</a></li> <li>build: bump github.com/skeema/knownhosts from 1.2.0 to 1.2.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/888">go-git/go-git#888</a></li> <li>build: bump actions/checkout from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/890">go-git/go-git#890</a></li> <li>build: bump golang.org/x/sys from 0.13.0 to 0.14.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/907">go-git/go-git#907</a></li> <li>build: bump golang.org/x/text from 0.13.0 to 0.14.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/906">go-git/go-git#906</a></li> <li>build: bump golang.org/x/crypto from 0.14.0 to 0.15.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/917">go-git/go-git#917</a></li> <li>build: bump golang.org/x/net from 0.17.0 to 0.18.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/918">go-git/go-git#918</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/anandf"><code>@​anandf</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/901">go-git/go-git#901</a></li> <li><a href="https://github.com/steiler"><code>@​steiler</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/930">go-git/go-git#930</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.10.0...v5.10.1">https://github.com/go-git/go-git/compare/v5.10.0...v5.10.1</a></p> <h2>v5.10.0</h2> <h2>What's Changed</h2> <ul> <li>PlainInitOptions.Bare and allow using InitOptions with PlainInitWithOptions by <a href="https://github.com/ThinkChaos"><code>@​ThinkChaos</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/782">go-git/go-git#782</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-git/go-git/commit/5d08d3bd94c65a3b6c25c6fba6907d12b0dac4ca"><code>5d08d3b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/958">#958</a> from pjbgf/workval</li> <li><a href="https://github.com/go-git/go-git/commit/5bd1d8f4abcfbf1345a1e5a5ec9a96121f3746dc"><code>5bd1d8f</code></a> build: Ensure checkout is the first operation</li> <li><a href="https://github.com/go-git/go-git/commit/b2c19824771bbcbb21abb51abb319c1a610aa6b3"><code>b2c1982</code></a> git: worktree, Align validation with upstream rules</li> <li><a href="https://github.com/go-git/go-git/commit/cec7da63ca0412fce55a0bf0715b7ba44a41eaa2"><code>cec7da6</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/953">#953</a> from pjbgf/alternates</li> <li><a href="https://github.com/go-git/go-git/commit/8b47ceb1aa854f3c3bfa1c347157a04324fcd51e"><code>8b47ceb</code></a> storage: filesystem, Add option to set a specific FS for alternates</li> <li><a href="https://github.com/go-git/go-git/commit/4f614891047bae5d0f7a253f014175505b9821d7"><code>4f61489</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/941">#941</a> from djmoch/filestats-rename</li> <li><a href="https://github.com/go-git/go-git/commit/ae552ce0bf32cddb689727c4c9fa6bf4d3bd6499"><code>ae552ce</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/939">#939</a> from dhoizner/fix-pull-after-shallow</li> <li><a href="https://github.com/go-git/go-git/commit/cc1895b905ebadb09504d88444ff05932fa6e928"><code>cc1895b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/950">#950</a> from aymanbagabas/validate-ref</li> <li><a href="https://github.com/go-git/go-git/commit/de1d5a5978b9599ca3dacd58bbf699e4bb4cf6bd"><code>de1d5a5</code></a> git: validate reference names</li> <li><a href="https://github.com/go-git/go-git/commit/d87110b492c94d99ebdaea732b23a54b7efba94b"><code>d87110b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/948">#948</a> from go-git/dependabot/go_modules/cli/go-git/github.c...</li> <li>Additional commits viewable in <a href="https://github.com/go-git/go-git/compare/v5.7.0...v5.11.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.7.0&new-version=5.11.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-28 14:46:28 +02:00
github.com/cyphar/filepath-securejoin v0.2.4 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/distribution/reference v0.5.0 // indirect
feat(deps): bump gocloud.dev from 0.34.0 to 0.35.0 (#4467) Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.34.0 to 0.35.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-cloud/releases">gocloud.dev's releases</a>.</em></p> <blockquote> <h2>v0.35.0</h2> <p><strong>BREAKING CHANGES</strong></p> <p>This release updates the dependency on AWS/S3, which included some breaking changes; see <a href="https://redirect.github.com/google/go-cloud/pull/3342">google/go-cloud#3342</a> for details.</p> <p><strong>blob</strong></p> <ul> <li><em>gcsblob</em>: Fix unauthenticated requests.</li> </ul> <p><strong>runtimevar</strong></p> <ul> <li><em>constantvar</em>: Add support for reading the constant variable value from the environment.</li> </ul> <p><strong>docstore</strong></p> <ul> <li><em>gcpfilestore</em>: Add support for non-default databases.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-cloud/commit/27e0bca95dae3165b94cab4f9b7e2e4b087c8aef"><code>27e0bca</code></a> all: prep for release (<a href="https://redirect.github.com/google/go-cloud/issues/3350">#3350</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/53ccd8db26a14fd2a40bfcb28af1a1ceba4663f4"><code>53ccd8d</code></a> all: update deps, including a breaking S3 change (<a href="https://redirect.github.com/google/go-cloud/issues/3342">#3342</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/fa413a39cdf8ffe0890a1b0a4cf5e06e0c915592"><code>fa413a3</code></a> docstore/gcpfilestore: add support for non-default databases. (<a href="https://redirect.github.com/google/go-cloud/issues/3345">#3345</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/c04000b96462ad3ec62e633eafd759185991bb27"><code>c04000b</code></a> secrets/hashivault: Update go-jose per dependabot (<a href="https://redirect.github.com/google/go-cloud/issues/3346">#3346</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/6d5d2890816abc88cd11ef13d6cd6506eb5b5537"><code>6d5d289</code></a> pubsub/natspubsub: upgrade a dependency (<a href="https://redirect.github.com/google/go-cloud/issues/3336">#3336</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/375e097193225b4ef300a336e04ccad9ace50bc1"><code>375e097</code></a> pubsub/natspubsub: Update dependency (<a href="https://redirect.github.com/google/go-cloud/issues/3331">#3331</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/35ac324ff7fae5ddc0f9dc2ff234a7d6b4935a20"><code>35ac324</code></a> all: update dependencies (<a href="https://redirect.github.com/google/go-cloud/issues/3329">#3329</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/4a18be0f4a48c145da4a76499485a45478fd69aa"><code>4a18be0</code></a> secrets/awskms: update the example for the AWS ARN use case (<a href="https://redirect.github.com/google/go-cloud/issues/3320">#3320</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/486d484a8f73fd5bedc910d4fd89c52e11412e68"><code>486d484</code></a> kafkapubsub: rename dependency Shopify/sarama to IBM/sarama (<a href="https://redirect.github.com/google/go-cloud/issues/3319">#3319</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/db7e808e313228ed8607a94d6e5cd075d66f4e86"><code>db7e808</code></a> runtimevar/constantvar: Add support for reading the constantvar from an envir...</li> <li>Additional commits viewable in <a href="https://github.com/google/go-cloud/compare/v0.34.0...v0.35.0">compare view</a></li> </ul> </details> <br /> <details> <summary>Most Recent Ignore Conditions Applied to This Pull Request</summary> | Dependency Name | Ignore Conditions | | --- | --- | | gocloud.dev | [>= 0.25.a, < 0.26] | </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.34.0&new-version=0.35.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-11 12:55:26 +02:00
github.com/golang-jwt/jwt/v5 v5.1.0 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect
feat(deps): bump github.com/google/ko from 0.14.1 to 0.15.0 (#4373) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.14.1 to 0.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.15.0</h2> <h2>What's Changed</h2> <ul> <li>implement dumb cache for images by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1102">ko-build/ko#1102</a></li> <li>fixed typo in configuration.md by <a href="https://github.com/samlaf"><code>@​samlaf</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li>pkg/commands: fix dropped errors by <a href="https://github.com/alrs"><code>@​alrs</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li>ci: add govulncheck by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1110">ko-build/ko#1110</a></li> <li>chore: remove refs to deprecated io/ioutil by <a href="https://github.com/testwill"><code>@​testwill</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li>Update install docs to install ko using Scoop by <a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> <li>include go build output in build error by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1127">ko-build/ko#1127</a></li> <li>Use go1.21, clean up ci and drop go1.19 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1137">ko-build/ko#1137</a></li> <li>Update e2e.yaml by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1141">ko-build/ko#1141</a></li> <li>handle newfound lint errors by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1142">ko-build/ko#1142</a></li> <li>fix test broken by lint fix by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1143">ko-build/ko#1143</a></li> <li>Bump actions/checkout from 3.6.0 to 4.0.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1136">ko-build/ko#1136</a></li> <li>fix env var for go env by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1140">ko-build/ko#1140</a></li> <li>docs: add docs for TF and Lambda by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1139">ko-build/ko#1139</a></li> <li>docs: add Lambda and TF pages to sidebar by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1144">ko-build/ko#1144</a></li> <li>include example using go packages by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1145">ko-build/ko#1145</a></li> <li>fix the release workflow and install instructions by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1150">ko-build/ko#1150</a></li> <li>update missing places that was using go1.20 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1163">ko-build/ko#1163</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/samlaf"><code>@​samlaf</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li><a href="https://github.com/alrs"><code>@​alrs</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li><a href="https://github.com/testwill"><code>@​testwill</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li><a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0">https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/31035ad2026bfbafaa4f009baefe72463af1b3a7"><code>31035ad</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1164">#1164</a> from ko-build/dependabot/go_modules/golang.org/x/net...</li> <li><a href="https://github.com/ko-build/ko/commit/ba952fd091f9d27ee5c136e842b5e94dd715100c"><code>ba952fd</code></a> Bump golang.org/x/net from 0.16.0 to 0.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/277f5d74353950c8663fc04b7546f66e57bd6aaf"><code>277f5d7</code></a> update missing places that was using go1.20 (<a href="https://redirect.github.com/google/ko/issues/1163">#1163</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/b8b3b21f8348d7cab863fe1b4eaa47dfc47632da"><code>b8b3b21</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1162">#1162</a> from ko-build/dependabot/go_modules/github.com/googl...</li> <li><a href="https://github.com/ko-build/ko/commit/4890ab2887b653d3c340de4d119bfd17b703f182"><code>4890ab2</code></a> Bump github.com/google/go-cmp from 0.5.9 to 0.6.0</li> <li><a href="https://github.com/ko-build/ko/commit/30b62aee3faf6866cee6513ea7eb13f5a27cd7ca"><code>30b62ae</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1161">#1161</a> from ko-build/dependabot/go_modules/github.com/spf13...</li> <li><a href="https://github.com/ko-build/ko/commit/449bcb61926cb3e3bcf191e8ca53fad5ab3a4e3c"><code>449bcb6</code></a> Bump github.com/spf13/viper from 1.16.0 to 1.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/c543dd83cc75cd849fb95637ea29e3c7c66d6f87"><code>c543dd8</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1160">#1160</a> from ko-build/dependabot/go_modules/golang.org/x/too...</li> <li><a href="https://github.com/ko-build/ko/commit/c1ae5f5ce4fe058830f24827c853d4db39a95250"><code>c1ae5f5</code></a> Bump golang.org/x/tools from 0.13.0 to 0.14.0</li> <li><a href="https://github.com/ko-build/ko/commit/e50d2fd5ff0ec88ac837ffe6f6c2f122eb54b9f8"><code>e50d2fd</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1159">#1159</a> from ko-build/dependabot/go_modules/golang.org/x/syn...</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.14.1...v0.15.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.14.1&new-version=0.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-17 17:47:47 +02:00
github.com/sagikazarmark/locafero v0.3.0 // indirect
github.com/sagikazarmark/slog-shim v0.1.0 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/secure-systems-lab/go-securesystemslib v0.7.0 // indirect
feat(deps): bump github.com/google/ko from 0.14.1 to 0.15.0 (#4373) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.14.1 to 0.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.15.0</h2> <h2>What's Changed</h2> <ul> <li>implement dumb cache for images by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1102">ko-build/ko#1102</a></li> <li>fixed typo in configuration.md by <a href="https://github.com/samlaf"><code>@​samlaf</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li>pkg/commands: fix dropped errors by <a href="https://github.com/alrs"><code>@​alrs</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li>ci: add govulncheck by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1110">ko-build/ko#1110</a></li> <li>chore: remove refs to deprecated io/ioutil by <a href="https://github.com/testwill"><code>@​testwill</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li>Update install docs to install ko using Scoop by <a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> <li>include go build output in build error by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1127">ko-build/ko#1127</a></li> <li>Use go1.21, clean up ci and drop go1.19 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1137">ko-build/ko#1137</a></li> <li>Update e2e.yaml by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1141">ko-build/ko#1141</a></li> <li>handle newfound lint errors by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1142">ko-build/ko#1142</a></li> <li>fix test broken by lint fix by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1143">ko-build/ko#1143</a></li> <li>Bump actions/checkout from 3.6.0 to 4.0.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1136">ko-build/ko#1136</a></li> <li>fix env var for go env by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1140">ko-build/ko#1140</a></li> <li>docs: add docs for TF and Lambda by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1139">ko-build/ko#1139</a></li> <li>docs: add Lambda and TF pages to sidebar by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1144">ko-build/ko#1144</a></li> <li>include example using go packages by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1145">ko-build/ko#1145</a></li> <li>fix the release workflow and install instructions by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1150">ko-build/ko#1150</a></li> <li>update missing places that was using go1.20 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1163">ko-build/ko#1163</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/samlaf"><code>@​samlaf</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li><a href="https://github.com/alrs"><code>@​alrs</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li><a href="https://github.com/testwill"><code>@​testwill</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li><a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0">https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/31035ad2026bfbafaa4f009baefe72463af1b3a7"><code>31035ad</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1164">#1164</a> from ko-build/dependabot/go_modules/golang.org/x/net...</li> <li><a href="https://github.com/ko-build/ko/commit/ba952fd091f9d27ee5c136e842b5e94dd715100c"><code>ba952fd</code></a> Bump golang.org/x/net from 0.16.0 to 0.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/277f5d74353950c8663fc04b7546f66e57bd6aaf"><code>277f5d7</code></a> update missing places that was using go1.20 (<a href="https://redirect.github.com/google/ko/issues/1163">#1163</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/b8b3b21f8348d7cab863fe1b4eaa47dfc47632da"><code>b8b3b21</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1162">#1162</a> from ko-build/dependabot/go_modules/github.com/googl...</li> <li><a href="https://github.com/ko-build/ko/commit/4890ab2887b653d3c340de4d119bfd17b703f182"><code>4890ab2</code></a> Bump github.com/google/go-cmp from 0.5.9 to 0.6.0</li> <li><a href="https://github.com/ko-build/ko/commit/30b62aee3faf6866cee6513ea7eb13f5a27cd7ca"><code>30b62ae</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1161">#1161</a> from ko-build/dependabot/go_modules/github.com/spf13...</li> <li><a href="https://github.com/ko-build/ko/commit/449bcb61926cb3e3bcf191e8ca53fad5ab3a4e3c"><code>449bcb6</code></a> Bump github.com/spf13/viper from 1.16.0 to 1.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/c543dd83cc75cd849fb95637ea29e3c7c66d6f87"><code>c543dd8</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1160">#1160</a> from ko-build/dependabot/go_modules/golang.org/x/too...</li> <li><a href="https://github.com/ko-build/ko/commit/c1ae5f5ce4fe058830f24827c853d4db39a95250"><code>c1ae5f5</code></a> Bump golang.org/x/tools from 0.13.0 to 0.14.0</li> <li><a href="https://github.com/ko-build/ko/commit/e50d2fd5ff0ec88ac837ffe6f6c2f122eb54b9f8"><code>e50d2fd</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1159">#1159</a> from ko-build/dependabot/go_modules/golang.org/x/syn...</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.14.1...v0.15.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.14.1&new-version=0.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-17 17:47:47 +02:00
github.com/sourcegraph/conc v0.3.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
gopkg.in/go-jose/go-jose.v2 v2.6.1 // indirect
feat(deps): bump github.com/google/ko from 0.14.1 to 0.15.0 (#4373) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.14.1 to 0.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.15.0</h2> <h2>What's Changed</h2> <ul> <li>implement dumb cache for images by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1102">ko-build/ko#1102</a></li> <li>fixed typo in configuration.md by <a href="https://github.com/samlaf"><code>@​samlaf</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li>pkg/commands: fix dropped errors by <a href="https://github.com/alrs"><code>@​alrs</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li>ci: add govulncheck by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1110">ko-build/ko#1110</a></li> <li>chore: remove refs to deprecated io/ioutil by <a href="https://github.com/testwill"><code>@​testwill</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li>Update install docs to install ko using Scoop by <a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> <li>include go build output in build error by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1127">ko-build/ko#1127</a></li> <li>Use go1.21, clean up ci and drop go1.19 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1137">ko-build/ko#1137</a></li> <li>Update e2e.yaml by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1141">ko-build/ko#1141</a></li> <li>handle newfound lint errors by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1142">ko-build/ko#1142</a></li> <li>fix test broken by lint fix by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1143">ko-build/ko#1143</a></li> <li>Bump actions/checkout from 3.6.0 to 4.0.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1136">ko-build/ko#1136</a></li> <li>fix env var for go env by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1140">ko-build/ko#1140</a></li> <li>docs: add docs for TF and Lambda by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1139">ko-build/ko#1139</a></li> <li>docs: add Lambda and TF pages to sidebar by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1144">ko-build/ko#1144</a></li> <li>include example using go packages by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1145">ko-build/ko#1145</a></li> <li>fix the release workflow and install instructions by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1150">ko-build/ko#1150</a></li> <li>update missing places that was using go1.20 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1163">ko-build/ko#1163</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/samlaf"><code>@​samlaf</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li><a href="https://github.com/alrs"><code>@​alrs</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li><a href="https://github.com/testwill"><code>@​testwill</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li><a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0">https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/31035ad2026bfbafaa4f009baefe72463af1b3a7"><code>31035ad</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1164">#1164</a> from ko-build/dependabot/go_modules/golang.org/x/net...</li> <li><a href="https://github.com/ko-build/ko/commit/ba952fd091f9d27ee5c136e842b5e94dd715100c"><code>ba952fd</code></a> Bump golang.org/x/net from 0.16.0 to 0.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/277f5d74353950c8663fc04b7546f66e57bd6aaf"><code>277f5d7</code></a> update missing places that was using go1.20 (<a href="https://redirect.github.com/google/ko/issues/1163">#1163</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/b8b3b21f8348d7cab863fe1b4eaa47dfc47632da"><code>b8b3b21</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1162">#1162</a> from ko-build/dependabot/go_modules/github.com/googl...</li> <li><a href="https://github.com/ko-build/ko/commit/4890ab2887b653d3c340de4d119bfd17b703f182"><code>4890ab2</code></a> Bump github.com/google/go-cmp from 0.5.9 to 0.6.0</li> <li><a href="https://github.com/ko-build/ko/commit/30b62aee3faf6866cee6513ea7eb13f5a27cd7ca"><code>30b62ae</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1161">#1161</a> from ko-build/dependabot/go_modules/github.com/spf13...</li> <li><a href="https://github.com/ko-build/ko/commit/449bcb61926cb3e3bcf191e8ca53fad5ab3a4e3c"><code>449bcb6</code></a> Bump github.com/spf13/viper from 1.16.0 to 1.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/c543dd83cc75cd849fb95637ea29e3c7c66d6f87"><code>c543dd8</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1160">#1160</a> from ko-build/dependabot/go_modules/golang.org/x/too...</li> <li><a href="https://github.com/ko-build/ko/commit/c1ae5f5ce4fe058830f24827c853d4db39a95250"><code>c1ae5f5</code></a> Bump golang.org/x/tools from 0.13.0 to 0.14.0</li> <li><a href="https://github.com/ko-build/ko/commit/e50d2fd5ff0ec88ac837ffe6f6c2f122eb54b9f8"><code>e50d2fd</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1159">#1159</a> from ko-build/dependabot/go_modules/golang.org/x/syn...</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.14.1...v0.15.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.14.1&new-version=0.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-17 17:47:47 +02:00
)
feat: use go 1.17 (#2408) * feat: use go 1.17 Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * fix: go mod tidy Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * test: fix failing test Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * ci: increase lint timeout Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * ci: increase lint timeout Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com>
2021-08-25 01:49:11 +02:00
require (
feat(deps): bump gocloud.dev from 0.34.0 to 0.35.0 (#4467) Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.34.0 to 0.35.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-cloud/releases">gocloud.dev's releases</a>.</em></p> <blockquote> <h2>v0.35.0</h2> <p><strong>BREAKING CHANGES</strong></p> <p>This release updates the dependency on AWS/S3, which included some breaking changes; see <a href="https://redirect.github.com/google/go-cloud/pull/3342">google/go-cloud#3342</a> for details.</p> <p><strong>blob</strong></p> <ul> <li><em>gcsblob</em>: Fix unauthenticated requests.</li> </ul> <p><strong>runtimevar</strong></p> <ul> <li><em>constantvar</em>: Add support for reading the constant variable value from the environment.</li> </ul> <p><strong>docstore</strong></p> <ul> <li><em>gcpfilestore</em>: Add support for non-default databases.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-cloud/commit/27e0bca95dae3165b94cab4f9b7e2e4b087c8aef"><code>27e0bca</code></a> all: prep for release (<a href="https://redirect.github.com/google/go-cloud/issues/3350">#3350</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/53ccd8db26a14fd2a40bfcb28af1a1ceba4663f4"><code>53ccd8d</code></a> all: update deps, including a breaking S3 change (<a href="https://redirect.github.com/google/go-cloud/issues/3342">#3342</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/fa413a39cdf8ffe0890a1b0a4cf5e06e0c915592"><code>fa413a3</code></a> docstore/gcpfilestore: add support for non-default databases. (<a href="https://redirect.github.com/google/go-cloud/issues/3345">#3345</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/c04000b96462ad3ec62e633eafd759185991bb27"><code>c04000b</code></a> secrets/hashivault: Update go-jose per dependabot (<a href="https://redirect.github.com/google/go-cloud/issues/3346">#3346</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/6d5d2890816abc88cd11ef13d6cd6506eb5b5537"><code>6d5d289</code></a> pubsub/natspubsub: upgrade a dependency (<a href="https://redirect.github.com/google/go-cloud/issues/3336">#3336</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/375e097193225b4ef300a336e04ccad9ace50bc1"><code>375e097</code></a> pubsub/natspubsub: Update dependency (<a href="https://redirect.github.com/google/go-cloud/issues/3331">#3331</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/35ac324ff7fae5ddc0f9dc2ff234a7d6b4935a20"><code>35ac324</code></a> all: update dependencies (<a href="https://redirect.github.com/google/go-cloud/issues/3329">#3329</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/4a18be0f4a48c145da4a76499485a45478fd69aa"><code>4a18be0</code></a> secrets/awskms: update the example for the AWS ARN use case (<a href="https://redirect.github.com/google/go-cloud/issues/3320">#3320</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/486d484a8f73fd5bedc910d4fd89c52e11412e68"><code>486d484</code></a> kafkapubsub: rename dependency Shopify/sarama to IBM/sarama (<a href="https://redirect.github.com/google/go-cloud/issues/3319">#3319</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/db7e808e313228ed8607a94d6e5cd075d66f4e86"><code>db7e808</code></a> runtimevar/constantvar: Add support for reading the constantvar from an envir...</li> <li>Additional commits viewable in <a href="https://github.com/google/go-cloud/compare/v0.34.0...v0.35.0">compare view</a></li> </ul> </details> <br /> <details> <summary>Most Recent Ignore Conditions Applied to This Pull Request</summary> | Dependency Name | Ignore Conditions | | --- | --- | | gocloud.dev | [>= 0.25.a, < 0.26] | </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.34.0&new-version=0.35.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-11 12:55:26 +02:00
cloud.google.com/go v0.110.10 // indirect
cloud.google.com/go/compute v1.23.3 // indirect
fix: force specific version of go-crypto (#3756) refs #3745 Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com>
2023-02-05 17:09:06 +02:00
cloud.google.com/go/compute/metadata v0.2.3 // indirect
feat(deps): bump gocloud.dev from 0.34.0 to 0.35.0 (#4467) Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.34.0 to 0.35.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-cloud/releases">gocloud.dev's releases</a>.</em></p> <blockquote> <h2>v0.35.0</h2> <p><strong>BREAKING CHANGES</strong></p> <p>This release updates the dependency on AWS/S3, which included some breaking changes; see <a href="https://redirect.github.com/google/go-cloud/pull/3342">google/go-cloud#3342</a> for details.</p> <p><strong>blob</strong></p> <ul> <li><em>gcsblob</em>: Fix unauthenticated requests.</li> </ul> <p><strong>runtimevar</strong></p> <ul> <li><em>constantvar</em>: Add support for reading the constant variable value from the environment.</li> </ul> <p><strong>docstore</strong></p> <ul> <li><em>gcpfilestore</em>: Add support for non-default databases.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-cloud/commit/27e0bca95dae3165b94cab4f9b7e2e4b087c8aef"><code>27e0bca</code></a> all: prep for release (<a href="https://redirect.github.com/google/go-cloud/issues/3350">#3350</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/53ccd8db26a14fd2a40bfcb28af1a1ceba4663f4"><code>53ccd8d</code></a> all: update deps, including a breaking S3 change (<a href="https://redirect.github.com/google/go-cloud/issues/3342">#3342</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/fa413a39cdf8ffe0890a1b0a4cf5e06e0c915592"><code>fa413a3</code></a> docstore/gcpfilestore: add support for non-default databases. (<a href="https://redirect.github.com/google/go-cloud/issues/3345">#3345</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/c04000b96462ad3ec62e633eafd759185991bb27"><code>c04000b</code></a> secrets/hashivault: Update go-jose per dependabot (<a href="https://redirect.github.com/google/go-cloud/issues/3346">#3346</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/6d5d2890816abc88cd11ef13d6cd6506eb5b5537"><code>6d5d289</code></a> pubsub/natspubsub: upgrade a dependency (<a href="https://redirect.github.com/google/go-cloud/issues/3336">#3336</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/375e097193225b4ef300a336e04ccad9ace50bc1"><code>375e097</code></a> pubsub/natspubsub: Update dependency (<a href="https://redirect.github.com/google/go-cloud/issues/3331">#3331</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/35ac324ff7fae5ddc0f9dc2ff234a7d6b4935a20"><code>35ac324</code></a> all: update dependencies (<a href="https://redirect.github.com/google/go-cloud/issues/3329">#3329</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/4a18be0f4a48c145da4a76499485a45478fd69aa"><code>4a18be0</code></a> secrets/awskms: update the example for the AWS ARN use case (<a href="https://redirect.github.com/google/go-cloud/issues/3320">#3320</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/486d484a8f73fd5bedc910d4fd89c52e11412e68"><code>486d484</code></a> kafkapubsub: rename dependency Shopify/sarama to IBM/sarama (<a href="https://redirect.github.com/google/go-cloud/issues/3319">#3319</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/db7e808e313228ed8607a94d6e5cd075d66f4e86"><code>db7e808</code></a> runtimevar/constantvar: Add support for reading the constantvar from an envir...</li> <li>Additional commits viewable in <a href="https://github.com/google/go-cloud/compare/v0.34.0...v0.35.0">compare view</a></li> </ul> </details> <br /> <details> <summary>Most Recent Ignore Conditions Applied to This Pull Request</summary> | Dependency Name | Ignore Conditions | | --- | --- | | gocloud.dev | [>= 0.25.a, < 0.26] | </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.34.0&new-version=0.35.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-11 12:55:26 +02:00
cloud.google.com/go/iam v1.1.5 // indirect
cloud.google.com/go/kms v1.15.5 // indirect
cloud.google.com/go/storage v1.35.1 // indirect
feat: update nfpm (#2640) * feat: update nfpm * feat: update nfpm * feat: update nfpm * feat: update nfpm * fix: dir type * docs: dir * docs: typo * fix: race * fix: race cond
2021-11-14 03:23:11 +02:00
github.com/AlekSi/pointer v1.2.0 // indirect
feat(deps): bump github.com/google/ko from 0.12.0 to 0.13.0 (#3880) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.12.0 to 0.13.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.13.0</h2> <h2>What's Changed</h2> <ul> <li>SPDX: Fix package manager label by <a href="https://github.com/puerco"><code>@​puerco</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/801">ko-build/ko#801</a></li> <li>SPDX 2.3 support by <a href="https://github.com/puerco"><code>@​puerco</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/803">ko-build/ko#803</a></li> <li>ci: build and test using 1.18 and 1.19 (drop 1.17) by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/812">ko-build/ko#812</a></li> <li>removes repo move message by <a href="https://github.com/mchmarny"><code>@​mchmarny</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/814">ko-build/ko#814</a></li> <li>feat: write sbom result to disk by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/822">ko-build/ko#822</a></li> <li>feat: adding support for using multiple keychain for sending sbom results to a different repository by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/821">ko-build/ko#821</a></li> <li>Move docs to ko.build by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/749">ko-build/ko#749</a></li> <li>Update setup-ko version by <a href="https://github.com/ianlewis"><code>@​ianlewis</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/836">ko-build/ko#836</a></li> <li>Add -- usage in readme by <a href="https://github.com/jwcesign"><code>@​jwcesign</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/840">ko-build/ko#840</a></li> <li>add CONTRIBUTING, code of conduct, roadmap by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/837">ko-build/ko#837</a></li> <li>attempt to fix GH Pages publishing by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/843">ko-build/ko#843</a></li> <li>doc: fix link to Installation page in Getting Started by <a href="https://github.com/antoineco"><code>@​antoineco</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/846">ko-build/ko#846</a></li> <li>.ko.yaml: bump golang 1.18 -&gt; 1.19 by <a href="https://github.com/srenatus"><code>@​srenatus</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/848">ko-build/ko#848</a></li> <li>truncate -image-refs file by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/855">ko-build/ko#855</a></li> <li>update docs: fix broken links, align with README by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/854">ko-build/ko#854</a></li> <li>Handle KO_DOCKER_REPO=ko.local/repo and --bare correctly by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/820">ko-build/ko#820</a></li> <li>another docs update by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/856">ko-build/ko#856</a></li> <li>ko.build: support some common shortlinks by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/872">ko-build/ko#872</a></li> <li>install: fail with 404 instead of gzip error when url was wrong by <a href="https://github.com/grosser"><code>@​grosser</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/879">ko-build/ko#879</a></li> <li>feat: deduplicate tags by <a href="https://github.com/bluebrown"><code>@​bluebrown</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/884">ko-build/ko#884</a></li> <li>install mkdocs-redirect when publishing site by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/873">ko-build/ko#873</a></li> <li>nit: replace one-item slice with const by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/885">ko-build/ko#885</a></li> <li>Temp fix for SLSA generators by <a href="https://github.com/laurentsimon"><code>@​laurentsimon</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/886">ko-build/ko#886</a></li> <li>Fix verifier by <a href="https://github.com/laurentsimon"><code>@​laurentsimon</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/891">ko-build/ko#891</a></li> <li>Fix link in static-assets.md by <a href="https://github.com/yuryu"><code>@​yuryu</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/893">ko-build/ko#893</a></li> <li>add KO_DEFAULTBASEIMAGE usage to docs by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/895">ko-build/ko#895</a></li> <li>Publish an tagged image on release by <a href="https://github.com/vdemeester"><code>@​vdemeester</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/868">ko-build/ko#868</a></li> <li>Add option to configure default platforms by <a href="https://github.com/ReToCode"><code>@​ReToCode</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/897">ko-build/ko#897</a></li> <li>Fix broken SLSA link by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/899">ko-build/ko#899</a></li> <li>add MAINTAINERS.md by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/905">ko-build/ko#905</a></li> <li>fix: possible race condition when applying templates to flags/ldflags by <a href="https://github.com/caarlos0"><code>@​caarlos0</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/913">ko-build/ko#913</a></li> <li>update docs to reflect actual default base image by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/903">ko-build/ko#903</a></li> <li>remove repeated error message on failure by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/921">ko-build/ko#921</a></li> <li>website: update CNCF announcement by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/920">ko-build/ko#920</a></li> <li>fix KO_CONFIG_PATH pointing to a file by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/923">ko-build/ko#923</a></li> <li>upgrade to cosign v2.0.0-rc.0 by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/933">ko-build/ko#933</a></li> <li>Feature: Add ECR presubmit testing. by <a href="https://github.com/mattmoor"><code>@​mattmoor</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/934">ko-build/ko#934</a></li> <li>remove 'ko deps' by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/937">ko-build/ko#937</a></li> <li>feat: Add KO_GO_PATH env var by <a href="https://github.com/embano1"><code>@​embano1</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/930">ko-build/ko#930</a></li> <li>add ko.build/slack short link by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/945">ko-build/ko#945</a></li> <li>update link to ko goreleaser docs by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/936">ko-build/ko#936</a></li> <li>add ko community meeting details by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/938">ko-build/ko#938</a></li> <li>fix cosign by adding --yes by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/973">ko-build/ko#973</a></li> <li>fix: handle docker's unknown/unknown platform in index manifests by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/975">ko-build/ko#975</a></li> <li>fix file extension for cyclonedx by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/974">ko-build/ko#974</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ianlewis"><code>@​ianlewis</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/836">ko-build/ko#836</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/e22e7a15ffb988adc14c3fc6a964f61ed711812f"><code>e22e7a1</code></a> bump ggcr dep to <a href="https://github.com/main"><code>@​main</code></a> (<a href="https://redirect.github.com/google/ko/issues/976">#976</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/8e075ae1f1822bb61a871f11197566b362c342f0"><code>8e075ae</code></a> fix file extension for cyclonedx (<a href="https://redirect.github.com/google/ko/issues/974">#974</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/11670b7498be63bc0e04e7ba36433fd22f9654ce"><code>11670b7</code></a> fix: handle docker's unknown/unknown platform in index manifests (<a href="https://redirect.github.com/google/ko/issues/975">#975</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/7ce947817e2f59942cb181aa833bfd13533bcc19"><code>7ce9478</code></a> fix cosign by adding --yes (<a href="https://redirect.github.com/google/ko/issues/973">#973</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/9302da78dc995b2b2dd70c044708c3c4c6a056b6"><code>9302da7</code></a> Bump k8s.io/apimachinery from 0.26.1 to 0.26.2 (<a href="https://redirect.github.com/google/ko/issues/972">#972</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/a1588838ba1698c3ca3f6785363a1a9f82ed4baa"><code>a158883</code></a> Bump sigstore/cosign-installer from 2.8.1 to 3.0.1 (<a href="https://redirect.github.com/google/ko/issues/971">#971</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/86b6c2854f8a7c321ce1b8ea121938ce9cc79475"><code>86b6c28</code></a> Bump actions/checkout from 2 to 3 (<a href="https://redirect.github.com/google/ko/issues/966">#966</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/0bd12fb106ed9d03994a6b8883f8a5d834a2aa15"><code>0bd12fb</code></a> Bump slsa-framework/slsa-github-generator from 1.2.1 to 1.5.0 (<a href="https://redirect.github.com/google/ko/issues/967">#967</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/d5125daacd07306d3814a6910cc54422824331e6"><code>d5125da</code></a> Bump github.com/sigstore/cosign/v2 from 2.0.0-rc.2 to 2.0.0 (<a href="https://redirect.github.com/google/ko/issues/965">#965</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/03f4aed68268fb320b32195c80292300056b264c"><code>03f4aed</code></a> add ko community meeting details (<a href="https://redirect.github.com/google/ko/issues/938">#938</a>)</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.12.0...v0.13.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.12.0&new-version=0.13.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Carlos A Becker <caarlos0@users.noreply.github.com>
2023-03-29 19:38:57 +02:00
github.com/Azure/azure-sdk-for-go v68.0.0+incompatible // indirect
feat(deps): bump gocloud.dev from 0.34.0 to 0.35.0 (#4467) Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.34.0 to 0.35.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-cloud/releases">gocloud.dev's releases</a>.</em></p> <blockquote> <h2>v0.35.0</h2> <p><strong>BREAKING CHANGES</strong></p> <p>This release updates the dependency on AWS/S3, which included some breaking changes; see <a href="https://redirect.github.com/google/go-cloud/pull/3342">google/go-cloud#3342</a> for details.</p> <p><strong>blob</strong></p> <ul> <li><em>gcsblob</em>: Fix unauthenticated requests.</li> </ul> <p><strong>runtimevar</strong></p> <ul> <li><em>constantvar</em>: Add support for reading the constant variable value from the environment.</li> </ul> <p><strong>docstore</strong></p> <ul> <li><em>gcpfilestore</em>: Add support for non-default databases.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-cloud/commit/27e0bca95dae3165b94cab4f9b7e2e4b087c8aef"><code>27e0bca</code></a> all: prep for release (<a href="https://redirect.github.com/google/go-cloud/issues/3350">#3350</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/53ccd8db26a14fd2a40bfcb28af1a1ceba4663f4"><code>53ccd8d</code></a> all: update deps, including a breaking S3 change (<a href="https://redirect.github.com/google/go-cloud/issues/3342">#3342</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/fa413a39cdf8ffe0890a1b0a4cf5e06e0c915592"><code>fa413a3</code></a> docstore/gcpfilestore: add support for non-default databases. (<a href="https://redirect.github.com/google/go-cloud/issues/3345">#3345</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/c04000b96462ad3ec62e633eafd759185991bb27"><code>c04000b</code></a> secrets/hashivault: Update go-jose per dependabot (<a href="https://redirect.github.com/google/go-cloud/issues/3346">#3346</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/6d5d2890816abc88cd11ef13d6cd6506eb5b5537"><code>6d5d289</code></a> pubsub/natspubsub: upgrade a dependency (<a href="https://redirect.github.com/google/go-cloud/issues/3336">#3336</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/375e097193225b4ef300a336e04ccad9ace50bc1"><code>375e097</code></a> pubsub/natspubsub: Update dependency (<a href="https://redirect.github.com/google/go-cloud/issues/3331">#3331</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/35ac324ff7fae5ddc0f9dc2ff234a7d6b4935a20"><code>35ac324</code></a> all: update dependencies (<a href="https://redirect.github.com/google/go-cloud/issues/3329">#3329</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/4a18be0f4a48c145da4a76499485a45478fd69aa"><code>4a18be0</code></a> secrets/awskms: update the example for the AWS ARN use case (<a href="https://redirect.github.com/google/go-cloud/issues/3320">#3320</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/486d484a8f73fd5bedc910d4fd89c52e11412e68"><code>486d484</code></a> kafkapubsub: rename dependency Shopify/sarama to IBM/sarama (<a href="https://redirect.github.com/google/go-cloud/issues/3319">#3319</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/db7e808e313228ed8607a94d6e5cd075d66f4e86"><code>db7e808</code></a> runtimevar/constantvar: Add support for reading the constantvar from an envir...</li> <li>Additional commits viewable in <a href="https://github.com/google/go-cloud/compare/v0.34.0...v0.35.0">compare view</a></li> </ul> </details> <br /> <details> <summary>Most Recent Ignore Conditions Applied to This Pull Request</summary> | Dependency Name | Ignore Conditions | | --- | --- | | gocloud.dev | [>= 0.25.a, < 0.26] | </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.34.0&new-version=0.35.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-11 12:55:26 +02:00
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.9.0 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.4.0 // indirect
feat(deps): bump gocloud.dev from 0.34.0 to 0.35.0 (#4467) Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.34.0 to 0.35.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-cloud/releases">gocloud.dev's releases</a>.</em></p> <blockquote> <h2>v0.35.0</h2> <p><strong>BREAKING CHANGES</strong></p> <p>This release updates the dependency on AWS/S3, which included some breaking changes; see <a href="https://redirect.github.com/google/go-cloud/pull/3342">google/go-cloud#3342</a> for details.</p> <p><strong>blob</strong></p> <ul> <li><em>gcsblob</em>: Fix unauthenticated requests.</li> </ul> <p><strong>runtimevar</strong></p> <ul> <li><em>constantvar</em>: Add support for reading the constant variable value from the environment.</li> </ul> <p><strong>docstore</strong></p> <ul> <li><em>gcpfilestore</em>: Add support for non-default databases.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-cloud/commit/27e0bca95dae3165b94cab4f9b7e2e4b087c8aef"><code>27e0bca</code></a> all: prep for release (<a href="https://redirect.github.com/google/go-cloud/issues/3350">#3350</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/53ccd8db26a14fd2a40bfcb28af1a1ceba4663f4"><code>53ccd8d</code></a> all: update deps, including a breaking S3 change (<a href="https://redirect.github.com/google/go-cloud/issues/3342">#3342</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/fa413a39cdf8ffe0890a1b0a4cf5e06e0c915592"><code>fa413a3</code></a> docstore/gcpfilestore: add support for non-default databases. (<a href="https://redirect.github.com/google/go-cloud/issues/3345">#3345</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/c04000b96462ad3ec62e633eafd759185991bb27"><code>c04000b</code></a> secrets/hashivault: Update go-jose per dependabot (<a href="https://redirect.github.com/google/go-cloud/issues/3346">#3346</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/6d5d2890816abc88cd11ef13d6cd6506eb5b5537"><code>6d5d289</code></a> pubsub/natspubsub: upgrade a dependency (<a href="https://redirect.github.com/google/go-cloud/issues/3336">#3336</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/375e097193225b4ef300a336e04ccad9ace50bc1"><code>375e097</code></a> pubsub/natspubsub: Update dependency (<a href="https://redirect.github.com/google/go-cloud/issues/3331">#3331</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/35ac324ff7fae5ddc0f9dc2ff234a7d6b4935a20"><code>35ac324</code></a> all: update dependencies (<a href="https://redirect.github.com/google/go-cloud/issues/3329">#3329</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/4a18be0f4a48c145da4a76499485a45478fd69aa"><code>4a18be0</code></a> secrets/awskms: update the example for the AWS ARN use case (<a href="https://redirect.github.com/google/go-cloud/issues/3320">#3320</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/486d484a8f73fd5bedc910d4fd89c52e11412e68"><code>486d484</code></a> kafkapubsub: rename dependency Shopify/sarama to IBM/sarama (<a href="https://redirect.github.com/google/go-cloud/issues/3319">#3319</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/db7e808e313228ed8607a94d6e5cd075d66f4e86"><code>db7e808</code></a> runtimevar/constantvar: Add support for reading the constantvar from an envir...</li> <li>Additional commits viewable in <a href="https://github.com/google/go-cloud/compare/v0.34.0...v0.35.0">compare view</a></li> </ul> </details> <br /> <details> <summary>Most Recent Ignore Conditions Applied to This Pull Request</summary> | Dependency Name | Ignore Conditions | | --- | --- | | gocloud.dev | [>= 0.25.a, < 0.26] | </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.34.0&new-version=0.35.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-11 12:55:26 +02:00
github.com/Azure/azure-sdk-for-go/sdk/internal v1.5.0 // indirect
feat(deps): bump gocloud.dev from 0.29.0 to 0.30.0 (#4129) Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.29.0 to 0.30.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-cloud/releases">gocloud.dev's releases</a>.</em></p> <blockquote> <h2>v0.30.0</h2> <p><strong>blob</strong></p> <ul> <li><strong>all</strong>: Add <code>Upload</code> and <code>Download</code> methods that may be more efficient for some drivers.</li> <li><strong>s3blob</strong>: Add support for per-request <code>s3v2.Options</code>.</li> <li><strong>s3blob</strong>: Stop escaping second <code>/</code> in <code>//</code>; it's no longer necessary.</li> </ul> <p><strong>pubsub</strong></p> <ul> <li><strong>gcppubsub</strong>: Make it possible to configure <code>max_send_batch_size</code>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-cloud/commit/d2d5bedb50683e2a6b893b75aafc193eca2715db"><code>d2d5bed</code></a> all: prep for release (<a href="https://redirect.github.com/google/go-cloud/issues/3263">#3263</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/c2e172b5a78def74973f7f3a8ece7c0bd6967432"><code>c2e172b</code></a> all: update dependencies (<a href="https://redirect.github.com/google/go-cloud/issues/3262">#3262</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/098177a48cae1bebfc90f88ed43d319444cab804"><code>098177a</code></a> blob/s3blob: fix the 'awssdk' argument examples</li> <li><a href="https://github.com/google/go-cloud/commit/2e4fad43f0b2606833b6a0de3e18628c70e11398"><code>2e4fad4</code></a> all: remove refs to deprecated xerrors</li> <li><a href="https://github.com/google/go-cloud/commit/1db413f1b3c4e344618b36401ba7e6dca3892929"><code>1db413f</code></a> pubsub/gcppubsub: make it possible to configure max_send_batch_size</li> <li><a href="https://github.com/google/go-cloud/commit/0c8428bf433136e7a4d96de0841f6373c6eacb53"><code>0c8428b</code></a> blob: Add Upload and Download methods that may be more efficient for some dri...</li> <li><a href="https://github.com/google/go-cloud/commit/54c71241a56f4c89eb64f587e5dc55667eaa40a3"><code>54c7124</code></a> all: cleanup duplicate import statements</li> <li><a href="https://github.com/google/go-cloud/commit/28b1328ae4fee939441faa5ee2e4eeba74c88ce7"><code>28b1328</code></a> all: minor code simplifications for returned boolean expressions</li> <li><a href="https://github.com/google/go-cloud/commit/2a407f5e6a71951384531445e25c58194f235062"><code>2a407f5</code></a> blob/gcsblob: Refresh goldens</li> <li><a href="https://github.com/google/go-cloud/commit/0cc16c8ae11e47028df24c4973debd6c56d29729"><code>0cc16c8</code></a> all: update goldens (<a href="https://redirect.github.com/google/go-cloud/issues/3252">#3252</a>)</li> <li>Additional commits viewable in <a href="https://github.com/google/go-cloud/compare/v0.29.0...v0.30.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.29.0&new-version=0.30.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-20 14:04:08 +02:00
github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys v0.10.0 // indirect
feat(deps): bump gocloud.dev from 0.27.0 to 0.28.0 (#3689) Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.27.0 to 0.28.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-cloud/releases">gocloud.dev's releases</a>.</em></p> <blockquote> <h2>v0.28.0</h2> <p><strong>BREAKING CHANGES</strong>:</p> <ul> <li><strong>secrets/azurekeyvault</strong>: Updated to latest Azure SDK.</li> <li><strong>blob/azureblob</strong>: Updated to match recent breaking changes in the Azure packages (yes, again).</li> <li><strong>pubsub/awssnssqs</strong>: Fixed <code>BeforeSend</code> to take a pointer to the <code>SendMessageBatchRequestEntry</code> struct, so that it can be modified.</li> </ul> <p><strong>blob</strong></p> <ul> <li><strong>memblob</strong>: Fixed bug where use of <code>BeforeCopy</code> callback would drop the actual copying.</li> <li><strong>azureblob</strong>: Updated to match recent breaking changes in the Azure packages.</li> </ul> <p><strong>pubsub</strong></p> <ul> <li><strong>all</strong>: Simplified and improved batch sizing, should resolve issues with too-frequent polling in some situations.</li> <li><strong>azurepubsub</strong>: Made <code>ListenerTimeout</code> configurable.</li> <li><strong>gcppubsub</strong> and <strong>awssnssqs</strong>: Support lazy mode for <code>Nack</code> (where no explicit <code>Nack</code> is sent).</li> <li><strong>awssnssqs</strong>: Fixed <code>BeforeSend</code> to take a pointer to the <code>SendMessageBatchRequestEntry</code> struct, so that it can be modified.</li> </ul> <p><strong>secrets</strong></p> <ul> <li><strong>secrets/azurekeyvault</strong>: Updated to latest Azure SDK. Use azidentity.NewDefaultAzureCredential.</li> </ul> <p><strong>sql</strong></p> <ul> <li><strong>gcp/cloudsql</strong>: Fixed IAM login.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-cloud/commit/24166090495b8e084a23aa7d11fcc81ec33e4729"><code>2416609</code></a> all: prep for v0.28.0 (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3207">#3207</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/13f46eb8065d5ea62b757f5f0f11a56f48faf7cc"><code>13f46eb</code></a> pubsub: simplify and improve batch sizing, especially for low message rates</li> <li><a href="https://github.com/google/go-cloud/commit/8f2c2b9a392a8e4a3d7a4942f88f3df607f8f6d0"><code>8f2c2b9</code></a> pubsub/memsub: Add Options for batching (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3205">#3205</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/fe0a3d75fe43c039258df25ebf102602526e3052"><code>fe0a3d7</code></a> pubsub/awssqs: Fix BeforeSend/As to enable changes to the sqs input message (...</li> <li><a href="https://github.com/google/go-cloud/commit/dfaf95af34dd9022a69a061028e0ceec98e9c670"><code>dfaf95a</code></a> secrets/azurekeyvault: Use azidentity.NewDefaultAzureCredential to support ot...</li> <li><a href="https://github.com/google/go-cloud/commit/1e26311532928f060c490a7fbf2be92b55ee12c4"><code>1e26311</code></a> blob: Remove some debug logging (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3197">#3197</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/43ed5a499864c08b7b6549ff7085f19634a1f02c"><code>43ed5a4</code></a> pubsub/gcppubsub: Support lazy mode for Nacks (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3195">#3195</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/be80e70b3dcf7a6b86481881c7ac0b44a8095178"><code>be80e70</code></a> pubsub/awssnssqs: Support lazy mode for Nacks (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3194">#3194</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/7d690993a53cf8cc2e7af07872876d58601f1261"><code>7d69099</code></a> blob/azblob: Update to latest, and restore As for dirlist (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3191">#3191</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/e942f3c339f0eb617ac4dbc7f37cc4e5920ee7cc"><code>e942f3c</code></a> blob/azblob: Restore As for List entry (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3188">#3188</a>)</li> <li>Additional commits viewable in <a href="https://github.com/google/go-cloud/compare/v0.27.0...v0.28.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.27.0&new-version=0.28.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-01-11 14:09:51 +02:00
github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal v0.7.1 // indirect
feat(deps): bump gocloud.dev from 0.34.0 to 0.35.0 (#4467) Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.34.0 to 0.35.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-cloud/releases">gocloud.dev's releases</a>.</em></p> <blockquote> <h2>v0.35.0</h2> <p><strong>BREAKING CHANGES</strong></p> <p>This release updates the dependency on AWS/S3, which included some breaking changes; see <a href="https://redirect.github.com/google/go-cloud/pull/3342">google/go-cloud#3342</a> for details.</p> <p><strong>blob</strong></p> <ul> <li><em>gcsblob</em>: Fix unauthenticated requests.</li> </ul> <p><strong>runtimevar</strong></p> <ul> <li><em>constantvar</em>: Add support for reading the constant variable value from the environment.</li> </ul> <p><strong>docstore</strong></p> <ul> <li><em>gcpfilestore</em>: Add support for non-default databases.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-cloud/commit/27e0bca95dae3165b94cab4f9b7e2e4b087c8aef"><code>27e0bca</code></a> all: prep for release (<a href="https://redirect.github.com/google/go-cloud/issues/3350">#3350</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/53ccd8db26a14fd2a40bfcb28af1a1ceba4663f4"><code>53ccd8d</code></a> all: update deps, including a breaking S3 change (<a href="https://redirect.github.com/google/go-cloud/issues/3342">#3342</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/fa413a39cdf8ffe0890a1b0a4cf5e06e0c915592"><code>fa413a3</code></a> docstore/gcpfilestore: add support for non-default databases. (<a href="https://redirect.github.com/google/go-cloud/issues/3345">#3345</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/c04000b96462ad3ec62e633eafd759185991bb27"><code>c04000b</code></a> secrets/hashivault: Update go-jose per dependabot (<a href="https://redirect.github.com/google/go-cloud/issues/3346">#3346</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/6d5d2890816abc88cd11ef13d6cd6506eb5b5537"><code>6d5d289</code></a> pubsub/natspubsub: upgrade a dependency (<a href="https://redirect.github.com/google/go-cloud/issues/3336">#3336</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/375e097193225b4ef300a336e04ccad9ace50bc1"><code>375e097</code></a> pubsub/natspubsub: Update dependency (<a href="https://redirect.github.com/google/go-cloud/issues/3331">#3331</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/35ac324ff7fae5ddc0f9dc2ff234a7d6b4935a20"><code>35ac324</code></a> all: update dependencies (<a href="https://redirect.github.com/google/go-cloud/issues/3329">#3329</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/4a18be0f4a48c145da4a76499485a45478fd69aa"><code>4a18be0</code></a> secrets/awskms: update the example for the AWS ARN use case (<a href="https://redirect.github.com/google/go-cloud/issues/3320">#3320</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/486d484a8f73fd5bedc910d4fd89c52e11412e68"><code>486d484</code></a> kafkapubsub: rename dependency Shopify/sarama to IBM/sarama (<a href="https://redirect.github.com/google/go-cloud/issues/3319">#3319</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/db7e808e313228ed8607a94d6e5cd075d66f4e86"><code>db7e808</code></a> runtimevar/constantvar: Add support for reading the constantvar from an envir...</li> <li>Additional commits viewable in <a href="https://github.com/google/go-cloud/compare/v0.34.0...v0.35.0">compare view</a></li> </ul> </details> <br /> <details> <summary>Most Recent Ignore Conditions Applied to This Pull Request</summary> | Dependency Name | Ignore Conditions | | --- | --- | | gocloud.dev | [>= 0.25.a, < 0.26] | </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.34.0&new-version=0.35.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-11 12:55:26 +02:00
github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.2.0 // indirect
feat(deps): bump github.com/google/ko from 0.13.0 to 0.14.1 (#4132) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.13.0 to 0.14.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.14.1</h2> <h2>What's Changed</h2> <ul> <li>fix: Use attestation-name output by <a href="https://github.com/ianlewis"><code>@​ianlewis</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/980">ko-build/ko#980</a></li> <li>Upgrade to go120 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/984">ko-build/ko#984</a></li> <li>fix release workflow by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/977">ko-build/ko#977</a></li> <li>fix deprecated attestation name by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/983">ko-build/ko#983</a></li> <li>refactor release job by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/986">ko-build/ko#986</a></li> <li>use git hash instead of git tag by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/988">ko-build/ko#988</a></li> <li>Correct a typo in resolver.go by <a href="https://github.com/felixonmars"><code>@​felixonmars</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/989">ko-build/ko#989</a></li> <li>feat: add riscv64 to goreleaser goarch by <a href="https://github.com/ernado"><code>@​ernado</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/990">ko-build/ko#990</a></li> <li>try to fix codeql workflow by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/994">ko-build/ko#994</a></li> <li>Push images faster by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1005">ko-build/ko#1005</a></li> <li>Don't publish tags twice by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1010">ko-build/ko#1010</a></li> <li>Add context to many gobuild errors by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1016">ko-build/ko#1016</a></li> <li>Fix --local with KO_DOCKER_REPO by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1017">ko-build/ko#1017</a></li> <li>Fix: Incorporate platform architecture by <a href="https://github.com/mattmoor"><code>@​mattmoor</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1029">ko-build/ko#1029</a></li> <li>Update community.md by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1035">ko-build/ko#1035</a></li> <li>mention ko tekton task by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1039">ko-build/ko#1039</a></li> <li>Update community.md by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1037">ko-build/ko#1037</a></li> <li>Fix kind image loading for MacOS by <a href="https://github.com/aidy"><code>@​aidy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1026">ko-build/ko#1026</a></li> <li>Revert &quot;Fix kind image loading for MacOS&quot; by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1054">ko-build/ko#1054</a></li> <li>update boilerplate file to be KO Build Authors by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1056">ko-build/ko#1056</a></li> <li>Pin setup-ko to previous release by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1082">ko-build/ko#1082</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/felixonmars"><code>@​felixonmars</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/989">ko-build/ko#989</a></li> <li><a href="https://github.com/ernado"><code>@​ernado</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/990">ko-build/ko#990</a></li> <li><a href="https://github.com/aidy"><code>@​aidy</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1026">ko-build/ko#1026</a></li> <li><a href="https://github.com/luhring"><code>@​luhring</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1073">ko-build/ko#1073</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ko-build/ko/compare/v0.13.0...v0.14.1">https://github.com/ko-build/ko/compare/v0.13.0...v0.14.1</a></p> <h2>v0.14.0</h2> <p>No release notes provided.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/200db7243f02b5c0303e21d8ab8e3b4ad3a229d0"><code>200db72</code></a> Pin setup-ko to previous release (<a href="https://redirect.github.com/google/ko/issues/1082">#1082</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/4366ded82cdda05ef85bc5483d19daa241d08f38"><code>4366ded</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1079">#1079</a> from ko-build/dependabot/github_actions/slsa-framewo...</li> <li><a href="https://github.com/ko-build/ko/commit/adbea950c10e2c69c7bf0589a6bf0b4e7ceafbfa"><code>adbea95</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1078">#1078</a> from ko-build/dependabot/github_actions/goreleaser/g...</li> <li><a href="https://github.com/ko-build/ko/commit/6175237fe6539a48206da87c239ad98b4f7d7312"><code>6175237</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1077">#1077</a> from ko-build/dependabot/go_modules/github.com/spf13...</li> <li><a href="https://github.com/ko-build/ko/commit/5e5fe2e703c1f0c9186975b06090ae563283f48d"><code>5e5fe2e</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1076">#1076</a> from ko-build/dependabot/github_actions/aws-actions/...</li> <li><a href="https://github.com/ko-build/ko/commit/dc9b3eebef9818e2efab17cec8dd3eebff72e074"><code>dc9b3ee</code></a> Bump github.com/spf13/viper from 1.15.0 to 1.16.0</li> <li><a href="https://github.com/ko-build/ko/commit/ed445128e25c7bd0b6643b58ac44383a583d84f5"><code>ed44512</code></a> Bump golang.org/x/tools from 0.9.3 to 0.10.0 (<a href="https://redirect.github.com/google/ko/issues/1080">#1080</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/fcd95ec958cad910b4746245662506b1f974f40e"><code>fcd95ec</code></a> Bump slsa-framework/slsa-github-generator from 1.6.0 to 1.7.0</li> <li><a href="https://github.com/ko-build/ko/commit/974f09cdeacd7042c3db573366768ecbb32246a5"><code>974f09c</code></a> Bump goreleaser/goreleaser-action from 4.2.0 to 4.3.0</li> <li><a href="https://github.com/ko-build/ko/commit/893f6e877f7c352261c13e078bb8fc9709bb285c"><code>893f6e8</code></a> Bump aws-actions/configure-aws-credentials from 2.1.0 to 2.2.0</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.13.0...v0.14.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.13.0&new-version=0.14.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-26 18:56:50 +02:00
github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
feat: use go 1.17 (#2408) * feat: use go 1.17 Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * fix: go mod tidy Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * test: fix failing test Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * ci: increase lint timeout Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * ci: increase lint timeout Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com>
2021-08-25 01:49:11 +02:00
github.com/Azure/go-autorest v14.2.0+incompatible // indirect
feat(deps): bump github.com/sigstore/rekor from 1.1.1 to 1.2.0 (#4044) Bumps [github.com/sigstore/rekor](https://github.com/sigstore/rekor) from 1.1.1 to 1.2.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/rekor/blob/main/CHANGELOG.md">github.com/sigstore/rekor's changelog</a>.</em></p> <blockquote> <h1>v1.2.0</h1> <h2>Functional Enhancements</h2> <ul> <li>add client method to generate TLE struct (<a href="https://redirect.github.com/sigstore/rekor/issues/1498">#1498</a>)</li> <li>add dsse type (<a href="https://redirect.github.com/sigstore/rekor/issues/1487">#1487</a>)</li> <li>support other KMS providers (AWS, Azure, Hashicorp) in addition to GCP (<a href="https://redirect.github.com/sigstore/rekor/issues/1488">#1488</a>)</li> <li>Add concurrency to backfill-redis (<a href="https://redirect.github.com/sigstore/rekor/issues/1504">#1504</a>)</li> <li>omit informational message if machine-parseable output has been requested (<a href="https://redirect.github.com/sigstore/rekor/issues/1486">#1486</a>)</li> <li>Publish stable checkpoint periodically to Redis (<a href="https://redirect.github.com/sigstore/rekor/issues/1461">#1461</a>)</li> <li>Add intoto v0.0.2 to backfill script (<a href="https://redirect.github.com/sigstore/rekor/issues/1500">#1500</a>)</li> <li>add new method to test insertability of proposed entries into log (<a href="https://redirect.github.com/sigstore/rekor/issues/1410">#1410</a>)</li> </ul> <h2>Quality Enhancements</h2> <ul> <li>use t.Skip() in fuzzers (<a href="https://redirect.github.com/sigstore/rekor/issues/1506">#1506</a>)</li> <li>improve fuzzing coverage (<a href="https://redirect.github.com/sigstore/rekor/issues/1499">#1499</a>)</li> <li>Remove watcher script (<a href="https://redirect.github.com/sigstore/rekor/issues/1484">#1484</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-frqx-jfcm-6jjr</li> <li>Remove requirement of PayloadHash for intoto 0.0.1 (<a href="https://redirect.github.com/sigstore/rekor/issues/1490">#1490</a>)</li> <li>fix lint errors, bump linter up to 1.52 (<a href="https://redirect.github.com/sigstore/rekor/issues/1485">#1485</a>)</li> <li>Remove dependencies from pkg/util (<a href="https://redirect.github.com/sigstore/rekor/issues/1469">#1469</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>Bob Callaway</li> <li>Carlos Tadeu Panato Junior</li> <li>Ceridwen Coghlan</li> <li>Cody Soyland</li> <li>Hayden B</li> <li>Miloslav Trmač</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/rekor/commit/20a995116b1548b79e62ba0ad9c29800387e8641"><code>20a9951</code></a> update for v1.2.0 (<a href="https://redirect.github.com/sigstore/rekor/issues/1507">#1507</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/140c5add105179e5ffd9e3e114fd1b6b93aebbd4"><code>140c5ad</code></a> Merge pull request from GHSA-frqx-jfcm-6jjr</li> <li><a href="https://github.com/sigstore/rekor/commit/85bb2bc7a35dcc94cd94e18984711806f437dcb6"><code>85bb2bc</code></a> use t.Skip() in fuzzers (<a href="https://redirect.github.com/sigstore/rekor/issues/1506">#1506</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/3adca0d2528699d2ff93bf78babef8b5cac46122"><code>3adca0d</code></a> Add concurrency to backfill-redis (<a href="https://redirect.github.com/sigstore/rekor/issues/1504">#1504</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/795a23619d5db1c9625a71f776474033c6712b56"><code>795a236</code></a> add client method to generate TLE struct (<a href="https://redirect.github.com/sigstore/rekor/issues/1498">#1498</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/161a796f91d7255443aa6ce98e7981e6926762f0"><code>161a796</code></a> build(deps): bump github/codeql-action from 2.3.3 to 2.3.4 (<a href="https://redirect.github.com/sigstore/rekor/issues/1505">#1505</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/35c4489abcff256298f1bc9f7caaf5a946750dac"><code>35c4489</code></a> add dsse type (<a href="https://redirect.github.com/sigstore/rekor/issues/1487">#1487</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/d318e2bf433d398d95923f3509557777a2fe5abb"><code>d318e2b</code></a> support other KMS providers (AWS, Azure, Hashicorp) in addition to GCP (<a href="https://redirect.github.com/sigstore/rekor/issues/1488">#1488</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/d508ebad91ef4e39d8e0dd3543cebe20321dc752"><code>d508eba</code></a> Remove requirement of PayloadHash for intoto 0.0.1 (<a href="https://redirect.github.com/sigstore/rekor/issues/1490">#1490</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/b387701f27aace3e3396ad4fdbb8d3ccc869fb5f"><code>b387701</code></a> Add intoto v0.0.2 to backfill script (<a href="https://redirect.github.com/sigstore/rekor/issues/1500">#1500</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/rekor/compare/v1.1.1...v1.2.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/rekor&package-manager=go_modules&previous-version=1.1.1&new-version=1.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-05-27 05:24:50 +02:00
github.com/Azure/go-autorest/autorest v0.11.29 // indirect
feat(deps): bump gocloud.dev from 0.29.0 to 0.30.0 (#4129) Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.29.0 to 0.30.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-cloud/releases">gocloud.dev's releases</a>.</em></p> <blockquote> <h2>v0.30.0</h2> <p><strong>blob</strong></p> <ul> <li><strong>all</strong>: Add <code>Upload</code> and <code>Download</code> methods that may be more efficient for some drivers.</li> <li><strong>s3blob</strong>: Add support for per-request <code>s3v2.Options</code>.</li> <li><strong>s3blob</strong>: Stop escaping second <code>/</code> in <code>//</code>; it's no longer necessary.</li> </ul> <p><strong>pubsub</strong></p> <ul> <li><strong>gcppubsub</strong>: Make it possible to configure <code>max_send_batch_size</code>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-cloud/commit/d2d5bedb50683e2a6b893b75aafc193eca2715db"><code>d2d5bed</code></a> all: prep for release (<a href="https://redirect.github.com/google/go-cloud/issues/3263">#3263</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/c2e172b5a78def74973f7f3a8ece7c0bd6967432"><code>c2e172b</code></a> all: update dependencies (<a href="https://redirect.github.com/google/go-cloud/issues/3262">#3262</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/098177a48cae1bebfc90f88ed43d319444cab804"><code>098177a</code></a> blob/s3blob: fix the 'awssdk' argument examples</li> <li><a href="https://github.com/google/go-cloud/commit/2e4fad43f0b2606833b6a0de3e18628c70e11398"><code>2e4fad4</code></a> all: remove refs to deprecated xerrors</li> <li><a href="https://github.com/google/go-cloud/commit/1db413f1b3c4e344618b36401ba7e6dca3892929"><code>1db413f</code></a> pubsub/gcppubsub: make it possible to configure max_send_batch_size</li> <li><a href="https://github.com/google/go-cloud/commit/0c8428bf433136e7a4d96de0841f6373c6eacb53"><code>0c8428b</code></a> blob: Add Upload and Download methods that may be more efficient for some dri...</li> <li><a href="https://github.com/google/go-cloud/commit/54c71241a56f4c89eb64f587e5dc55667eaa40a3"><code>54c7124</code></a> all: cleanup duplicate import statements</li> <li><a href="https://github.com/google/go-cloud/commit/28b1328ae4fee939441faa5ee2e4eeba74c88ce7"><code>28b1328</code></a> all: minor code simplifications for returned boolean expressions</li> <li><a href="https://github.com/google/go-cloud/commit/2a407f5e6a71951384531445e25c58194f235062"><code>2a407f5</code></a> blob/gcsblob: Refresh goldens</li> <li><a href="https://github.com/google/go-cloud/commit/0cc16c8ae11e47028df24c4973debd6c56d29729"><code>0cc16c8</code></a> all: update goldens (<a href="https://redirect.github.com/google/go-cloud/issues/3252">#3252</a>)</li> <li>Additional commits viewable in <a href="https://github.com/google/go-cloud/compare/v0.29.0...v0.30.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.29.0&new-version=0.30.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-20 14:04:08 +02:00
github.com/Azure/go-autorest/autorest/adal v0.9.23 // indirect
feat(deps): bump github.com/google/ko from 0.12.0 to 0.13.0 (#3880) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.12.0 to 0.13.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.13.0</h2> <h2>What's Changed</h2> <ul> <li>SPDX: Fix package manager label by <a href="https://github.com/puerco"><code>@​puerco</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/801">ko-build/ko#801</a></li> <li>SPDX 2.3 support by <a href="https://github.com/puerco"><code>@​puerco</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/803">ko-build/ko#803</a></li> <li>ci: build and test using 1.18 and 1.19 (drop 1.17) by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/812">ko-build/ko#812</a></li> <li>removes repo move message by <a href="https://github.com/mchmarny"><code>@​mchmarny</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/814">ko-build/ko#814</a></li> <li>feat: write sbom result to disk by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/822">ko-build/ko#822</a></li> <li>feat: adding support for using multiple keychain for sending sbom results to a different repository by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/821">ko-build/ko#821</a></li> <li>Move docs to ko.build by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/749">ko-build/ko#749</a></li> <li>Update setup-ko version by <a href="https://github.com/ianlewis"><code>@​ianlewis</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/836">ko-build/ko#836</a></li> <li>Add -- usage in readme by <a href="https://github.com/jwcesign"><code>@​jwcesign</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/840">ko-build/ko#840</a></li> <li>add CONTRIBUTING, code of conduct, roadmap by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/837">ko-build/ko#837</a></li> <li>attempt to fix GH Pages publishing by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/843">ko-build/ko#843</a></li> <li>doc: fix link to Installation page in Getting Started by <a href="https://github.com/antoineco"><code>@​antoineco</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/846">ko-build/ko#846</a></li> <li>.ko.yaml: bump golang 1.18 -&gt; 1.19 by <a href="https://github.com/srenatus"><code>@​srenatus</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/848">ko-build/ko#848</a></li> <li>truncate -image-refs file by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/855">ko-build/ko#855</a></li> <li>update docs: fix broken links, align with README by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/854">ko-build/ko#854</a></li> <li>Handle KO_DOCKER_REPO=ko.local/repo and --bare correctly by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/820">ko-build/ko#820</a></li> <li>another docs update by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/856">ko-build/ko#856</a></li> <li>ko.build: support some common shortlinks by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/872">ko-build/ko#872</a></li> <li>install: fail with 404 instead of gzip error when url was wrong by <a href="https://github.com/grosser"><code>@​grosser</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/879">ko-build/ko#879</a></li> <li>feat: deduplicate tags by <a href="https://github.com/bluebrown"><code>@​bluebrown</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/884">ko-build/ko#884</a></li> <li>install mkdocs-redirect when publishing site by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/873">ko-build/ko#873</a></li> <li>nit: replace one-item slice with const by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/885">ko-build/ko#885</a></li> <li>Temp fix for SLSA generators by <a href="https://github.com/laurentsimon"><code>@​laurentsimon</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/886">ko-build/ko#886</a></li> <li>Fix verifier by <a href="https://github.com/laurentsimon"><code>@​laurentsimon</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/891">ko-build/ko#891</a></li> <li>Fix link in static-assets.md by <a href="https://github.com/yuryu"><code>@​yuryu</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/893">ko-build/ko#893</a></li> <li>add KO_DEFAULTBASEIMAGE usage to docs by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/895">ko-build/ko#895</a></li> <li>Publish an tagged image on release by <a href="https://github.com/vdemeester"><code>@​vdemeester</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/868">ko-build/ko#868</a></li> <li>Add option to configure default platforms by <a href="https://github.com/ReToCode"><code>@​ReToCode</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/897">ko-build/ko#897</a></li> <li>Fix broken SLSA link by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/899">ko-build/ko#899</a></li> <li>add MAINTAINERS.md by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/905">ko-build/ko#905</a></li> <li>fix: possible race condition when applying templates to flags/ldflags by <a href="https://github.com/caarlos0"><code>@​caarlos0</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/913">ko-build/ko#913</a></li> <li>update docs to reflect actual default base image by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/903">ko-build/ko#903</a></li> <li>remove repeated error message on failure by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/921">ko-build/ko#921</a></li> <li>website: update CNCF announcement by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/920">ko-build/ko#920</a></li> <li>fix KO_CONFIG_PATH pointing to a file by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/923">ko-build/ko#923</a></li> <li>upgrade to cosign v2.0.0-rc.0 by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/933">ko-build/ko#933</a></li> <li>Feature: Add ECR presubmit testing. by <a href="https://github.com/mattmoor"><code>@​mattmoor</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/934">ko-build/ko#934</a></li> <li>remove 'ko deps' by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/937">ko-build/ko#937</a></li> <li>feat: Add KO_GO_PATH env var by <a href="https://github.com/embano1"><code>@​embano1</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/930">ko-build/ko#930</a></li> <li>add ko.build/slack short link by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/945">ko-build/ko#945</a></li> <li>update link to ko goreleaser docs by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/936">ko-build/ko#936</a></li> <li>add ko community meeting details by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/938">ko-build/ko#938</a></li> <li>fix cosign by adding --yes by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/973">ko-build/ko#973</a></li> <li>fix: handle docker's unknown/unknown platform in index manifests by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/975">ko-build/ko#975</a></li> <li>fix file extension for cyclonedx by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/974">ko-build/ko#974</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ianlewis"><code>@​ianlewis</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/836">ko-build/ko#836</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/e22e7a15ffb988adc14c3fc6a964f61ed711812f"><code>e22e7a1</code></a> bump ggcr dep to <a href="https://github.com/main"><code>@​main</code></a> (<a href="https://redirect.github.com/google/ko/issues/976">#976</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/8e075ae1f1822bb61a871f11197566b362c342f0"><code>8e075ae</code></a> fix file extension for cyclonedx (<a href="https://redirect.github.com/google/ko/issues/974">#974</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/11670b7498be63bc0e04e7ba36433fd22f9654ce"><code>11670b7</code></a> fix: handle docker's unknown/unknown platform in index manifests (<a href="https://redirect.github.com/google/ko/issues/975">#975</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/7ce947817e2f59942cb181aa833bfd13533bcc19"><code>7ce9478</code></a> fix cosign by adding --yes (<a href="https://redirect.github.com/google/ko/issues/973">#973</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/9302da78dc995b2b2dd70c044708c3c4c6a056b6"><code>9302da7</code></a> Bump k8s.io/apimachinery from 0.26.1 to 0.26.2 (<a href="https://redirect.github.com/google/ko/issues/972">#972</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/a1588838ba1698c3ca3f6785363a1a9f82ed4baa"><code>a158883</code></a> Bump sigstore/cosign-installer from 2.8.1 to 3.0.1 (<a href="https://redirect.github.com/google/ko/issues/971">#971</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/86b6c2854f8a7c321ce1b8ea121938ce9cc79475"><code>86b6c28</code></a> Bump actions/checkout from 2 to 3 (<a href="https://redirect.github.com/google/ko/issues/966">#966</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/0bd12fb106ed9d03994a6b8883f8a5d834a2aa15"><code>0bd12fb</code></a> Bump slsa-framework/slsa-github-generator from 1.2.1 to 1.5.0 (<a href="https://redirect.github.com/google/ko/issues/967">#967</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/d5125daacd07306d3814a6910cc54422824331e6"><code>d5125da</code></a> Bump github.com/sigstore/cosign/v2 from 2.0.0-rc.2 to 2.0.0 (<a href="https://redirect.github.com/google/ko/issues/965">#965</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/03f4aed68268fb320b32195c80292300056b264c"><code>03f4aed</code></a> add ko community meeting details (<a href="https://redirect.github.com/google/ko/issues/938">#938</a>)</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.12.0...v0.13.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.12.0&new-version=0.13.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Carlos A Becker <caarlos0@users.noreply.github.com>
2023-03-29 19:38:57 +02:00
github.com/Azure/go-autorest/autorest/azure/auth v0.5.12 // indirect
feat: add ko support (#3653) continuing the PR by @developer-guy - [x] should be a publisher, as it does publish the images it builds every time - [x] `Default` method does not work - [x] the `fromConfig` thing should probably be on the defaults, too - [x] wire `--skip-ko` - [x] documentation - [x] more tests - [x] use same registry as docker tests does - [ ] see if we can make the log output match goreleaser's - [ ] ?? closes #2556 closes #3490 Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com> Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> Co-authored-by: actions-user <actions@github.com> Co-authored-by: Jason Hall <jason@chainguard.dev> Co-authored-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
2023-01-17 03:34:49 +02:00
github.com/Azure/go-autorest/autorest/azure/cli v0.4.6 // indirect
github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
feat: use go 1.17 (#2408) * feat: use go 1.17 Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * fix: go mod tidy Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * test: fix failing test Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * ci: increase lint timeout Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * ci: increase lint timeout Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com>
2021-08-25 01:49:11 +02:00
github.com/Azure/go-autorest/autorest/to v0.4.0 // indirect
feat: add ko support (#3653) continuing the PR by @developer-guy - [x] should be a publisher, as it does publish the images it builds every time - [x] `Default` method does not work - [x] the `fromConfig` thing should probably be on the defaults, too - [x] wire `--skip-ko` - [x] documentation - [x] more tests - [x] use same registry as docker tests does - [ ] see if we can make the log output match goreleaser's - [ ] ?? closes #2556 closes #3490 Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com> Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> Co-authored-by: actions-user <actions@github.com> Co-authored-by: Jason Hall <jason@chainguard.dev> Co-authored-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
2023-01-17 03:34:49 +02:00
github.com/Azure/go-autorest/logger v0.2.1 // indirect
github.com/Azure/go-autorest/tracing v0.6.0 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/AzureAD/microsoft-authentication-library-for-go v1.2.0 // indirect
feat(deps): bump github.com/google/ko from 0.13.0 to 0.14.1 (#4132) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.13.0 to 0.14.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.14.1</h2> <h2>What's Changed</h2> <ul> <li>fix: Use attestation-name output by <a href="https://github.com/ianlewis"><code>@​ianlewis</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/980">ko-build/ko#980</a></li> <li>Upgrade to go120 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/984">ko-build/ko#984</a></li> <li>fix release workflow by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/977">ko-build/ko#977</a></li> <li>fix deprecated attestation name by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/983">ko-build/ko#983</a></li> <li>refactor release job by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/986">ko-build/ko#986</a></li> <li>use git hash instead of git tag by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/988">ko-build/ko#988</a></li> <li>Correct a typo in resolver.go by <a href="https://github.com/felixonmars"><code>@​felixonmars</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/989">ko-build/ko#989</a></li> <li>feat: add riscv64 to goreleaser goarch by <a href="https://github.com/ernado"><code>@​ernado</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/990">ko-build/ko#990</a></li> <li>try to fix codeql workflow by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/994">ko-build/ko#994</a></li> <li>Push images faster by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1005">ko-build/ko#1005</a></li> <li>Don't publish tags twice by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1010">ko-build/ko#1010</a></li> <li>Add context to many gobuild errors by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1016">ko-build/ko#1016</a></li> <li>Fix --local with KO_DOCKER_REPO by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1017">ko-build/ko#1017</a></li> <li>Fix: Incorporate platform architecture by <a href="https://github.com/mattmoor"><code>@​mattmoor</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1029">ko-build/ko#1029</a></li> <li>Update community.md by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1035">ko-build/ko#1035</a></li> <li>mention ko tekton task by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1039">ko-build/ko#1039</a></li> <li>Update community.md by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1037">ko-build/ko#1037</a></li> <li>Fix kind image loading for MacOS by <a href="https://github.com/aidy"><code>@​aidy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1026">ko-build/ko#1026</a></li> <li>Revert &quot;Fix kind image loading for MacOS&quot; by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1054">ko-build/ko#1054</a></li> <li>update boilerplate file to be KO Build Authors by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1056">ko-build/ko#1056</a></li> <li>Pin setup-ko to previous release by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1082">ko-build/ko#1082</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/felixonmars"><code>@​felixonmars</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/989">ko-build/ko#989</a></li> <li><a href="https://github.com/ernado"><code>@​ernado</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/990">ko-build/ko#990</a></li> <li><a href="https://github.com/aidy"><code>@​aidy</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1026">ko-build/ko#1026</a></li> <li><a href="https://github.com/luhring"><code>@​luhring</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1073">ko-build/ko#1073</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ko-build/ko/compare/v0.13.0...v0.14.1">https://github.com/ko-build/ko/compare/v0.13.0...v0.14.1</a></p> <h2>v0.14.0</h2> <p>No release notes provided.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/200db7243f02b5c0303e21d8ab8e3b4ad3a229d0"><code>200db72</code></a> Pin setup-ko to previous release (<a href="https://redirect.github.com/google/ko/issues/1082">#1082</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/4366ded82cdda05ef85bc5483d19daa241d08f38"><code>4366ded</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1079">#1079</a> from ko-build/dependabot/github_actions/slsa-framewo...</li> <li><a href="https://github.com/ko-build/ko/commit/adbea950c10e2c69c7bf0589a6bf0b4e7ceafbfa"><code>adbea95</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1078">#1078</a> from ko-build/dependabot/github_actions/goreleaser/g...</li> <li><a href="https://github.com/ko-build/ko/commit/6175237fe6539a48206da87c239ad98b4f7d7312"><code>6175237</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1077">#1077</a> from ko-build/dependabot/go_modules/github.com/spf13...</li> <li><a href="https://github.com/ko-build/ko/commit/5e5fe2e703c1f0c9186975b06090ae563283f48d"><code>5e5fe2e</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1076">#1076</a> from ko-build/dependabot/github_actions/aws-actions/...</li> <li><a href="https://github.com/ko-build/ko/commit/dc9b3eebef9818e2efab17cec8dd3eebff72e074"><code>dc9b3ee</code></a> Bump github.com/spf13/viper from 1.15.0 to 1.16.0</li> <li><a href="https://github.com/ko-build/ko/commit/ed445128e25c7bd0b6643b58ac44383a583d84f5"><code>ed44512</code></a> Bump golang.org/x/tools from 0.9.3 to 0.10.0 (<a href="https://redirect.github.com/google/ko/issues/1080">#1080</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/fcd95ec958cad910b4746245662506b1f974f40e"><code>fcd95ec</code></a> Bump slsa-framework/slsa-github-generator from 1.6.0 to 1.7.0</li> <li><a href="https://github.com/ko-build/ko/commit/974f09cdeacd7042c3db573366768ecbb32246a5"><code>974f09c</code></a> Bump goreleaser/goreleaser-action from 4.2.0 to 4.3.0</li> <li><a href="https://github.com/ko-build/ko/commit/893f6e877f7c352261c13e078bb8fc9709bb285c"><code>893f6e8</code></a> Bump aws-actions/configure-aws-credentials from 2.1.0 to 2.2.0</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.13.0...v0.14.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.13.0&new-version=0.14.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-26 18:56:50 +02:00
github.com/BurntSushi/toml v1.2.1 // indirect
feat: use go 1.17 (#2408) * feat: use go 1.17 Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * fix: go mod tidy Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * test: fix failing test Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * ci: increase lint timeout Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * ci: increase lint timeout Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com>
2021-08-25 01:49:11 +02:00
github.com/Masterminds/goutils v1.1.1 // indirect
feat(deps): bump github.com/goreleaser/nfpm/v2 from 2.30.1 to 2.31.0 (#4144) latest and greatest
2023-06-26 18:20:47 +02:00
github.com/Masterminds/sprig/v3 v3.2.3 // indirect
feat(deps): bump github.com/google/ko from 0.13.0 to 0.14.1 (#4132) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.13.0 to 0.14.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.14.1</h2> <h2>What's Changed</h2> <ul> <li>fix: Use attestation-name output by <a href="https://github.com/ianlewis"><code>@​ianlewis</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/980">ko-build/ko#980</a></li> <li>Upgrade to go120 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/984">ko-build/ko#984</a></li> <li>fix release workflow by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/977">ko-build/ko#977</a></li> <li>fix deprecated attestation name by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/983">ko-build/ko#983</a></li> <li>refactor release job by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/986">ko-build/ko#986</a></li> <li>use git hash instead of git tag by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/988">ko-build/ko#988</a></li> <li>Correct a typo in resolver.go by <a href="https://github.com/felixonmars"><code>@​felixonmars</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/989">ko-build/ko#989</a></li> <li>feat: add riscv64 to goreleaser goarch by <a href="https://github.com/ernado"><code>@​ernado</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/990">ko-build/ko#990</a></li> <li>try to fix codeql workflow by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/994">ko-build/ko#994</a></li> <li>Push images faster by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1005">ko-build/ko#1005</a></li> <li>Don't publish tags twice by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1010">ko-build/ko#1010</a></li> <li>Add context to many gobuild errors by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1016">ko-build/ko#1016</a></li> <li>Fix --local with KO_DOCKER_REPO by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1017">ko-build/ko#1017</a></li> <li>Fix: Incorporate platform architecture by <a href="https://github.com/mattmoor"><code>@​mattmoor</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1029">ko-build/ko#1029</a></li> <li>Update community.md by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1035">ko-build/ko#1035</a></li> <li>mention ko tekton task by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1039">ko-build/ko#1039</a></li> <li>Update community.md by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1037">ko-build/ko#1037</a></li> <li>Fix kind image loading for MacOS by <a href="https://github.com/aidy"><code>@​aidy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1026">ko-build/ko#1026</a></li> <li>Revert &quot;Fix kind image loading for MacOS&quot; by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1054">ko-build/ko#1054</a></li> <li>update boilerplate file to be KO Build Authors by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1056">ko-build/ko#1056</a></li> <li>Pin setup-ko to previous release by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1082">ko-build/ko#1082</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/felixonmars"><code>@​felixonmars</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/989">ko-build/ko#989</a></li> <li><a href="https://github.com/ernado"><code>@​ernado</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/990">ko-build/ko#990</a></li> <li><a href="https://github.com/aidy"><code>@​aidy</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1026">ko-build/ko#1026</a></li> <li><a href="https://github.com/luhring"><code>@​luhring</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1073">ko-build/ko#1073</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ko-build/ko/compare/v0.13.0...v0.14.1">https://github.com/ko-build/ko/compare/v0.13.0...v0.14.1</a></p> <h2>v0.14.0</h2> <p>No release notes provided.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/200db7243f02b5c0303e21d8ab8e3b4ad3a229d0"><code>200db72</code></a> Pin setup-ko to previous release (<a href="https://redirect.github.com/google/ko/issues/1082">#1082</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/4366ded82cdda05ef85bc5483d19daa241d08f38"><code>4366ded</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1079">#1079</a> from ko-build/dependabot/github_actions/slsa-framewo...</li> <li><a href="https://github.com/ko-build/ko/commit/adbea950c10e2c69c7bf0589a6bf0b4e7ceafbfa"><code>adbea95</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1078">#1078</a> from ko-build/dependabot/github_actions/goreleaser/g...</li> <li><a href="https://github.com/ko-build/ko/commit/6175237fe6539a48206da87c239ad98b4f7d7312"><code>6175237</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1077">#1077</a> from ko-build/dependabot/go_modules/github.com/spf13...</li> <li><a href="https://github.com/ko-build/ko/commit/5e5fe2e703c1f0c9186975b06090ae563283f48d"><code>5e5fe2e</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1076">#1076</a> from ko-build/dependabot/github_actions/aws-actions/...</li> <li><a href="https://github.com/ko-build/ko/commit/dc9b3eebef9818e2efab17cec8dd3eebff72e074"><code>dc9b3ee</code></a> Bump github.com/spf13/viper from 1.15.0 to 1.16.0</li> <li><a href="https://github.com/ko-build/ko/commit/ed445128e25c7bd0b6643b58ac44383a583d84f5"><code>ed44512</code></a> Bump golang.org/x/tools from 0.9.3 to 0.10.0 (<a href="https://redirect.github.com/google/ko/issues/1080">#1080</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/fcd95ec958cad910b4746245662506b1f974f40e"><code>fcd95ec</code></a> Bump slsa-framework/slsa-github-generator from 1.6.0 to 1.7.0</li> <li><a href="https://github.com/ko-build/ko/commit/974f09cdeacd7042c3db573366768ecbb32246a5"><code>974f09c</code></a> Bump goreleaser/goreleaser-action from 4.2.0 to 4.3.0</li> <li><a href="https://github.com/ko-build/ko/commit/893f6e877f7c352261c13e078bb8fc9709bb285c"><code>893f6e8</code></a> Bump aws-actions/configure-aws-credentials from 2.1.0 to 2.2.0</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.13.0...v0.14.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.13.0&new-version=0.14.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-26 18:56:50 +02:00
github.com/Microsoft/go-winio v0.6.1 // indirect
refactor: improving minio and docker tests (#3642) using ory/dockertest to simplify integration tests Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com>
2022-12-15 15:25:52 +02:00
github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 // indirect
chore(deps): bump github.com/goreleaser/nfpm/v2 from 2.35.2 to 2.35.3 (#4596) Bumps [github.com/goreleaser/nfpm/v2](https://github.com/goreleaser/nfpm) from 2.35.2 to 2.35.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/goreleaser/nfpm/releases">github.com/goreleaser/nfpm/v2's releases</a>.</em></p> <blockquote> <h2>v2.35.3</h2> <h2>Changelog</h2> <h3>Bug fixes</h3> <ul> <li>f8ccc9df94eb9a4c91c3a1c78d4759a65f156731: fix: file mode when type: tree (<a href="https://redirect.github.com/goreleaser/nfpm/issues/779">#779</a>) (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> <li>e1ebfdad10ef98fe6c9d424efe3f97d7b2322f04: fix: honor SOURCE_DATE_EPOCH for files (<a href="https://redirect.github.com/goreleaser/nfpm/issues/775">#775</a>) (<a href="https://github.com/osm"><code>@​osm</code></a>)</li> </ul> <h3>Dependency updates</h3> <ul> <li>9c48b79596993dd653087f91861794b7da6267e6: feat(deps): bump github.com/ProtonMail/go-crypto (<a href="https://redirect.github.com/goreleaser/nfpm/issues/771">#771</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li> <li>d7a5dc79573e4bf5d65c3f00d9cac81736f12597: feat(deps): bump github.com/cloudflare/circl from 1.3.3 to 1.3.7 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/765">#765</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li> <li>fbc55c56be14ac5de4207becb98c908c615dee7e: feat(deps): bump github.com/klauspost/compress from 1.17.4 to 1.17.5 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/774">#774</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li> <li>9bb94d758ce739fc27c19bbe04bf1c1d33ce3fa9: fix(deps): update go-rpmutils (<a href="https://redirect.github.com/goreleaser/nfpm/issues/764">#764</a>) (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> </ul> <h3>Build process updates</h3> <ul> <li>5ace4da2fd3162383a16218e2ef405dc2676bdfc: ci: update changelog (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> </ul> <h3>Other work</h3> <ul> <li>cd6b94108561b9ef1b06e1db8bfe9e3b3f643253: docs: update cmd docs (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> <li>672f8c6537228848062786d7ad2d2956f6808986: docs: update starchart url (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/goreleaser/nfpm/compare/v2.35.2...v2.35.3">https://github.com/goreleaser/nfpm/compare/v2.35.2...v2.35.3</a></p> <h2>Helping out</h2> <p>This release is only possible thanks to <strong>all</strong> the support of <strong>awesome people</strong>!</p> <p>Want to be one of them? You can <a href="https://goreleaser.com/sponsors/">sponsor</a> or <a href="https://goreleaser.com/contributing">contribute with code</a>.</p> <h2>Where to go next?</h2> <ul> <li>nFPM is a satellite project from GoReleaser. <a href="https://goreleaser.com">Check it out</a>!</li> <li>Find examples and commented usage of all options in our <a href="https://nfpm.goreleaser.com/">website</a>.</li> <li>Reach out on <a href="https://discord.gg/RGEBtg8vQ6">Discord</a> and <a href="https://twitter.com/goreleaser">Twitter</a>!</li> </ul> <p><!-- raw HTML omitted --><!-- raw HTML omitted --><!-- raw HTML omitted --></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/goreleaser/nfpm/commit/5ace4da2fd3162383a16218e2ef405dc2676bdfc"><code>5ace4da</code></a> ci: update changelog</li> <li><a href="https://github.com/goreleaser/nfpm/commit/f8ccc9df94eb9a4c91c3a1c78d4759a65f156731"><code>f8ccc9d</code></a> fix: file mode when type: tree (<a href="https://redirect.github.com/goreleaser/nfpm/issues/779">#779</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/48d1a19eb6c3b6fa7cf69295aa2e7bf8d2b2f520"><code>48d1a19</code></a> chore(deps): bump anchore/sbom-action from 0.15.6 to 0.15.7 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/778">#778</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/e1ebfdad10ef98fe6c9d424efe3f97d7b2322f04"><code>e1ebfda</code></a> fix: honor SOURCE_DATE_EPOCH for files (<a href="https://redirect.github.com/goreleaser/nfpm/issues/775">#775</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/25f6f2b7368585e0534b668ef76094f107e1fe4f"><code>25f6f2b</code></a> chore(deps): bump anchore/sbom-action from 0.15.5 to 0.15.6 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/776">#776</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/fbc55c56be14ac5de4207becb98c908c615dee7e"><code>fbc55c5</code></a> feat(deps): bump github.com/klauspost/compress from 1.17.4 to 1.17.5 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/774">#774</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/d83a6724284364757db5b61c7b2bd9bf0918264e"><code>d83a672</code></a> chore(deps): bump anchore/sbom-action from 0.15.4 to 0.15.5 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/773">#773</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/995a27a6fb5009a2a7e13e7747c9a7ef5a3e8098"><code>995a27a</code></a> chore(deps): bump anchore/sbom-action from 0.15.3 to 0.15.4 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/772">#772</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/9c48b79596993dd653087f91861794b7da6267e6"><code>9c48b79</code></a> feat(deps): bump github.com/ProtonMail/go-crypto (<a href="https://redirect.github.com/goreleaser/nfpm/issues/771">#771</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/e8832cc97b405ce3af1a6026f010d19e521bb1ff"><code>e8832cc</code></a> chore(deps): bump actions/cache from 3.3.3 to 4.0.0 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/770">#770</a>)</li> <li>Additional commits viewable in <a href="https://github.com/goreleaser/nfpm/compare/v2.35.2...v2.35.3">compare view</a></li> </ul> </details> <br /> <details> <summary>Most Recent Ignore Conditions Applied to This Pull Request</summary> | Dependency Name | Ignore Conditions | | --- | --- | | github.com/goreleaser/nfpm/v2 | [>= 2.24.a, < 2.25] | </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/goreleaser/nfpm/v2&package-manager=go_modules&previous-version=2.35.2&new-version=2.35.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) Dependabot will merge this PR once it's up-to-date and CI passes on it, as requested by @caarlos0. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-01 20:56:17 +02:00
github.com/ProtonMail/go-crypto v1.0.0 // indirect
feat: add ko support (#3653) continuing the PR by @developer-guy - [x] should be a publisher, as it does publish the images it builds every time - [x] `Default` method does not work - [x] the `fromConfig` thing should probably be on the defaults, too - [x] wire `--skip-ko` - [x] documentation - [x] more tests - [x] use same registry as docker tests does - [ ] see if we can make the log output match goreleaser's - [ ] ?? closes #2556 closes #3490 Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com> Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> Co-authored-by: actions-user <actions@github.com> Co-authored-by: Jason Hall <jason@chainguard.dev> Co-authored-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
2023-01-17 03:34:49 +02:00
github.com/alessio/shellescape v1.4.1 // indirect
feat(deps): bump github.com/sigstore/rekor from 1.0.1 to 1.1.1 (#3979) Bumps [github.com/sigstore/rekor](https://github.com/sigstore/rekor) from 1.0.1 to 1.1.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/rekor/releases">github.com/sigstore/rekor's releases</a>.</em></p> <blockquote> <h1>v1.1.1</h1> <h2>Functional Enhancements</h2> <ul> <li>Refactor Trillian client with exported methods (<a href="https://redirect.github.com/sigstore/rekor/issues/1454">#1454</a>)</li> <li>Switch to official redis-go client (<a href="https://redirect.github.com/sigstore/rekor/issues/1459">#1459</a>)</li> <li>Remove replace in go.mod (<a href="https://redirect.github.com/sigstore/rekor/issues/1444">#1444</a>)</li> <li>Add Rekor OID info. (<a href="https://redirect.github.com/sigstore/rekor/issues/1390">#1390</a>)</li> </ul> <h2>Quality Enhancements</h2> <ul> <li>remove legacy encrypted cosign key (<a href="https://redirect.github.com/sigstore/rekor/issues/1446">#1446</a>)</li> <li>swap cjson dependency (<a href="https://redirect.github.com/sigstore/rekor/issues/1441">#1441</a>)</li> <li>Update release readme (<a href="https://redirect.github.com/sigstore/rekor/issues/1456">#1456</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-2h5h-59f5-c5x9</li> </ul> <h2>Contributors</h2> <ul> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Carlos Tadeu Panato Junior</li> <li>Ceridwen Coghlan</li> <li>Hayden B</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/rekor/compare/v1.1.0...v1.1.1">https://github.com/sigstore/rekor/compare/v1.1.0...v1.1.1</a></p> <h1>v1.1.0</h1> <h2>Functional Enhancements</h2> <ul> <li>improve validation on intoto v0.0.2 type (<a href="https://redirect.github.com/sigstore/rekor/issues/1351">#1351</a>)</li> <li>add feature to limit HTTP request body length to process (<a href="https://redirect.github.com/sigstore/rekor/issues/1334">#1334</a>)</li> <li>add information about the file size limit (<a href="https://redirect.github.com/sigstore/rekor/issues/1313">#1313</a>)</li> <li>Add script to backfill Redis from Rekor (<a href="https://redirect.github.com/sigstore/rekor/issues/1163">#1163</a>)</li> <li>Feature: add search support for sha512 (<a href="https://redirect.github.com/sigstore/rekor/issues/1142">#1142</a>)</li> </ul> <h2>Quality Enhancements</h2> <ul> <li>fuzzing: refactor OSS-Fuzz build script (<a href="https://redirect.github.com/sigstore/rekor/issues/1377">#1377</a>)</li> <li>Update cloudbuild for cosign 2.0 (<a href="https://redirect.github.com/sigstore/rekor/issues/1375">#1375</a>)</li> <li>Tests - Additional sharding tests (<a href="https://redirect.github.com/sigstore/rekor/issues/1180">#1180</a>)</li> <li>jar type: add fuzzer for 3rd-party dep (<a href="https://redirect.github.com/sigstore/rekor/issues/1360">#1360</a>)</li> <li>update cosign to 2.0.0 and builder image and also cosign flags (<a href="https://redirect.github.com/sigstore/rekor/issues/1368">#1368</a>)</li> <li>fuzzing: move alpine utils to fuzz utils (<a href="https://redirect.github.com/sigstore/rekor/issues/1335">#1335</a>)</li> <li>fuzzing: add seed for alpine fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1342">#1342</a>)</li> <li>jar: add v001 fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1327">#1327</a>)</li> <li>fuzzing: open writer later in fuzz utils (<a href="https://redirect.github.com/sigstore/rekor/issues/1326">#1326</a>)</li> <li>fuzzing: remove tar operations in alpine fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1322">#1322</a>)</li> <li>alpine: add v001 fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1316">#1316</a>)</li> <li>hashedrekord: add v001 fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1315">#1315</a>)</li> <li>fuzzing: add call to IndexKeys in multiple fuzzers (<a href="https://redirect.github.com/sigstore/rekor/issues/1302">#1302</a>)</li> <li>fuzzing: improve cose fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1300">#1300</a>)</li> <li>fuzzing: improve fuzz utils (<a href="https://redirect.github.com/sigstore/rekor/issues/1298">#1298</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/rekor/blob/main/CHANGELOG.md">github.com/sigstore/rekor's changelog</a>.</em></p> <blockquote> <h1>v1.1.1</h1> <h2>Functional Enhancements</h2> <ul> <li>Refactor Trillian client with exported methods (<a href="https://redirect.github.com/sigstore/rekor/issues/1454">#1454</a>)</li> <li>Switch to official redis-go client (<a href="https://redirect.github.com/sigstore/rekor/issues/1459">#1459</a>)</li> <li>Remove replace in go.mod (<a href="https://redirect.github.com/sigstore/rekor/issues/1444">#1444</a>)</li> <li>Add Rekor OID info. (<a href="https://redirect.github.com/sigstore/rekor/issues/1390">#1390</a>)</li> </ul> <h2>Quality Enhancements</h2> <ul> <li>remove legacy encrypted cosign key (<a href="https://redirect.github.com/sigstore/rekor/issues/1446">#1446</a>)</li> <li>swap cjson dependency (<a href="https://redirect.github.com/sigstore/rekor/issues/1441">#1441</a>)</li> <li>Update release readme (<a href="https://redirect.github.com/sigstore/rekor/issues/1456">#1456</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-2h5h-59f5-c5x9</li> </ul> <h2>Contributors</h2> <ul> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Carlos Tadeu Panato Junior</li> <li>Ceridwen Coghlan</li> <li>Hayden B</li> </ul> <h1>v1.1.0</h1> <h2>Functional Enhancements</h2> <ul> <li>improve validation on intoto v0.0.2 type (<a href="https://redirect.github.com/sigstore/rekor/issues/1351">#1351</a>)</li> <li>add feature to limit HTTP request body length to process (<a href="https://redirect.github.com/sigstore/rekor/issues/1334">#1334</a>)</li> <li>add information about the file size limit (<a href="https://redirect.github.com/sigstore/rekor/issues/1313">#1313</a>)</li> <li>Add script to backfill Redis from Rekor (<a href="https://redirect.github.com/sigstore/rekor/issues/1163">#1163</a>)</li> <li>Feature: add search support for sha512 (<a href="https://redirect.github.com/sigstore/rekor/issues/1142">#1142</a>)</li> </ul> <h2>Quality Enhancements</h2> <ul> <li>fuzzing: refactor OSS-Fuzz build script (<a href="https://redirect.github.com/sigstore/rekor/issues/1377">#1377</a>)</li> <li>Update cloudbuild for cosign 2.0 (<a href="https://redirect.github.com/sigstore/rekor/issues/1375">#1375</a>)</li> <li>Tests - Additional sharding tests (<a href="https://redirect.github.com/sigstore/rekor/issues/1180">#1180</a>)</li> <li>jar type: add fuzzer for 3rd-party dep (<a href="https://redirect.github.com/sigstore/rekor/issues/1360">#1360</a>)</li> <li>update cosign to 2.0.0 and builder image and also cosign flags (<a href="https://redirect.github.com/sigstore/rekor/issues/1368">#1368</a>)</li> <li>fuzzing: move alpine utils to fuzz utils (<a href="https://redirect.github.com/sigstore/rekor/issues/1335">#1335</a>)</li> <li>fuzzing: add seed for alpine fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1342">#1342</a>)</li> <li>jar: add v001 fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1327">#1327</a>)</li> <li>fuzzing: open writer later in fuzz utils (<a href="https://redirect.github.com/sigstore/rekor/issues/1326">#1326</a>)</li> <li>fuzzing: remove tar operations in alpine fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1322">#1322</a>)</li> <li>alpine: add v001 fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1316">#1316</a>)</li> <li>hashedrekord: add v001 fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1315">#1315</a>)</li> <li>fuzzing: add call to IndexKeys in multiple fuzzers (<a href="https://redirect.github.com/sigstore/rekor/issues/1302">#1302</a>)</li> <li>fuzzing: improve cose fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1300">#1300</a>)</li> <li>fuzzing: improve fuzz utils (<a href="https://redirect.github.com/sigstore/rekor/issues/1298">#1298</a>)</li> <li>fuzzing: improve alpine fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1273">#1273</a>)</li> <li>fuzzing: go mod edit go-fuzz-headers (<a href="https://redirect.github.com/sigstore/rekor/issues/1272">#1272</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/rekor/commit/0c1914e5e955cb9f514e32b222cf61a13e91ab08"><code>0c1914e</code></a> update CHANGELOG for v1.1.1 (<a href="https://redirect.github.com/sigstore/rekor/issues/1462">#1462</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/cf42ace82667025fe128f7a50cf6b4cdff51cc48"><code>cf42ace</code></a> Merge pull request from GHSA-2h5h-59f5-c5x9</li> <li><a href="https://github.com/sigstore/rekor/commit/46ac0b224e673b969457597b15af2d125ae8c5c2"><code>46ac0b2</code></a> Refactor Trillian client with exported methods (<a href="https://redirect.github.com/sigstore/rekor/issues/1454">#1454</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/5d6e9723b1d251001906c5583b0fd6fe7e3a1cb3"><code>5d6e972</code></a> build(deps): bump github.com/redis/go-redis/v9 from 9.0.3 to 9.0.4 (<a href="https://redirect.github.com/sigstore/rekor/issues/1460">#1460</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/baa14ce4ebe621399ff8330dd8ddc4a6ca2e2533"><code>baa14ce</code></a> Switch to official redis-go client (<a href="https://redirect.github.com/sigstore/rekor/issues/1459">#1459</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/059e097a0b6856ff6ed79c96cba171df691eb3d8"><code>059e097</code></a> build(deps): bump github.com/go-playground/validator/v10 (<a href="https://redirect.github.com/sigstore/rekor/issues/1457">#1457</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/1f75c792567e6a4b2fa0ebb5e12fe500434d33b1"><code>1f75c79</code></a> Update release readme (<a href="https://redirect.github.com/sigstore/rekor/issues/1456">#1456</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/98163f336ce3db11d776c0eabc4c7bccda7612dd"><code>98163f3</code></a> build(deps): bump github/codeql-action from 2.3.1 to 2.3.2 (<a href="https://redirect.github.com/sigstore/rekor/issues/1455">#1455</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/24cb647106d74051ba70ce867b5c7319ad29e3b9"><code>24cb647</code></a> Remove replace in go.mod (<a href="https://redirect.github.com/sigstore/rekor/issues/1444">#1444</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/39bd69bc7c474ff07fef392ff139d0c01c2e116a"><code>39bd69b</code></a> Add Rekor OID info. (<a href="https://redirect.github.com/sigstore/rekor/issues/1390">#1390</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/rekor/compare/v1.0.1...v1.1.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/rekor&package-manager=go_modules&previous-version=1.0.1&new-version=1.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-05-04 04:11:29 +02:00
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
chore(deps): update aws-sdk-go Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>
2024-02-05 03:24:39 +02:00
github.com/aws/aws-sdk-go v1.50.10
fix(deps): bump gocloud.dev from 0.35.0 to 0.36.0 (#4506) Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.35.0 to 0.36.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-cloud/releases">gocloud.dev's releases</a>.</em></p> <blockquote> <h2>v0.36.0</h2> <p><strong>blob</strong></p> <ul> <li><strong>all</strong>: Allow disabling of <code>ContentType</code> auto-detection during writes.</li> </ul> <p><strong>pubsub</strong></p> <ul> <li><strong>azuresb</strong>: Added a new auth method to support Service principal/kubelet identity/Workload identity auth methods.</li> </ul> <p><strong>docstore</strong></p> <ul> <li><strong>all</strong>: Add in/not-in operators for Query.</li> <li><strong>gcpfirestore</strong>: Added a missing resource header when running query.</li> </ul> <p><strong>mysql</strong></p> <ul> <li>Pass TLS config directly to MySQL's config</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-cloud/commit/01064b751a87ca20722835090310a7034a9fc598"><code>01064b7</code></a> all: prerelease</li> <li><a href="https://github.com/google/go-cloud/commit/92114ef43337ed26acd851a050380d699bf036b6"><code>92114ef</code></a> mysql: pass TLS config directly to MySQL's config (<a href="https://redirect.github.com/google/go-cloud/issues/3348">#3348</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/97fe9d0425b25c43657f5676799c993e51cd39f0"><code>97fe9d0</code></a> docstore/all: Add in/not-in operators for Query</li> <li><a href="https://github.com/google/go-cloud/commit/4fe95eea2dfb0156514d0cb96fb12a8e0dd595c5"><code>4fe95ee</code></a> blob/all: Allow disabling of ContentType auto-detection during writes (<a href="https://redirect.github.com/google/go-cloud/issues/3371">#3371</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/1dbbbb3e6470abd60e1532af4278652d0a5cd908"><code>1dbbbb3</code></a> pubsub/azuresb: minor comments and fixes (<a href="https://redirect.github.com/google/go-cloud/issues/3370">#3370</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/20909842088ed5ddd1717473f32a9568515904f8"><code>2090984</code></a> all: update golang.org/x/crypto (<a href="https://redirect.github.com/google/go-cloud/issues/3369">#3369</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/ddc7b991019d4234928ba08ea211de3b8087abc2"><code>ddc7b99</code></a> pubsub/azuresb: new auth method to support Service principal/kubelet identit...</li> <li><a href="https://github.com/google/go-cloud/commit/c770de821742ef8c7dddf36b63625eae35899124"><code>c770de8</code></a> docstore/gcpfirestore: Add missing resource header when running query</li> <li><a href="https://github.com/google/go-cloud/commit/e86400ea404ee3bcd31b1253c5351071f3fc96a8"><code>e86400e</code></a> pubsub/awssnssqs: Remove hack for broken AWS error codes now that they've fix...</li> <li><a href="https://github.com/google/go-cloud/commit/8c8f558affc873a0f2abb1690b80e10f8028cff4"><code>8c8f558</code></a> all: postrelease (<a href="https://redirect.github.com/google/go-cloud/issues/3351">#3351</a>)</li> <li>See full diff in <a href="https://github.com/google/go-cloud/compare/v0.35.0...v0.36.0">compare view</a></li> </ul> </details> <br /> <details> <summary>Most Recent Ignore Conditions Applied to This Pull Request</summary> | Dependency Name | Ignore Conditions | | --- | --- | | gocloud.dev | [>= 0.25.a, < 0.26] | </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.35.0&new-version=0.36.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-06 17:49:45 +02:00
github.com/aws/aws-sdk-go-v2 v1.24.0 // indirect
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.5.4 // indirect
github.com/aws/aws-sdk-go-v2/config v1.26.1 // indirect
github.com/aws/aws-sdk-go-v2/credentials v1.16.12 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.10 // indirect
github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.15.7 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.9 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.9 // indirect
github.com/aws/aws-sdk-go-v2/internal/ini v1.7.2 // indirect
github.com/aws/aws-sdk-go-v2/internal/v4a v1.2.9 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/aws/aws-sdk-go-v2/service/ecr v1.20.2 // indirect
github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.18.2 // indirect
fix(deps): bump gocloud.dev from 0.35.0 to 0.36.0 (#4506) Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.35.0 to 0.36.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-cloud/releases">gocloud.dev's releases</a>.</em></p> <blockquote> <h2>v0.36.0</h2> <p><strong>blob</strong></p> <ul> <li><strong>all</strong>: Allow disabling of <code>ContentType</code> auto-detection during writes.</li> </ul> <p><strong>pubsub</strong></p> <ul> <li><strong>azuresb</strong>: Added a new auth method to support Service principal/kubelet identity/Workload identity auth methods.</li> </ul> <p><strong>docstore</strong></p> <ul> <li><strong>all</strong>: Add in/not-in operators for Query.</li> <li><strong>gcpfirestore</strong>: Added a missing resource header when running query.</li> </ul> <p><strong>mysql</strong></p> <ul> <li>Pass TLS config directly to MySQL's config</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-cloud/commit/01064b751a87ca20722835090310a7034a9fc598"><code>01064b7</code></a> all: prerelease</li> <li><a href="https://github.com/google/go-cloud/commit/92114ef43337ed26acd851a050380d699bf036b6"><code>92114ef</code></a> mysql: pass TLS config directly to MySQL's config (<a href="https://redirect.github.com/google/go-cloud/issues/3348">#3348</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/97fe9d0425b25c43657f5676799c993e51cd39f0"><code>97fe9d0</code></a> docstore/all: Add in/not-in operators for Query</li> <li><a href="https://github.com/google/go-cloud/commit/4fe95eea2dfb0156514d0cb96fb12a8e0dd595c5"><code>4fe95ee</code></a> blob/all: Allow disabling of ContentType auto-detection during writes (<a href="https://redirect.github.com/google/go-cloud/issues/3371">#3371</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/1dbbbb3e6470abd60e1532af4278652d0a5cd908"><code>1dbbbb3</code></a> pubsub/azuresb: minor comments and fixes (<a href="https://redirect.github.com/google/go-cloud/issues/3370">#3370</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/20909842088ed5ddd1717473f32a9568515904f8"><code>2090984</code></a> all: update golang.org/x/crypto (<a href="https://redirect.github.com/google/go-cloud/issues/3369">#3369</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/ddc7b991019d4234928ba08ea211de3b8087abc2"><code>ddc7b99</code></a> pubsub/azuresb: new auth method to support Service principal/kubelet identit...</li> <li><a href="https://github.com/google/go-cloud/commit/c770de821742ef8c7dddf36b63625eae35899124"><code>c770de8</code></a> docstore/gcpfirestore: Add missing resource header when running query</li> <li><a href="https://github.com/google/go-cloud/commit/e86400ea404ee3bcd31b1253c5351071f3fc96a8"><code>e86400e</code></a> pubsub/awssnssqs: Remove hack for broken AWS error codes now that they've fix...</li> <li><a href="https://github.com/google/go-cloud/commit/8c8f558affc873a0f2abb1690b80e10f8028cff4"><code>8c8f558</code></a> all: postrelease (<a href="https://redirect.github.com/google/go-cloud/issues/3351">#3351</a>)</li> <li>See full diff in <a href="https://github.com/google/go-cloud/compare/v0.35.0...v0.36.0">compare view</a></li> </ul> </details> <br /> <details> <summary>Most Recent Ignore Conditions Applied to This Pull Request</summary> | Dependency Name | Ignore Conditions | | --- | --- | | gocloud.dev | [>= 0.25.a, < 0.26] | </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.35.0&new-version=0.36.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-06 17:49:45 +02:00
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.2.9 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.9 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.16.9 // indirect
github.com/aws/aws-sdk-go-v2/service/kms v1.27.5 // indirect
github.com/aws/aws-sdk-go-v2/service/s3 v1.47.5 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.18.5 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.5 // indirect
github.com/aws/aws-sdk-go-v2/service/sts v1.26.5 // indirect
github.com/aws/smithy-go v1.19.0 // indirect
feat(deps): bump github.com/caarlos0/log from v0.2.1 to v0.2.2 (#3875) update caarlos0/log Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com>
2023-03-20 03:47:02 +02:00
github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
feat(deps): bump github.com/invopop/jsonschema from 0.8.0 to 0.9.0 Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>
2023-09-22 04:17:31 +02:00
github.com/bahlo/generic-list-go v0.2.0 // indirect
feat: add ko support (#3653) continuing the PR by @developer-guy - [x] should be a publisher, as it does publish the images it builds every time - [x] `Default` method does not work - [x] the `fromConfig` thing should probably be on the defaults, too - [x] wire `--skip-ko` - [x] documentation - [x] more tests - [x] use same registry as docker tests does - [ ] see if we can make the log output match goreleaser's - [ ] ?? closes #2556 closes #3490 Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com> Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> Co-authored-by: actions-user <actions@github.com> Co-authored-by: Jason Hall <jason@chainguard.dev> Co-authored-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
2023-01-17 03:34:49 +02:00
github.com/beorn7/perks v1.0.1 // indirect
feat: use go 1.17 (#2408) * feat: use go 1.17 Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * fix: go mod tidy Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * test: fix failing test Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * ci: increase lint timeout Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * ci: increase lint timeout Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com>
2021-08-25 01:49:11 +02:00
github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb // indirect
feat(deps): bump github.com/invopop/jsonschema from 0.8.0 to 0.9.0 Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>
2023-09-22 04:17:31 +02:00
github.com/buger/jsonparser v1.1.1 // indirect
feat: update deps Signed-off-by: Carlos A Becker <caarlos0@gmail.com>
2021-12-21 05:03:48 +02:00
github.com/cavaliergopher/cpio v1.0.1 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/cenkalti/backoff/v4 v4.2.1 // indirect
feat(deps): bump gocloud.dev from 0.28.0 to 0.29.0 (#3837) Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.28.0 to 0.29.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-cloud/releases">gocloud.dev's releases</a>.</em></p> <blockquote> <h2>v0.29.0</h2> <p><strong>BREAKING CHANGES</strong></p> <ul> <li>Updated to latest <code>azureblob</code>, which had some non-backward-compatible changes (again).</li> </ul> <p><strong>all</strong></p> <ul> <li>Defaulting to <code>go</code> version <code>1.2</code>.</li> <li><strong>aws</strong>: Added support for custom endpoints for AWS SDK v2.</li> <li><strong>gcp</strong>: Updated imports for <code>credentialspb</code>.</li> </ul> <p><strong>blob</strong></p> <ul> <li><strong>azureblob</strong>: Updated to latest (breaking change).</li> </ul> <p><strong>pubsub</strong></p> <ul> <li><strong>kafkapub</strong>: Fixed nil Options pointer dereference.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-cloud/commit/62397121ec57013e925de45ec6fb7a7bacbf5799"><code>6239712</code></a> all: prep for release (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3236">#3236</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/973ec8737135d7bf2e2c21975ed871526e38ef8a"><code>973ec87</code></a> all: prep for release (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3235">#3235</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/3348a6a4a0ccbcc4cc179866ea682d54ba3e0276"><code>3348a6a</code></a> aws: fix typo on awssdk=v2 docstring</li> <li><a href="https://github.com/google/go-cloud/commit/ec0a2bbc3f48f58b707fcad9e1926044efb242cb"><code>ec0a2bb</code></a> pubsub/rabbitpubsub: give rabbitmq more time to come up (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3233">#3233</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/082a4958948e4a36875570f6ee931ebfe950e29c"><code>082a495</code></a> docstore/gcpfirestore: update proto import (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3229">#3229</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/53ba9013f0a1240e7266b64a1c8f37ac891a84f8"><code>53ba901</code></a> pubsub/gcppubsub: update proto import (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3230">#3230</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/b3612581b153f8ecbf63590c9087e746b5df9f8e"><code>b361258</code></a> runtimevar/gcpsecretmanager: update proto import (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3231">#3231</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/e5235d85eb9a1674f26984a068fcd91f445ef620"><code>e5235d8</code></a> blob/gcsblob: update proto import (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3228">#3228</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/7cd8b2b9f63cb8b15c114ea64fbef28aed00f0cc"><code>7cd8b2b</code></a> secrets/gcpkms: update proto import (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3227">#3227</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/8cddf16323d2af04a4bdd9b58fb85d9b28a1abee"><code>8cddf16</code></a> all: update deps BREAKING_CHANGE_OK (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3225">#3225</a>)</li> <li>Additional commits viewable in <a href="https://github.com/google/go-cloud/compare/v0.28.0...v0.29.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.28.0&new-version=0.29.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-03-06 18:07:00 +02:00
github.com/cespare/xxhash/v2 v2.2.0 // indirect
feat(deps): bump github.com/cloudflare/circl from 1.3.5 to 1.3.7 (#4525)
2024-01-09 13:32:59 +02:00
github.com/cloudflare/circl v1.3.7 // indirect
refactor: improving minio and docker tests (#3642) using ory/dockertest to simplify integration tests Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com>
2022-12-15 15:25:52 +02:00
github.com/containerd/continuity v0.3.0 // indirect
feat(deps): bump github.com/google/go-containerregistry from 0.13.0 to 0.14.0 (#3878) Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.13.0 to 0.14.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-containerregistry/releases">github.com/google/go-containerregistry's releases</a>.</em></p> <blockquote> <h2>v0.14.0</h2> <h2>Changelog</h2> <ul> <li>9306ebad Allow crane edit to generate non-image artifacts (<a href="https://redirect.github.com/google/go-containerregistry/issues/1545">#1545</a>)</li> <li>de35f0f7 Allow setting Content-Type in crane edit manifest (<a href="https://redirect.github.com/google/go-containerregistry/issues/1551">#1551</a>)</li> <li>4b081f80 Avoid v1.Manifest in crane edit config (<a href="https://redirect.github.com/google/go-containerregistry/issues/1583">#1583</a>)</li> <li>1cfe1fc2 Bump aws-actions/configure-aws-credentials from 1.7.0 to 2.0.0 (<a href="https://redirect.github.com/google/go-containerregistry/issues/1593">#1593</a>)</li> <li>da1008fb Bump golangci/golangci-lint-action from 3.3.1 to 3.4.0 (<a href="https://redirect.github.com/google/go-containerregistry/issues/1548">#1548</a>)</li> <li>86be45fb Bump goreleaser/goreleaser-action from 4.1.0 to 4.1.1 (<a href="https://redirect.github.com/google/go-containerregistry/issues/1547">#1547</a>)</li> <li>62f183e5 Bump goreleaser/goreleaser-action from 4.1.1 to 4.2.0 (<a href="https://redirect.github.com/google/go-containerregistry/issues/1556">#1556</a>)</li> <li>1b8dc2ba Bump slsa-framework/slsa-github-generator from 1.2.2 to 1.5.0 (<a href="https://redirect.github.com/google/go-containerregistry/issues/1580">#1580</a>)</li> <li>11843ba2 Enforce proper sha256 usage (<a href="https://redirect.github.com/google/go-containerregistry/issues/1544">#1544</a>)</li> <li>2ceebaaf Implement crane index subcommand (<a href="https://redirect.github.com/google/go-containerregistry/issues/1561">#1561</a>)</li> <li>9f42e028 Set mediaType for empty.ImageIndex in RawManifest (<a href="https://redirect.github.com/google/go-containerregistry/issues/1562">#1562</a>)</li> <li>759b19f7 Support artifactType, for images whose config.mediaType is not a config (<a href="https://redirect.github.com/google/go-containerregistry/issues/1541">#1541</a>)</li> <li>b3c23b4c Support for OCI 1.1+ referrers via API (<a href="https://redirect.github.com/google/go-containerregistry/issues/1546">#1546</a>)</li> <li>061ee6bf Support for OCI 1.1+ referrers via fallback tag (<a href="https://redirect.github.com/google/go-containerregistry/issues/1543">#1543</a>)</li> <li>67703048 Update descriptor &quot;data&quot; field (when valid) during &quot;crane edit config&quot; (<a href="https://redirect.github.com/google/go-containerregistry/issues/1584">#1584</a>)</li> <li>76bac933 Update release.yml (<a href="https://redirect.github.com/google/go-containerregistry/issues/1540">#1540</a>)</li> <li>eb7d746c authn: also read mount secrets (<a href="https://redirect.github.com/google/go-containerregistry/issues/1560">#1560</a>)</li> <li>e94d4089 bump deps using ./hack/bump-deps.sh (<a href="https://redirect.github.com/google/go-containerregistry/issues/1592">#1592</a>)</li> <li>4e95ae2b crane: add --flatten for index append (<a href="https://redirect.github.com/google/go-containerregistry/issues/1566">#1566</a>)</li> <li>ff810c18 crane: add serve subcommand (<a href="https://redirect.github.com/google/go-containerregistry/issues/1586">#1586</a>)</li> <li>8ea5e0e8 crane: support --omit-digest-tags in crane ls (<a href="https://redirect.github.com/google/go-containerregistry/issues/1528">#1528</a>)</li> <li>824efc77 fix(mutate): also set timestamps only present in some formats (<a href="https://redirect.github.com/google/go-containerregistry/issues/1550">#1550</a>)</li> <li>e04520bc fix: Fix the crane release url and add more steps (<a href="https://redirect.github.com/google/go-containerregistry/issues/1532">#1532</a>)</li> <li>d8722327 hash: use generic instantiation (<a href="https://redirect.github.com/google/go-containerregistry/issues/1538">#1538</a>)</li> <li>57f010d2 replace manual slsa-verifier installation with action (<a href="https://redirect.github.com/google/go-containerregistry/issues/1585">#1585</a>)</li> <li>9cd098e3 skip tls verification if default transport is used with insecure option (<a href="https://redirect.github.com/google/go-containerregistry/issues/1559">#1559</a>)</li> <li>36249683 tarball: pass imageToTags (<a href="https://redirect.github.com/google/go-containerregistry/issues/1563">#1563</a>)</li> </ul> <h3>Container Images</h3> <p><a href="https://gcr.io/go-containerregistry/crane:v0.14.0">https://gcr.io/go-containerregistry/crane:v0.14.0</a> <a href="https://gcr.io/go-containerregistry/gcrane:v0.14.0">https://gcr.io/go-containerregistry/gcrane:v0.14.0</a></p> <p>For example:</p> <pre><code>docker pull gcr.io/go-containerregistry/crane:v0.14.0 docker pull gcr.io/go-containerregistry/gcrane:v0.14.0 </code></pre> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-containerregistry/commit/4b081f801f399fa293f23e42ba4c4ac6a6003f2c"><code>4b081f8</code></a> Avoid v1.Manifest in crane edit config (<a href="https://redirect.github.com/google/go-containerregistry/issues/1583">#1583</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/1cfe1fc25f233b40aa5d3b0edd572ed5c3f854c9"><code>1cfe1fc</code></a> Bump aws-actions/configure-aws-credentials from 1.7.0 to 2.0.0 (<a href="https://redirect.github.com/google/go-containerregistry/issues/1593">#1593</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/e94d40893b2d013992192f8a1a04fd1984fd24dc"><code>e94d408</code></a> bump deps using ./hack/bump-deps.sh (<a href="https://redirect.github.com/google/go-containerregistry/issues/1592">#1592</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/ff810c186c772e1056aa4081278ee84ee3fb565b"><code>ff810c1</code></a> crane: add serve subcommand (<a href="https://redirect.github.com/google/go-containerregistry/issues/1586">#1586</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/57f010d26af871587be87f5aed2550893d564a8c"><code>57f010d</code></a> replace manual slsa-verifier installation with action (<a href="https://redirect.github.com/google/go-containerregistry/issues/1585">#1585</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/67703048992e9b025adf1a7b08f3bb195636be33"><code>6770304</code></a> Update descriptor &quot;data&quot; field (when valid) during &quot;crane edit config&quot; (<a href="https://redirect.github.com/google/go-containerregistry/issues/1584">#1584</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/1b8dc2babc55fd72d274e8f470f00e9e5ba43f1b"><code>1b8dc2b</code></a> Bump slsa-framework/slsa-github-generator from 1.2.2 to 1.5.0 (<a href="https://redirect.github.com/google/go-containerregistry/issues/1580">#1580</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/8ea5e0e8f045d827389d13bde5ae8269630e2e2e"><code>8ea5e0e</code></a> crane: support --omit-digest-tags in crane ls (<a href="https://redirect.github.com/google/go-containerregistry/issues/1528">#1528</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/4e95ae2b72dd3b58fccb4ed579dbddf5c884822c"><code>4e95ae2</code></a> crane: add --flatten for index append (<a href="https://redirect.github.com/google/go-containerregistry/issues/1566">#1566</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/4a0e0af4bf958c0bfb17bdfac71c38204b930623"><code>4a0e0af</code></a> docs: Update crane installation and verification instructions (<a href="https://redirect.github.com/google/go-containerregistry/issues/1567">#1567</a>)</li> <li>Additional commits viewable in <a href="https://github.com/google/go-containerregistry/compare/v0.13.0...v0.14.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/go-containerregistry&package-manager=go_modules&previous-version=0.13.0&new-version=0.14.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-03-20 14:58:29 +02:00
github.com/containerd/stargz-snapshotter/estargz v0.14.3 // indirect
feat(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (#4410) Bumps [github.com/spf13/cobra](https://github.com/spf13/cobra) from 1.7.0 to 1.8.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/spf13/cobra/releases">github.com/spf13/cobra's releases</a>.</em></p> <blockquote> <h2>v1.8.0</h2> <h2>✨ Features</h2> <ul> <li>Support usage as plugin for tools like kubectl by <a href="https://github.com/nirs"><code>@​nirs</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2018">spf13/cobra#2018</a> - this means that programs that utilize a &quot;plugin-like&quot; structure have much better support and usage (like for completions, command paths, etc.)</li> <li>Move documentation sources to site/content by <a href="https://github.com/umarcor"><code>@​umarcor</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1428">spf13/cobra#1428</a></li> <li>Add 'one required flag' group by <a href="https://github.com/marevers"><code>@​marevers</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1952">spf13/cobra#1952</a> - this includes a new <code>MarkFlagsOneRequired</code> API for flags which can be used to mark a flag group as required and cause command failure if at least one is not used when invoked.</li> <li>Customizable error message prefix by <a href="https://github.com/5ouma"><code>@​5ouma</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2023">spf13/cobra#2023</a> - This adds the <code>SetErrPrefix</code> and <code>ErrPrefix</code> APIs on the <code>Command</code> struct to allow for setting a custom prefix for errors</li> <li>feat: add getters for flag completions by <a href="https://github.com/avirtopeanu-ionos"><code>@​avirtopeanu-ionos</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1943">spf13/cobra#1943</a></li> <li>Feature: allow running persistent run hooks of all parents by <a href="https://github.com/vkhoroz"><code>@​vkhoroz</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2044">spf13/cobra#2044</a></li> <li>Improve API to get flag completion function by <a href="https://github.com/marckhouzam"><code>@​marckhouzam</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2063">spf13/cobra#2063</a></li> </ul> <h2>🐛 Bug fixes</h2> <ul> <li>Fix typo in fish completions by <a href="https://github.com/twpayne"><code>@​twpayne</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1945">spf13/cobra#1945</a></li> <li>Fix grammar: 'allows to' by <a href="https://github.com/supertassu"><code>@​supertassu</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1978">spf13/cobra#1978</a></li> <li>powershell: escape variable with curly brackets by <a href="https://github.com/Luap99"><code>@​Luap99</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1960">spf13/cobra#1960</a></li> <li>Don't complete --help flag when flag parsing disabled by <a href="https://github.com/marckhouzam"><code>@​marckhouzam</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2061">spf13/cobra#2061</a></li> <li>Replace all non-alphanumerics in active help env var program prefix by <a href="https://github.com/scop"><code>@​scop</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1940">spf13/cobra#1940</a></li> </ul> <h2>🔧 Maintenance</h2> <ul> <li>build(deps): bump golangci/golangci-lint-action from 3.4.0 to 3.5.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1971">spf13/cobra#1971</a></li> <li>build(deps): bump golangci/golangci-lint-action from 3.5.0 to 3.6.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1976">spf13/cobra#1976</a></li> <li>build(deps): bump golangci/golangci-lint-action from 3.6.0 to 3.7.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2021">spf13/cobra#2021</a></li> <li>build(deps): bump actions/setup-go from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1934">spf13/cobra#1934</a></li> <li>build(deps): bump github.com/cpuguy83/go-md2man/v2 from 2.0.2 to 2.0.3 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2047">spf13/cobra#2047</a></li> <li>build(deps): bump actions/checkout from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2028">spf13/cobra#2028</a></li> <li>command: temporarily disable G602 due to <a href="https://redirect.github.com/securego/gosec/issues/1005">securego/gosec#1005</a> by <a href="https://github.com/umarcor"><code>@​umarcor</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2022">spf13/cobra#2022</a></li> </ul> <h2>🧪 Testing &amp; CI/CD</h2> <ul> <li>test: make fish_completions_test more robust by <a href="https://github.com/branchvincent"><code>@​branchvincent</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1980">spf13/cobra#1980</a></li> <li>golangci: enable 'unused' and disable deprecated replaced by it by <a href="https://github.com/umarcor"><code>@​umarcor</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1983">spf13/cobra#1983</a></li> <li>cleanup: minor corrections to unit tests by <a href="https://github.com/JunNishimura"><code>@​JunNishimura</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2003">spf13/cobra#2003</a></li> <li>ci: test golang 1.21 by <a href="https://github.com/nunoadrego"><code>@​nunoadrego</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2024">spf13/cobra#2024</a></li> <li>Fix linter errors by <a href="https://github.com/marckhouzam"><code>@​marckhouzam</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2052">spf13/cobra#2052</a></li> <li>Add tests for flag completion registration by <a href="https://github.com/marckhouzam"><code>@​marckhouzam</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2053">spf13/cobra#2053</a></li> </ul> <h2>✏️ Documentation</h2> <ul> <li>doc: fix typo, Deperecated -&gt; Deprecated by <a href="https://github.com/callthingsoff"><code>@​callthingsoff</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2000">spf13/cobra#2000</a></li> <li>Add notes to doc about the execution condition of *PreRun and *PostRun functions by <a href="https://github.com/haoming29"><code>@​haoming29</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2041">spf13/cobra#2041</a></li> </ul> <hr /> <p>Thank you everyone who contributed to this release and all your hard work! Cobra and this community would never be possible without all of you!!!! 🐍</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/spf13/cobra/compare/v1.7.0...v1.8.0">https://github.com/spf13/cobra/compare/v1.7.0...v1.8.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/spf13/cobra/commit/a0a6ae020bb3899ff0276067863e50523f897370"><code>a0a6ae0</code></a> Improve API to get flag completion function (<a href="https://redirect.github.com/spf13/cobra/issues/2063">#2063</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/890302a35f578311404a462b3cdd404f34db3720"><code>890302a</code></a> Support usage as plugin for tools like kubectl (<a href="https://redirect.github.com/spf13/cobra/issues/2018">#2018</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/48cea5c87b5299b68c3f5b7f2c67ea948717276f"><code>48cea5c</code></a> build(deps): bump actions/checkout from 3 to 4 (<a href="https://redirect.github.com/spf13/cobra/issues/2028">#2028</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/22953d88453ec9343b4a78b9d67400a3326f3138"><code>22953d8</code></a> Replace all non-alphanumerics in active help env var program prefix (<a href="https://redirect.github.com/spf13/cobra/issues/1940">#1940</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/00b68a1c260eaf2b9bcb10a3178d36cec81548ca"><code>00b68a1</code></a> Add tests for flag completion registration (<a href="https://redirect.github.com/spf13/cobra/issues/2053">#2053</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/b711e8760b73c6aa1b4aa1bef3a26da5926f175d"><code>b711e87</code></a> Don't complete --help flag when flag parsing disabled (<a href="https://redirect.github.com/spf13/cobra/issues/2061">#2061</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/8b1eba47616566fc4d258a93da48d5d8741865f0"><code>8b1eba4</code></a> Fix linter errors (<a href="https://redirect.github.com/spf13/cobra/issues/2052">#2052</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/4cafa37bc4bb85633b4245aa118280fe5a9edcd5"><code>4cafa37</code></a> Allow running persistent run hooks of all parents (<a href="https://redirect.github.com/spf13/cobra/issues/2044">#2044</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/5c962a221e70fd6b12296e5d7075f28b422f98b2"><code>5c962a2</code></a> build(deps): bump github.com/cpuguy83/go-md2man/v2 from 2.0.2 to 2.0.3 (<a href="https://redirect.github.com/spf13/cobra/issues/2047">#2047</a>)</li> <li><a href="https://github.com/spf13/cobra/commit/efe8fa3e4453e41d6419b26c9769a51e42825632"><code>efe8fa3</code></a> build(deps): bump actions/setup-go from 3 to 4 (<a href="https://redirect.github.com/spf13/cobra/issues/1934">#1934</a>)</li> <li>Additional commits viewable in <a href="https://github.com/spf13/cobra/compare/v1.7.0...v1.8.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/spf13/cobra&package-manager=go_modules&previous-version=1.7.0&new-version=1.8.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) Dependabot will merge this PR once CI passes on it, as requested by @caarlos0. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-06 17:44:28 +02:00
github.com/cpuguy83/go-md2man/v2 v2.0.3 // indirect
feat(deps): bump github.com/google/ko from 0.14.1 to 0.15.0 (#4373) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.14.1 to 0.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.15.0</h2> <h2>What's Changed</h2> <ul> <li>implement dumb cache for images by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1102">ko-build/ko#1102</a></li> <li>fixed typo in configuration.md by <a href="https://github.com/samlaf"><code>@​samlaf</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li>pkg/commands: fix dropped errors by <a href="https://github.com/alrs"><code>@​alrs</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li>ci: add govulncheck by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1110">ko-build/ko#1110</a></li> <li>chore: remove refs to deprecated io/ioutil by <a href="https://github.com/testwill"><code>@​testwill</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li>Update install docs to install ko using Scoop by <a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> <li>include go build output in build error by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1127">ko-build/ko#1127</a></li> <li>Use go1.21, clean up ci and drop go1.19 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1137">ko-build/ko#1137</a></li> <li>Update e2e.yaml by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1141">ko-build/ko#1141</a></li> <li>handle newfound lint errors by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1142">ko-build/ko#1142</a></li> <li>fix test broken by lint fix by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1143">ko-build/ko#1143</a></li> <li>Bump actions/checkout from 3.6.0 to 4.0.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1136">ko-build/ko#1136</a></li> <li>fix env var for go env by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1140">ko-build/ko#1140</a></li> <li>docs: add docs for TF and Lambda by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1139">ko-build/ko#1139</a></li> <li>docs: add Lambda and TF pages to sidebar by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1144">ko-build/ko#1144</a></li> <li>include example using go packages by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1145">ko-build/ko#1145</a></li> <li>fix the release workflow and install instructions by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1150">ko-build/ko#1150</a></li> <li>update missing places that was using go1.20 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1163">ko-build/ko#1163</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/samlaf"><code>@​samlaf</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li><a href="https://github.com/alrs"><code>@​alrs</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li><a href="https://github.com/testwill"><code>@​testwill</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li><a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0">https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/31035ad2026bfbafaa4f009baefe72463af1b3a7"><code>31035ad</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1164">#1164</a> from ko-build/dependabot/go_modules/golang.org/x/net...</li> <li><a href="https://github.com/ko-build/ko/commit/ba952fd091f9d27ee5c136e842b5e94dd715100c"><code>ba952fd</code></a> Bump golang.org/x/net from 0.16.0 to 0.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/277f5d74353950c8663fc04b7546f66e57bd6aaf"><code>277f5d7</code></a> update missing places that was using go1.20 (<a href="https://redirect.github.com/google/ko/issues/1163">#1163</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/b8b3b21f8348d7cab863fe1b4eaa47dfc47632da"><code>b8b3b21</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1162">#1162</a> from ko-build/dependabot/go_modules/github.com/googl...</li> <li><a href="https://github.com/ko-build/ko/commit/4890ab2887b653d3c340de4d119bfd17b703f182"><code>4890ab2</code></a> Bump github.com/google/go-cmp from 0.5.9 to 0.6.0</li> <li><a href="https://github.com/ko-build/ko/commit/30b62aee3faf6866cee6513ea7eb13f5a27cd7ca"><code>30b62ae</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1161">#1161</a> from ko-build/dependabot/go_modules/github.com/spf13...</li> <li><a href="https://github.com/ko-build/ko/commit/449bcb61926cb3e3bcf191e8ca53fad5ab3a4e3c"><code>449bcb6</code></a> Bump github.com/spf13/viper from 1.16.0 to 1.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/c543dd83cc75cd849fb95637ea29e3c7c66d6f87"><code>c543dd8</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1160">#1160</a> from ko-build/dependabot/go_modules/golang.org/x/too...</li> <li><a href="https://github.com/ko-build/ko/commit/c1ae5f5ce4fe058830f24827c853d4db39a95250"><code>c1ae5f5</code></a> Bump golang.org/x/tools from 0.13.0 to 0.14.0</li> <li><a href="https://github.com/ko-build/ko/commit/e50d2fd5ff0ec88ac837ffe6f6c2f122eb54b9f8"><code>e50d2fd</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1159">#1159</a> from ko-build/dependabot/go_modules/golang.org/x/syn...</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.14.1...v0.15.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.14.1&new-version=0.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-17 17:47:47 +02:00
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
feat(deps): bump github.com/invopop/jsonschema from 0.8.0 to 0.9.0 Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>
2023-09-22 04:17:31 +02:00
github.com/davidmz/go-pageant v1.0.2 // indirect
feat: update deps Signed-off-by: Carlos A Becker <caarlos0@gmail.com>
2021-12-21 05:03:48 +02:00
github.com/dghubble/sling v1.4.0 // indirect
feat: add ko support (#3653) continuing the PR by @developer-guy - [x] should be a publisher, as it does publish the images it builds every time - [x] `Default` method does not work - [x] the `fromConfig` thing should probably be on the defaults, too - [x] wire `--skip-ko` - [x] documentation - [x] more tests - [x] use same registry as docker tests does - [ ] see if we can make the log output match goreleaser's - [ ] ?? closes #2556 closes #3490 Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com> Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> Co-authored-by: actions-user <actions@github.com> Co-authored-by: Jason Hall <jason@chainguard.dev> Co-authored-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
2023-01-17 03:34:49 +02:00
github.com/dimchansky/utfbom v1.1.1 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/docker/cli v24.0.7+incompatible // indirect
github.com/docker/distribution v2.8.3+incompatible // indirect
feat(deps): bump github.com/docker/docker Bumps [github.com/docker/docker](https://github.com/docker/docker) from 24.0.6+incompatible to 24.0.7+incompatible. - [Release notes](https://github.com/docker/docker/releases) - [Commits](https://github.com/docker/docker/compare/v24.0.6...v24.0.7) --- updated-dependencies: - dependency-name: github.com/docker/docker dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
2023-10-30 17:52:07 +02:00
github.com/docker/docker v24.0.7+incompatible // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/docker/docker-credential-helpers v0.8.0 // indirect
refactor: improving minio and docker tests (#3642) using ory/dockertest to simplify integration tests Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com>
2022-12-15 15:25:52 +02:00
github.com/docker/go-connections v0.4.0 // indirect
feat: add ko support (#3653) continuing the PR by @developer-guy - [x] should be a publisher, as it does publish the images it builds every time - [x] `Default` method does not work - [x] the `fromConfig` thing should probably be on the defaults, too - [x] wire `--skip-ko` - [x] documentation - [x] more tests - [x] use same registry as docker tests does - [ ] see if we can make the log output match goreleaser's - [ ] ?? closes #2556 closes #3490 Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com> Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> Co-authored-by: actions-user <actions@github.com> Co-authored-by: Jason Hall <jason@chainguard.dev> Co-authored-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
2023-01-17 03:34:49 +02:00
github.com/docker/go-metrics v0.0.1 // indirect
feat(deps): bump github.com/xanzy/go-gitlab from 0.82.0 to 0.83.0 (#3955) Bumps [github.com/xanzy/go-gitlab](https://github.com/xanzy/go-gitlab) from 0.82.0 to 0.83.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/xanzy/go-gitlab/commit/9560b5bd1bf3fd02fe427e15c91ec7bfaecd51f9"><code>9560b5b</code></a> Merge pull request <a href="https://redirect.github.com/xanzy/go-gitlab/issues/1704">#1704</a> from cloudquery/master</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/5950ae0e1896664199337f50283cf936a3c30968"><code>5950ae0</code></a> newline</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/ad8af11b52f3d4cfe9f6590ee02c62e0c12eecb1"><code>ad8af11</code></a> ignore vendor</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/36a098515464b46cb9683ea684ff92d536951179"><code>36a0985</code></a> Merge pull request <a href="https://redirect.github.com/xanzy/go-gitlab/issues/1702">#1702</a> from cloudquery/feat/group_members/email</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/cc52c831af098fc64fe67675ba14d8d29e4d5536"><code>cc52c83</code></a> fix typo</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/12342600079f984cbcdb2fb7d2caebea6b05099b"><code>1234260</code></a> revert gitignore change</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/931c6625bcfa56e1279fede9b7b162940489518b"><code>931c662</code></a> Add <code>email</code> field to <code>GroupMember</code></li> <li><a href="https://github.com/xanzy/go-gitlab/commit/195295c1d3bb9f9ab754a2bcf0791d1c9d02ef31"><code>195295c</code></a> Merge pull request <a href="https://redirect.github.com/xanzy/go-gitlab/issues/1689">#1689</a> from smit-modi/issue-comment-event</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/f459ed34e662c06b6fed5dd248d67261d125b2bf"><code>f459ed3</code></a> Fixed order</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/e7028c3cfed78024bb6f0dfb96a468c6e5fa3413"><code>e7028c3</code></a> Merge pull request <a href="https://redirect.github.com/xanzy/go-gitlab/issues/1670">#1670</a> from skast96/feature/project_templates</li> <li>Additional commits viewable in <a href="https://github.com/xanzy/go-gitlab/compare/v0.82.0...v0.83.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/xanzy/go-gitlab&package-manager=go_modules&previous-version=0.82.0&new-version=0.83.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-04-24 13:47:21 +02:00
github.com/docker/go-units v0.5.0
feat: improve output (#3966) - log keys will be ordered as intended instead of sorted - paths always relative to cwd --------- Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>
2023-05-02 14:06:35 +02:00
github.com/elliotchance/orderedmap/v2 v2.2.0 // indirect
feat(deps): bump github.com/goreleaser/nfpm/v2 from 2.30.1 to 2.31.0 (#4144) latest and greatest
2023-06-26 18:20:47 +02:00
github.com/emirpasic/gods v1.18.1 // indirect
feat: add ko support (#3653) continuing the PR by @developer-guy - [x] should be a publisher, as it does publish the images it builds every time - [x] `Default` method does not work - [x] the `fromConfig` thing should probably be on the defaults, too - [x] wire `--skip-ko` - [x] documentation - [x] more tests - [x] use same registry as docker tests does - [ ] see if we can make the log output match goreleaser's - [ ] ?? closes #2556 closes #3490 Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com> Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> Co-authored-by: actions-user <actions@github.com> Co-authored-by: Jason Hall <jason@chainguard.dev> Co-authored-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
2023-01-17 03:34:49 +02:00
github.com/evanphx/json-patch/v5 v5.6.0 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/fsnotify/fsnotify v1.7.0 // indirect
feat(deps): bump github.com/invopop/jsonschema from 0.8.0 to 0.9.0 Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>
2023-09-22 04:17:31 +02:00
github.com/go-fed/httpsig v1.1.0 // indirect
feat(deps): bump github.com/goreleaser/nfpm/v2 from 2.30.1 to 2.31.0 (#4144) latest and greatest
2023-06-26 18:20:47 +02:00
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
sec(deps): bump github.com/go-git/go-git/v5 from 5.7.0 to 5.11.0 (#4505) Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.7.0 to 5.11.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's releases</a>.</em></p> <blockquote> <h2>v5.11.0</h2> <h2>What's Changed</h2> <ul> <li>git: validate reference names (<a href="https://redirect.github.com/go-git/go-git/issues/929">#929</a>) by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/950">go-git/go-git#950</a></li> <li>git: stop iterating at oldest shallow when pulling. Fixes <a href="https://redirect.github.com/go-git/go-git/issues/305">#305</a> by <a href="https://github.com/dhoizner"><code>@​dhoizner</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/939">go-git/go-git#939</a></li> <li>plumbing: object, enable renames in getFileStatsFromFilePatches by <a href="https://github.com/djmoch"><code>@​djmoch</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/941">go-git/go-git#941</a></li> <li>storage: filesystem, Add option to set a specific FS for alternates by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/953">go-git/go-git#953</a></li> <li>Align worktree validation with upstream and remove build warnings by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/958">go-git/go-git#958</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/dhoizner"><code>@​dhoizner</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/939">go-git/go-git#939</a></li> <li><a href="https://github.com/djmoch"><code>@​djmoch</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/941">go-git/go-git#941</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.10.1...v5.11.0">https://github.com/go-git/go-git/compare/v5.10.1...v5.11.0</a></p> <h2>v5.10.1</h2> <h2>What's Changed</h2> <ul> <li>Worktree, ignore ModeSocket files by <a href="https://github.com/steiler"><code>@​steiler</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/930">go-git/go-git#930</a></li> <li>git: add tracer package by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/916">go-git/go-git#916</a></li> <li>remote: Flip clause for fast-forward only check by <a href="https://github.com/adityasaky"><code>@​adityasaky</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/875">go-git/go-git#875</a></li> <li>plumbing: transport/ssh, Fix nil pointer dereference caused when an unreachable proxy server is set. Fixes <a href="https://redirect.github.com/go-git/go-git/issues/900">#900</a> by <a href="https://github.com/anandf"><code>@​anandf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/901">go-git/go-git#901</a></li> <li>plumbing: uppload-server-info, implement upload-server-info by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/896">go-git/go-git#896</a></li> <li>plumbing: optimise memory consumption for filesystem storage by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/799">go-git/go-git#799</a></li> <li>plumbing: format/packfile, Refactor patch delta by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/908">go-git/go-git#908</a></li> <li>plumbing: fix empty uploadpack request error by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/932">go-git/go-git#932</a></li> <li>plumbing: transport/git, Improve tests error message by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/752">go-git/go-git#752</a></li> <li>plumbing: format/pktline, Respect pktline error-line errors by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/936">go-git/go-git#936</a></li> <li>utils: remove ioutil.Pipe and use std library io.Pipe by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/922">go-git/go-git#922</a></li> <li>utils: move trace to utils by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/931">go-git/go-git#931</a></li> <li>cli: separate go module for cli by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/914">go-git/go-git#914</a></li> <li>build: bump github.com/google/go-cmp from 0.5.9 to 0.6.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/887">go-git/go-git#887</a></li> <li>build: bump actions/setup-go from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/891">go-git/go-git#891</a></li> <li>build: bump github.com/skeema/knownhosts from 1.2.0 to 1.2.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/888">go-git/go-git#888</a></li> <li>build: bump actions/checkout from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/890">go-git/go-git#890</a></li> <li>build: bump golang.org/x/sys from 0.13.0 to 0.14.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/907">go-git/go-git#907</a></li> <li>build: bump golang.org/x/text from 0.13.0 to 0.14.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/906">go-git/go-git#906</a></li> <li>build: bump golang.org/x/crypto from 0.14.0 to 0.15.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/917">go-git/go-git#917</a></li> <li>build: bump golang.org/x/net from 0.17.0 to 0.18.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/918">go-git/go-git#918</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/anandf"><code>@​anandf</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/901">go-git/go-git#901</a></li> <li><a href="https://github.com/steiler"><code>@​steiler</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/930">go-git/go-git#930</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.10.0...v5.10.1">https://github.com/go-git/go-git/compare/v5.10.0...v5.10.1</a></p> <h2>v5.10.0</h2> <h2>What's Changed</h2> <ul> <li>PlainInitOptions.Bare and allow using InitOptions with PlainInitWithOptions by <a href="https://github.com/ThinkChaos"><code>@​ThinkChaos</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/782">go-git/go-git#782</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-git/go-git/commit/5d08d3bd94c65a3b6c25c6fba6907d12b0dac4ca"><code>5d08d3b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/958">#958</a> from pjbgf/workval</li> <li><a href="https://github.com/go-git/go-git/commit/5bd1d8f4abcfbf1345a1e5a5ec9a96121f3746dc"><code>5bd1d8f</code></a> build: Ensure checkout is the first operation</li> <li><a href="https://github.com/go-git/go-git/commit/b2c19824771bbcbb21abb51abb319c1a610aa6b3"><code>b2c1982</code></a> git: worktree, Align validation with upstream rules</li> <li><a href="https://github.com/go-git/go-git/commit/cec7da63ca0412fce55a0bf0715b7ba44a41eaa2"><code>cec7da6</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/953">#953</a> from pjbgf/alternates</li> <li><a href="https://github.com/go-git/go-git/commit/8b47ceb1aa854f3c3bfa1c347157a04324fcd51e"><code>8b47ceb</code></a> storage: filesystem, Add option to set a specific FS for alternates</li> <li><a href="https://github.com/go-git/go-git/commit/4f614891047bae5d0f7a253f014175505b9821d7"><code>4f61489</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/941">#941</a> from djmoch/filestats-rename</li> <li><a href="https://github.com/go-git/go-git/commit/ae552ce0bf32cddb689727c4c9fa6bf4d3bd6499"><code>ae552ce</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/939">#939</a> from dhoizner/fix-pull-after-shallow</li> <li><a href="https://github.com/go-git/go-git/commit/cc1895b905ebadb09504d88444ff05932fa6e928"><code>cc1895b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/950">#950</a> from aymanbagabas/validate-ref</li> <li><a href="https://github.com/go-git/go-git/commit/de1d5a5978b9599ca3dacd58bbf699e4bb4cf6bd"><code>de1d5a5</code></a> git: validate reference names</li> <li><a href="https://github.com/go-git/go-git/commit/d87110b492c94d99ebdaea732b23a54b7efba94b"><code>d87110b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/948">#948</a> from go-git/dependabot/go_modules/cli/go-git/github.c...</li> <li>Additional commits viewable in <a href="https://github.com/go-git/go-git/compare/v5.7.0...v5.11.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.7.0&new-version=5.11.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-28 14:46:28 +02:00
github.com/go-git/go-billy/v5 v5.5.0 // indirect
github.com/go-git/go-git/v5 v5.11.0 // indirect
feat: add ko support (#3653) continuing the PR by @developer-guy - [x] should be a publisher, as it does publish the images it builds every time - [x] `Default` method does not work - [x] the `fromConfig` thing should probably be on the defaults, too - [x] wire `--skip-ko` - [x] documentation - [x] more tests - [x] use same registry as docker tests does - [ ] see if we can make the log output match goreleaser's - [ ] ?? closes #2556 closes #3490 Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com> Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> Co-authored-by: actions-user <actions@github.com> Co-authored-by: Jason Hall <jason@chainguard.dev> Co-authored-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
2023-01-17 03:34:49 +02:00
github.com/go-openapi/analysis v0.21.4 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/go-openapi/errors v0.20.4 // indirect
github.com/go-openapi/jsonpointer v0.20.0 // indirect
feat(deps): bump gocloud.dev from 0.29.0 to 0.30.0 (#4129) Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.29.0 to 0.30.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-cloud/releases">gocloud.dev's releases</a>.</em></p> <blockquote> <h2>v0.30.0</h2> <p><strong>blob</strong></p> <ul> <li><strong>all</strong>: Add <code>Upload</code> and <code>Download</code> methods that may be more efficient for some drivers.</li> <li><strong>s3blob</strong>: Add support for per-request <code>s3v2.Options</code>.</li> <li><strong>s3blob</strong>: Stop escaping second <code>/</code> in <code>//</code>; it's no longer necessary.</li> </ul> <p><strong>pubsub</strong></p> <ul> <li><strong>gcppubsub</strong>: Make it possible to configure <code>max_send_batch_size</code>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-cloud/commit/d2d5bedb50683e2a6b893b75aafc193eca2715db"><code>d2d5bed</code></a> all: prep for release (<a href="https://redirect.github.com/google/go-cloud/issues/3263">#3263</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/c2e172b5a78def74973f7f3a8ece7c0bd6967432"><code>c2e172b</code></a> all: update dependencies (<a href="https://redirect.github.com/google/go-cloud/issues/3262">#3262</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/098177a48cae1bebfc90f88ed43d319444cab804"><code>098177a</code></a> blob/s3blob: fix the 'awssdk' argument examples</li> <li><a href="https://github.com/google/go-cloud/commit/2e4fad43f0b2606833b6a0de3e18628c70e11398"><code>2e4fad4</code></a> all: remove refs to deprecated xerrors</li> <li><a href="https://github.com/google/go-cloud/commit/1db413f1b3c4e344618b36401ba7e6dca3892929"><code>1db413f</code></a> pubsub/gcppubsub: make it possible to configure max_send_batch_size</li> <li><a href="https://github.com/google/go-cloud/commit/0c8428bf433136e7a4d96de0841f6373c6eacb53"><code>0c8428b</code></a> blob: Add Upload and Download methods that may be more efficient for some dri...</li> <li><a href="https://github.com/google/go-cloud/commit/54c71241a56f4c89eb64f587e5dc55667eaa40a3"><code>54c7124</code></a> all: cleanup duplicate import statements</li> <li><a href="https://github.com/google/go-cloud/commit/28b1328ae4fee939441faa5ee2e4eeba74c88ce7"><code>28b1328</code></a> all: minor code simplifications for returned boolean expressions</li> <li><a href="https://github.com/google/go-cloud/commit/2a407f5e6a71951384531445e25c58194f235062"><code>2a407f5</code></a> blob/gcsblob: Refresh goldens</li> <li><a href="https://github.com/google/go-cloud/commit/0cc16c8ae11e47028df24c4973debd6c56d29729"><code>0cc16c8</code></a> all: update goldens (<a href="https://redirect.github.com/google/go-cloud/issues/3252">#3252</a>)</li> <li>Additional commits viewable in <a href="https://github.com/google/go-cloud/compare/v0.29.0...v0.30.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.29.0&new-version=0.30.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-20 14:04:08 +02:00
github.com/go-openapi/jsonreference v0.20.2 // indirect
feat: add ko support (#3653) continuing the PR by @developer-guy - [x] should be a publisher, as it does publish the images it builds every time - [x] `Default` method does not work - [x] the `fromConfig` thing should probably be on the defaults, too - [x] wire `--skip-ko` - [x] documentation - [x] more tests - [x] use same registry as docker tests does - [ ] see if we can make the log output match goreleaser's - [ ] ?? closes #2556 closes #3490 Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com> Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> Co-authored-by: actions-user <actions@github.com> Co-authored-by: Jason Hall <jason@chainguard.dev> Co-authored-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
2023-01-17 03:34:49 +02:00
github.com/go-openapi/loads v0.21.2 // indirect
feat(deps): bump github.com/sigstore/rekor from 1.0.1 to 1.1.1 (#3979) Bumps [github.com/sigstore/rekor](https://github.com/sigstore/rekor) from 1.0.1 to 1.1.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/rekor/releases">github.com/sigstore/rekor's releases</a>.</em></p> <blockquote> <h1>v1.1.1</h1> <h2>Functional Enhancements</h2> <ul> <li>Refactor Trillian client with exported methods (<a href="https://redirect.github.com/sigstore/rekor/issues/1454">#1454</a>)</li> <li>Switch to official redis-go client (<a href="https://redirect.github.com/sigstore/rekor/issues/1459">#1459</a>)</li> <li>Remove replace in go.mod (<a href="https://redirect.github.com/sigstore/rekor/issues/1444">#1444</a>)</li> <li>Add Rekor OID info. (<a href="https://redirect.github.com/sigstore/rekor/issues/1390">#1390</a>)</li> </ul> <h2>Quality Enhancements</h2> <ul> <li>remove legacy encrypted cosign key (<a href="https://redirect.github.com/sigstore/rekor/issues/1446">#1446</a>)</li> <li>swap cjson dependency (<a href="https://redirect.github.com/sigstore/rekor/issues/1441">#1441</a>)</li> <li>Update release readme (<a href="https://redirect.github.com/sigstore/rekor/issues/1456">#1456</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-2h5h-59f5-c5x9</li> </ul> <h2>Contributors</h2> <ul> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Carlos Tadeu Panato Junior</li> <li>Ceridwen Coghlan</li> <li>Hayden B</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/rekor/compare/v1.1.0...v1.1.1">https://github.com/sigstore/rekor/compare/v1.1.0...v1.1.1</a></p> <h1>v1.1.0</h1> <h2>Functional Enhancements</h2> <ul> <li>improve validation on intoto v0.0.2 type (<a href="https://redirect.github.com/sigstore/rekor/issues/1351">#1351</a>)</li> <li>add feature to limit HTTP request body length to process (<a href="https://redirect.github.com/sigstore/rekor/issues/1334">#1334</a>)</li> <li>add information about the file size limit (<a href="https://redirect.github.com/sigstore/rekor/issues/1313">#1313</a>)</li> <li>Add script to backfill Redis from Rekor (<a href="https://redirect.github.com/sigstore/rekor/issues/1163">#1163</a>)</li> <li>Feature: add search support for sha512 (<a href="https://redirect.github.com/sigstore/rekor/issues/1142">#1142</a>)</li> </ul> <h2>Quality Enhancements</h2> <ul> <li>fuzzing: refactor OSS-Fuzz build script (<a href="https://redirect.github.com/sigstore/rekor/issues/1377">#1377</a>)</li> <li>Update cloudbuild for cosign 2.0 (<a href="https://redirect.github.com/sigstore/rekor/issues/1375">#1375</a>)</li> <li>Tests - Additional sharding tests (<a href="https://redirect.github.com/sigstore/rekor/issues/1180">#1180</a>)</li> <li>jar type: add fuzzer for 3rd-party dep (<a href="https://redirect.github.com/sigstore/rekor/issues/1360">#1360</a>)</li> <li>update cosign to 2.0.0 and builder image and also cosign flags (<a href="https://redirect.github.com/sigstore/rekor/issues/1368">#1368</a>)</li> <li>fuzzing: move alpine utils to fuzz utils (<a href="https://redirect.github.com/sigstore/rekor/issues/1335">#1335</a>)</li> <li>fuzzing: add seed for alpine fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1342">#1342</a>)</li> <li>jar: add v001 fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1327">#1327</a>)</li> <li>fuzzing: open writer later in fuzz utils (<a href="https://redirect.github.com/sigstore/rekor/issues/1326">#1326</a>)</li> <li>fuzzing: remove tar operations in alpine fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1322">#1322</a>)</li> <li>alpine: add v001 fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1316">#1316</a>)</li> <li>hashedrekord: add v001 fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1315">#1315</a>)</li> <li>fuzzing: add call to IndexKeys in multiple fuzzers (<a href="https://redirect.github.com/sigstore/rekor/issues/1302">#1302</a>)</li> <li>fuzzing: improve cose fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1300">#1300</a>)</li> <li>fuzzing: improve fuzz utils (<a href="https://redirect.github.com/sigstore/rekor/issues/1298">#1298</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/rekor/blob/main/CHANGELOG.md">github.com/sigstore/rekor's changelog</a>.</em></p> <blockquote> <h1>v1.1.1</h1> <h2>Functional Enhancements</h2> <ul> <li>Refactor Trillian client with exported methods (<a href="https://redirect.github.com/sigstore/rekor/issues/1454">#1454</a>)</li> <li>Switch to official redis-go client (<a href="https://redirect.github.com/sigstore/rekor/issues/1459">#1459</a>)</li> <li>Remove replace in go.mod (<a href="https://redirect.github.com/sigstore/rekor/issues/1444">#1444</a>)</li> <li>Add Rekor OID info. (<a href="https://redirect.github.com/sigstore/rekor/issues/1390">#1390</a>)</li> </ul> <h2>Quality Enhancements</h2> <ul> <li>remove legacy encrypted cosign key (<a href="https://redirect.github.com/sigstore/rekor/issues/1446">#1446</a>)</li> <li>swap cjson dependency (<a href="https://redirect.github.com/sigstore/rekor/issues/1441">#1441</a>)</li> <li>Update release readme (<a href="https://redirect.github.com/sigstore/rekor/issues/1456">#1456</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-2h5h-59f5-c5x9</li> </ul> <h2>Contributors</h2> <ul> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Carlos Tadeu Panato Junior</li> <li>Ceridwen Coghlan</li> <li>Hayden B</li> </ul> <h1>v1.1.0</h1> <h2>Functional Enhancements</h2> <ul> <li>improve validation on intoto v0.0.2 type (<a href="https://redirect.github.com/sigstore/rekor/issues/1351">#1351</a>)</li> <li>add feature to limit HTTP request body length to process (<a href="https://redirect.github.com/sigstore/rekor/issues/1334">#1334</a>)</li> <li>add information about the file size limit (<a href="https://redirect.github.com/sigstore/rekor/issues/1313">#1313</a>)</li> <li>Add script to backfill Redis from Rekor (<a href="https://redirect.github.com/sigstore/rekor/issues/1163">#1163</a>)</li> <li>Feature: add search support for sha512 (<a href="https://redirect.github.com/sigstore/rekor/issues/1142">#1142</a>)</li> </ul> <h2>Quality Enhancements</h2> <ul> <li>fuzzing: refactor OSS-Fuzz build script (<a href="https://redirect.github.com/sigstore/rekor/issues/1377">#1377</a>)</li> <li>Update cloudbuild for cosign 2.0 (<a href="https://redirect.github.com/sigstore/rekor/issues/1375">#1375</a>)</li> <li>Tests - Additional sharding tests (<a href="https://redirect.github.com/sigstore/rekor/issues/1180">#1180</a>)</li> <li>jar type: add fuzzer for 3rd-party dep (<a href="https://redirect.github.com/sigstore/rekor/issues/1360">#1360</a>)</li> <li>update cosign to 2.0.0 and builder image and also cosign flags (<a href="https://redirect.github.com/sigstore/rekor/issues/1368">#1368</a>)</li> <li>fuzzing: move alpine utils to fuzz utils (<a href="https://redirect.github.com/sigstore/rekor/issues/1335">#1335</a>)</li> <li>fuzzing: add seed for alpine fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1342">#1342</a>)</li> <li>jar: add v001 fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1327">#1327</a>)</li> <li>fuzzing: open writer later in fuzz utils (<a href="https://redirect.github.com/sigstore/rekor/issues/1326">#1326</a>)</li> <li>fuzzing: remove tar operations in alpine fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1322">#1322</a>)</li> <li>alpine: add v001 fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1316">#1316</a>)</li> <li>hashedrekord: add v001 fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1315">#1315</a>)</li> <li>fuzzing: add call to IndexKeys in multiple fuzzers (<a href="https://redirect.github.com/sigstore/rekor/issues/1302">#1302</a>)</li> <li>fuzzing: improve cose fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1300">#1300</a>)</li> <li>fuzzing: improve fuzz utils (<a href="https://redirect.github.com/sigstore/rekor/issues/1298">#1298</a>)</li> <li>fuzzing: improve alpine fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1273">#1273</a>)</li> <li>fuzzing: go mod edit go-fuzz-headers (<a href="https://redirect.github.com/sigstore/rekor/issues/1272">#1272</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/rekor/commit/0c1914e5e955cb9f514e32b222cf61a13e91ab08"><code>0c1914e</code></a> update CHANGELOG for v1.1.1 (<a href="https://redirect.github.com/sigstore/rekor/issues/1462">#1462</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/cf42ace82667025fe128f7a50cf6b4cdff51cc48"><code>cf42ace</code></a> Merge pull request from GHSA-2h5h-59f5-c5x9</li> <li><a href="https://github.com/sigstore/rekor/commit/46ac0b224e673b969457597b15af2d125ae8c5c2"><code>46ac0b2</code></a> Refactor Trillian client with exported methods (<a href="https://redirect.github.com/sigstore/rekor/issues/1454">#1454</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/5d6e9723b1d251001906c5583b0fd6fe7e3a1cb3"><code>5d6e972</code></a> build(deps): bump github.com/redis/go-redis/v9 from 9.0.3 to 9.0.4 (<a href="https://redirect.github.com/sigstore/rekor/issues/1460">#1460</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/baa14ce4ebe621399ff8330dd8ddc4a6ca2e2533"><code>baa14ce</code></a> Switch to official redis-go client (<a href="https://redirect.github.com/sigstore/rekor/issues/1459">#1459</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/059e097a0b6856ff6ed79c96cba171df691eb3d8"><code>059e097</code></a> build(deps): bump github.com/go-playground/validator/v10 (<a href="https://redirect.github.com/sigstore/rekor/issues/1457">#1457</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/1f75c792567e6a4b2fa0ebb5e12fe500434d33b1"><code>1f75c79</code></a> Update release readme (<a href="https://redirect.github.com/sigstore/rekor/issues/1456">#1456</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/98163f336ce3db11d776c0eabc4c7bccda7612dd"><code>98163f3</code></a> build(deps): bump github/codeql-action from 2.3.1 to 2.3.2 (<a href="https://redirect.github.com/sigstore/rekor/issues/1455">#1455</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/24cb647106d74051ba70ce867b5c7319ad29e3b9"><code>24cb647</code></a> Remove replace in go.mod (<a href="https://redirect.github.com/sigstore/rekor/issues/1444">#1444</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/39bd69bc7c474ff07fef392ff139d0c01c2e116a"><code>39bd69b</code></a> Add Rekor OID info. (<a href="https://redirect.github.com/sigstore/rekor/issues/1390">#1390</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/rekor/compare/v1.0.1...v1.1.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/rekor&package-manager=go_modules&previous-version=1.0.1&new-version=1.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-05-04 04:11:29 +02:00
github.com/go-openapi/runtime v0.26.0 // indirect
github.com/go-openapi/spec v0.20.9 // indirect
github.com/go-openapi/strfmt v0.21.7 // indirect
feat(deps): bump github.com/google/ko from 0.14.1 to 0.15.0 (#4373) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.14.1 to 0.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.15.0</h2> <h2>What's Changed</h2> <ul> <li>implement dumb cache for images by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1102">ko-build/ko#1102</a></li> <li>fixed typo in configuration.md by <a href="https://github.com/samlaf"><code>@​samlaf</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li>pkg/commands: fix dropped errors by <a href="https://github.com/alrs"><code>@​alrs</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li>ci: add govulncheck by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1110">ko-build/ko#1110</a></li> <li>chore: remove refs to deprecated io/ioutil by <a href="https://github.com/testwill"><code>@​testwill</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li>Update install docs to install ko using Scoop by <a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> <li>include go build output in build error by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1127">ko-build/ko#1127</a></li> <li>Use go1.21, clean up ci and drop go1.19 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1137">ko-build/ko#1137</a></li> <li>Update e2e.yaml by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1141">ko-build/ko#1141</a></li> <li>handle newfound lint errors by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1142">ko-build/ko#1142</a></li> <li>fix test broken by lint fix by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1143">ko-build/ko#1143</a></li> <li>Bump actions/checkout from 3.6.0 to 4.0.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1136">ko-build/ko#1136</a></li> <li>fix env var for go env by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1140">ko-build/ko#1140</a></li> <li>docs: add docs for TF and Lambda by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1139">ko-build/ko#1139</a></li> <li>docs: add Lambda and TF pages to sidebar by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1144">ko-build/ko#1144</a></li> <li>include example using go packages by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1145">ko-build/ko#1145</a></li> <li>fix the release workflow and install instructions by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1150">ko-build/ko#1150</a></li> <li>update missing places that was using go1.20 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1163">ko-build/ko#1163</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/samlaf"><code>@​samlaf</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li><a href="https://github.com/alrs"><code>@​alrs</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li><a href="https://github.com/testwill"><code>@​testwill</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li><a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0">https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/31035ad2026bfbafaa4f009baefe72463af1b3a7"><code>31035ad</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1164">#1164</a> from ko-build/dependabot/go_modules/golang.org/x/net...</li> <li><a href="https://github.com/ko-build/ko/commit/ba952fd091f9d27ee5c136e842b5e94dd715100c"><code>ba952fd</code></a> Bump golang.org/x/net from 0.16.0 to 0.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/277f5d74353950c8663fc04b7546f66e57bd6aaf"><code>277f5d7</code></a> update missing places that was using go1.20 (<a href="https://redirect.github.com/google/ko/issues/1163">#1163</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/b8b3b21f8348d7cab863fe1b4eaa47dfc47632da"><code>b8b3b21</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1162">#1162</a> from ko-build/dependabot/go_modules/github.com/googl...</li> <li><a href="https://github.com/ko-build/ko/commit/4890ab2887b653d3c340de4d119bfd17b703f182"><code>4890ab2</code></a> Bump github.com/google/go-cmp from 0.5.9 to 0.6.0</li> <li><a href="https://github.com/ko-build/ko/commit/30b62aee3faf6866cee6513ea7eb13f5a27cd7ca"><code>30b62ae</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1161">#1161</a> from ko-build/dependabot/go_modules/github.com/spf13...</li> <li><a href="https://github.com/ko-build/ko/commit/449bcb61926cb3e3bcf191e8ca53fad5ab3a4e3c"><code>449bcb6</code></a> Bump github.com/spf13/viper from 1.16.0 to 1.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/c543dd83cc75cd849fb95637ea29e3c7c66d6f87"><code>c543dd8</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1160">#1160</a> from ko-build/dependabot/go_modules/golang.org/x/too...</li> <li><a href="https://github.com/ko-build/ko/commit/c1ae5f5ce4fe058830f24827c853d4db39a95250"><code>c1ae5f5</code></a> Bump golang.org/x/tools from 0.13.0 to 0.14.0</li> <li><a href="https://github.com/ko-build/ko/commit/e50d2fd5ff0ec88ac837ffe6f6c2f122eb54b9f8"><code>e50d2fd</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1159">#1159</a> from ko-build/dependabot/go_modules/golang.org/x/syn...</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.14.1...v0.15.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.14.1&new-version=0.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-17 17:47:47 +02:00
github.com/go-openapi/swag v0.22.4 // indirect
feat(deps): bump github.com/sigstore/rekor from 1.0.1 to 1.1.1 (#3979) Bumps [github.com/sigstore/rekor](https://github.com/sigstore/rekor) from 1.0.1 to 1.1.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/rekor/releases">github.com/sigstore/rekor's releases</a>.</em></p> <blockquote> <h1>v1.1.1</h1> <h2>Functional Enhancements</h2> <ul> <li>Refactor Trillian client with exported methods (<a href="https://redirect.github.com/sigstore/rekor/issues/1454">#1454</a>)</li> <li>Switch to official redis-go client (<a href="https://redirect.github.com/sigstore/rekor/issues/1459">#1459</a>)</li> <li>Remove replace in go.mod (<a href="https://redirect.github.com/sigstore/rekor/issues/1444">#1444</a>)</li> <li>Add Rekor OID info. (<a href="https://redirect.github.com/sigstore/rekor/issues/1390">#1390</a>)</li> </ul> <h2>Quality Enhancements</h2> <ul> <li>remove legacy encrypted cosign key (<a href="https://redirect.github.com/sigstore/rekor/issues/1446">#1446</a>)</li> <li>swap cjson dependency (<a href="https://redirect.github.com/sigstore/rekor/issues/1441">#1441</a>)</li> <li>Update release readme (<a href="https://redirect.github.com/sigstore/rekor/issues/1456">#1456</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-2h5h-59f5-c5x9</li> </ul> <h2>Contributors</h2> <ul> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Carlos Tadeu Panato Junior</li> <li>Ceridwen Coghlan</li> <li>Hayden B</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/rekor/compare/v1.1.0...v1.1.1">https://github.com/sigstore/rekor/compare/v1.1.0...v1.1.1</a></p> <h1>v1.1.0</h1> <h2>Functional Enhancements</h2> <ul> <li>improve validation on intoto v0.0.2 type (<a href="https://redirect.github.com/sigstore/rekor/issues/1351">#1351</a>)</li> <li>add feature to limit HTTP request body length to process (<a href="https://redirect.github.com/sigstore/rekor/issues/1334">#1334</a>)</li> <li>add information about the file size limit (<a href="https://redirect.github.com/sigstore/rekor/issues/1313">#1313</a>)</li> <li>Add script to backfill Redis from Rekor (<a href="https://redirect.github.com/sigstore/rekor/issues/1163">#1163</a>)</li> <li>Feature: add search support for sha512 (<a href="https://redirect.github.com/sigstore/rekor/issues/1142">#1142</a>)</li> </ul> <h2>Quality Enhancements</h2> <ul> <li>fuzzing: refactor OSS-Fuzz build script (<a href="https://redirect.github.com/sigstore/rekor/issues/1377">#1377</a>)</li> <li>Update cloudbuild for cosign 2.0 (<a href="https://redirect.github.com/sigstore/rekor/issues/1375">#1375</a>)</li> <li>Tests - Additional sharding tests (<a href="https://redirect.github.com/sigstore/rekor/issues/1180">#1180</a>)</li> <li>jar type: add fuzzer for 3rd-party dep (<a href="https://redirect.github.com/sigstore/rekor/issues/1360">#1360</a>)</li> <li>update cosign to 2.0.0 and builder image and also cosign flags (<a href="https://redirect.github.com/sigstore/rekor/issues/1368">#1368</a>)</li> <li>fuzzing: move alpine utils to fuzz utils (<a href="https://redirect.github.com/sigstore/rekor/issues/1335">#1335</a>)</li> <li>fuzzing: add seed for alpine fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1342">#1342</a>)</li> <li>jar: add v001 fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1327">#1327</a>)</li> <li>fuzzing: open writer later in fuzz utils (<a href="https://redirect.github.com/sigstore/rekor/issues/1326">#1326</a>)</li> <li>fuzzing: remove tar operations in alpine fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1322">#1322</a>)</li> <li>alpine: add v001 fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1316">#1316</a>)</li> <li>hashedrekord: add v001 fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1315">#1315</a>)</li> <li>fuzzing: add call to IndexKeys in multiple fuzzers (<a href="https://redirect.github.com/sigstore/rekor/issues/1302">#1302</a>)</li> <li>fuzzing: improve cose fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1300">#1300</a>)</li> <li>fuzzing: improve fuzz utils (<a href="https://redirect.github.com/sigstore/rekor/issues/1298">#1298</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/rekor/blob/main/CHANGELOG.md">github.com/sigstore/rekor's changelog</a>.</em></p> <blockquote> <h1>v1.1.1</h1> <h2>Functional Enhancements</h2> <ul> <li>Refactor Trillian client with exported methods (<a href="https://redirect.github.com/sigstore/rekor/issues/1454">#1454</a>)</li> <li>Switch to official redis-go client (<a href="https://redirect.github.com/sigstore/rekor/issues/1459">#1459</a>)</li> <li>Remove replace in go.mod (<a href="https://redirect.github.com/sigstore/rekor/issues/1444">#1444</a>)</li> <li>Add Rekor OID info. (<a href="https://redirect.github.com/sigstore/rekor/issues/1390">#1390</a>)</li> </ul> <h2>Quality Enhancements</h2> <ul> <li>remove legacy encrypted cosign key (<a href="https://redirect.github.com/sigstore/rekor/issues/1446">#1446</a>)</li> <li>swap cjson dependency (<a href="https://redirect.github.com/sigstore/rekor/issues/1441">#1441</a>)</li> <li>Update release readme (<a href="https://redirect.github.com/sigstore/rekor/issues/1456">#1456</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-2h5h-59f5-c5x9</li> </ul> <h2>Contributors</h2> <ul> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Carlos Tadeu Panato Junior</li> <li>Ceridwen Coghlan</li> <li>Hayden B</li> </ul> <h1>v1.1.0</h1> <h2>Functional Enhancements</h2> <ul> <li>improve validation on intoto v0.0.2 type (<a href="https://redirect.github.com/sigstore/rekor/issues/1351">#1351</a>)</li> <li>add feature to limit HTTP request body length to process (<a href="https://redirect.github.com/sigstore/rekor/issues/1334">#1334</a>)</li> <li>add information about the file size limit (<a href="https://redirect.github.com/sigstore/rekor/issues/1313">#1313</a>)</li> <li>Add script to backfill Redis from Rekor (<a href="https://redirect.github.com/sigstore/rekor/issues/1163">#1163</a>)</li> <li>Feature: add search support for sha512 (<a href="https://redirect.github.com/sigstore/rekor/issues/1142">#1142</a>)</li> </ul> <h2>Quality Enhancements</h2> <ul> <li>fuzzing: refactor OSS-Fuzz build script (<a href="https://redirect.github.com/sigstore/rekor/issues/1377">#1377</a>)</li> <li>Update cloudbuild for cosign 2.0 (<a href="https://redirect.github.com/sigstore/rekor/issues/1375">#1375</a>)</li> <li>Tests - Additional sharding tests (<a href="https://redirect.github.com/sigstore/rekor/issues/1180">#1180</a>)</li> <li>jar type: add fuzzer for 3rd-party dep (<a href="https://redirect.github.com/sigstore/rekor/issues/1360">#1360</a>)</li> <li>update cosign to 2.0.0 and builder image and also cosign flags (<a href="https://redirect.github.com/sigstore/rekor/issues/1368">#1368</a>)</li> <li>fuzzing: move alpine utils to fuzz utils (<a href="https://redirect.github.com/sigstore/rekor/issues/1335">#1335</a>)</li> <li>fuzzing: add seed for alpine fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1342">#1342</a>)</li> <li>jar: add v001 fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1327">#1327</a>)</li> <li>fuzzing: open writer later in fuzz utils (<a href="https://redirect.github.com/sigstore/rekor/issues/1326">#1326</a>)</li> <li>fuzzing: remove tar operations in alpine fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1322">#1322</a>)</li> <li>alpine: add v001 fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1316">#1316</a>)</li> <li>hashedrekord: add v001 fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1315">#1315</a>)</li> <li>fuzzing: add call to IndexKeys in multiple fuzzers (<a href="https://redirect.github.com/sigstore/rekor/issues/1302">#1302</a>)</li> <li>fuzzing: improve cose fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1300">#1300</a>)</li> <li>fuzzing: improve fuzz utils (<a href="https://redirect.github.com/sigstore/rekor/issues/1298">#1298</a>)</li> <li>fuzzing: improve alpine fuzzer (<a href="https://redirect.github.com/sigstore/rekor/issues/1273">#1273</a>)</li> <li>fuzzing: go mod edit go-fuzz-headers (<a href="https://redirect.github.com/sigstore/rekor/issues/1272">#1272</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/rekor/commit/0c1914e5e955cb9f514e32b222cf61a13e91ab08"><code>0c1914e</code></a> update CHANGELOG for v1.1.1 (<a href="https://redirect.github.com/sigstore/rekor/issues/1462">#1462</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/cf42ace82667025fe128f7a50cf6b4cdff51cc48"><code>cf42ace</code></a> Merge pull request from GHSA-2h5h-59f5-c5x9</li> <li><a href="https://github.com/sigstore/rekor/commit/46ac0b224e673b969457597b15af2d125ae8c5c2"><code>46ac0b2</code></a> Refactor Trillian client with exported methods (<a href="https://redirect.github.com/sigstore/rekor/issues/1454">#1454</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/5d6e9723b1d251001906c5583b0fd6fe7e3a1cb3"><code>5d6e972</code></a> build(deps): bump github.com/redis/go-redis/v9 from 9.0.3 to 9.0.4 (<a href="https://redirect.github.com/sigstore/rekor/issues/1460">#1460</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/baa14ce4ebe621399ff8330dd8ddc4a6ca2e2533"><code>baa14ce</code></a> Switch to official redis-go client (<a href="https://redirect.github.com/sigstore/rekor/issues/1459">#1459</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/059e097a0b6856ff6ed79c96cba171df691eb3d8"><code>059e097</code></a> build(deps): bump github.com/go-playground/validator/v10 (<a href="https://redirect.github.com/sigstore/rekor/issues/1457">#1457</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/1f75c792567e6a4b2fa0ebb5e12fe500434d33b1"><code>1f75c79</code></a> Update release readme (<a href="https://redirect.github.com/sigstore/rekor/issues/1456">#1456</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/98163f336ce3db11d776c0eabc4c7bccda7612dd"><code>98163f3</code></a> build(deps): bump github/codeql-action from 2.3.1 to 2.3.2 (<a href="https://redirect.github.com/sigstore/rekor/issues/1455">#1455</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/24cb647106d74051ba70ce867b5c7319ad29e3b9"><code>24cb647</code></a> Remove replace in go.mod (<a href="https://redirect.github.com/sigstore/rekor/issues/1444">#1444</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/39bd69bc7c474ff07fef392ff139d0c01c2e116a"><code>39bd69b</code></a> Add Rekor OID info. (<a href="https://redirect.github.com/sigstore/rekor/issues/1390">#1390</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/rekor/compare/v1.0.1...v1.1.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/rekor&package-manager=go_modules&previous-version=1.0.1&new-version=1.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-05-04 04:11:29 +02:00
github.com/go-openapi/validate v0.22.1 // indirect
feat: use go 1.17 (#2408) * feat: use go 1.17 Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * fix: go mod tidy Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * test: fix failing test Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * ci: increase lint timeout Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * ci: increase lint timeout Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com>
2021-08-25 01:49:11 +02:00
github.com/gobwas/glob v0.2.3 // indirect
refactor: improving minio and docker tests (#3642) using ory/dockertest to simplify integration tests Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com>
2022-12-15 15:25:52 +02:00
github.com/gogo/protobuf v1.3.2 // indirect
feat(deps): bump github.com/sigstore/rekor from 1.1.1 to 1.2.0 (#4044) Bumps [github.com/sigstore/rekor](https://github.com/sigstore/rekor) from 1.1.1 to 1.2.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/rekor/blob/main/CHANGELOG.md">github.com/sigstore/rekor's changelog</a>.</em></p> <blockquote> <h1>v1.2.0</h1> <h2>Functional Enhancements</h2> <ul> <li>add client method to generate TLE struct (<a href="https://redirect.github.com/sigstore/rekor/issues/1498">#1498</a>)</li> <li>add dsse type (<a href="https://redirect.github.com/sigstore/rekor/issues/1487">#1487</a>)</li> <li>support other KMS providers (AWS, Azure, Hashicorp) in addition to GCP (<a href="https://redirect.github.com/sigstore/rekor/issues/1488">#1488</a>)</li> <li>Add concurrency to backfill-redis (<a href="https://redirect.github.com/sigstore/rekor/issues/1504">#1504</a>)</li> <li>omit informational message if machine-parseable output has been requested (<a href="https://redirect.github.com/sigstore/rekor/issues/1486">#1486</a>)</li> <li>Publish stable checkpoint periodically to Redis (<a href="https://redirect.github.com/sigstore/rekor/issues/1461">#1461</a>)</li> <li>Add intoto v0.0.2 to backfill script (<a href="https://redirect.github.com/sigstore/rekor/issues/1500">#1500</a>)</li> <li>add new method to test insertability of proposed entries into log (<a href="https://redirect.github.com/sigstore/rekor/issues/1410">#1410</a>)</li> </ul> <h2>Quality Enhancements</h2> <ul> <li>use t.Skip() in fuzzers (<a href="https://redirect.github.com/sigstore/rekor/issues/1506">#1506</a>)</li> <li>improve fuzzing coverage (<a href="https://redirect.github.com/sigstore/rekor/issues/1499">#1499</a>)</li> <li>Remove watcher script (<a href="https://redirect.github.com/sigstore/rekor/issues/1484">#1484</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-frqx-jfcm-6jjr</li> <li>Remove requirement of PayloadHash for intoto 0.0.1 (<a href="https://redirect.github.com/sigstore/rekor/issues/1490">#1490</a>)</li> <li>fix lint errors, bump linter up to 1.52 (<a href="https://redirect.github.com/sigstore/rekor/issues/1485">#1485</a>)</li> <li>Remove dependencies from pkg/util (<a href="https://redirect.github.com/sigstore/rekor/issues/1469">#1469</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>Bob Callaway</li> <li>Carlos Tadeu Panato Junior</li> <li>Ceridwen Coghlan</li> <li>Cody Soyland</li> <li>Hayden B</li> <li>Miloslav Trmač</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/rekor/commit/20a995116b1548b79e62ba0ad9c29800387e8641"><code>20a9951</code></a> update for v1.2.0 (<a href="https://redirect.github.com/sigstore/rekor/issues/1507">#1507</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/140c5add105179e5ffd9e3e114fd1b6b93aebbd4"><code>140c5ad</code></a> Merge pull request from GHSA-frqx-jfcm-6jjr</li> <li><a href="https://github.com/sigstore/rekor/commit/85bb2bc7a35dcc94cd94e18984711806f437dcb6"><code>85bb2bc</code></a> use t.Skip() in fuzzers (<a href="https://redirect.github.com/sigstore/rekor/issues/1506">#1506</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/3adca0d2528699d2ff93bf78babef8b5cac46122"><code>3adca0d</code></a> Add concurrency to backfill-redis (<a href="https://redirect.github.com/sigstore/rekor/issues/1504">#1504</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/795a23619d5db1c9625a71f776474033c6712b56"><code>795a236</code></a> add client method to generate TLE struct (<a href="https://redirect.github.com/sigstore/rekor/issues/1498">#1498</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/161a796f91d7255443aa6ce98e7981e6926762f0"><code>161a796</code></a> build(deps): bump github/codeql-action from 2.3.3 to 2.3.4 (<a href="https://redirect.github.com/sigstore/rekor/issues/1505">#1505</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/35c4489abcff256298f1bc9f7caaf5a946750dac"><code>35c4489</code></a> add dsse type (<a href="https://redirect.github.com/sigstore/rekor/issues/1487">#1487</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/d318e2bf433d398d95923f3509557777a2fe5abb"><code>d318e2b</code></a> support other KMS providers (AWS, Azure, Hashicorp) in addition to GCP (<a href="https://redirect.github.com/sigstore/rekor/issues/1488">#1488</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/d508ebad91ef4e39d8e0dd3543cebe20321dc752"><code>d508eba</code></a> Remove requirement of PayloadHash for intoto 0.0.1 (<a href="https://redirect.github.com/sigstore/rekor/issues/1490">#1490</a>)</li> <li><a href="https://github.com/sigstore/rekor/commit/b387701f27aace3e3396ad4fdbb8d3ccc869fb5f"><code>b387701</code></a> Add intoto v0.0.2 to backfill script (<a href="https://redirect.github.com/sigstore/rekor/issues/1500">#1500</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/rekor/compare/v1.1.1...v1.2.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/rekor&package-manager=go_modules&previous-version=1.1.1&new-version=1.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-05-27 05:24:50 +02:00
github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
feat: use go 1.17 (#2408) * feat: use go 1.17 Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * fix: go mod tidy Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * test: fix failing test Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * ci: increase lint timeout Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * ci: increase lint timeout Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com>
2021-08-25 01:49:11 +02:00
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
feat(deps): bump github.com/xanzy/go-gitlab from 0.80.2 to 0.81.0 (#3855) [//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [github.com/xanzy/go-gitlab](https://github.com/xanzy/go-gitlab) from 0.80.2 to 0.81.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/xanzy/go-gitlab/commit/7c78a6c1e0a16d61cfa8b76c6759d0f9f97d8844"><code>7c78a6c</code></a> Update dependencies</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/711e0b4cc5281875ca401e457d1d97f7eb6758cf"><code>711e0b4</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/xanzy/go-gitlab/issues/1663">#1663</a> from xanzy/feature/rate-limiter</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/40e5bfd65b5efc88548352bd14e8c55ff0c39756"><code>40e5bfd</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/xanzy/go-gitlab/issues/1665">#1665</a> from PatrickRice-KSC/add-omit-empty-to-project-options</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/77f5aac6fb877498bd26ca6b796a179b4182e5a8"><code>77f5aac</code></a> Fix lint errors</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/8f5194d5312e031fa2d32cf0aa912a4a8e09d19b"><code>8f5194d</code></a> Add omitempty and test</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/824308adfdf509c346a90db5471be1ac4ed087ba"><code>824308a</code></a> Prevent additional call to config the rate limiter</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/ae46dbc110aed4f44cc0e2d019e086b2178e894e"><code>ae46dbc</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/xanzy/go-gitlab/issues/1661">#1661</a> from KingCrunch/feature/add-missing-fields-to-project</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/1e983714503ffe138c6418a5153160cde113abac"><code>1e98371</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/xanzy/go-gitlab/issues/1662">#1662</a> from timofurrer/deploy-token</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/74e732fb037ea2480da4c502ec22de323e01a136"><code>74e732f</code></a> Tweak PR just a little…</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/507b9ece5e45a0d5bfee0653887733fd746a6f8c"><code>507b9ec</code></a> Expose Revoked and Expired field for Deploy Tokens</li> <li>Additional commits viewable in <a href="https://github.com/xanzy/go-gitlab/compare/v0.80.2...v0.81.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/xanzy/go-gitlab&package-manager=go_modules&previous-version=0.80.2&new-version=0.81.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-03-20 03:28:33 +02:00
github.com/golang/protobuf v1.5.3 // indirect
feat(deps): upgrade go-github (#2581) Signed-off-by: Carlos A Becker <caarlos0@gmail.com>
2021-10-14 14:32:52 +02:00
github.com/google/go-querystring v1.1.0 // indirect
feat(deps): bump the gomod-deps group with 3 updates (#4200) Bumps the gomod-deps group with 3 updates: [github.com/xanzy/go-gitlab](https://github.com/xanzy/go-gitlab), [gocloud.dev](https://github.com/google/go-cloud) and [go.uber.org/automaxprocs](https://github.com/uber-go/automaxprocs). Updates `github.com/xanzy/go-gitlab` from 0.86.0 to 0.88.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/xanzy/go-gitlab/commit/7e3c23c9c221c0a334e11356503a99d41f206651"><code>7e3c23c</code></a> Update pipeline tests</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/2ac3eea05ffd9c096624ce3f88bf88132940b025"><code>2ac3eea</code></a> Merge pull request <a href="https://redirect.github.com/xanzy/go-gitlab/issues/1758">#1758</a> from billiechar/billiechar-snippet-moves</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/ddb5ca097455e3087ade383fec32ab07d24cb2c0"><code>ddb5ca0</code></a> Update the PR to make the code consistent</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/a4d27d6848beb49923d87d6201330f869f230f8b"><code>a4d27d6</code></a> Merge pull request <a href="https://redirect.github.com/xanzy/go-gitlab/issues/1759">#1759</a> from PatrickRice-KSC/add-missing-housekeeping-setting</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/a42af8593e45e5a55a6008e482ecbc3dc6f5d06b"><code>a42af85</code></a> Change PipelineTestCases.SystemOutput to interface{}</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/89486a0530374b782bb0267664a5bd49394fbb31"><code>89486a0</code></a> Add missing housekeeping setting</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/852645c7728d7a4284053806b68682b2905c856a"><code>852645c</code></a> Update tests</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/f2c344ca14c5829c55154263b6504d57b26126c3"><code>f2c344c</code></a> Use separate options for each schedule</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/86dd6321cdc296bc3f9a065718e58ea33cb1e686"><code>86dd632</code></a> Add snippet repository storage move APIs</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/3c1f9bfa0d349acfb0aba8991a1abdf62495ee81"><code>3c1f9bf</code></a> Use io.ReadAll instead of ioutil.ReadAll</li> <li>Additional commits viewable in <a href="https://github.com/xanzy/go-gitlab/compare/v0.86.0...v0.88.0">compare view</a></li> </ul> </details> <br /> Updates `gocloud.dev` from 0.30.0 to 0.32.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-cloud/releases">gocloud.dev's releases</a>.</em></p> <blockquote> <h2>v0.32.0</h2> <p>Redoing <code>v0.31.0</code> since I think I messed up the tags. Copying the release notes:</p> <p><strong>all</strong></p> <ul> <li>Update <code>go</code> version in <code>go.mod</code> to maintain cleaner <code>go.mod</code> and <code>go.sum</code> files.</li> </ul> <p><strong>blob</strong></p> <ul> <li><strong>all</strong>: Pass through reader/writer to <code>WriteTo</code>/<code>ReadFrom</code> if available (optimization).</li> <li><strong>all</strong>: Make <code>blob.Bucket</code> implement <code>io/fs.FS</code> and <code>io/fs.SubFS</code>.</li> <li><strong>gcsblob</strong>: Add support for forcing an unauthenticated client.</li> </ul> <p><strong>server</strong></p> <ul> <li>Make <code>requestlog</code> internal structs implement <code>http.Flusher</code>.</li> <li>Don't always read the full request in order to calculate the request size; use <code>Content-Length</code> when available.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-cloud/commit/728b7c1395cb35d23e85ee0a8e957744e2560183"><code>728b7c1</code></a> all: prerelease take 2 (<a href="https://redirect.github.com/google/go-cloud/issues/3278">#3278</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/838a8fd9b6b7efc90b55cb5ed10e19463cbb1262"><code>838a8fd</code></a> all: prerelease (<a href="https://redirect.github.com/google/go-cloud/issues/3277">#3277</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/0f33c81c8dbec9d5302d9615b95c5ba878e0ede9"><code>0f33c81</code></a> all: add dragonfly build to test suite (<a href="https://redirect.github.com/google/go-cloud/issues/3268">#3268</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/bfd1b284ad86ce55bd0a7bc3e1c27fc8814fb87a"><code>bfd1b28</code></a> all: update dependencies (<a href="https://redirect.github.com/google/go-cloud/issues/3276">#3276</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/8d4590ac1e51bca704bc85422cb0a2f2d0b1b7ba"><code>8d4590a</code></a> server/requestlog: Don't consume entire body just to get a request size (<a href="https://redirect.github.com/google/go-cloud/issues/3274">#3274</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/a1d9f4295c59f30b30a085682b47e314c6960673"><code>a1d9f42</code></a> server/requestlog: make responseStats implement http.Flusher (<a href="https://redirect.github.com/google/go-cloud/issues/3275">#3275</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/8cab06ea136cfdd73f67300332994f81234469bc"><code>8cab06e</code></a> blob/gcsblob: add support for forcing an authenticated client (<a href="https://redirect.github.com/google/go-cloud/issues/3273">#3273</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/0e5728dd337838e82e07e03dcef9f54dfc04cc52"><code>0e5728d</code></a> blob: make blob.Bucket implement io/fs.FS and io/fs.SubFS (<a href="https://redirect.github.com/google/go-cloud/issues/3272">#3272</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/a6551792237ccc995a6e95169210ac8e77dbcd94"><code>a655179</code></a> all: update go.mod files to go 1.19 (<a href="https://redirect.github.com/google/go-cloud/issues/3271">#3271</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/8385fc39c70f6589823ca019e399f5514feb377d"><code>8385fc3</code></a> blob: pass through reader/writer to <code>WriteTo</code>/<code>ReadFrom</code> if available (<a href="https://redirect.github.com/google/go-cloud/issues/3267">#3267</a>)</li> <li>Additional commits viewable in <a href="https://github.com/google/go-cloud/compare/v0.30.0...v0.32.0">compare view</a></li> </ul> </details> <br /> Updates `go.uber.org/automaxprocs` from 1.5.2 to 1.5.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/uber-go/automaxprocs/releases">go.uber.org/automaxprocs's releases</a>.</em></p> <blockquote> <h2>v1.5.3</h2> <ul> <li>Fix mountinfo parsing when super options have fields with spaces.</li> <li>Fix division by zero while parsing cgroups.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/uber-go/automaxprocs/blob/master/CHANGELOG.md">go.uber.org/automaxprocs's changelog</a>.</em></p> <blockquote> <h2>v1.5.3 (2023-07-19)</h2> <ul> <li>Fix mountinfo parsing when super options have fields with spaces.</li> <li>Fix division by zero while parsing cgroups.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/uber-go/automaxprocs/commit/e83e959d8845f659d02749ba5598fd62a7129e4e"><code>e83e959</code></a> Release v1.5.3 (<a href="https://redirect.github.com/uber-go/automaxprocs/issues/77">#77</a>)</li> <li><a href="https://github.com/uber-go/automaxprocs/commit/94404505e072633727945d6adc276be8759dadcf"><code>9440450</code></a> Update actions (<a href="https://redirect.github.com/uber-go/automaxprocs/issues/76">#76</a>)</li> <li><a href="https://github.com/uber-go/automaxprocs/commit/4b0a5c9c3c30af086d1251cecd4114b7d4b55a45"><code>4b0a5c9</code></a> set CI perms to readonly (<a href="https://redirect.github.com/uber-go/automaxprocs/issues/75">#75</a>)</li> <li><a href="https://github.com/uber-go/automaxprocs/commit/c64632e175f532a5fe994622797d70b06338337e"><code>c64632e</code></a> Drop Go 1.17 and Go 1.18 from CI (<a href="https://redirect.github.com/uber-go/automaxprocs/issues/74">#74</a>)</li> <li><a href="https://github.com/uber-go/automaxprocs/commit/60f22786b2d20055ca8d888ed455a25aed935bea"><code>60f2278</code></a> fix: mountinfo parsing (<a href="https://redirect.github.com/uber-go/automaxprocs/issues/73">#73</a>)</li> <li><a href="https://github.com/uber-go/automaxprocs/commit/d064ede19db88036b1a2fb6b41113717a84dfda2"><code>d064ede</code></a> Fix division by zero (<a href="https://redirect.github.com/uber-go/automaxprocs/issues/71">#71</a>)</li> <li>See full diff in <a href="https://github.com/uber-go/automaxprocs/compare/v1.5.2...v1.5.3">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-07-20 14:56:26 +02:00
github.com/google/rpmpack v0.5.0 // indirect
feat(deps): bump github.com/google/ko from 0.14.1 to 0.15.0 (#4373) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.14.1 to 0.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.15.0</h2> <h2>What's Changed</h2> <ul> <li>implement dumb cache for images by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1102">ko-build/ko#1102</a></li> <li>fixed typo in configuration.md by <a href="https://github.com/samlaf"><code>@​samlaf</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li>pkg/commands: fix dropped errors by <a href="https://github.com/alrs"><code>@​alrs</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li>ci: add govulncheck by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1110">ko-build/ko#1110</a></li> <li>chore: remove refs to deprecated io/ioutil by <a href="https://github.com/testwill"><code>@​testwill</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li>Update install docs to install ko using Scoop by <a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> <li>include go build output in build error by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1127">ko-build/ko#1127</a></li> <li>Use go1.21, clean up ci and drop go1.19 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1137">ko-build/ko#1137</a></li> <li>Update e2e.yaml by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1141">ko-build/ko#1141</a></li> <li>handle newfound lint errors by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1142">ko-build/ko#1142</a></li> <li>fix test broken by lint fix by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1143">ko-build/ko#1143</a></li> <li>Bump actions/checkout from 3.6.0 to 4.0.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1136">ko-build/ko#1136</a></li> <li>fix env var for go env by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1140">ko-build/ko#1140</a></li> <li>docs: add docs for TF and Lambda by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1139">ko-build/ko#1139</a></li> <li>docs: add Lambda and TF pages to sidebar by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1144">ko-build/ko#1144</a></li> <li>include example using go packages by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1145">ko-build/ko#1145</a></li> <li>fix the release workflow and install instructions by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1150">ko-build/ko#1150</a></li> <li>update missing places that was using go1.20 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1163">ko-build/ko#1163</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/samlaf"><code>@​samlaf</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li><a href="https://github.com/alrs"><code>@​alrs</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li><a href="https://github.com/testwill"><code>@​testwill</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li><a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0">https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/31035ad2026bfbafaa4f009baefe72463af1b3a7"><code>31035ad</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1164">#1164</a> from ko-build/dependabot/go_modules/golang.org/x/net...</li> <li><a href="https://github.com/ko-build/ko/commit/ba952fd091f9d27ee5c136e842b5e94dd715100c"><code>ba952fd</code></a> Bump golang.org/x/net from 0.16.0 to 0.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/277f5d74353950c8663fc04b7546f66e57bd6aaf"><code>277f5d7</code></a> update missing places that was using go1.20 (<a href="https://redirect.github.com/google/ko/issues/1163">#1163</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/b8b3b21f8348d7cab863fe1b4eaa47dfc47632da"><code>b8b3b21</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1162">#1162</a> from ko-build/dependabot/go_modules/github.com/googl...</li> <li><a href="https://github.com/ko-build/ko/commit/4890ab2887b653d3c340de4d119bfd17b703f182"><code>4890ab2</code></a> Bump github.com/google/go-cmp from 0.5.9 to 0.6.0</li> <li><a href="https://github.com/ko-build/ko/commit/30b62aee3faf6866cee6513ea7eb13f5a27cd7ca"><code>30b62ae</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1161">#1161</a> from ko-build/dependabot/go_modules/github.com/spf13...</li> <li><a href="https://github.com/ko-build/ko/commit/449bcb61926cb3e3bcf191e8ca53fad5ab3a4e3c"><code>449bcb6</code></a> Bump github.com/spf13/viper from 1.16.0 to 1.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/c543dd83cc75cd849fb95637ea29e3c7c66d6f87"><code>c543dd8</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1160">#1160</a> from ko-build/dependabot/go_modules/golang.org/x/too...</li> <li><a href="https://github.com/ko-build/ko/commit/c1ae5f5ce4fe058830f24827c853d4db39a95250"><code>c1ae5f5</code></a> Bump golang.org/x/tools from 0.13.0 to 0.14.0</li> <li><a href="https://github.com/ko-build/ko/commit/e50d2fd5ff0ec88ac837ffe6f6c2f122eb54b9f8"><code>e50d2fd</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1159">#1159</a> from ko-build/dependabot/go_modules/golang.org/x/syn...</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.14.1...v0.15.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.14.1&new-version=0.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-17 17:47:47 +02:00
github.com/google/s2a-go v0.1.7 // indirect
feat(deps): bump github.com/google/ko from 0.12.0 to 0.13.0 (#3880) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.12.0 to 0.13.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.13.0</h2> <h2>What's Changed</h2> <ul> <li>SPDX: Fix package manager label by <a href="https://github.com/puerco"><code>@​puerco</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/801">ko-build/ko#801</a></li> <li>SPDX 2.3 support by <a href="https://github.com/puerco"><code>@​puerco</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/803">ko-build/ko#803</a></li> <li>ci: build and test using 1.18 and 1.19 (drop 1.17) by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/812">ko-build/ko#812</a></li> <li>removes repo move message by <a href="https://github.com/mchmarny"><code>@​mchmarny</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/814">ko-build/ko#814</a></li> <li>feat: write sbom result to disk by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/822">ko-build/ko#822</a></li> <li>feat: adding support for using multiple keychain for sending sbom results to a different repository by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/821">ko-build/ko#821</a></li> <li>Move docs to ko.build by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/749">ko-build/ko#749</a></li> <li>Update setup-ko version by <a href="https://github.com/ianlewis"><code>@​ianlewis</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/836">ko-build/ko#836</a></li> <li>Add -- usage in readme by <a href="https://github.com/jwcesign"><code>@​jwcesign</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/840">ko-build/ko#840</a></li> <li>add CONTRIBUTING, code of conduct, roadmap by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/837">ko-build/ko#837</a></li> <li>attempt to fix GH Pages publishing by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/843">ko-build/ko#843</a></li> <li>doc: fix link to Installation page in Getting Started by <a href="https://github.com/antoineco"><code>@​antoineco</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/846">ko-build/ko#846</a></li> <li>.ko.yaml: bump golang 1.18 -&gt; 1.19 by <a href="https://github.com/srenatus"><code>@​srenatus</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/848">ko-build/ko#848</a></li> <li>truncate -image-refs file by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/855">ko-build/ko#855</a></li> <li>update docs: fix broken links, align with README by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/854">ko-build/ko#854</a></li> <li>Handle KO_DOCKER_REPO=ko.local/repo and --bare correctly by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/820">ko-build/ko#820</a></li> <li>another docs update by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/856">ko-build/ko#856</a></li> <li>ko.build: support some common shortlinks by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/872">ko-build/ko#872</a></li> <li>install: fail with 404 instead of gzip error when url was wrong by <a href="https://github.com/grosser"><code>@​grosser</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/879">ko-build/ko#879</a></li> <li>feat: deduplicate tags by <a href="https://github.com/bluebrown"><code>@​bluebrown</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/884">ko-build/ko#884</a></li> <li>install mkdocs-redirect when publishing site by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/873">ko-build/ko#873</a></li> <li>nit: replace one-item slice with const by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/885">ko-build/ko#885</a></li> <li>Temp fix for SLSA generators by <a href="https://github.com/laurentsimon"><code>@​laurentsimon</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/886">ko-build/ko#886</a></li> <li>Fix verifier by <a href="https://github.com/laurentsimon"><code>@​laurentsimon</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/891">ko-build/ko#891</a></li> <li>Fix link in static-assets.md by <a href="https://github.com/yuryu"><code>@​yuryu</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/893">ko-build/ko#893</a></li> <li>add KO_DEFAULTBASEIMAGE usage to docs by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/895">ko-build/ko#895</a></li> <li>Publish an tagged image on release by <a href="https://github.com/vdemeester"><code>@​vdemeester</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/868">ko-build/ko#868</a></li> <li>Add option to configure default platforms by <a href="https://github.com/ReToCode"><code>@​ReToCode</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/897">ko-build/ko#897</a></li> <li>Fix broken SLSA link by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/899">ko-build/ko#899</a></li> <li>add MAINTAINERS.md by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/905">ko-build/ko#905</a></li> <li>fix: possible race condition when applying templates to flags/ldflags by <a href="https://github.com/caarlos0"><code>@​caarlos0</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/913">ko-build/ko#913</a></li> <li>update docs to reflect actual default base image by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/903">ko-build/ko#903</a></li> <li>remove repeated error message on failure by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/921">ko-build/ko#921</a></li> <li>website: update CNCF announcement by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/920">ko-build/ko#920</a></li> <li>fix KO_CONFIG_PATH pointing to a file by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/923">ko-build/ko#923</a></li> <li>upgrade to cosign v2.0.0-rc.0 by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/933">ko-build/ko#933</a></li> <li>Feature: Add ECR presubmit testing. by <a href="https://github.com/mattmoor"><code>@​mattmoor</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/934">ko-build/ko#934</a></li> <li>remove 'ko deps' by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/937">ko-build/ko#937</a></li> <li>feat: Add KO_GO_PATH env var by <a href="https://github.com/embano1"><code>@​embano1</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/930">ko-build/ko#930</a></li> <li>add ko.build/slack short link by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/945">ko-build/ko#945</a></li> <li>update link to ko goreleaser docs by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/936">ko-build/ko#936</a></li> <li>add ko community meeting details by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/938">ko-build/ko#938</a></li> <li>fix cosign by adding --yes by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/973">ko-build/ko#973</a></li> <li>fix: handle docker's unknown/unknown platform in index manifests by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/975">ko-build/ko#975</a></li> <li>fix file extension for cyclonedx by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/974">ko-build/ko#974</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ianlewis"><code>@​ianlewis</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/836">ko-build/ko#836</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/e22e7a15ffb988adc14c3fc6a964f61ed711812f"><code>e22e7a1</code></a> bump ggcr dep to <a href="https://github.com/main"><code>@​main</code></a> (<a href="https://redirect.github.com/google/ko/issues/976">#976</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/8e075ae1f1822bb61a871f11197566b362c342f0"><code>8e075ae</code></a> fix file extension for cyclonedx (<a href="https://redirect.github.com/google/ko/issues/974">#974</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/11670b7498be63bc0e04e7ba36433fd22f9654ce"><code>11670b7</code></a> fix: handle docker's unknown/unknown platform in index manifests (<a href="https://redirect.github.com/google/ko/issues/975">#975</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/7ce947817e2f59942cb181aa833bfd13533bcc19"><code>7ce9478</code></a> fix cosign by adding --yes (<a href="https://redirect.github.com/google/ko/issues/973">#973</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/9302da78dc995b2b2dd70c044708c3c4c6a056b6"><code>9302da7</code></a> Bump k8s.io/apimachinery from 0.26.1 to 0.26.2 (<a href="https://redirect.github.com/google/ko/issues/972">#972</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/a1588838ba1698c3ca3f6785363a1a9f82ed4baa"><code>a158883</code></a> Bump sigstore/cosign-installer from 2.8.1 to 3.0.1 (<a href="https://redirect.github.com/google/ko/issues/971">#971</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/86b6c2854f8a7c321ce1b8ea121938ce9cc79475"><code>86b6c28</code></a> Bump actions/checkout from 2 to 3 (<a href="https://redirect.github.com/google/ko/issues/966">#966</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/0bd12fb106ed9d03994a6b8883f8a5d834a2aa15"><code>0bd12fb</code></a> Bump slsa-framework/slsa-github-generator from 1.2.1 to 1.5.0 (<a href="https://redirect.github.com/google/ko/issues/967">#967</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/d5125daacd07306d3814a6910cc54422824331e6"><code>d5125da</code></a> Bump github.com/sigstore/cosign/v2 from 2.0.0-rc.2 to 2.0.0 (<a href="https://redirect.github.com/google/ko/issues/965">#965</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/03f4aed68268fb320b32195c80292300056b264c"><code>03f4aed</code></a> add ko community meeting details (<a href="https://redirect.github.com/google/ko/issues/938">#938</a>)</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.12.0...v0.13.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.12.0&new-version=0.13.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Carlos A Becker <caarlos0@users.noreply.github.com>
2023-03-29 19:38:57 +02:00
github.com/google/safetext v0.0.0-20220905092116-b49f7bc46da2 // indirect
refactor: improving minio and docker tests (#3642) using ory/dockertest to simplify integration tests Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com>
2022-12-15 15:25:52 +02:00
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
feat: use go 1.17 (#2408) * feat: use go 1.17 Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * fix: go mod tidy Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * test: fix failing test Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * ci: increase lint timeout Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * ci: increase lint timeout Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com>
2021-08-25 01:49:11 +02:00
github.com/google/wire v0.5.0 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
feat(deps): bump the gomod-deps group with 3 updates (#4200) Bumps the gomod-deps group with 3 updates: [github.com/xanzy/go-gitlab](https://github.com/xanzy/go-gitlab), [gocloud.dev](https://github.com/google/go-cloud) and [go.uber.org/automaxprocs](https://github.com/uber-go/automaxprocs). Updates `github.com/xanzy/go-gitlab` from 0.86.0 to 0.88.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/xanzy/go-gitlab/commit/7e3c23c9c221c0a334e11356503a99d41f206651"><code>7e3c23c</code></a> Update pipeline tests</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/2ac3eea05ffd9c096624ce3f88bf88132940b025"><code>2ac3eea</code></a> Merge pull request <a href="https://redirect.github.com/xanzy/go-gitlab/issues/1758">#1758</a> from billiechar/billiechar-snippet-moves</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/ddb5ca097455e3087ade383fec32ab07d24cb2c0"><code>ddb5ca0</code></a> Update the PR to make the code consistent</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/a4d27d6848beb49923d87d6201330f869f230f8b"><code>a4d27d6</code></a> Merge pull request <a href="https://redirect.github.com/xanzy/go-gitlab/issues/1759">#1759</a> from PatrickRice-KSC/add-missing-housekeeping-setting</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/a42af8593e45e5a55a6008e482ecbc3dc6f5d06b"><code>a42af85</code></a> Change PipelineTestCases.SystemOutput to interface{}</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/89486a0530374b782bb0267664a5bd49394fbb31"><code>89486a0</code></a> Add missing housekeeping setting</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/852645c7728d7a4284053806b68682b2905c856a"><code>852645c</code></a> Update tests</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/f2c344ca14c5829c55154263b6504d57b26126c3"><code>f2c344c</code></a> Use separate options for each schedule</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/86dd6321cdc296bc3f9a065718e58ea33cb1e686"><code>86dd632</code></a> Add snippet repository storage move APIs</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/3c1f9bfa0d349acfb0aba8991a1abdf62495ee81"><code>3c1f9bf</code></a> Use io.ReadAll instead of ioutil.ReadAll</li> <li>Additional commits viewable in <a href="https://github.com/xanzy/go-gitlab/compare/v0.86.0...v0.88.0">compare view</a></li> </ul> </details> <br /> Updates `gocloud.dev` from 0.30.0 to 0.32.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-cloud/releases">gocloud.dev's releases</a>.</em></p> <blockquote> <h2>v0.32.0</h2> <p>Redoing <code>v0.31.0</code> since I think I messed up the tags. Copying the release notes:</p> <p><strong>all</strong></p> <ul> <li>Update <code>go</code> version in <code>go.mod</code> to maintain cleaner <code>go.mod</code> and <code>go.sum</code> files.</li> </ul> <p><strong>blob</strong></p> <ul> <li><strong>all</strong>: Pass through reader/writer to <code>WriteTo</code>/<code>ReadFrom</code> if available (optimization).</li> <li><strong>all</strong>: Make <code>blob.Bucket</code> implement <code>io/fs.FS</code> and <code>io/fs.SubFS</code>.</li> <li><strong>gcsblob</strong>: Add support for forcing an unauthenticated client.</li> </ul> <p><strong>server</strong></p> <ul> <li>Make <code>requestlog</code> internal structs implement <code>http.Flusher</code>.</li> <li>Don't always read the full request in order to calculate the request size; use <code>Content-Length</code> when available.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-cloud/commit/728b7c1395cb35d23e85ee0a8e957744e2560183"><code>728b7c1</code></a> all: prerelease take 2 (<a href="https://redirect.github.com/google/go-cloud/issues/3278">#3278</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/838a8fd9b6b7efc90b55cb5ed10e19463cbb1262"><code>838a8fd</code></a> all: prerelease (<a href="https://redirect.github.com/google/go-cloud/issues/3277">#3277</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/0f33c81c8dbec9d5302d9615b95c5ba878e0ede9"><code>0f33c81</code></a> all: add dragonfly build to test suite (<a href="https://redirect.github.com/google/go-cloud/issues/3268">#3268</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/bfd1b284ad86ce55bd0a7bc3e1c27fc8814fb87a"><code>bfd1b28</code></a> all: update dependencies (<a href="https://redirect.github.com/google/go-cloud/issues/3276">#3276</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/8d4590ac1e51bca704bc85422cb0a2f2d0b1b7ba"><code>8d4590a</code></a> server/requestlog: Don't consume entire body just to get a request size (<a href="https://redirect.github.com/google/go-cloud/issues/3274">#3274</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/a1d9f4295c59f30b30a085682b47e314c6960673"><code>a1d9f42</code></a> server/requestlog: make responseStats implement http.Flusher (<a href="https://redirect.github.com/google/go-cloud/issues/3275">#3275</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/8cab06ea136cfdd73f67300332994f81234469bc"><code>8cab06e</code></a> blob/gcsblob: add support for forcing an authenticated client (<a href="https://redirect.github.com/google/go-cloud/issues/3273">#3273</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/0e5728dd337838e82e07e03dcef9f54dfc04cc52"><code>0e5728d</code></a> blob: make blob.Bucket implement io/fs.FS and io/fs.SubFS (<a href="https://redirect.github.com/google/go-cloud/issues/3272">#3272</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/a6551792237ccc995a6e95169210ac8e77dbcd94"><code>a655179</code></a> all: update go.mod files to go 1.19 (<a href="https://redirect.github.com/google/go-cloud/issues/3271">#3271</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/8385fc39c70f6589823ca019e399f5514feb377d"><code>8385fc3</code></a> blob: pass through reader/writer to <code>WriteTo</code>/<code>ReadFrom</code> if available (<a href="https://redirect.github.com/google/go-cloud/issues/3267">#3267</a>)</li> <li>Additional commits viewable in <a href="https://github.com/google/go-cloud/compare/v0.30.0...v0.32.0">compare view</a></li> </ul> </details> <br /> Updates `go.uber.org/automaxprocs` from 1.5.2 to 1.5.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/uber-go/automaxprocs/releases">go.uber.org/automaxprocs's releases</a>.</em></p> <blockquote> <h2>v1.5.3</h2> <ul> <li>Fix mountinfo parsing when super options have fields with spaces.</li> <li>Fix division by zero while parsing cgroups.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/uber-go/automaxprocs/blob/master/CHANGELOG.md">go.uber.org/automaxprocs's changelog</a>.</em></p> <blockquote> <h2>v1.5.3 (2023-07-19)</h2> <ul> <li>Fix mountinfo parsing when super options have fields with spaces.</li> <li>Fix division by zero while parsing cgroups.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/uber-go/automaxprocs/commit/e83e959d8845f659d02749ba5598fd62a7129e4e"><code>e83e959</code></a> Release v1.5.3 (<a href="https://redirect.github.com/uber-go/automaxprocs/issues/77">#77</a>)</li> <li><a href="https://github.com/uber-go/automaxprocs/commit/94404505e072633727945d6adc276be8759dadcf"><code>9440450</code></a> Update actions (<a href="https://redirect.github.com/uber-go/automaxprocs/issues/76">#76</a>)</li> <li><a href="https://github.com/uber-go/automaxprocs/commit/4b0a5c9c3c30af086d1251cecd4114b7d4b55a45"><code>4b0a5c9</code></a> set CI perms to readonly (<a href="https://redirect.github.com/uber-go/automaxprocs/issues/75">#75</a>)</li> <li><a href="https://github.com/uber-go/automaxprocs/commit/c64632e175f532a5fe994622797d70b06338337e"><code>c64632e</code></a> Drop Go 1.17 and Go 1.18 from CI (<a href="https://redirect.github.com/uber-go/automaxprocs/issues/74">#74</a>)</li> <li><a href="https://github.com/uber-go/automaxprocs/commit/60f22786b2d20055ca8d888ed455a25aed935bea"><code>60f2278</code></a> fix: mountinfo parsing (<a href="https://redirect.github.com/uber-go/automaxprocs/issues/73">#73</a>)</li> <li><a href="https://github.com/uber-go/automaxprocs/commit/d064ede19db88036b1a2fb6b41113717a84dfda2"><code>d064ede</code></a> Fix division by zero (<a href="https://redirect.github.com/uber-go/automaxprocs/issues/71">#71</a>)</li> <li>See full diff in <a href="https://github.com/uber-go/automaxprocs/compare/v1.5.2...v1.5.3">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-07-20 14:56:26 +02:00
github.com/googleapis/gax-go/v2 v2.12.0 // indirect
feat(deps): bump github.com/goreleaser/nfpm/v2 from 2.30.1 to 2.31.0 (#4144) latest and greatest
2023-06-26 18:20:47 +02:00
github.com/goreleaser/chglog v0.5.0 // indirect
chore(deps): bump github.com/distribution/distribution/v3 from 3.0.0-20221021092657-c47a966fded8 to 3.0.0-alpha.1 (#4604) Bumps [github.com/distribution/distribution/v3](https://github.com/distribution/distribution) from 3.0.0-20221021092657-c47a966fded8 to 3.0.0-alpha.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/distribution/distribution/releases">github.com/distribution/distribution/v3's releases</a>.</em></p> <blockquote> <h2>v3.0.0-alpha.1</h2> <p>This is the first major release in years!</p> <p>It's an accumulation of effort that's bringing major improvements in performance, security and general code quality!</p> <p>See the abridged changelog below and the full release log <a href="https://github.com/distribution/distribution/blob/576d93fee39c22ef1e4735d932ccef32ee49f7fd/releases/v3.0.0.toml">here</a>.</p> <h3>Deprecations</h3> <ul> <li>Image Manifest v2 Schema v1</li> <li><code>oss</code> and <code>swift</code> storage drivers</li> <li><a href="https://github.com/docker/libtrust"><code>docker/libtrust</code></a> has been replaced with <a href="https://github.com/go-jose/go-jose"><code>go-jose/go-jose</code></a></li> <li><code>reference</code> package has been moved to a dedicated repository (see <a href="https://github.com/distribution/reference">here</a>)</li> <li><code>client</code> is no longer supported as a standalone package</li> </ul> <h3>Notable Changes</h3> <ul> <li><code>reference</code> package has been moved to its own dedicated <a href="https://github.com/distribution/reference">repository</a></li> <li>Go module has changed from <code>docker/distribution</code> to <code>distribution/distribution/v3</code></li> <li>Major performance improvements across all supported storage drivers</li> <li>Major dependencies updates (see the full list below)</li> <li>Online documentation is available at <a href="https://distribution.github.io/distribution/">https://distribution.github.io/distribution/</a></li> </ul> <h2>What's Changed</h2> <ul> <li>default autoredirect to false by <a href="https://github.com/davidswu"><code>@​davidswu</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2800">distribution/distribution#2800</a></li> <li>Add docs for autoredirect config parameter by <a href="https://github.com/caervs"><code>@​caervs</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2801">distribution/distribution#2801</a></li> <li>Registry - make minimum TLS version user configurable by <a href="https://github.com/gregrebholz"><code>@​gregrebholz</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2808">distribution/distribution#2808</a></li> <li>Support BYOK for OSS storage driver by <a href="https://github.com/denverdino"><code>@​denverdino</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2791">distribution/distribution#2791</a></li> <li>Add reference. ParseDockerRef utility function by <a href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2786">distribution/distribution#2786</a></li> <li>Fix gometalint errors by <a href="https://github.com/manishtomar"><code>@​manishtomar</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2840">distribution/distribution#2840</a></li> <li>registry: fix binary JSON content-type by <a href="https://github.com/lucab"><code>@​lucab</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2813">distribution/distribution#2813</a></li> <li>Log authorized username by <a href="https://github.com/manishtomar"><code>@​manishtomar</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2854">distribution/distribution#2854</a></li> <li>Fix cloudfront middleware by <a href="https://github.com/vishesh92"><code>@​vishesh92</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2837">distribution/distribution#2837</a></li> <li>support Alibaba Cloud CDN storage middleware by <a href="https://github.com/Shawnpku"><code>@​Shawnpku</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2849">distribution/distribution#2849</a></li> <li>replace rsc.io/letsencrypt in favour of golang.org/x/crypto by <a href="https://github.com/tariq1890"><code>@​tariq1890</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2926">distribution/distribution#2926</a></li> <li>migrate to go modules from vndr by <a href="https://github.com/tariq1890"><code>@​tariq1890</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2941">distribution/distribution#2941</a></li> <li>Fix typo: offest -&gt; offset by <a href="https://github.com/jabrown85"><code>@​jabrown85</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2894">distribution/distribution#2894</a></li> <li>Fix s3 driver for supporting ceph radosgw by <a href="https://github.com/tbe"><code>@​tbe</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2879">distribution/distribution#2879</a></li> <li>Fixes <a href="https://redirect.github.com/distribution/distribution/issues/2835">#2835</a> Process Accept header MIME types in case-insensitive way by <a href="https://github.com/yuwaMSFT2"><code>@​yuwaMSFT2</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2861">distribution/distribution#2861</a></li> <li>change default Dockerfile to install ssl utils by <a href="https://github.com/andyzhangx"><code>@​andyzhangx</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2809">distribution/distribution#2809</a></li> <li>Append the written bytes to the blob writer's size by <a href="https://github.com/dmathieu"><code>@​dmathieu</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2920">distribution/distribution#2920</a></li> <li>fix no error returned in fetchTokenWithOAuth by <a href="https://github.com/sevki"><code>@​sevki</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2900">distribution/distribution#2900</a></li> <li>use latest version of alpine when building the Docker container by <a href="https://github.com/tariq1890"><code>@​tariq1890</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2946">distribution/distribution#2946</a></li> <li>Extract blob upload resume into its own method by <a href="https://github.com/dmathieu"><code>@​dmathieu</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2930">distribution/distribution#2930</a></li> <li>Handle Blob Create when the underlying registry doesn't provide 'Docker-Upload-UUID' by <a href="https://github.com/dmathieu"><code>@​dmathieu</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2927">distribution/distribution#2927</a></li> <li>Implement Repository ServeBlob by <a href="https://github.com/dmathieu"><code>@​dmathieu</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2921">distribution/distribution#2921</a></li> <li>Add notification metrics by <a href="https://github.com/tifayuki"><code>@​tifayuki</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2522">distribution/distribution#2522</a></li> <li>Update the versions of several dependencies by <a href="https://github.com/tariq1890"><code>@​tariq1890</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2947">distribution/distribution#2947</a></li> <li>Implement Repository Blobs upload resuming by <a href="https://github.com/dmathieu"><code>@​dmathieu</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2917">distribution/distribution#2917</a></li> <li>allow for VERSION and REVISION to be passed in during docker builds by <a href="https://github.com/alex-laties"><code>@​alex-laties</code></a> in <a href="https://redirect.github.com/distribution/distribution/pull/2955">distribution/distribution#2955</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/distribution/distribution/commits/v3.0.0-alpha.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/distribution/distribution/v3&package-manager=go_modules&previous-version=3.0.0-20221021092657-c47a966fded8&new-version=3.0.0-alpha.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-08 15:22:12 +02:00
github.com/gorilla/mux v1.8.1 // indirect
feat(deps): bump github.com/disgoorg/disgo from 0.16.12 to 0.17.0 (#4434) Bumps [github.com/disgoorg/disgo](https://github.com/disgoorg/disgo) from 0.16.12 to 0.17.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/disgoorg/disgo/commit/c4ffb0537d5a1db28e68730eb4685434d4c9bbe6"><code>c4ffb05</code></a> fix checking timeouts when calculating permissions</li> <li><a href="https://github.com/disgoorg/disgo/commit/7e8c825d82051a11460aab8a80ea828fa46aa9aa"><code>7e8c825</code></a> Address Discord having shitty API design</li> <li><a href="https://github.com/disgoorg/disgo/commit/c9a23642bd7b45423361411c520ae5a8033d6306"><code>c9a2364</code></a> Add new expressions and events permissions (<a href="https://redirect.github.com/disgoorg/disgo/issues/292">#292</a>)</li> <li><a href="https://github.com/disgoorg/disgo/commit/f19739c45e4043e06728aa78557e128ee268f568"><code>f19739c</code></a> update dependencies</li> <li><a href="https://github.com/disgoorg/disgo/commit/0c2c0328fadb2426ff5b3349cc013bd9b1d7f18a"><code>0c2c032</code></a> migrate to slog &amp; go 1.21 (<a href="https://redirect.github.com/disgoorg/disgo/issues/294">#294</a>)</li> <li>See full diff in <a href="https://github.com/disgoorg/disgo/compare/v0.16.12...v0.17.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/disgoorg/disgo&package-manager=go_modules&previous-version=0.16.12&new-version=0.17.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-23 22:38:25 +02:00
github.com/gorilla/websocket v1.5.1 // indirect
fix: only fail announcing phase in the end (#3666) This prevents one announce failure to skip all other announcers. The release will still report a failure in the end, but will not fail in the first failure. Also improved errors messages a little bit. closes #3663 Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com>
2022-12-28 17:24:21 +02:00
github.com/hashicorp/errwrap v1.1.0 // indirect
feat(deps): bump github.com/xanzy/go-gitlab from 0.65.0 to 0.68.0 (#3126) Bumps [github.com/xanzy/go-gitlab](https://github.com/xanzy/go-gitlab) from 0.65.0 to 0.68.0. - [Release notes](https://github.com/xanzy/go-gitlab/releases) - [Changelog](https://github.com/xanzy/go-gitlab/blob/master/releases_test.go) - [Commits](https://github.com/xanzy/go-gitlab/compare/v0.65.0...v0.68.0) --- updated-dependencies: - dependency-name: github.com/xanzy/go-gitlab dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-06-02 14:02:24 +02:00
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/hashicorp/go-retryablehttp v0.7.4 // indirect
feat: add ko support (#3653) continuing the PR by @developer-guy - [x] should be a publisher, as it does publish the images it builds every time - [x] `Default` method does not work - [x] the `fromConfig` thing should probably be on the defaults, too - [x] wire `--skip-ko` - [x] documentation - [x] more tests - [x] use same registry as docker tests does - [ ] see if we can make the log output match goreleaser's - [ ] ?? closes #2556 closes #3490 Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com> Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> Co-authored-by: actions-user <actions@github.com> Co-authored-by: Jason Hall <jason@chainguard.dev> Co-authored-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
2023-01-17 03:34:49 +02:00
github.com/hashicorp/go-version v1.6.0 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/hashicorp/hcl v1.0.1-vault-5 // indirect
feat(deps): bump github.com/goreleaser/nfpm/v2 from 2.30.1 to 2.31.0 (#4144) latest and greatest
2023-06-26 18:20:47 +02:00
github.com/huandu/xstrings v1.3.3 // indirect
feat(deps): bump github.com/invopop/jsonschema from 0.8.0 to 0.9.0 Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>
2023-09-22 04:17:31 +02:00
github.com/imdario/mergo v0.3.16 // indirect
feat(deps): bump github.com/google/go-containerregistry from 0.13.0 to 0.14.0 (#3878) Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.13.0 to 0.14.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-containerregistry/releases">github.com/google/go-containerregistry's releases</a>.</em></p> <blockquote> <h2>v0.14.0</h2> <h2>Changelog</h2> <ul> <li>9306ebad Allow crane edit to generate non-image artifacts (<a href="https://redirect.github.com/google/go-containerregistry/issues/1545">#1545</a>)</li> <li>de35f0f7 Allow setting Content-Type in crane edit manifest (<a href="https://redirect.github.com/google/go-containerregistry/issues/1551">#1551</a>)</li> <li>4b081f80 Avoid v1.Manifest in crane edit config (<a href="https://redirect.github.com/google/go-containerregistry/issues/1583">#1583</a>)</li> <li>1cfe1fc2 Bump aws-actions/configure-aws-credentials from 1.7.0 to 2.0.0 (<a href="https://redirect.github.com/google/go-containerregistry/issues/1593">#1593</a>)</li> <li>da1008fb Bump golangci/golangci-lint-action from 3.3.1 to 3.4.0 (<a href="https://redirect.github.com/google/go-containerregistry/issues/1548">#1548</a>)</li> <li>86be45fb Bump goreleaser/goreleaser-action from 4.1.0 to 4.1.1 (<a href="https://redirect.github.com/google/go-containerregistry/issues/1547">#1547</a>)</li> <li>62f183e5 Bump goreleaser/goreleaser-action from 4.1.1 to 4.2.0 (<a href="https://redirect.github.com/google/go-containerregistry/issues/1556">#1556</a>)</li> <li>1b8dc2ba Bump slsa-framework/slsa-github-generator from 1.2.2 to 1.5.0 (<a href="https://redirect.github.com/google/go-containerregistry/issues/1580">#1580</a>)</li> <li>11843ba2 Enforce proper sha256 usage (<a href="https://redirect.github.com/google/go-containerregistry/issues/1544">#1544</a>)</li> <li>2ceebaaf Implement crane index subcommand (<a href="https://redirect.github.com/google/go-containerregistry/issues/1561">#1561</a>)</li> <li>9f42e028 Set mediaType for empty.ImageIndex in RawManifest (<a href="https://redirect.github.com/google/go-containerregistry/issues/1562">#1562</a>)</li> <li>759b19f7 Support artifactType, for images whose config.mediaType is not a config (<a href="https://redirect.github.com/google/go-containerregistry/issues/1541">#1541</a>)</li> <li>b3c23b4c Support for OCI 1.1+ referrers via API (<a href="https://redirect.github.com/google/go-containerregistry/issues/1546">#1546</a>)</li> <li>061ee6bf Support for OCI 1.1+ referrers via fallback tag (<a href="https://redirect.github.com/google/go-containerregistry/issues/1543">#1543</a>)</li> <li>67703048 Update descriptor &quot;data&quot; field (when valid) during &quot;crane edit config&quot; (<a href="https://redirect.github.com/google/go-containerregistry/issues/1584">#1584</a>)</li> <li>76bac933 Update release.yml (<a href="https://redirect.github.com/google/go-containerregistry/issues/1540">#1540</a>)</li> <li>eb7d746c authn: also read mount secrets (<a href="https://redirect.github.com/google/go-containerregistry/issues/1560">#1560</a>)</li> <li>e94d4089 bump deps using ./hack/bump-deps.sh (<a href="https://redirect.github.com/google/go-containerregistry/issues/1592">#1592</a>)</li> <li>4e95ae2b crane: add --flatten for index append (<a href="https://redirect.github.com/google/go-containerregistry/issues/1566">#1566</a>)</li> <li>ff810c18 crane: add serve subcommand (<a href="https://redirect.github.com/google/go-containerregistry/issues/1586">#1586</a>)</li> <li>8ea5e0e8 crane: support --omit-digest-tags in crane ls (<a href="https://redirect.github.com/google/go-containerregistry/issues/1528">#1528</a>)</li> <li>824efc77 fix(mutate): also set timestamps only present in some formats (<a href="https://redirect.github.com/google/go-containerregistry/issues/1550">#1550</a>)</li> <li>e04520bc fix: Fix the crane release url and add more steps (<a href="https://redirect.github.com/google/go-containerregistry/issues/1532">#1532</a>)</li> <li>d8722327 hash: use generic instantiation (<a href="https://redirect.github.com/google/go-containerregistry/issues/1538">#1538</a>)</li> <li>57f010d2 replace manual slsa-verifier installation with action (<a href="https://redirect.github.com/google/go-containerregistry/issues/1585">#1585</a>)</li> <li>9cd098e3 skip tls verification if default transport is used with insecure option (<a href="https://redirect.github.com/google/go-containerregistry/issues/1559">#1559</a>)</li> <li>36249683 tarball: pass imageToTags (<a href="https://redirect.github.com/google/go-containerregistry/issues/1563">#1563</a>)</li> </ul> <h3>Container Images</h3> <p><a href="https://gcr.io/go-containerregistry/crane:v0.14.0">https://gcr.io/go-containerregistry/crane:v0.14.0</a> <a href="https://gcr.io/go-containerregistry/gcrane:v0.14.0">https://gcr.io/go-containerregistry/gcrane:v0.14.0</a></p> <p>For example:</p> <pre><code>docker pull gcr.io/go-containerregistry/crane:v0.14.0 docker pull gcr.io/go-containerregistry/gcrane:v0.14.0 </code></pre> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-containerregistry/commit/4b081f801f399fa293f23e42ba4c4ac6a6003f2c"><code>4b081f8</code></a> Avoid v1.Manifest in crane edit config (<a href="https://redirect.github.com/google/go-containerregistry/issues/1583">#1583</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/1cfe1fc25f233b40aa5d3b0edd572ed5c3f854c9"><code>1cfe1fc</code></a> Bump aws-actions/configure-aws-credentials from 1.7.0 to 2.0.0 (<a href="https://redirect.github.com/google/go-containerregistry/issues/1593">#1593</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/e94d40893b2d013992192f8a1a04fd1984fd24dc"><code>e94d408</code></a> bump deps using ./hack/bump-deps.sh (<a href="https://redirect.github.com/google/go-containerregistry/issues/1592">#1592</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/ff810c186c772e1056aa4081278ee84ee3fb565b"><code>ff810c1</code></a> crane: add serve subcommand (<a href="https://redirect.github.com/google/go-containerregistry/issues/1586">#1586</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/57f010d26af871587be87f5aed2550893d564a8c"><code>57f010d</code></a> replace manual slsa-verifier installation with action (<a href="https://redirect.github.com/google/go-containerregistry/issues/1585">#1585</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/67703048992e9b025adf1a7b08f3bb195636be33"><code>6770304</code></a> Update descriptor &quot;data&quot; field (when valid) during &quot;crane edit config&quot; (<a href="https://redirect.github.com/google/go-containerregistry/issues/1584">#1584</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/1b8dc2babc55fd72d274e8f470f00e9e5ba43f1b"><code>1b8dc2b</code></a> Bump slsa-framework/slsa-github-generator from 1.2.2 to 1.5.0 (<a href="https://redirect.github.com/google/go-containerregistry/issues/1580">#1580</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/8ea5e0e8f045d827389d13bde5ae8269630e2e2e"><code>8ea5e0e</code></a> crane: support --omit-digest-tags in crane ls (<a href="https://redirect.github.com/google/go-containerregistry/issues/1528">#1528</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/4e95ae2b72dd3b58fccb4ed579dbddf5c884822c"><code>4e95ae2</code></a> crane: add --flatten for index append (<a href="https://redirect.github.com/google/go-containerregistry/issues/1566">#1566</a>)</li> <li><a href="https://github.com/google/go-containerregistry/commit/4a0e0af4bf958c0bfb17bdfac71c38204b930623"><code>4a0e0af</code></a> docs: Update crane installation and verification instructions (<a href="https://redirect.github.com/google/go-containerregistry/issues/1567">#1567</a>)</li> <li>Additional commits viewable in <a href="https://github.com/google/go-containerregistry/compare/v0.13.0...v0.14.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/go-containerregistry&package-manager=go_modules&previous-version=0.13.0&new-version=0.14.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-03-20 14:58:29 +02:00
github.com/inconshreveable/mousetrap v1.1.0 // indirect
feat: use go 1.17 (#2408) * feat: use go 1.17 Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * fix: go mod tidy Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * test: fix failing test Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * ci: increase lint timeout Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * ci: increase lint timeout Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com>
2021-08-25 01:49:11 +02:00
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
github.com/jmespath/go-jmespath v0.4.0 // indirect
feat: add ko support (#3653) continuing the PR by @developer-guy - [x] should be a publisher, as it does publish the images it builds every time - [x] `Default` method does not work - [x] the `fromConfig` thing should probably be on the defaults, too - [x] wire `--skip-ko` - [x] documentation - [x] more tests - [x] use same registry as docker tests does - [ ] see if we can make the log output match goreleaser's - [ ] ?? closes #2556 closes #3490 Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com> Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> Co-authored-by: actions-user <actions@github.com> Co-authored-by: Jason Hall <jason@chainguard.dev> Co-authored-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
2023-01-17 03:34:49 +02:00
github.com/josharian/intern v1.0.0 // indirect
feat(deps): bump github.com/goreleaser/nfpm/v2 from 2.30.1 to 2.31.0 (#4144) latest and greatest
2023-06-26 18:20:47 +02:00
github.com/kevinburke/ssh_config v1.2.0 // indirect
chore(deps): bump github.com/goreleaser/nfpm/v2 from 2.35.2 to 2.35.3 (#4596) Bumps [github.com/goreleaser/nfpm/v2](https://github.com/goreleaser/nfpm) from 2.35.2 to 2.35.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/goreleaser/nfpm/releases">github.com/goreleaser/nfpm/v2's releases</a>.</em></p> <blockquote> <h2>v2.35.3</h2> <h2>Changelog</h2> <h3>Bug fixes</h3> <ul> <li>f8ccc9df94eb9a4c91c3a1c78d4759a65f156731: fix: file mode when type: tree (<a href="https://redirect.github.com/goreleaser/nfpm/issues/779">#779</a>) (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> <li>e1ebfdad10ef98fe6c9d424efe3f97d7b2322f04: fix: honor SOURCE_DATE_EPOCH for files (<a href="https://redirect.github.com/goreleaser/nfpm/issues/775">#775</a>) (<a href="https://github.com/osm"><code>@​osm</code></a>)</li> </ul> <h3>Dependency updates</h3> <ul> <li>9c48b79596993dd653087f91861794b7da6267e6: feat(deps): bump github.com/ProtonMail/go-crypto (<a href="https://redirect.github.com/goreleaser/nfpm/issues/771">#771</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li> <li>d7a5dc79573e4bf5d65c3f00d9cac81736f12597: feat(deps): bump github.com/cloudflare/circl from 1.3.3 to 1.3.7 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/765">#765</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li> <li>fbc55c56be14ac5de4207becb98c908c615dee7e: feat(deps): bump github.com/klauspost/compress from 1.17.4 to 1.17.5 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/774">#774</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li> <li>9bb94d758ce739fc27c19bbe04bf1c1d33ce3fa9: fix(deps): update go-rpmutils (<a href="https://redirect.github.com/goreleaser/nfpm/issues/764">#764</a>) (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> </ul> <h3>Build process updates</h3> <ul> <li>5ace4da2fd3162383a16218e2ef405dc2676bdfc: ci: update changelog (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> </ul> <h3>Other work</h3> <ul> <li>cd6b94108561b9ef1b06e1db8bfe9e3b3f643253: docs: update cmd docs (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> <li>672f8c6537228848062786d7ad2d2956f6808986: docs: update starchart url (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/goreleaser/nfpm/compare/v2.35.2...v2.35.3">https://github.com/goreleaser/nfpm/compare/v2.35.2...v2.35.3</a></p> <h2>Helping out</h2> <p>This release is only possible thanks to <strong>all</strong> the support of <strong>awesome people</strong>!</p> <p>Want to be one of them? You can <a href="https://goreleaser.com/sponsors/">sponsor</a> or <a href="https://goreleaser.com/contributing">contribute with code</a>.</p> <h2>Where to go next?</h2> <ul> <li>nFPM is a satellite project from GoReleaser. <a href="https://goreleaser.com">Check it out</a>!</li> <li>Find examples and commented usage of all options in our <a href="https://nfpm.goreleaser.com/">website</a>.</li> <li>Reach out on <a href="https://discord.gg/RGEBtg8vQ6">Discord</a> and <a href="https://twitter.com/goreleaser">Twitter</a>!</li> </ul> <p><!-- raw HTML omitted --><!-- raw HTML omitted --><!-- raw HTML omitted --></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/goreleaser/nfpm/commit/5ace4da2fd3162383a16218e2ef405dc2676bdfc"><code>5ace4da</code></a> ci: update changelog</li> <li><a href="https://github.com/goreleaser/nfpm/commit/f8ccc9df94eb9a4c91c3a1c78d4759a65f156731"><code>f8ccc9d</code></a> fix: file mode when type: tree (<a href="https://redirect.github.com/goreleaser/nfpm/issues/779">#779</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/48d1a19eb6c3b6fa7cf69295aa2e7bf8d2b2f520"><code>48d1a19</code></a> chore(deps): bump anchore/sbom-action from 0.15.6 to 0.15.7 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/778">#778</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/e1ebfdad10ef98fe6c9d424efe3f97d7b2322f04"><code>e1ebfda</code></a> fix: honor SOURCE_DATE_EPOCH for files (<a href="https://redirect.github.com/goreleaser/nfpm/issues/775">#775</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/25f6f2b7368585e0534b668ef76094f107e1fe4f"><code>25f6f2b</code></a> chore(deps): bump anchore/sbom-action from 0.15.5 to 0.15.6 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/776">#776</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/fbc55c56be14ac5de4207becb98c908c615dee7e"><code>fbc55c5</code></a> feat(deps): bump github.com/klauspost/compress from 1.17.4 to 1.17.5 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/774">#774</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/d83a6724284364757db5b61c7b2bd9bf0918264e"><code>d83a672</code></a> chore(deps): bump anchore/sbom-action from 0.15.4 to 0.15.5 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/773">#773</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/995a27a6fb5009a2a7e13e7747c9a7ef5a3e8098"><code>995a27a</code></a> chore(deps): bump anchore/sbom-action from 0.15.3 to 0.15.4 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/772">#772</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/9c48b79596993dd653087f91861794b7da6267e6"><code>9c48b79</code></a> feat(deps): bump github.com/ProtonMail/go-crypto (<a href="https://redirect.github.com/goreleaser/nfpm/issues/771">#771</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/e8832cc97b405ce3af1a6026f010d19e521bb1ff"><code>e8832cc</code></a> chore(deps): bump actions/cache from 3.3.3 to 4.0.0 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/770">#770</a>)</li> <li>Additional commits viewable in <a href="https://github.com/goreleaser/nfpm/compare/v2.35.2...v2.35.3">compare view</a></li> </ul> </details> <br /> <details> <summary>Most Recent Ignore Conditions Applied to This Pull Request</summary> | Dependency Name | Ignore Conditions | | --- | --- | | github.com/goreleaser/nfpm/v2 | [>= 2.24.a, < 2.25] | </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/goreleaser/nfpm/v2&package-manager=go_modules&previous-version=2.35.2&new-version=2.35.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) Dependabot will merge this PR once it's up-to-date and CI passes on it, as requested by @caarlos0. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-01 20:56:17 +02:00
github.com/klauspost/compress v1.17.5 // indirect
feat(deps): bump gocloud.dev from 0.26.0 to 0.27.0 (#3430) Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.26.0 to 0.27.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-cloud/releases">gocloud.dev's releases</a>.</em></p> <blockquote> <h2>v0.27.0</h2> <p><strong>ANNOUNCEMENT</strong>: In the next release we plan to switch over from using OpenCensus to using OpenTelemetry; see <a href="https://github-redirect.dependabot.com/google/go-cloud/issues/2877">#2877</a> for discussion. Please comment on that issue if this is a concern for you.</p> <p><strong>BREAKING CHANGES</strong>: <strong>blob/azureblob, pubsub/azuresb</strong>: Switched over to using the new Azure beta release. Constructors and <code>As</code> types have changed.</p> <p><strong>pubsub</strong>: <strong>all</strong>: Added support for overriding batching for AWS, GCP, Azure.</p> <p><strong>blob</strong>: <strong>fileblob</strong>: Fixed file permissions on temporary files.</p> <p><strong>runtimevar</strong>: <strong>etcdvar</strong>: Brought back this package now that the upstream issues have been resolved.</p> <p><strong>secrets</strong>: <strong>awskms</strong>: Added support for EncryptionContext parameters.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-cloud/commit/3c635fdcb2e648272296b12a4b23d593a965609e"><code>3c635fd</code></a> all: prep for v0.27.0 release</li> <li><a href="https://github.com/google/go-cloud/commit/132c6952d06448b5325f6b856d742a2e535eaf65"><code>132c695</code></a> internal: remove unused package for tracing (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3167">#3167</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/b078f175bb3d0de54df4b2ff1497ce19f9583fce"><code>b078f17</code></a> Add a custom createTemp function that uses consistent file permissions. (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3166">#3166</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/2c69298b18a5e169e9b6b4f4fb338487006b5f47"><code>2c69298</code></a> pubsub/kafka: Allow overriding batching options for Topic (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3163">#3163</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/2ae6e177616a04b94100982ad9f1197af3c41d71"><code>2ae6e17</code></a> blob/azureblob: add storage_account query parameter (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3159">#3159</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/58fd16630bd7ce978bf53ec5a3974cac4299e105"><code>58fd166</code></a> blob/azureblob: Use azidentity.NewDefaultAzureCredential the default/fallback...</li> <li><a href="https://github.com/google/go-cloud/commit/bb5165b76b81ce64c0e769965c0eb293ccd938ac"><code>bb5165b</code></a> pubsub: Add support for overriding batching for AWS, GCP, Azure drivers (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3158">#3158</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/0c45fa60411312d52335c521a8a8411a15e1ce71"><code>0c45fa6</code></a> blob/azureblob: Update to new azblob package BREAKING_CHANGE_OK (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3156">#3156</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/cf4fa6ff18f951d45ec6f1997a3b70695f3a0b17"><code>cf4fa6f</code></a> runtimevar/etcdvar: Bring back runtimevar/etcdvar (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3157">#3157</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/8cd52867f0776832bdc91cc2f1151920351380b2"><code>8cd5286</code></a> all: update deps and regenerate goldens (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3153">#3153</a>)</li> <li>Additional commits viewable in <a href="https://github.com/google/go-cloud/compare/v0.26.0...v0.27.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.26.0&new-version=0.27.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-10-05 14:49:30 +02:00
github.com/kylelemons/godebug v1.1.0 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/letsencrypt/boulder v0.0.0-20231026200631-000cd05d5491 // indirect
feat: replacing the log library (#3139) * feat: replacing logs Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> * fix: tests et al Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> * feat: update termenv/lipgloss Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> * wip: output Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> * fix: pin dep Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> * fix: update Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> * fix: tests Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> * fix: tests Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> * fix: deps Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> * fix: dep Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com>
2022-06-22 02:11:15 +02:00
github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
fix: force specific version of go-crypto (#3756) refs #3745 Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com>
2023-02-05 17:09:06 +02:00
github.com/magiconair/properties v1.8.7 // indirect
feat: add ko support (#3653) continuing the PR by @developer-guy - [x] should be a publisher, as it does publish the images it builds every time - [x] `Default` method does not work - [x] the `fromConfig` thing should probably be on the defaults, too - [x] wire `--skip-ko` - [x] documentation - [x] more tests - [x] use same registry as docker tests does - [ ] see if we can make the log output match goreleaser's - [ ] ?? closes #2556 closes #3490 Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com> Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> Co-authored-by: actions-user <actions@github.com> Co-authored-by: Jason Hall <jason@chainguard.dev> Co-authored-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
2023-01-17 03:34:49 +02:00
github.com/mailru/easyjson v0.7.7 // indirect
feat(deps): bump github.com/muesli/termenv from 0.15.1 to 0.15.2 (#4148) Bumps [github.com/muesli/termenv](https://github.com/muesli/termenv) from 0.15.1 to 0.15.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/muesli/termenv/releases">github.com/muesli/termenv's releases</a>.</em></p> <blockquote> <h2>v0.15.2</h2> <h2>What's Changed</h2> <ul> <li>build(deps): bump actions/setup-go from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/muesli/termenv/pull/126">muesli/termenv#126</a></li> <li>build(deps): bump github.com/mattn/go-isatty from 0.0.17 to 0.0.18 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/muesli/termenv/pull/128">muesli/termenv#128</a></li> <li>fix: Cloud Shell supports RGB colors by <a href="https://github.com/muesli"><code>@​muesli</code></a> in <a href="https://redirect.github.com/muesli/termenv/pull/127">muesli/termenv#127</a></li> <li>build(deps): bump golang.org/x/sys from 0.6.0 to 0.7.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/muesli/termenv/pull/129">muesli/termenv#129</a></li> <li>fix: wezterm is truecolor by <a href="https://github.com/caarlos0"><code>@​caarlos0</code></a> in <a href="https://redirect.github.com/muesli/termenv/pull/139">muesli/termenv#139</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/muesli/termenv/compare/v0.15.1...v0.15.2">https://github.com/muesli/termenv/compare/v0.15.1...v0.15.2</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/muesli/termenv/commit/51d72d34e2b9778a31aa5dd79fbdd8cdac50b4d5"><code>51d72d3</code></a> fix: wezterm is truecolor (<a href="https://redirect.github.com/muesli/termenv/issues/139">#139</a>)</li> <li><a href="https://github.com/muesli/termenv/commit/b57cbb11093e11f08bdeb3d54234909b8fa079fe"><code>b57cbb1</code></a> fix: lint</li> <li><a href="https://github.com/muesli/termenv/commit/e02986697d716017087dc725465e3d8691d317e4"><code>e029866</code></a> build(deps): bump golang.org/x/sys from 0.6.0 to 0.7.0</li> <li><a href="https://github.com/muesli/termenv/commit/9b3e79975a48df063aa7a7c1ca0c20c3c868332c"><code>9b3e799</code></a> fix: Cloud Shell supports RGB colors</li> <li><a href="https://github.com/muesli/termenv/commit/73a40463ff25452432bd4e588150285c6aeca58e"><code>73a4046</code></a> build(deps): bump github.com/mattn/go-isatty from 0.0.17 to 0.0.18</li> <li><a href="https://github.com/muesli/termenv/commit/39f5d6e77915ccc34a9e752ad0b7a3443b393058"><code>39f5d6e</code></a> build(deps): bump actions/setup-go from 3 to 4</li> <li>See full diff in <a href="https://github.com/muesli/termenv/compare/v0.15.1...v0.15.2">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/muesli/termenv&package-manager=go_modules&previous-version=0.15.1&new-version=0.15.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-28 14:46:00 +02:00
github.com/mattn/go-isatty v0.0.18 // indirect
feat(deps): bump github.com/charmbracelet/lipgloss from 0.8.0 to 0.9.0 (#4364) Bumps [github.com/charmbracelet/lipgloss](https://github.com/charmbracelet/lipgloss) from 0.8.0 to 0.9.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/charmbracelet/lipgloss/releases">github.com/charmbracelet/lipgloss's releases</a>.</em></p> <blockquote> <h2>v0.9.0</h2> <h1>My, how the tables have turned</h1> <p>Now you can draw <code>Table</code>s with Lip Gloss! 💅</p> <!-- raw HTML omitted --> <p>View <a href="https://github.com/charmbracelet/lipgloss/tree/master/examples/table/pokemon/main.go">the source code</a>.</p> <h2>Let's get started</h2> <pre lang="go"><code>import &quot;github.com/charmbracelet/lipgloss/table&quot; </code></pre> <p>Define some rows of data.</p> <pre lang="go"><code>rows := [][]string{ {&quot;Chinese&quot;, &quot;您好&quot;, &quot;你好&quot;}, {&quot;Japanese&quot;, &quot;こんにちは&quot;, &quot;やあ&quot;}, {&quot;Arabic&quot;, &quot;أهلين&quot;, &quot;أهلا&quot;}, {&quot;Russian&quot;, &quot;Здравствуйте&quot;, &quot;Привет&quot;}, {&quot;Spanish&quot;, &quot;Hola&quot;, &quot;¿Qué tal?&quot;}, } </code></pre> <p>Use the table package to style and render the table.</p> <pre lang="go"><code>t := table.New(). Border(lipgloss.NormalBorder()). BorderStyle(lipgloss.NewStyle().Foreground(lipgloss.Color(&quot;99&quot;))). StyleFunc(func(row, col int) lipgloss.Style { switch { case row == 0: return HeaderStyle case row%2 == 0: return EvenRowStyle default: return OddRowStyle } }). Headers(&quot;LANGUAGE&quot;, &quot;FORMAL&quot;, &quot;INFORMAL&quot;). Rows(rows...) <p>// You can also add tables row-by-row t.Row(&quot;English&quot;, &quot;You look absolutely fabulous.&quot;, &quot;How's it going?&quot;) </code></pre></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/charmbracelet/lipgloss/commit/4476263d0598a0799b48f75d1bfb394b4dce79f4"><code>4476263</code></a> Feature: Tables (<a href="https://redirect.github.com/charmbracelet/lipgloss/issues/218">#218</a>)</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/408dcf3b9ec535cddf7d343bf5b1a3dd0eba4a00"><code>408dcf3</code></a> feat: add <code>Middle</code> borders (<a href="https://redirect.github.com/charmbracelet/lipgloss/issues/230">#230</a>)</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/93cd5e0d35ae7fed6884560097b304cec79f0fc1"><code>93cd5e0</code></a> feat: bump minimum go version to 1.18 (<a href="https://redirect.github.com/charmbracelet/lipgloss/issues/216">#216</a>)</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/b766f24d454396ae75c1b0e86310dffadf4ceb77"><code>b766f24</code></a> feat(deps): bump github.com/mattn/go-runewidth from 0.0.14 to 0.0.15 (<a href="https://redirect.github.com/charmbracelet/lipgloss/issues/215">#215</a>)</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/b0eb95dbc18f712ad939ab7193cb69951a95361f"><code>b0eb95d</code></a> fix(border): both GetHorizontalBorderSize and GetVerticalBorderSize (<a href="https://redirect.github.com/charmbracelet/lipgloss/issues/225">#225</a>)</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/2d2a577e2d32c9b23e64be859b8af98599bba243"><code>2d2a577</code></a> fix(border): GetBorderRightSize (<a href="https://redirect.github.com/charmbracelet/lipgloss/issues/224">#224</a>)</li> <li><a href="https://github.com/charmbracelet/lipgloss/commit/18166eaa8adf46a03c4b732ab1dec81fad1c691b"><code>18166ea</code></a> chore(deps): bump actions/checkout from 3 to 4 (<a href="https://redirect.github.com/charmbracelet/lipgloss/issues/222">#222</a>)</li> <li>See full diff in <a href="https://github.com/charmbracelet/lipgloss/compare/v0.8.0...v0.9.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/charmbracelet/lipgloss&package-manager=go_modules&previous-version=0.8.0&new-version=0.9.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-11 14:05:53 +02:00
github.com/mattn/go-runewidth v0.0.15 // indirect
feat: update nfpm (#2640) * feat: update nfpm * feat: update nfpm * feat: update nfpm * feat: update nfpm * fix: dir type * docs: dir * docs: typo * fix: race * fix: race cond
2021-11-14 03:23:11 +02:00
github.com/mitchellh/copystructure v1.2.0 // indirect
refactor: improving minio and docker tests (#3642) using ory/dockertest to simplify integration tests Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com>
2022-12-15 15:25:52 +02:00
github.com/mitchellh/mapstructure v1.5.0 // indirect
feat: update nfpm (#2640) * feat: update nfpm * feat: update nfpm * feat: update nfpm * feat: update nfpm * fix: dir type * docs: dir * docs: typo * fix: race * fix: race cond
2021-11-14 03:23:11 +02:00
github.com/mitchellh/reflectwalk v1.0.2 // indirect
feat(deps): bump github.com/google/ko from 0.14.1 to 0.15.0 (#4373) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.14.1 to 0.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.15.0</h2> <h2>What's Changed</h2> <ul> <li>implement dumb cache for images by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1102">ko-build/ko#1102</a></li> <li>fixed typo in configuration.md by <a href="https://github.com/samlaf"><code>@​samlaf</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li>pkg/commands: fix dropped errors by <a href="https://github.com/alrs"><code>@​alrs</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li>ci: add govulncheck by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1110">ko-build/ko#1110</a></li> <li>chore: remove refs to deprecated io/ioutil by <a href="https://github.com/testwill"><code>@​testwill</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li>Update install docs to install ko using Scoop by <a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> <li>include go build output in build error by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1127">ko-build/ko#1127</a></li> <li>Use go1.21, clean up ci and drop go1.19 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1137">ko-build/ko#1137</a></li> <li>Update e2e.yaml by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1141">ko-build/ko#1141</a></li> <li>handle newfound lint errors by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1142">ko-build/ko#1142</a></li> <li>fix test broken by lint fix by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1143">ko-build/ko#1143</a></li> <li>Bump actions/checkout from 3.6.0 to 4.0.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1136">ko-build/ko#1136</a></li> <li>fix env var for go env by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1140">ko-build/ko#1140</a></li> <li>docs: add docs for TF and Lambda by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1139">ko-build/ko#1139</a></li> <li>docs: add Lambda and TF pages to sidebar by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1144">ko-build/ko#1144</a></li> <li>include example using go packages by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1145">ko-build/ko#1145</a></li> <li>fix the release workflow and install instructions by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1150">ko-build/ko#1150</a></li> <li>update missing places that was using go1.20 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1163">ko-build/ko#1163</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/samlaf"><code>@​samlaf</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li><a href="https://github.com/alrs"><code>@​alrs</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li><a href="https://github.com/testwill"><code>@​testwill</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li><a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0">https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/31035ad2026bfbafaa4f009baefe72463af1b3a7"><code>31035ad</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1164">#1164</a> from ko-build/dependabot/go_modules/golang.org/x/net...</li> <li><a href="https://github.com/ko-build/ko/commit/ba952fd091f9d27ee5c136e842b5e94dd715100c"><code>ba952fd</code></a> Bump golang.org/x/net from 0.16.0 to 0.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/277f5d74353950c8663fc04b7546f66e57bd6aaf"><code>277f5d7</code></a> update missing places that was using go1.20 (<a href="https://redirect.github.com/google/ko/issues/1163">#1163</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/b8b3b21f8348d7cab863fe1b4eaa47dfc47632da"><code>b8b3b21</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1162">#1162</a> from ko-build/dependabot/go_modules/github.com/googl...</li> <li><a href="https://github.com/ko-build/ko/commit/4890ab2887b653d3c340de4d119bfd17b703f182"><code>4890ab2</code></a> Bump github.com/google/go-cmp from 0.5.9 to 0.6.0</li> <li><a href="https://github.com/ko-build/ko/commit/30b62aee3faf6866cee6513ea7eb13f5a27cd7ca"><code>30b62ae</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1161">#1161</a> from ko-build/dependabot/go_modules/github.com/spf13...</li> <li><a href="https://github.com/ko-build/ko/commit/449bcb61926cb3e3bcf191e8ca53fad5ab3a4e3c"><code>449bcb6</code></a> Bump github.com/spf13/viper from 1.16.0 to 1.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/c543dd83cc75cd849fb95637ea29e3c7c66d6f87"><code>c543dd8</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1160">#1160</a> from ko-build/dependabot/go_modules/golang.org/x/too...</li> <li><a href="https://github.com/ko-build/ko/commit/c1ae5f5ce4fe058830f24827c853d4db39a95250"><code>c1ae5f5</code></a> Bump golang.org/x/tools from 0.13.0 to 0.14.0</li> <li><a href="https://github.com/ko-build/ko/commit/e50d2fd5ff0ec88ac837ffe6f6c2f122eb54b9f8"><code>e50d2fd</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1159">#1159</a> from ko-build/dependabot/go_modules/golang.org/x/syn...</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.14.1...v0.15.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.14.1&new-version=0.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-17 17:47:47 +02:00
github.com/moby/term v0.5.0 // indirect
feat: upgrade nfpm to v2.12.0 (#2882) Signed-off-by: Carlos A Becker <caarlos0@gmail.com>
2022-02-04 20:51:42 +02:00
github.com/muesli/mango v0.1.0 // indirect
github.com/muesli/mango-pflag v0.1.0 // indirect
fix: race condition on logs This brings an update on caarlos0/log, precisely due to https://github.com/caarlos0/log/commit/452cd19227f733ea694ccce724390ac992ecc207, which fixes the bug reported at #3363. Closes #3363
2022-09-12 04:06:01 +02:00
github.com/muesli/reflow v0.3.0 // indirect
feat: add ko support (#3653) continuing the PR by @developer-guy - [x] should be a publisher, as it does publish the images it builds every time - [x] `Default` method does not work - [x] the `fromConfig` thing should probably be on the defaults, too - [x] wire `--skip-ko` - [x] documentation - [x] more tests - [x] use same registry as docker tests does - [ ] see if we can make the log output match goreleaser's - [ ] ?? closes #2556 closes #3490 Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com> Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> Co-authored-by: actions-user <actions@github.com> Co-authored-by: Jason Hall <jason@chainguard.dev> Co-authored-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
2023-01-17 03:34:49 +02:00
github.com/oklog/ulid v1.3.1 // indirect
refactor: improving minio and docker tests (#3642) using ory/dockertest to simplify integration tests Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com>
2022-12-15 15:25:52 +02:00
github.com/opencontainers/go-digest v1.0.0 // indirect
feat(deps): bump github.com/google/ko from 0.14.1 to 0.15.0 (#4373) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.14.1 to 0.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.15.0</h2> <h2>What's Changed</h2> <ul> <li>implement dumb cache for images by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1102">ko-build/ko#1102</a></li> <li>fixed typo in configuration.md by <a href="https://github.com/samlaf"><code>@​samlaf</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li>pkg/commands: fix dropped errors by <a href="https://github.com/alrs"><code>@​alrs</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li>ci: add govulncheck by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1110">ko-build/ko#1110</a></li> <li>chore: remove refs to deprecated io/ioutil by <a href="https://github.com/testwill"><code>@​testwill</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li>Update install docs to install ko using Scoop by <a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> <li>include go build output in build error by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1127">ko-build/ko#1127</a></li> <li>Use go1.21, clean up ci and drop go1.19 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1137">ko-build/ko#1137</a></li> <li>Update e2e.yaml by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1141">ko-build/ko#1141</a></li> <li>handle newfound lint errors by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1142">ko-build/ko#1142</a></li> <li>fix test broken by lint fix by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1143">ko-build/ko#1143</a></li> <li>Bump actions/checkout from 3.6.0 to 4.0.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1136">ko-build/ko#1136</a></li> <li>fix env var for go env by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1140">ko-build/ko#1140</a></li> <li>docs: add docs for TF and Lambda by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1139">ko-build/ko#1139</a></li> <li>docs: add Lambda and TF pages to sidebar by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1144">ko-build/ko#1144</a></li> <li>include example using go packages by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1145">ko-build/ko#1145</a></li> <li>fix the release workflow and install instructions by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1150">ko-build/ko#1150</a></li> <li>update missing places that was using go1.20 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1163">ko-build/ko#1163</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/samlaf"><code>@​samlaf</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li><a href="https://github.com/alrs"><code>@​alrs</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li><a href="https://github.com/testwill"><code>@​testwill</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li><a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0">https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/31035ad2026bfbafaa4f009baefe72463af1b3a7"><code>31035ad</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1164">#1164</a> from ko-build/dependabot/go_modules/golang.org/x/net...</li> <li><a href="https://github.com/ko-build/ko/commit/ba952fd091f9d27ee5c136e842b5e94dd715100c"><code>ba952fd</code></a> Bump golang.org/x/net from 0.16.0 to 0.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/277f5d74353950c8663fc04b7546f66e57bd6aaf"><code>277f5d7</code></a> update missing places that was using go1.20 (<a href="https://redirect.github.com/google/ko/issues/1163">#1163</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/b8b3b21f8348d7cab863fe1b4eaa47dfc47632da"><code>b8b3b21</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1162">#1162</a> from ko-build/dependabot/go_modules/github.com/googl...</li> <li><a href="https://github.com/ko-build/ko/commit/4890ab2887b653d3c340de4d119bfd17b703f182"><code>4890ab2</code></a> Bump github.com/google/go-cmp from 0.5.9 to 0.6.0</li> <li><a href="https://github.com/ko-build/ko/commit/30b62aee3faf6866cee6513ea7eb13f5a27cd7ca"><code>30b62ae</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1161">#1161</a> from ko-build/dependabot/go_modules/github.com/spf13...</li> <li><a href="https://github.com/ko-build/ko/commit/449bcb61926cb3e3bcf191e8ca53fad5ab3a4e3c"><code>449bcb6</code></a> Bump github.com/spf13/viper from 1.16.0 to 1.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/c543dd83cc75cd849fb95637ea29e3c7c66d6f87"><code>c543dd8</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1160">#1160</a> from ko-build/dependabot/go_modules/golang.org/x/too...</li> <li><a href="https://github.com/ko-build/ko/commit/c1ae5f5ce4fe058830f24827c853d4db39a95250"><code>c1ae5f5</code></a> Bump golang.org/x/tools from 0.13.0 to 0.14.0</li> <li><a href="https://github.com/ko-build/ko/commit/e50d2fd5ff0ec88ac837ffe6f6c2f122eb54b9f8"><code>e50d2fd</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1159">#1159</a> from ko-build/dependabot/go_modules/golang.org/x/syn...</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.14.1...v0.15.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.14.1&new-version=0.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-17 17:47:47 +02:00
github.com/opencontainers/image-spec v1.1.0-rc5 // indirect
chore(deps): bump github.com/opencontainers/runc from 1.1.5 to 1.1.12 (#4594) Bumps [github.com/opencontainers/runc](https://github.com/opencontainers/runc) from 1.1.5 to 1.1.12. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/opencontainers/runc/releases">github.com/opencontainers/runc's releases</a>.</em></p> <blockquote> <h2>runc 1.1.12 -- &quot;Now you're thinking with Portals™!&quot;</h2> <p>This is the twelfth patch release in the 1.1.z release branch of runc. It fixes a high-severity container breakout vulnerability involving leaked file descriptors, and users are strongly encouraged to update as soon as possible.</p> <ul> <li> <p>Fix <a href="https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv">CVE-2024-21626</a>, a container breakout attack that took advantage of a file descriptor that was leaked internally within runc (but never leaked to the container process).</p> <p>In addition to fixing the leak, several strict hardening measures were added to ensure that future internal leaks could not be used to break out in this manner again.</p> <p>Based on our research, while no other container runtime had a similar leak, none had any of the hardening steps we've introduced (and some runtimes would not check for any file descriptors that a calling process may have leaked to them, allowing for container breakouts due to basic user error).</p> </li> </ul> <h3>Static Linking Notices</h3> <p>The <code>runc</code> binary distributed with this release are <em>statically linked</em> with the following <a href="https://www.gnu.org/licenses/old-licenses/lgpl-2.1.en.html">GNU LGPL-2.1</a> licensed libraries, with <code>runc</code> acting as a &quot;work that uses the Library&quot;:</p> <ul> <li><a href="https://github.com/seccomp/libseccomp">libseccomp</a></li> </ul> <p>The versions of these libraries were not modified from their upstream versions, but in order to comply with the LGPL-2.1 (§6(a)), we have attached the complete source code for those libraries which (when combined with the attached runc source code) may be used to exercise your rights under the LGPL-2.1.</p> <p>However we strongly suggest that you make use of your distribution's packages or download them from the authoritative upstream sources, especially since these libraries are related to the security of your containers.</p> <!-- raw HTML omitted --> <p>Thanks to all of the contributors who made this release possible:</p> <ul> <li>Aleksa Sarai <a href="mailto:cyphar@cyphar.com">cyphar@cyphar.com</a></li> <li>hang.jiang <a href="mailto:hang.jiang@daocloud.io">hang.jiang@daocloud.io</a></li> <li>lfbzhm <a href="mailto:lifubang@acmcoder.com">lifubang@acmcoder.com</a></li> </ul> <p>Signed-off-by: Aleksa Sarai <a href="mailto:cyphar@cyphar.com">cyphar@cyphar.com</a></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/opencontainers/runc/blob/v1.1.12/CHANGELOG.md">github.com/opencontainers/runc's changelog</a>.</em></p> <blockquote> <h2>[1.1.12] - 2024-01-31</h2> <blockquote> <p>Now you're thinking with Portals™!</p> </blockquote> <h3>Security</h3> <ul> <li>Fix <a href="https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv">CVE-2024-21626</a>, a container breakout attack that took advantage of a file descriptor that was leaked internally within runc (but never leaked to the container process). In addition to fixing the leak, several strict hardening measures were added to ensure that future internal leaks could not be used to break out in this manner again. Based on our research, while no other container runtime had a similar leak, none had any of the hardening steps we've introduced (and some runtimes would not check for any file descriptors that a calling process may have leaked to them, allowing for container breakouts due to basic user error).</li> </ul> <h2>[1.1.11] - 2024-01-01</h2> <blockquote> <p>Happy New Year!</p> </blockquote> <h3>Fixed</h3> <ul> <li>Fix several issues with userns path handling. (<a href="https://redirect.github.com/opencontainers/runc/issues/4122">#4122</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/4124">#4124</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/4134">#4134</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/4144">#4144</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Support memory.peak and memory.swap.peak in cgroups v2. Add <code>swapOnlyUsage</code> in <code>MemoryStats</code>. This field reports swap-only usage. For cgroupv1, <code>Usage</code> and <code>Failcnt</code> are set by subtracting memory usage from memory+swap usage. For cgroupv2, <code>Usage</code>, <code>Limit</code>, and <code>MaxUsage</code> are set. (<a href="https://redirect.github.com/opencontainers/runc/issues/4000">#4000</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/4010">#4010</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/4131">#4131</a>)</li> <li>build(deps): bump github.com/cyphar/filepath-securejoin. (<a href="https://redirect.github.com/opencontainers/runc/issues/4140">#4140</a>)</li> </ul> <h2>[1.1.10] - 2023-10-31</h2> <blockquote> <p>Śruba, przykręcona we śnie, nie zmieni sytuacji, jaka panuje na jawie.</p> </blockquote> <h3>Added</h3> <ul> <li>Support for <code>hugetlb.&lt;pagesize&gt;.rsvd</code> limiting and accounting. Fixes the issue of postres failing when hugepage limits are set. (<a href="https://redirect.github.com/opencontainers/runc/issues/3859">#3859</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/4077">#4077</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Fixed permissions of a newly created directories to not depend on the value of umask in tmpcopyup feature implementation. (<a href="https://redirect.github.com/opencontainers/runc/issues/3991">#3991</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/4060">#4060</a>)</li> <li>libcontainer: cgroup v1 GetStats now ignores missing <code>kmem.limit_in_bytes</code> (fixes the compatibility with Linux kernel 6.1+). (<a href="https://redirect.github.com/opencontainers/runc/issues/4028">#4028</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/opencontainers/runc/commit/51d5e94601ceffbbd85688df1c928ecccbfa4685"><code>51d5e94</code></a> VERSION: release 1.1.12</li> <li><a href="https://github.com/opencontainers/runc/commit/2a4ed3e75b9e80d93d1836a9c4c1ebfa2b78870e"><code>2a4ed3e</code></a> merge 1.1-ghsa-xr7r-f8xq-vfvv into release-1.1</li> <li><a href="https://github.com/opencontainers/runc/commit/e9665f4d606b64bf9c4652ab2510da368bfbd951"><code>e9665f4</code></a> init: don't special-case logrus fds</li> <li><a href="https://github.com/opencontainers/runc/commit/683ad2ff3b01fb142ece7a8b3829de17150cf688"><code>683ad2f</code></a> libcontainer: mark all non-stdio fds O_CLOEXEC before spawning init</li> <li><a href="https://github.com/opencontainers/runc/commit/b6633f48a8c970433737b9be5bfe4f25d58a5aa7"><code>b6633f4</code></a> cgroup: plug leaks of /sys/fs/cgroup handle</li> <li><a href="https://github.com/opencontainers/runc/commit/284ba3057e428f8d6c7afcc3b0ac752e525957df"><code>284ba30</code></a> init: close internal fds before execve</li> <li><a href="https://github.com/opencontainers/runc/commit/fbe3eed1e568a376f371d2ced1b4ac16b7d7adde"><code>fbe3eed</code></a> setns init: do explicit lookup of execve argument early</li> <li><a href="https://github.com/opencontainers/runc/commit/0994249a5ec4e363bfcf9af58a87a722e9a3a31b"><code>0994249</code></a> init: verify after chdir that cwd is inside the container</li> <li><a href="https://github.com/opencontainers/runc/commit/506552a88bd3455e80a9b3829568e94ec0160309"><code>506552a</code></a> Fix File to Close</li> <li><a href="https://github.com/opencontainers/runc/commit/099ff69336840fecf3fc0ab13aab4c3aded640c3"><code>099ff69</code></a> merge <a href="https://redirect.github.com/opencontainers/runc/issues/4177">#4177</a> into opencontainers/runc:release-1.1</li> <li>Additional commits viewable in <a href="https://github.com/opencontainers/runc/compare/v1.1.5...v1.1.12">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/opencontainers/runc&package-manager=go_modules&previous-version=1.1.5&new-version=1.1.12)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-01 01:45:29 +02:00
github.com/opencontainers/runc v1.1.12 // indirect
feat: add ko support (#3653) continuing the PR by @developer-guy - [x] should be a publisher, as it does publish the images it builds every time - [x] `Default` method does not work - [x] the `fromConfig` thing should probably be on the defaults, too - [x] wire `--skip-ko` - [x] documentation - [x] more tests - [x] use same registry as docker tests does - [ ] see if we can make the log output match goreleaser's - [ ] ?? closes #2556 closes #3490 Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com> Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> Co-authored-by: actions-user <actions@github.com> Co-authored-by: Jason Hall <jason@chainguard.dev> Co-authored-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
2023-01-17 03:34:49 +02:00
github.com/pelletier/go-toml v1.9.5 // indirect
feat(deps): bump github.com/google/ko from 0.14.1 to 0.15.0 (#4373) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.14.1 to 0.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.15.0</h2> <h2>What's Changed</h2> <ul> <li>implement dumb cache for images by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1102">ko-build/ko#1102</a></li> <li>fixed typo in configuration.md by <a href="https://github.com/samlaf"><code>@​samlaf</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li>pkg/commands: fix dropped errors by <a href="https://github.com/alrs"><code>@​alrs</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li>ci: add govulncheck by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1110">ko-build/ko#1110</a></li> <li>chore: remove refs to deprecated io/ioutil by <a href="https://github.com/testwill"><code>@​testwill</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li>Update install docs to install ko using Scoop by <a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> <li>include go build output in build error by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1127">ko-build/ko#1127</a></li> <li>Use go1.21, clean up ci and drop go1.19 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1137">ko-build/ko#1137</a></li> <li>Update e2e.yaml by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1141">ko-build/ko#1141</a></li> <li>handle newfound lint errors by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1142">ko-build/ko#1142</a></li> <li>fix test broken by lint fix by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1143">ko-build/ko#1143</a></li> <li>Bump actions/checkout from 3.6.0 to 4.0.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1136">ko-build/ko#1136</a></li> <li>fix env var for go env by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1140">ko-build/ko#1140</a></li> <li>docs: add docs for TF and Lambda by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1139">ko-build/ko#1139</a></li> <li>docs: add Lambda and TF pages to sidebar by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1144">ko-build/ko#1144</a></li> <li>include example using go packages by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1145">ko-build/ko#1145</a></li> <li>fix the release workflow and install instructions by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1150">ko-build/ko#1150</a></li> <li>update missing places that was using go1.20 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1163">ko-build/ko#1163</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/samlaf"><code>@​samlaf</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li><a href="https://github.com/alrs"><code>@​alrs</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li><a href="https://github.com/testwill"><code>@​testwill</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li><a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0">https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/31035ad2026bfbafaa4f009baefe72463af1b3a7"><code>31035ad</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1164">#1164</a> from ko-build/dependabot/go_modules/golang.org/x/net...</li> <li><a href="https://github.com/ko-build/ko/commit/ba952fd091f9d27ee5c136e842b5e94dd715100c"><code>ba952fd</code></a> Bump golang.org/x/net from 0.16.0 to 0.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/277f5d74353950c8663fc04b7546f66e57bd6aaf"><code>277f5d7</code></a> update missing places that was using go1.20 (<a href="https://redirect.github.com/google/ko/issues/1163">#1163</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/b8b3b21f8348d7cab863fe1b4eaa47dfc47632da"><code>b8b3b21</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1162">#1162</a> from ko-build/dependabot/go_modules/github.com/googl...</li> <li><a href="https://github.com/ko-build/ko/commit/4890ab2887b653d3c340de4d119bfd17b703f182"><code>4890ab2</code></a> Bump github.com/google/go-cmp from 0.5.9 to 0.6.0</li> <li><a href="https://github.com/ko-build/ko/commit/30b62aee3faf6866cee6513ea7eb13f5a27cd7ca"><code>30b62ae</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1161">#1161</a> from ko-build/dependabot/go_modules/github.com/spf13...</li> <li><a href="https://github.com/ko-build/ko/commit/449bcb61926cb3e3bcf191e8ca53fad5ab3a4e3c"><code>449bcb6</code></a> Bump github.com/spf13/viper from 1.16.0 to 1.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/c543dd83cc75cd849fb95637ea29e3c7c66d6f87"><code>c543dd8</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1160">#1160</a> from ko-build/dependabot/go_modules/golang.org/x/too...</li> <li><a href="https://github.com/ko-build/ko/commit/c1ae5f5ce4fe058830f24827c853d4db39a95250"><code>c1ae5f5</code></a> Bump golang.org/x/tools from 0.13.0 to 0.14.0</li> <li><a href="https://github.com/ko-build/ko/commit/e50d2fd5ff0ec88ac837ffe6f6c2f122eb54b9f8"><code>e50d2fd</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1159">#1159</a> from ko-build/dependabot/go_modules/golang.org/x/syn...</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.14.1...v0.15.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.14.1&new-version=0.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-17 17:47:47 +02:00
github.com/pelletier/go-toml/v2 v2.1.0 // indirect
feat(deps): bump github.com/goreleaser/nfpm/v2 from 2.30.1 to 2.31.0 (#4144) latest and greatest
2023-06-26 18:20:47 +02:00
github.com/pjbgf/sha1cd v0.3.0 // indirect
feat(deps): bump gocloud.dev from 0.27.0 to 0.28.0 (#3689) Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.27.0 to 0.28.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-cloud/releases">gocloud.dev's releases</a>.</em></p> <blockquote> <h2>v0.28.0</h2> <p><strong>BREAKING CHANGES</strong>:</p> <ul> <li><strong>secrets/azurekeyvault</strong>: Updated to latest Azure SDK.</li> <li><strong>blob/azureblob</strong>: Updated to match recent breaking changes in the Azure packages (yes, again).</li> <li><strong>pubsub/awssnssqs</strong>: Fixed <code>BeforeSend</code> to take a pointer to the <code>SendMessageBatchRequestEntry</code> struct, so that it can be modified.</li> </ul> <p><strong>blob</strong></p> <ul> <li><strong>memblob</strong>: Fixed bug where use of <code>BeforeCopy</code> callback would drop the actual copying.</li> <li><strong>azureblob</strong>: Updated to match recent breaking changes in the Azure packages.</li> </ul> <p><strong>pubsub</strong></p> <ul> <li><strong>all</strong>: Simplified and improved batch sizing, should resolve issues with too-frequent polling in some situations.</li> <li><strong>azurepubsub</strong>: Made <code>ListenerTimeout</code> configurable.</li> <li><strong>gcppubsub</strong> and <strong>awssnssqs</strong>: Support lazy mode for <code>Nack</code> (where no explicit <code>Nack</code> is sent).</li> <li><strong>awssnssqs</strong>: Fixed <code>BeforeSend</code> to take a pointer to the <code>SendMessageBatchRequestEntry</code> struct, so that it can be modified.</li> </ul> <p><strong>secrets</strong></p> <ul> <li><strong>secrets/azurekeyvault</strong>: Updated to latest Azure SDK. Use azidentity.NewDefaultAzureCredential.</li> </ul> <p><strong>sql</strong></p> <ul> <li><strong>gcp/cloudsql</strong>: Fixed IAM login.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-cloud/commit/24166090495b8e084a23aa7d11fcc81ec33e4729"><code>2416609</code></a> all: prep for v0.28.0 (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3207">#3207</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/13f46eb8065d5ea62b757f5f0f11a56f48faf7cc"><code>13f46eb</code></a> pubsub: simplify and improve batch sizing, especially for low message rates</li> <li><a href="https://github.com/google/go-cloud/commit/8f2c2b9a392a8e4a3d7a4942f88f3df607f8f6d0"><code>8f2c2b9</code></a> pubsub/memsub: Add Options for batching (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3205">#3205</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/fe0a3d75fe43c039258df25ebf102602526e3052"><code>fe0a3d7</code></a> pubsub/awssqs: Fix BeforeSend/As to enable changes to the sqs input message (...</li> <li><a href="https://github.com/google/go-cloud/commit/dfaf95af34dd9022a69a061028e0ceec98e9c670"><code>dfaf95a</code></a> secrets/azurekeyvault: Use azidentity.NewDefaultAzureCredential to support ot...</li> <li><a href="https://github.com/google/go-cloud/commit/1e26311532928f060c490a7fbf2be92b55ee12c4"><code>1e26311</code></a> blob: Remove some debug logging (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3197">#3197</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/43ed5a499864c08b7b6549ff7085f19634a1f02c"><code>43ed5a4</code></a> pubsub/gcppubsub: Support lazy mode for Nacks (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3195">#3195</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/be80e70b3dcf7a6b86481881c7ac0b44a8095178"><code>be80e70</code></a> pubsub/awssnssqs: Support lazy mode for Nacks (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3194">#3194</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/7d690993a53cf8cc2e7af07872876d58601f1261"><code>7d69099</code></a> blob/azblob: Update to latest, and restore As for dirlist (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3191">#3191</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/e942f3c339f0eb617ac4dbc7f37cc4e5920ee7cc"><code>e942f3c</code></a> blob/azblob: Restore As for List entry (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3188">#3188</a>)</li> <li>Additional commits viewable in <a href="https://github.com/google/go-cloud/compare/v0.27.0...v0.28.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.27.0&new-version=0.28.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-01-11 14:09:51 +02:00
github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8 // indirect
feat: use go 1.17 (#2408) * feat: use go 1.17 Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * fix: go mod tidy Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * test: fix failing test Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * ci: increase lint timeout Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * ci: increase lint timeout Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com>
2021-08-25 01:49:11 +02:00
github.com/pkg/errors v0.9.1 // indirect
feat(deps): bump github.com/google/ko from 0.14.1 to 0.15.0 (#4373) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.14.1 to 0.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.15.0</h2> <h2>What's Changed</h2> <ul> <li>implement dumb cache for images by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1102">ko-build/ko#1102</a></li> <li>fixed typo in configuration.md by <a href="https://github.com/samlaf"><code>@​samlaf</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li>pkg/commands: fix dropped errors by <a href="https://github.com/alrs"><code>@​alrs</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li>ci: add govulncheck by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1110">ko-build/ko#1110</a></li> <li>chore: remove refs to deprecated io/ioutil by <a href="https://github.com/testwill"><code>@​testwill</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li>Update install docs to install ko using Scoop by <a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> <li>include go build output in build error by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1127">ko-build/ko#1127</a></li> <li>Use go1.21, clean up ci and drop go1.19 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1137">ko-build/ko#1137</a></li> <li>Update e2e.yaml by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1141">ko-build/ko#1141</a></li> <li>handle newfound lint errors by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1142">ko-build/ko#1142</a></li> <li>fix test broken by lint fix by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1143">ko-build/ko#1143</a></li> <li>Bump actions/checkout from 3.6.0 to 4.0.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1136">ko-build/ko#1136</a></li> <li>fix env var for go env by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1140">ko-build/ko#1140</a></li> <li>docs: add docs for TF and Lambda by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1139">ko-build/ko#1139</a></li> <li>docs: add Lambda and TF pages to sidebar by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1144">ko-build/ko#1144</a></li> <li>include example using go packages by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1145">ko-build/ko#1145</a></li> <li>fix the release workflow and install instructions by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1150">ko-build/ko#1150</a></li> <li>update missing places that was using go1.20 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1163">ko-build/ko#1163</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/samlaf"><code>@​samlaf</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li><a href="https://github.com/alrs"><code>@​alrs</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li><a href="https://github.com/testwill"><code>@​testwill</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li><a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0">https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/31035ad2026bfbafaa4f009baefe72463af1b3a7"><code>31035ad</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1164">#1164</a> from ko-build/dependabot/go_modules/golang.org/x/net...</li> <li><a href="https://github.com/ko-build/ko/commit/ba952fd091f9d27ee5c136e842b5e94dd715100c"><code>ba952fd</code></a> Bump golang.org/x/net from 0.16.0 to 0.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/277f5d74353950c8663fc04b7546f66e57bd6aaf"><code>277f5d7</code></a> update missing places that was using go1.20 (<a href="https://redirect.github.com/google/ko/issues/1163">#1163</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/b8b3b21f8348d7cab863fe1b4eaa47dfc47632da"><code>b8b3b21</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1162">#1162</a> from ko-build/dependabot/go_modules/github.com/googl...</li> <li><a href="https://github.com/ko-build/ko/commit/4890ab2887b653d3c340de4d119bfd17b703f182"><code>4890ab2</code></a> Bump github.com/google/go-cmp from 0.5.9 to 0.6.0</li> <li><a href="https://github.com/ko-build/ko/commit/30b62aee3faf6866cee6513ea7eb13f5a27cd7ca"><code>30b62ae</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1161">#1161</a> from ko-build/dependabot/go_modules/github.com/spf13...</li> <li><a href="https://github.com/ko-build/ko/commit/449bcb61926cb3e3bcf191e8ca53fad5ab3a4e3c"><code>449bcb6</code></a> Bump github.com/spf13/viper from 1.16.0 to 1.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/c543dd83cc75cd849fb95637ea29e3c7c66d6f87"><code>c543dd8</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1160">#1160</a> from ko-build/dependabot/go_modules/golang.org/x/too...</li> <li><a href="https://github.com/ko-build/ko/commit/c1ae5f5ce4fe058830f24827c853d4db39a95250"><code>c1ae5f5</code></a> Bump golang.org/x/tools from 0.13.0 to 0.14.0</li> <li><a href="https://github.com/ko-build/ko/commit/e50d2fd5ff0ec88ac837ffe6f6c2f122eb54b9f8"><code>e50d2fd</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1159">#1159</a> from ko-build/dependabot/go_modules/golang.org/x/syn...</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.14.1...v0.15.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.14.1&new-version=0.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-17 17:47:47 +02:00
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/prometheus/client_golang v1.17.0 // indirect
github.com/prometheus/client_model v0.5.0 // indirect
github.com/prometheus/common v0.45.0 // indirect
github.com/prometheus/procfs v0.12.0 // indirect
fix: race condition on logs This brings an update on caarlos0/log, precisely due to https://github.com/caarlos0/log/commit/452cd19227f733ea694ccce724390ac992ecc207, which fixes the bug reported at #3363. Closes #3363
2022-09-12 04:06:01 +02:00
github.com/rivo/uniseg v0.4.2 // indirect
feat: update nfpm (#2640) * feat: update nfpm * feat: update nfpm * feat: update nfpm * feat: update nfpm * fix: dir type * docs: dir * docs: typo * fix: race * fix: race cond
2021-11-14 03:23:11 +02:00
github.com/russross/blackfriday/v2 v2.1.0 // indirect
feat: use go 1.17 (#2408) * feat: use go 1.17 Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * fix: go mod tidy Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * test: fix failing test Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * ci: increase lint timeout Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * ci: increase lint timeout Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com>
2021-08-25 01:49:11 +02:00
github.com/sergi/go-diff v1.2.0 // indirect
feat(deps): bump github.com/goreleaser/nfpm/v2 from 2.30.1 to 2.31.0 (#4144) latest and greatest
2023-06-26 18:20:47 +02:00
github.com/shopspring/decimal v1.2.0 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/sigstore/cosign/v2 v2.2.1 // indirect
github.com/sigstore/rekor v1.3.3 // indirect
github.com/sigstore/sigstore v1.7.5 // indirect
feat(deps): bump github.com/google/ko from 0.14.1 to 0.15.0 (#4373) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.14.1 to 0.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.15.0</h2> <h2>What's Changed</h2> <ul> <li>implement dumb cache for images by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1102">ko-build/ko#1102</a></li> <li>fixed typo in configuration.md by <a href="https://github.com/samlaf"><code>@​samlaf</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li>pkg/commands: fix dropped errors by <a href="https://github.com/alrs"><code>@​alrs</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li>ci: add govulncheck by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1110">ko-build/ko#1110</a></li> <li>chore: remove refs to deprecated io/ioutil by <a href="https://github.com/testwill"><code>@​testwill</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li>Update install docs to install ko using Scoop by <a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> <li>include go build output in build error by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1127">ko-build/ko#1127</a></li> <li>Use go1.21, clean up ci and drop go1.19 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1137">ko-build/ko#1137</a></li> <li>Update e2e.yaml by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1141">ko-build/ko#1141</a></li> <li>handle newfound lint errors by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1142">ko-build/ko#1142</a></li> <li>fix test broken by lint fix by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1143">ko-build/ko#1143</a></li> <li>Bump actions/checkout from 3.6.0 to 4.0.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1136">ko-build/ko#1136</a></li> <li>fix env var for go env by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1140">ko-build/ko#1140</a></li> <li>docs: add docs for TF and Lambda by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1139">ko-build/ko#1139</a></li> <li>docs: add Lambda and TF pages to sidebar by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1144">ko-build/ko#1144</a></li> <li>include example using go packages by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1145">ko-build/ko#1145</a></li> <li>fix the release workflow and install instructions by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1150">ko-build/ko#1150</a></li> <li>update missing places that was using go1.20 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1163">ko-build/ko#1163</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/samlaf"><code>@​samlaf</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li><a href="https://github.com/alrs"><code>@​alrs</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li><a href="https://github.com/testwill"><code>@​testwill</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li><a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0">https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/31035ad2026bfbafaa4f009baefe72463af1b3a7"><code>31035ad</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1164">#1164</a> from ko-build/dependabot/go_modules/golang.org/x/net...</li> <li><a href="https://github.com/ko-build/ko/commit/ba952fd091f9d27ee5c136e842b5e94dd715100c"><code>ba952fd</code></a> Bump golang.org/x/net from 0.16.0 to 0.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/277f5d74353950c8663fc04b7546f66e57bd6aaf"><code>277f5d7</code></a> update missing places that was using go1.20 (<a href="https://redirect.github.com/google/ko/issues/1163">#1163</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/b8b3b21f8348d7cab863fe1b4eaa47dfc47632da"><code>b8b3b21</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1162">#1162</a> from ko-build/dependabot/go_modules/github.com/googl...</li> <li><a href="https://github.com/ko-build/ko/commit/4890ab2887b653d3c340de4d119bfd17b703f182"><code>4890ab2</code></a> Bump github.com/google/go-cmp from 0.5.9 to 0.6.0</li> <li><a href="https://github.com/ko-build/ko/commit/30b62aee3faf6866cee6513ea7eb13f5a27cd7ca"><code>30b62ae</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1161">#1161</a> from ko-build/dependabot/go_modules/github.com/spf13...</li> <li><a href="https://github.com/ko-build/ko/commit/449bcb61926cb3e3bcf191e8ca53fad5ab3a4e3c"><code>449bcb6</code></a> Bump github.com/spf13/viper from 1.16.0 to 1.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/c543dd83cc75cd849fb95637ea29e3c7c66d6f87"><code>c543dd8</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1160">#1160</a> from ko-build/dependabot/go_modules/golang.org/x/too...</li> <li><a href="https://github.com/ko-build/ko/commit/c1ae5f5ce4fe058830f24827c853d4db39a95250"><code>c1ae5f5</code></a> Bump golang.org/x/tools from 0.13.0 to 0.14.0</li> <li><a href="https://github.com/ko-build/ko/commit/e50d2fd5ff0ec88ac837ffe6f6c2f122eb54b9f8"><code>e50d2fd</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1159">#1159</a> from ko-build/dependabot/go_modules/golang.org/x/syn...</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.14.1...v0.15.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.14.1&new-version=0.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-17 17:47:47 +02:00
github.com/sirupsen/logrus v1.9.3 // indirect
sec(deps): bump github.com/go-git/go-git/v5 from 5.7.0 to 5.11.0 (#4505) Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.7.0 to 5.11.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's releases</a>.</em></p> <blockquote> <h2>v5.11.0</h2> <h2>What's Changed</h2> <ul> <li>git: validate reference names (<a href="https://redirect.github.com/go-git/go-git/issues/929">#929</a>) by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/950">go-git/go-git#950</a></li> <li>git: stop iterating at oldest shallow when pulling. Fixes <a href="https://redirect.github.com/go-git/go-git/issues/305">#305</a> by <a href="https://github.com/dhoizner"><code>@​dhoizner</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/939">go-git/go-git#939</a></li> <li>plumbing: object, enable renames in getFileStatsFromFilePatches by <a href="https://github.com/djmoch"><code>@​djmoch</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/941">go-git/go-git#941</a></li> <li>storage: filesystem, Add option to set a specific FS for alternates by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/953">go-git/go-git#953</a></li> <li>Align worktree validation with upstream and remove build warnings by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/958">go-git/go-git#958</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/dhoizner"><code>@​dhoizner</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/939">go-git/go-git#939</a></li> <li><a href="https://github.com/djmoch"><code>@​djmoch</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/941">go-git/go-git#941</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.10.1...v5.11.0">https://github.com/go-git/go-git/compare/v5.10.1...v5.11.0</a></p> <h2>v5.10.1</h2> <h2>What's Changed</h2> <ul> <li>Worktree, ignore ModeSocket files by <a href="https://github.com/steiler"><code>@​steiler</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/930">go-git/go-git#930</a></li> <li>git: add tracer package by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/916">go-git/go-git#916</a></li> <li>remote: Flip clause for fast-forward only check by <a href="https://github.com/adityasaky"><code>@​adityasaky</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/875">go-git/go-git#875</a></li> <li>plumbing: transport/ssh, Fix nil pointer dereference caused when an unreachable proxy server is set. Fixes <a href="https://redirect.github.com/go-git/go-git/issues/900">#900</a> by <a href="https://github.com/anandf"><code>@​anandf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/901">go-git/go-git#901</a></li> <li>plumbing: uppload-server-info, implement upload-server-info by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/896">go-git/go-git#896</a></li> <li>plumbing: optimise memory consumption for filesystem storage by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/799">go-git/go-git#799</a></li> <li>plumbing: format/packfile, Refactor patch delta by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/908">go-git/go-git#908</a></li> <li>plumbing: fix empty uploadpack request error by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/932">go-git/go-git#932</a></li> <li>plumbing: transport/git, Improve tests error message by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/752">go-git/go-git#752</a></li> <li>plumbing: format/pktline, Respect pktline error-line errors by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/936">go-git/go-git#936</a></li> <li>utils: remove ioutil.Pipe and use std library io.Pipe by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/922">go-git/go-git#922</a></li> <li>utils: move trace to utils by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/931">go-git/go-git#931</a></li> <li>cli: separate go module for cli by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/914">go-git/go-git#914</a></li> <li>build: bump github.com/google/go-cmp from 0.5.9 to 0.6.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/887">go-git/go-git#887</a></li> <li>build: bump actions/setup-go from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/891">go-git/go-git#891</a></li> <li>build: bump github.com/skeema/knownhosts from 1.2.0 to 1.2.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/888">go-git/go-git#888</a></li> <li>build: bump actions/checkout from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/890">go-git/go-git#890</a></li> <li>build: bump golang.org/x/sys from 0.13.0 to 0.14.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/907">go-git/go-git#907</a></li> <li>build: bump golang.org/x/text from 0.13.0 to 0.14.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/906">go-git/go-git#906</a></li> <li>build: bump golang.org/x/crypto from 0.14.0 to 0.15.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/917">go-git/go-git#917</a></li> <li>build: bump golang.org/x/net from 0.17.0 to 0.18.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/918">go-git/go-git#918</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/anandf"><code>@​anandf</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/901">go-git/go-git#901</a></li> <li><a href="https://github.com/steiler"><code>@​steiler</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/930">go-git/go-git#930</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.10.0...v5.10.1">https://github.com/go-git/go-git/compare/v5.10.0...v5.10.1</a></p> <h2>v5.10.0</h2> <h2>What's Changed</h2> <ul> <li>PlainInitOptions.Bare and allow using InitOptions with PlainInitWithOptions by <a href="https://github.com/ThinkChaos"><code>@​ThinkChaos</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/782">go-git/go-git#782</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-git/go-git/commit/5d08d3bd94c65a3b6c25c6fba6907d12b0dac4ca"><code>5d08d3b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/958">#958</a> from pjbgf/workval</li> <li><a href="https://github.com/go-git/go-git/commit/5bd1d8f4abcfbf1345a1e5a5ec9a96121f3746dc"><code>5bd1d8f</code></a> build: Ensure checkout is the first operation</li> <li><a href="https://github.com/go-git/go-git/commit/b2c19824771bbcbb21abb51abb319c1a610aa6b3"><code>b2c1982</code></a> git: worktree, Align validation with upstream rules</li> <li><a href="https://github.com/go-git/go-git/commit/cec7da63ca0412fce55a0bf0715b7ba44a41eaa2"><code>cec7da6</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/953">#953</a> from pjbgf/alternates</li> <li><a href="https://github.com/go-git/go-git/commit/8b47ceb1aa854f3c3bfa1c347157a04324fcd51e"><code>8b47ceb</code></a> storage: filesystem, Add option to set a specific FS for alternates</li> <li><a href="https://github.com/go-git/go-git/commit/4f614891047bae5d0f7a253f014175505b9821d7"><code>4f61489</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/941">#941</a> from djmoch/filestats-rename</li> <li><a href="https://github.com/go-git/go-git/commit/ae552ce0bf32cddb689727c4c9fa6bf4d3bd6499"><code>ae552ce</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/939">#939</a> from dhoizner/fix-pull-after-shallow</li> <li><a href="https://github.com/go-git/go-git/commit/cc1895b905ebadb09504d88444ff05932fa6e928"><code>cc1895b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/950">#950</a> from aymanbagabas/validate-ref</li> <li><a href="https://github.com/go-git/go-git/commit/de1d5a5978b9599ca3dacd58bbf699e4bb4cf6bd"><code>de1d5a5</code></a> git: validate reference names</li> <li><a href="https://github.com/go-git/go-git/commit/d87110b492c94d99ebdaea732b23a54b7efba94b"><code>d87110b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/948">#948</a> from go-git/dependabot/go_modules/cli/go-git/github.c...</li> <li>Additional commits viewable in <a href="https://github.com/go-git/go-git/compare/v5.7.0...v5.11.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.7.0&new-version=5.11.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-28 14:46:28 +02:00
github.com/skeema/knownhosts v1.2.1 // indirect
feat(deps): bump github.com/google/ko from 0.14.1 to 0.15.0 (#4373) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.14.1 to 0.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.15.0</h2> <h2>What's Changed</h2> <ul> <li>implement dumb cache for images by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1102">ko-build/ko#1102</a></li> <li>fixed typo in configuration.md by <a href="https://github.com/samlaf"><code>@​samlaf</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li>pkg/commands: fix dropped errors by <a href="https://github.com/alrs"><code>@​alrs</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li>ci: add govulncheck by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1110">ko-build/ko#1110</a></li> <li>chore: remove refs to deprecated io/ioutil by <a href="https://github.com/testwill"><code>@​testwill</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li>Update install docs to install ko using Scoop by <a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> <li>include go build output in build error by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1127">ko-build/ko#1127</a></li> <li>Use go1.21, clean up ci and drop go1.19 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1137">ko-build/ko#1137</a></li> <li>Update e2e.yaml by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1141">ko-build/ko#1141</a></li> <li>handle newfound lint errors by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1142">ko-build/ko#1142</a></li> <li>fix test broken by lint fix by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1143">ko-build/ko#1143</a></li> <li>Bump actions/checkout from 3.6.0 to 4.0.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1136">ko-build/ko#1136</a></li> <li>fix env var for go env by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1140">ko-build/ko#1140</a></li> <li>docs: add docs for TF and Lambda by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1139">ko-build/ko#1139</a></li> <li>docs: add Lambda and TF pages to sidebar by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1144">ko-build/ko#1144</a></li> <li>include example using go packages by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1145">ko-build/ko#1145</a></li> <li>fix the release workflow and install instructions by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1150">ko-build/ko#1150</a></li> <li>update missing places that was using go1.20 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1163">ko-build/ko#1163</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/samlaf"><code>@​samlaf</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li><a href="https://github.com/alrs"><code>@​alrs</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li><a href="https://github.com/testwill"><code>@​testwill</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li><a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0">https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/31035ad2026bfbafaa4f009baefe72463af1b3a7"><code>31035ad</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1164">#1164</a> from ko-build/dependabot/go_modules/golang.org/x/net...</li> <li><a href="https://github.com/ko-build/ko/commit/ba952fd091f9d27ee5c136e842b5e94dd715100c"><code>ba952fd</code></a> Bump golang.org/x/net from 0.16.0 to 0.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/277f5d74353950c8663fc04b7546f66e57bd6aaf"><code>277f5d7</code></a> update missing places that was using go1.20 (<a href="https://redirect.github.com/google/ko/issues/1163">#1163</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/b8b3b21f8348d7cab863fe1b4eaa47dfc47632da"><code>b8b3b21</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1162">#1162</a> from ko-build/dependabot/go_modules/github.com/googl...</li> <li><a href="https://github.com/ko-build/ko/commit/4890ab2887b653d3c340de4d119bfd17b703f182"><code>4890ab2</code></a> Bump github.com/google/go-cmp from 0.5.9 to 0.6.0</li> <li><a href="https://github.com/ko-build/ko/commit/30b62aee3faf6866cee6513ea7eb13f5a27cd7ca"><code>30b62ae</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1161">#1161</a> from ko-build/dependabot/go_modules/github.com/spf13...</li> <li><a href="https://github.com/ko-build/ko/commit/449bcb61926cb3e3bcf191e8ca53fad5ab3a4e3c"><code>449bcb6</code></a> Bump github.com/spf13/viper from 1.16.0 to 1.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/c543dd83cc75cd849fb95637ea29e3c7c66d6f87"><code>c543dd8</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1160">#1160</a> from ko-build/dependabot/go_modules/golang.org/x/too...</li> <li><a href="https://github.com/ko-build/ko/commit/c1ae5f5ce4fe058830f24827c853d4db39a95250"><code>c1ae5f5</code></a> Bump golang.org/x/tools from 0.13.0 to 0.14.0</li> <li><a href="https://github.com/ko-build/ko/commit/e50d2fd5ff0ec88ac837ffe6f6c2f122eb54b9f8"><code>e50d2fd</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1159">#1159</a> from ko-build/dependabot/go_modules/golang.org/x/syn...</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.14.1...v0.15.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.14.1&new-version=0.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-17 17:47:47 +02:00
github.com/spf13/afero v1.10.0 // indirect
feat(deps): bump github.com/goreleaser/nfpm/v2 from 2.30.1 to 2.31.0 (#4144) latest and greatest
2023-06-26 18:20:47 +02:00
github.com/spf13/cast v1.5.1 // indirect
feat: use go 1.17 (#2408) * feat: use go 1.17 Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * fix: go mod tidy Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * test: fix failing test Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * ci: increase lint timeout Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * ci: increase lint timeout Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com>
2021-08-25 01:49:11 +02:00
github.com/spf13/pflag v1.0.5 // indirect
feat(deps): bump github.com/google/ko from 0.14.1 to 0.15.0 (#4373) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.14.1 to 0.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.15.0</h2> <h2>What's Changed</h2> <ul> <li>implement dumb cache for images by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1102">ko-build/ko#1102</a></li> <li>fixed typo in configuration.md by <a href="https://github.com/samlaf"><code>@​samlaf</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li>pkg/commands: fix dropped errors by <a href="https://github.com/alrs"><code>@​alrs</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li>ci: add govulncheck by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1110">ko-build/ko#1110</a></li> <li>chore: remove refs to deprecated io/ioutil by <a href="https://github.com/testwill"><code>@​testwill</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li>Update install docs to install ko using Scoop by <a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> <li>include go build output in build error by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1127">ko-build/ko#1127</a></li> <li>Use go1.21, clean up ci and drop go1.19 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1137">ko-build/ko#1137</a></li> <li>Update e2e.yaml by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1141">ko-build/ko#1141</a></li> <li>handle newfound lint errors by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1142">ko-build/ko#1142</a></li> <li>fix test broken by lint fix by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1143">ko-build/ko#1143</a></li> <li>Bump actions/checkout from 3.6.0 to 4.0.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1136">ko-build/ko#1136</a></li> <li>fix env var for go env by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1140">ko-build/ko#1140</a></li> <li>docs: add docs for TF and Lambda by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1139">ko-build/ko#1139</a></li> <li>docs: add Lambda and TF pages to sidebar by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1144">ko-build/ko#1144</a></li> <li>include example using go packages by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1145">ko-build/ko#1145</a></li> <li>fix the release workflow and install instructions by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1150">ko-build/ko#1150</a></li> <li>update missing places that was using go1.20 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1163">ko-build/ko#1163</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/samlaf"><code>@​samlaf</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1105">ko-build/ko#1105</a></li> <li><a href="https://github.com/alrs"><code>@​alrs</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1109">ko-build/ko#1109</a></li> <li><a href="https://github.com/testwill"><code>@​testwill</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1092">ko-build/ko#1092</a></li> <li><a href="https://github.com/pgrunm"><code>@​pgrunm</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1118">ko-build/ko#1118</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0">https://github.com/ko-build/ko/compare/v0.14.1...v0.15.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/31035ad2026bfbafaa4f009baefe72463af1b3a7"><code>31035ad</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1164">#1164</a> from ko-build/dependabot/go_modules/golang.org/x/net...</li> <li><a href="https://github.com/ko-build/ko/commit/ba952fd091f9d27ee5c136e842b5e94dd715100c"><code>ba952fd</code></a> Bump golang.org/x/net from 0.16.0 to 0.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/277f5d74353950c8663fc04b7546f66e57bd6aaf"><code>277f5d7</code></a> update missing places that was using go1.20 (<a href="https://redirect.github.com/google/ko/issues/1163">#1163</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/b8b3b21f8348d7cab863fe1b4eaa47dfc47632da"><code>b8b3b21</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1162">#1162</a> from ko-build/dependabot/go_modules/github.com/googl...</li> <li><a href="https://github.com/ko-build/ko/commit/4890ab2887b653d3c340de4d119bfd17b703f182"><code>4890ab2</code></a> Bump github.com/google/go-cmp from 0.5.9 to 0.6.0</li> <li><a href="https://github.com/ko-build/ko/commit/30b62aee3faf6866cee6513ea7eb13f5a27cd7ca"><code>30b62ae</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1161">#1161</a> from ko-build/dependabot/go_modules/github.com/spf13...</li> <li><a href="https://github.com/ko-build/ko/commit/449bcb61926cb3e3bcf191e8ca53fad5ab3a4e3c"><code>449bcb6</code></a> Bump github.com/spf13/viper from 1.16.0 to 1.17.0</li> <li><a href="https://github.com/ko-build/ko/commit/c543dd83cc75cd849fb95637ea29e3c7c66d6f87"><code>c543dd8</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1160">#1160</a> from ko-build/dependabot/go_modules/golang.org/x/too...</li> <li><a href="https://github.com/ko-build/ko/commit/c1ae5f5ce4fe058830f24827c853d4db39a95250"><code>c1ae5f5</code></a> Bump golang.org/x/tools from 0.13.0 to 0.14.0</li> <li><a href="https://github.com/ko-build/ko/commit/e50d2fd5ff0ec88ac837ffe6f6c2f122eb54b9f8"><code>e50d2fd</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1159">#1159</a> from ko-build/dependabot/go_modules/golang.org/x/syn...</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.14.1...v0.15.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.14.1&new-version=0.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-17 17:47:47 +02:00
github.com/spf13/viper v1.17.0 // indirect
github.com/subosito/gotenv v1.6.0 // indirect
feat(schema): add command that generates jsonschema (#2589) * feat(schema): Add command that generates the jsonschema for .goreleaser.yml files This commit adds the jsonschema/schema subcommand that generates a jsonschema doc based on the Project go struct. For the config types that alternatively allow you to specify a string via custom UnmarshalYAML function, this commit adds the JSONSchemaType function, so the type gets documented with an oneOf with string or itself. Add yaml key names for properties that are currently missing them, so alecthomas/jsonschema generates the keys with correct casing. Signed-off-by: Patrick Hahn <patricksilashahn@gmx.net> * fix: Add linguist-generated attribute to generated schema json to exclude this file from pull request size validation Signed-off-by: Patrick Hahn <patricksilashahn@gmx.net> * fix: run gofumpt Signed-off-by: Patrick Hahn <patricksilashahn@gmx.net> * chore(schema): update alecthomas/jsonschema and regenerate schema.json Signed-off-by: Patrick Hahn <patricksilashahn@gmx.net>
2021-10-26 20:02:03 +02:00
github.com/technoweenie/multipartstreamer v1.0.1 // indirect
feat: add ko support (#3653) continuing the PR by @developer-guy - [x] should be a publisher, as it does publish the images it builds every time - [x] `Default` method does not work - [x] the `fromConfig` thing should probably be on the defaults, too - [x] wire `--skip-ko` - [x] documentation - [x] more tests - [x] use same registry as docker tests does - [ ] see if we can make the log output match goreleaser's - [ ] ?? closes #2556 closes #3490 Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com> Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> Co-authored-by: actions-user <actions@github.com> Co-authored-by: Jason Hall <jason@chainguard.dev> Co-authored-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
2023-01-17 03:34:49 +02:00
github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
feat: add mastodon (#3567) This PR adds [mastodon](https://joinmastodon.org/) as an announcement pipeline. 🥳 ![mastodon-announce](https://user-images.githubusercontent.com/42128690/202544345-d90d8f10-0818-4bc2-bc35-3dbcba4254b0.png) Resolves #3566 Signed-off-by: jolheiser <john.olheiser@gmail.com>
2022-11-18 01:40:00 +02:00
github.com/tomnomnom/linkheader v0.0.0-20180905144013-02ca5825eb80 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
github.com/vbatts/tar-split v0.11.5 // indirect
feat(deps): bump github.com/invopop/jsonschema from 0.8.0 to 0.9.0 Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>
2023-09-22 04:17:31 +02:00
github.com/wk8/go-ordered-map/v2 v2.1.8 // indirect
feat(deps): bump github.com/goreleaser/nfpm/v2 from 2.30.1 to 2.31.0 (#4144) latest and greatest
2023-06-26 18:20:47 +02:00
github.com/xanzy/ssh-agent v0.3.3 // indirect
feat: add ko support (#3653) continuing the PR by @developer-guy - [x] should be a publisher, as it does publish the images it builds every time - [x] `Default` method does not work - [x] the `fromConfig` thing should probably be on the defaults, too - [x] wire `--skip-ko` - [x] documentation - [x] more tests - [x] use same registry as docker tests does - [ ] see if we can make the log output match goreleaser's - [ ] ?? closes #2556 closes #3490 Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com> Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> Co-authored-by: actions-user <actions@github.com> Co-authored-by: Jason Hall <jason@chainguard.dev> Co-authored-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
2023-01-17 03:34:49 +02:00
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
refactor: improving minio and docker tests (#3642) using ory/dockertest to simplify integration tests Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com>
2022-12-15 15:25:52 +02:00
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
github.com/xeipuuv/gojsonschema v1.2.0 // indirect
feat(deps): update nfpm to v2.18.0 (#3311) Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com>
2022-08-16 06:00:17 +02:00
gitlab.com/digitalxero/go-conventional-commit v1.0.7 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
go.mongodb.org/mongo-driver v1.12.1 // indirect
feat(deps): bump gocloud.dev from 0.27.0 to 0.28.0 (#3689) Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.27.0 to 0.28.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-cloud/releases">gocloud.dev's releases</a>.</em></p> <blockquote> <h2>v0.28.0</h2> <p><strong>BREAKING CHANGES</strong>:</p> <ul> <li><strong>secrets/azurekeyvault</strong>: Updated to latest Azure SDK.</li> <li><strong>blob/azureblob</strong>: Updated to match recent breaking changes in the Azure packages (yes, again).</li> <li><strong>pubsub/awssnssqs</strong>: Fixed <code>BeforeSend</code> to take a pointer to the <code>SendMessageBatchRequestEntry</code> struct, so that it can be modified.</li> </ul> <p><strong>blob</strong></p> <ul> <li><strong>memblob</strong>: Fixed bug where use of <code>BeforeCopy</code> callback would drop the actual copying.</li> <li><strong>azureblob</strong>: Updated to match recent breaking changes in the Azure packages.</li> </ul> <p><strong>pubsub</strong></p> <ul> <li><strong>all</strong>: Simplified and improved batch sizing, should resolve issues with too-frequent polling in some situations.</li> <li><strong>azurepubsub</strong>: Made <code>ListenerTimeout</code> configurable.</li> <li><strong>gcppubsub</strong> and <strong>awssnssqs</strong>: Support lazy mode for <code>Nack</code> (where no explicit <code>Nack</code> is sent).</li> <li><strong>awssnssqs</strong>: Fixed <code>BeforeSend</code> to take a pointer to the <code>SendMessageBatchRequestEntry</code> struct, so that it can be modified.</li> </ul> <p><strong>secrets</strong></p> <ul> <li><strong>secrets/azurekeyvault</strong>: Updated to latest Azure SDK. Use azidentity.NewDefaultAzureCredential.</li> </ul> <p><strong>sql</strong></p> <ul> <li><strong>gcp/cloudsql</strong>: Fixed IAM login.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-cloud/commit/24166090495b8e084a23aa7d11fcc81ec33e4729"><code>2416609</code></a> all: prep for v0.28.0 (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3207">#3207</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/13f46eb8065d5ea62b757f5f0f11a56f48faf7cc"><code>13f46eb</code></a> pubsub: simplify and improve batch sizing, especially for low message rates</li> <li><a href="https://github.com/google/go-cloud/commit/8f2c2b9a392a8e4a3d7a4942f88f3df607f8f6d0"><code>8f2c2b9</code></a> pubsub/memsub: Add Options for batching (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3205">#3205</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/fe0a3d75fe43c039258df25ebf102602526e3052"><code>fe0a3d7</code></a> pubsub/awssqs: Fix BeforeSend/As to enable changes to the sqs input message (...</li> <li><a href="https://github.com/google/go-cloud/commit/dfaf95af34dd9022a69a061028e0ceec98e9c670"><code>dfaf95a</code></a> secrets/azurekeyvault: Use azidentity.NewDefaultAzureCredential to support ot...</li> <li><a href="https://github.com/google/go-cloud/commit/1e26311532928f060c490a7fbf2be92b55ee12c4"><code>1e26311</code></a> blob: Remove some debug logging (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3197">#3197</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/43ed5a499864c08b7b6549ff7085f19634a1f02c"><code>43ed5a4</code></a> pubsub/gcppubsub: Support lazy mode for Nacks (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3195">#3195</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/be80e70b3dcf7a6b86481881c7ac0b44a8095178"><code>be80e70</code></a> pubsub/awssnssqs: Support lazy mode for Nacks (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3194">#3194</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/7d690993a53cf8cc2e7af07872876d58601f1261"><code>7d69099</code></a> blob/azblob: Update to latest, and restore As for dirlist (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3191">#3191</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/e942f3c339f0eb617ac4dbc7f37cc4e5920ee7cc"><code>e942f3c</code></a> blob/azblob: Restore As for List entry (<a href="https://github-redirect.dependabot.com/google/go-cloud/issues/3188">#3188</a>)</li> <li>Additional commits viewable in <a href="https://github.com/google/go-cloud/compare/v0.27.0...v0.28.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.27.0&new-version=0.28.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-01-11 14:09:51 +02:00
go.opencensus.io v0.24.0 // indirect
feat(deps): bump the gomod-deps group with 3 updates (#4200) Bumps the gomod-deps group with 3 updates: [github.com/xanzy/go-gitlab](https://github.com/xanzy/go-gitlab), [gocloud.dev](https://github.com/google/go-cloud) and [go.uber.org/automaxprocs](https://github.com/uber-go/automaxprocs). Updates `github.com/xanzy/go-gitlab` from 0.86.0 to 0.88.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/xanzy/go-gitlab/commit/7e3c23c9c221c0a334e11356503a99d41f206651"><code>7e3c23c</code></a> Update pipeline tests</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/2ac3eea05ffd9c096624ce3f88bf88132940b025"><code>2ac3eea</code></a> Merge pull request <a href="https://redirect.github.com/xanzy/go-gitlab/issues/1758">#1758</a> from billiechar/billiechar-snippet-moves</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/ddb5ca097455e3087ade383fec32ab07d24cb2c0"><code>ddb5ca0</code></a> Update the PR to make the code consistent</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/a4d27d6848beb49923d87d6201330f869f230f8b"><code>a4d27d6</code></a> Merge pull request <a href="https://redirect.github.com/xanzy/go-gitlab/issues/1759">#1759</a> from PatrickRice-KSC/add-missing-housekeeping-setting</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/a42af8593e45e5a55a6008e482ecbc3dc6f5d06b"><code>a42af85</code></a> Change PipelineTestCases.SystemOutput to interface{}</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/89486a0530374b782bb0267664a5bd49394fbb31"><code>89486a0</code></a> Add missing housekeeping setting</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/852645c7728d7a4284053806b68682b2905c856a"><code>852645c</code></a> Update tests</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/f2c344ca14c5829c55154263b6504d57b26126c3"><code>f2c344c</code></a> Use separate options for each schedule</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/86dd6321cdc296bc3f9a065718e58ea33cb1e686"><code>86dd632</code></a> Add snippet repository storage move APIs</li> <li><a href="https://github.com/xanzy/go-gitlab/commit/3c1f9bfa0d349acfb0aba8991a1abdf62495ee81"><code>3c1f9bf</code></a> Use io.ReadAll instead of ioutil.ReadAll</li> <li>Additional commits viewable in <a href="https://github.com/xanzy/go-gitlab/compare/v0.86.0...v0.88.0">compare view</a></li> </ul> </details> <br /> Updates `gocloud.dev` from 0.30.0 to 0.32.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-cloud/releases">gocloud.dev's releases</a>.</em></p> <blockquote> <h2>v0.32.0</h2> <p>Redoing <code>v0.31.0</code> since I think I messed up the tags. Copying the release notes:</p> <p><strong>all</strong></p> <ul> <li>Update <code>go</code> version in <code>go.mod</code> to maintain cleaner <code>go.mod</code> and <code>go.sum</code> files.</li> </ul> <p><strong>blob</strong></p> <ul> <li><strong>all</strong>: Pass through reader/writer to <code>WriteTo</code>/<code>ReadFrom</code> if available (optimization).</li> <li><strong>all</strong>: Make <code>blob.Bucket</code> implement <code>io/fs.FS</code> and <code>io/fs.SubFS</code>.</li> <li><strong>gcsblob</strong>: Add support for forcing an unauthenticated client.</li> </ul> <p><strong>server</strong></p> <ul> <li>Make <code>requestlog</code> internal structs implement <code>http.Flusher</code>.</li> <li>Don't always read the full request in order to calculate the request size; use <code>Content-Length</code> when available.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-cloud/commit/728b7c1395cb35d23e85ee0a8e957744e2560183"><code>728b7c1</code></a> all: prerelease take 2 (<a href="https://redirect.github.com/google/go-cloud/issues/3278">#3278</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/838a8fd9b6b7efc90b55cb5ed10e19463cbb1262"><code>838a8fd</code></a> all: prerelease (<a href="https://redirect.github.com/google/go-cloud/issues/3277">#3277</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/0f33c81c8dbec9d5302d9615b95c5ba878e0ede9"><code>0f33c81</code></a> all: add dragonfly build to test suite (<a href="https://redirect.github.com/google/go-cloud/issues/3268">#3268</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/bfd1b284ad86ce55bd0a7bc3e1c27fc8814fb87a"><code>bfd1b28</code></a> all: update dependencies (<a href="https://redirect.github.com/google/go-cloud/issues/3276">#3276</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/8d4590ac1e51bca704bc85422cb0a2f2d0b1b7ba"><code>8d4590a</code></a> server/requestlog: Don't consume entire body just to get a request size (<a href="https://redirect.github.com/google/go-cloud/issues/3274">#3274</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/a1d9f4295c59f30b30a085682b47e314c6960673"><code>a1d9f42</code></a> server/requestlog: make responseStats implement http.Flusher (<a href="https://redirect.github.com/google/go-cloud/issues/3275">#3275</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/8cab06ea136cfdd73f67300332994f81234469bc"><code>8cab06e</code></a> blob/gcsblob: add support for forcing an authenticated client (<a href="https://redirect.github.com/google/go-cloud/issues/3273">#3273</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/0e5728dd337838e82e07e03dcef9f54dfc04cc52"><code>0e5728d</code></a> blob: make blob.Bucket implement io/fs.FS and io/fs.SubFS (<a href="https://redirect.github.com/google/go-cloud/issues/3272">#3272</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/a6551792237ccc995a6e95169210ac8e77dbcd94"><code>a655179</code></a> all: update go.mod files to go 1.19 (<a href="https://redirect.github.com/google/go-cloud/issues/3271">#3271</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/8385fc39c70f6589823ca019e399f5514feb377d"><code>8385fc3</code></a> blob: pass through reader/writer to <code>WriteTo</code>/<code>ReadFrom</code> if available (<a href="https://redirect.github.com/google/go-cloud/issues/3267">#3267</a>)</li> <li>Additional commits viewable in <a href="https://github.com/google/go-cloud/compare/v0.30.0...v0.32.0">compare view</a></li> </ul> </details> <br /> Updates `go.uber.org/automaxprocs` from 1.5.2 to 1.5.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/uber-go/automaxprocs/releases">go.uber.org/automaxprocs's releases</a>.</em></p> <blockquote> <h2>v1.5.3</h2> <ul> <li>Fix mountinfo parsing when super options have fields with spaces.</li> <li>Fix division by zero while parsing cgroups.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/uber-go/automaxprocs/blob/master/CHANGELOG.md">go.uber.org/automaxprocs's changelog</a>.</em></p> <blockquote> <h2>v1.5.3 (2023-07-19)</h2> <ul> <li>Fix mountinfo parsing when super options have fields with spaces.</li> <li>Fix division by zero while parsing cgroups.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/uber-go/automaxprocs/commit/e83e959d8845f659d02749ba5598fd62a7129e4e"><code>e83e959</code></a> Release v1.5.3 (<a href="https://redirect.github.com/uber-go/automaxprocs/issues/77">#77</a>)</li> <li><a href="https://github.com/uber-go/automaxprocs/commit/94404505e072633727945d6adc276be8759dadcf"><code>9440450</code></a> Update actions (<a href="https://redirect.github.com/uber-go/automaxprocs/issues/76">#76</a>)</li> <li><a href="https://github.com/uber-go/automaxprocs/commit/4b0a5c9c3c30af086d1251cecd4114b7d4b55a45"><code>4b0a5c9</code></a> set CI perms to readonly (<a href="https://redirect.github.com/uber-go/automaxprocs/issues/75">#75</a>)</li> <li><a href="https://github.com/uber-go/automaxprocs/commit/c64632e175f532a5fe994622797d70b06338337e"><code>c64632e</code></a> Drop Go 1.17 and Go 1.18 from CI (<a href="https://redirect.github.com/uber-go/automaxprocs/issues/74">#74</a>)</li> <li><a href="https://github.com/uber-go/automaxprocs/commit/60f22786b2d20055ca8d888ed455a25aed935bea"><code>60f2278</code></a> fix: mountinfo parsing (<a href="https://redirect.github.com/uber-go/automaxprocs/issues/73">#73</a>)</li> <li><a href="https://github.com/uber-go/automaxprocs/commit/d064ede19db88036b1a2fb6b41113717a84dfda2"><code>d064ede</code></a> Fix division by zero (<a href="https://redirect.github.com/uber-go/automaxprocs/issues/71">#71</a>)</li> <li>See full diff in <a href="https://github.com/uber-go/automaxprocs/compare/v1.5.2...v1.5.3">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-07-20 14:56:26 +02:00
go.uber.org/automaxprocs v1.5.3
feat(deps): bump github.com/goreleaser/nfpm/v2 from 2.34.0 to 2.35.0 (#4492) Bumps [github.com/goreleaser/nfpm/v2](https://github.com/goreleaser/nfpm) from 2.34.0 to 2.35.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/goreleaser/nfpm/releases">github.com/goreleaser/nfpm/v2's releases</a>.</em></p> <blockquote> <h2>v2.35.0</h2> <h2>Changelog</h2> <h3>New Features</h3> <ul> <li>9c4fc0e886dabcd359967cdeca9107973e93c4b9: feat: reproducible packages (<a href="https://redirect.github.com/goreleaser/nfpm/issues/748">#748</a>) (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>3485ec3edaba34f90ab57c287ac71eaabfc816be: fix(deb): blank line in package description (<a href="https://redirect.github.com/goreleaser/nfpm/issues/742">#742</a>) (<a href="https://github.com/abemedia"><code>@​abemedia</code></a>)</li> <li>60cff806c953650d9bda31fda43452003552784b: fix: Ensure reproducable Deb package (<a href="https://redirect.github.com/goreleaser/nfpm/issues/747">#747</a>) (<a href="https://github.com/keliramu"><code>@​keliramu</code></a>)</li> <li>2c8f9e0d70ccc37e2eb6433daccc3ca2f67841a1: fix: config merge (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> <li>216b17ffff80a5faad835fc53cbe461322d4bf6a: fix: example should not have prefixed version (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> <li>cdd9a621e98bb5e1b41798b74b720a3273e743ab: fix: use parent owner/group on typedir (<a href="https://redirect.github.com/goreleaser/nfpm/issues/754">#754</a>) (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> </ul> <h3>Dependency updates</h3> <ul> <li>a8707cd42874f46a192ec2ef9918d3a75631afb6: feat(deps): bump github.com/klauspost/compress from 1.17.2 to 1.17.3 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/737">#737</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li> <li>6f2eb59cd263e4a8516ca6addb40e4a5d87b1084: feat(deps): bump github.com/klauspost/compress from 1.17.3 to 1.17.4 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/745">#745</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li> <li>6c241370ccdd5718730556f2b8c13e4733d0fda7: feat(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/732">#732</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li> <li>d56350e61f34f7a596d2383b365da633798aed97: feat(deps): bump golang.org/x/crypto from 0.14.0 to 0.17.0 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/756">#756</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li> </ul> <h3>Build process updates</h3> <ul> <li>560c42ca3c87a2938e3b9cc841ec6cde05c8984b: build: added shell.nix (<a href="https://redirect.github.com/goreleaser/nfpm/issues/743">#743</a>) (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> <li>29c85136454eabe774558c1b67e3ecf025269f55: build: setup nur and winget (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> </ul> <h3>Other work</h3> <ul> <li>c4f2da3568bdd0d2882a02a29b60101f944e0f33: docs: correct GOARCH docs (<a href="https://redirect.github.com/goreleaser/nfpm/issues/733">#733</a>) (<a href="https://github.com/cognifloyd"><code>@​cognifloyd</code></a>)</li> <li>aaaa3fbb8625a9fe03ba2cb5e2c0f050d2393e6b: docs: fix systemd note (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> <li>f0941db79b18d292a921e0ea778fcf5d1c282e0e: docs: update cmd docs (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> <li>7439013fb5dc9357e84aabb36823a21c1b97e8ba: docs: update cmd docs (<a href="https://github.com/caarlos0"><code>@​caarlos0</code></a>)</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/goreleaser/nfpm/compare/v2.34.0...v2.35.0">https://github.com/goreleaser/nfpm/compare/v2.34.0...v2.35.0</a></p> <h2>Helping out</h2> <p>This release is only possible thanks to <strong>all</strong> the support of <strong>awesome people</strong>!</p> <p>Want to be one of them? You can <a href="https://goreleaser.com/sponsors/">sponsor</a> or <a href="https://goreleaser.com/contributing">contribute with code</a>.</p> <h2>Where to go next?</h2> <ul> <li>nFPM is a satellite project from GoReleaser. <a href="https://goreleaser.com">Check it out</a>!</li> <li>Find examples and commented usage of all options in our <a href="https://nfpm.goreleaser.com/">website</a>.</li> <li>Reach out on <a href="https://discord.gg/RGEBtg8vQ6">Discord</a> and <a href="https://twitter.com/goreleaser">Twitter</a>!</li> </ul> <p><!-- raw HTML omitted --><!-- raw HTML omitted --><!-- raw HTML omitted --></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/goreleaser/nfpm/commit/29c85136454eabe774558c1b67e3ecf025269f55"><code>29c8513</code></a> build: setup nur and winget</li> <li><a href="https://github.com/goreleaser/nfpm/commit/cdd9a621e98bb5e1b41798b74b720a3273e743ab"><code>cdd9a62</code></a> fix: use parent owner/group on typedir (<a href="https://redirect.github.com/goreleaser/nfpm/issues/754">#754</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/d56350e61f34f7a596d2383b365da633798aed97"><code>d56350e</code></a> feat(deps): bump golang.org/x/crypto from 0.14.0 to 0.17.0 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/756">#756</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/99bf0d0cf933113d23f200f6d4201f3cf3d93f22"><code>99bf0d0</code></a> test: testifylint fixes (<a href="https://redirect.github.com/goreleaser/nfpm/issues/753">#753</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/8c91e5ebefb281051472fe33c1f68dc3e1587a41"><code>8c91e5e</code></a> chore(deps): bump github/codeql-action from 2 to 3 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/752">#752</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/e43aa7f7d1ec6752af8af47987981cf882f22fa0"><code>e43aa7f</code></a> chore(deps): bump sigstore/cosign-installer from 3.2.0 to 3.3.0 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/751">#751</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/2c8f9e0d70ccc37e2eb6433daccc3ca2f67841a1"><code>2c8f9e0</code></a> fix: config merge</li> <li><a href="https://github.com/goreleaser/nfpm/commit/7439013fb5dc9357e84aabb36823a21c1b97e8ba"><code>7439013</code></a> docs: update cmd docs</li> <li><a href="https://github.com/goreleaser/nfpm/commit/9c4fc0e886dabcd359967cdeca9107973e93c4b9"><code>9c4fc0e</code></a> feat: reproducible packages (<a href="https://redirect.github.com/goreleaser/nfpm/issues/748">#748</a>)</li> <li><a href="https://github.com/goreleaser/nfpm/commit/c3142513c990e867c93c1acad256c9960a059fa1"><code>c314251</code></a> chore(deps): bump actions/setup-go from 4 to 5 (<a href="https://redirect.github.com/goreleaser/nfpm/issues/749">#749</a>)</li> <li>Additional commits viewable in <a href="https://github.com/goreleaser/nfpm/compare/v2.34.0...v2.35.0">compare view</a></li> </ul> </details> <br /> <details> <summary>Most Recent Ignore Conditions Applied to This Pull Request</summary> | Dependency Name | Ignore Conditions | | --- | --- | | github.com/goreleaser/nfpm/v2 | [>= 2.24.a, < 2.25] | </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/goreleaser/nfpm/v2&package-manager=go_modules&previous-version=2.34.0&new-version=2.35.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-21 14:16:43 +02:00
golang.org/x/exp v0.0.0-20231206192017-f3f8817b8deb
chore(deps): bump golang.org/x/tools from 0.17.0 to 0.18.0 (#4628) Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.17.0 to 0.18.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/tools/commit/c5643e9baf7fed6936d70e3abf925f86fa895ca1"><code>c5643e9</code></a> gopls/internal/server: fix two bugs related to dynamic configuration</li> <li><a href="https://github.com/golang/tools/commit/50b4f1b124a3a03ca655a70817a9b95eedab863d"><code>50b4f1b</code></a> gopls/internal/golang: close open file</li> <li><a href="https://github.com/golang/tools/commit/f0ef3c690241cae5119135077dee723e50c1278d"><code>f0ef3c6</code></a> gopls: update x/telemetry dependency to fix crash</li> <li><a href="https://github.com/golang/tools/commit/8cf0a8e204a2438da431f503635abed925cbfb79"><code>8cf0a8e</code></a> gopls: record that v0.15 will be the last to support go1.18</li> <li><a href="https://github.com/golang/tools/commit/730dc3c170c3e54f0dc78e72a0943f7cd43bb425"><code>730dc3c</code></a> gopls/internal/settings: add a hidden option to disable zero config</li> <li><a href="https://github.com/golang/tools/commit/95f04f4ae85908c11fcb0f0cdb7d0e14ca318fe3"><code>95f04f4</code></a> gopls/internal/golang: add resolve support for inline refactorings</li> <li><a href="https://github.com/golang/tools/commit/9619683231abea86b02c3e2af49a1f5ee9fc5d1a"><code>9619683</code></a> gopls/internal/cache: treat local replaces as workspace modules</li> <li><a href="https://github.com/golang/tools/commit/a5af84e3f3e3a6f2652789eeba70253d6ea8cb4c"><code>a5af84e</code></a> gopls/internal/cache: check views on any on-disk change to go.mod files</li> <li><a href="https://github.com/golang/tools/commit/a7407facde3f3a9b2736a7306823549d2c24efae"><code>a7407fa</code></a> gopls: update telemetry</li> <li><a href="https://github.com/golang/tools/commit/314368ddf001d9629fdf2df9fce2b209f8890925"><code>314368d</code></a> go/analysis/passes/deepequalerrors: audit for types.Alias safety</li> <li>Additional commits viewable in <a href="https://github.com/golang/tools/compare/v0.17.0...v0.18.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/tools&package-manager=go_modules&previous-version=0.17.0&new-version=0.18.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-13 14:16:20 +02:00
golang.org/x/mod v0.15.0 // indirect
chore(deps): bump golang.org/x/oauth2 from 0.17.0 to 0.18.0 (#4668)
2024-03-05 13:57:00 +02:00
golang.org/x/net v0.22.0 // indirect
golang.org/x/sys v0.18.0 // indirect
golang.org/x/term v0.18.0 // indirect
feat(deps): bump gocloud.dev from 0.34.0 to 0.35.0 (#4467) Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.34.0 to 0.35.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-cloud/releases">gocloud.dev's releases</a>.</em></p> <blockquote> <h2>v0.35.0</h2> <p><strong>BREAKING CHANGES</strong></p> <p>This release updates the dependency on AWS/S3, which included some breaking changes; see <a href="https://redirect.github.com/google/go-cloud/pull/3342">google/go-cloud#3342</a> for details.</p> <p><strong>blob</strong></p> <ul> <li><em>gcsblob</em>: Fix unauthenticated requests.</li> </ul> <p><strong>runtimevar</strong></p> <ul> <li><em>constantvar</em>: Add support for reading the constant variable value from the environment.</li> </ul> <p><strong>docstore</strong></p> <ul> <li><em>gcpfilestore</em>: Add support for non-default databases.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-cloud/commit/27e0bca95dae3165b94cab4f9b7e2e4b087c8aef"><code>27e0bca</code></a> all: prep for release (<a href="https://redirect.github.com/google/go-cloud/issues/3350">#3350</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/53ccd8db26a14fd2a40bfcb28af1a1ceba4663f4"><code>53ccd8d</code></a> all: update deps, including a breaking S3 change (<a href="https://redirect.github.com/google/go-cloud/issues/3342">#3342</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/fa413a39cdf8ffe0890a1b0a4cf5e06e0c915592"><code>fa413a3</code></a> docstore/gcpfilestore: add support for non-default databases. (<a href="https://redirect.github.com/google/go-cloud/issues/3345">#3345</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/c04000b96462ad3ec62e633eafd759185991bb27"><code>c04000b</code></a> secrets/hashivault: Update go-jose per dependabot (<a href="https://redirect.github.com/google/go-cloud/issues/3346">#3346</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/6d5d2890816abc88cd11ef13d6cd6506eb5b5537"><code>6d5d289</code></a> pubsub/natspubsub: upgrade a dependency (<a href="https://redirect.github.com/google/go-cloud/issues/3336">#3336</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/375e097193225b4ef300a336e04ccad9ace50bc1"><code>375e097</code></a> pubsub/natspubsub: Update dependency (<a href="https://redirect.github.com/google/go-cloud/issues/3331">#3331</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/35ac324ff7fae5ddc0f9dc2ff234a7d6b4935a20"><code>35ac324</code></a> all: update dependencies (<a href="https://redirect.github.com/google/go-cloud/issues/3329">#3329</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/4a18be0f4a48c145da4a76499485a45478fd69aa"><code>4a18be0</code></a> secrets/awskms: update the example for the AWS ARN use case (<a href="https://redirect.github.com/google/go-cloud/issues/3320">#3320</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/486d484a8f73fd5bedc910d4fd89c52e11412e68"><code>486d484</code></a> kafkapubsub: rename dependency Shopify/sarama to IBM/sarama (<a href="https://redirect.github.com/google/go-cloud/issues/3319">#3319</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/db7e808e313228ed8607a94d6e5cd075d66f4e86"><code>db7e808</code></a> runtimevar/constantvar: Add support for reading the constantvar from an envir...</li> <li>Additional commits viewable in <a href="https://github.com/google/go-cloud/compare/v0.34.0...v0.35.0">compare view</a></li> </ul> </details> <br /> <details> <summary>Most Recent Ignore Conditions Applied to This Pull Request</summary> | Dependency Name | Ignore Conditions | | --- | --- | | gocloud.dev | [>= 0.25.a, < 0.26] | </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.34.0&new-version=0.35.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-11 12:55:26 +02:00
golang.org/x/time v0.4.0 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
feat(deps): bump gocloud.dev from 0.34.0 to 0.35.0 (#4467) Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.34.0 to 0.35.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-cloud/releases">gocloud.dev's releases</a>.</em></p> <blockquote> <h2>v0.35.0</h2> <p><strong>BREAKING CHANGES</strong></p> <p>This release updates the dependency on AWS/S3, which included some breaking changes; see <a href="https://redirect.github.com/google/go-cloud/pull/3342">google/go-cloud#3342</a> for details.</p> <p><strong>blob</strong></p> <ul> <li><em>gcsblob</em>: Fix unauthenticated requests.</li> </ul> <p><strong>runtimevar</strong></p> <ul> <li><em>constantvar</em>: Add support for reading the constant variable value from the environment.</li> </ul> <p><strong>docstore</strong></p> <ul> <li><em>gcpfilestore</em>: Add support for non-default databases.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-cloud/commit/27e0bca95dae3165b94cab4f9b7e2e4b087c8aef"><code>27e0bca</code></a> all: prep for release (<a href="https://redirect.github.com/google/go-cloud/issues/3350">#3350</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/53ccd8db26a14fd2a40bfcb28af1a1ceba4663f4"><code>53ccd8d</code></a> all: update deps, including a breaking S3 change (<a href="https://redirect.github.com/google/go-cloud/issues/3342">#3342</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/fa413a39cdf8ffe0890a1b0a4cf5e06e0c915592"><code>fa413a3</code></a> docstore/gcpfilestore: add support for non-default databases. (<a href="https://redirect.github.com/google/go-cloud/issues/3345">#3345</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/c04000b96462ad3ec62e633eafd759185991bb27"><code>c04000b</code></a> secrets/hashivault: Update go-jose per dependabot (<a href="https://redirect.github.com/google/go-cloud/issues/3346">#3346</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/6d5d2890816abc88cd11ef13d6cd6506eb5b5537"><code>6d5d289</code></a> pubsub/natspubsub: upgrade a dependency (<a href="https://redirect.github.com/google/go-cloud/issues/3336">#3336</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/375e097193225b4ef300a336e04ccad9ace50bc1"><code>375e097</code></a> pubsub/natspubsub: Update dependency (<a href="https://redirect.github.com/google/go-cloud/issues/3331">#3331</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/35ac324ff7fae5ddc0f9dc2ff234a7d6b4935a20"><code>35ac324</code></a> all: update dependencies (<a href="https://redirect.github.com/google/go-cloud/issues/3329">#3329</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/4a18be0f4a48c145da4a76499485a45478fd69aa"><code>4a18be0</code></a> secrets/awskms: update the example for the AWS ARN use case (<a href="https://redirect.github.com/google/go-cloud/issues/3320">#3320</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/486d484a8f73fd5bedc910d4fd89c52e11412e68"><code>486d484</code></a> kafkapubsub: rename dependency Shopify/sarama to IBM/sarama (<a href="https://redirect.github.com/google/go-cloud/issues/3319">#3319</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/db7e808e313228ed8607a94d6e5cd075d66f4e86"><code>db7e808</code></a> runtimevar/constantvar: Add support for reading the constantvar from an envir...</li> <li>Additional commits viewable in <a href="https://github.com/google/go-cloud/compare/v0.34.0...v0.35.0">compare view</a></li> </ul> </details> <br /> <details> <summary>Most Recent Ignore Conditions Applied to This Pull Request</summary> | Dependency Name | Ignore Conditions | | --- | --- | | gocloud.dev | [>= 0.25.a, < 0.26] | </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.34.0&new-version=0.35.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-11 12:55:26 +02:00
google.golang.org/api v0.151.0 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
google.golang.org/appengine v1.6.8 // indirect
feat(deps): bump gocloud.dev from 0.34.0 to 0.35.0 (#4467) Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.34.0 to 0.35.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-cloud/releases">gocloud.dev's releases</a>.</em></p> <blockquote> <h2>v0.35.0</h2> <p><strong>BREAKING CHANGES</strong></p> <p>This release updates the dependency on AWS/S3, which included some breaking changes; see <a href="https://redirect.github.com/google/go-cloud/pull/3342">google/go-cloud#3342</a> for details.</p> <p><strong>blob</strong></p> <ul> <li><em>gcsblob</em>: Fix unauthenticated requests.</li> </ul> <p><strong>runtimevar</strong></p> <ul> <li><em>constantvar</em>: Add support for reading the constant variable value from the environment.</li> </ul> <p><strong>docstore</strong></p> <ul> <li><em>gcpfilestore</em>: Add support for non-default databases.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/go-cloud/commit/27e0bca95dae3165b94cab4f9b7e2e4b087c8aef"><code>27e0bca</code></a> all: prep for release (<a href="https://redirect.github.com/google/go-cloud/issues/3350">#3350</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/53ccd8db26a14fd2a40bfcb28af1a1ceba4663f4"><code>53ccd8d</code></a> all: update deps, including a breaking S3 change (<a href="https://redirect.github.com/google/go-cloud/issues/3342">#3342</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/fa413a39cdf8ffe0890a1b0a4cf5e06e0c915592"><code>fa413a3</code></a> docstore/gcpfilestore: add support for non-default databases. (<a href="https://redirect.github.com/google/go-cloud/issues/3345">#3345</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/c04000b96462ad3ec62e633eafd759185991bb27"><code>c04000b</code></a> secrets/hashivault: Update go-jose per dependabot (<a href="https://redirect.github.com/google/go-cloud/issues/3346">#3346</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/6d5d2890816abc88cd11ef13d6cd6506eb5b5537"><code>6d5d289</code></a> pubsub/natspubsub: upgrade a dependency (<a href="https://redirect.github.com/google/go-cloud/issues/3336">#3336</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/375e097193225b4ef300a336e04ccad9ace50bc1"><code>375e097</code></a> pubsub/natspubsub: Update dependency (<a href="https://redirect.github.com/google/go-cloud/issues/3331">#3331</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/35ac324ff7fae5ddc0f9dc2ff234a7d6b4935a20"><code>35ac324</code></a> all: update dependencies (<a href="https://redirect.github.com/google/go-cloud/issues/3329">#3329</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/4a18be0f4a48c145da4a76499485a45478fd69aa"><code>4a18be0</code></a> secrets/awskms: update the example for the AWS ARN use case (<a href="https://redirect.github.com/google/go-cloud/issues/3320">#3320</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/486d484a8f73fd5bedc910d4fd89c52e11412e68"><code>486d484</code></a> kafkapubsub: rename dependency Shopify/sarama to IBM/sarama (<a href="https://redirect.github.com/google/go-cloud/issues/3319">#3319</a>)</li> <li><a href="https://github.com/google/go-cloud/commit/db7e808e313228ed8607a94d6e5cd075d66f4e86"><code>db7e808</code></a> runtimevar/constantvar: Add support for reading the constantvar from an envir...</li> <li>Additional commits viewable in <a href="https://github.com/google/go-cloud/compare/v0.34.0...v0.35.0">compare view</a></li> </ul> </details> <br /> <details> <summary>Most Recent Ignore Conditions Applied to This Pull Request</summary> | Dependency Name | Ignore Conditions | | --- | --- | | gocloud.dev | [>= 0.25.a, < 0.26] | </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gocloud.dev&package-manager=go_modules&previous-version=0.34.0&new-version=0.35.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-11 12:55:26 +02:00
google.golang.org/genproto v0.0.0-20231120223509-83a465c0220f // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20231120223509-83a465c0220f // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20231120223509-83a465c0220f // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
google.golang.org/grpc v1.59.0 // indirect
feat(deps): bump the gomod-deps group with 3 updates (#4165) Bumps the gomod-deps group with 3 updates: [golang.org/x/crypto](https://github.com/golang/crypto), [golang.org/x/oauth2](https://github.com/golang/oauth2) and [golang.org/x/tools](https://github.com/golang/tools). Updates `golang.org/x/crypto` from 0.10.0 to 0.11.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/crypto/commit/e98487292dcad4efaa6033b245ee014f90d177a2"><code>e984872</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/crypto/commit/183630ada7e00d6d4743f43479b7d4ea51de715e"><code>183630a</code></a> x509roots: generate a stable sort, for real this time</li> <li><a href="https://github.com/golang/crypto/commit/a9e447dde7f8f364232efb5072e3ff89b24308da"><code>a9e447d</code></a> x509roots/fallback: add //go:build go1.20 to bundle.go</li> <li><a href="https://github.com/golang/crypto/commit/64c3993f5c824fe7febbf8561179da523a4e98ea"><code>64c3993</code></a> ssh: add hmac-sha2-512</li> <li><a href="https://github.com/golang/crypto/commit/5fe8145acacf736d52576b87b17c416731e0c4a8"><code>5fe8145</code></a> x509roots: remove list hash and generation date, change ordering</li> <li><a href="https://github.com/golang/crypto/commit/043e94c17aa993f4d1026a2f692b8980e7740df2"><code>043e94c</code></a> x509roots: fix generate script argument checking</li> <li><a href="https://github.com/golang/crypto/commit/0d502d7cd64920c6d2cce3950ead89a5c4eb5e69"><code>0d502d7</code></a> x509roots: use &quot;generate&quot; build tag</li> <li><a href="https://github.com/golang/crypto/commit/0ff60057bbafb685e9f9a97af5261f484f8283d1"><code>0ff6005</code></a> ssh/test: set a timeout and WaitDelay on sshd subcommands</li> <li>See full diff in <a href="https://github.com/golang/crypto/compare/v0.10.0...v0.11.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/oauth2` from 0.9.0 to 0.10.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/oauth2/commit/ec5679f607c139709bdc4c2608494d56b95611fe"><code>ec5679f</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/oauth2/commit/989acb1bfed17be45134185bd228d89675a68f19"><code>989acb1</code></a> all: update dependencies to their latest versions</li> <li>See full diff in <a href="https://github.com/golang/oauth2/compare/v0.9.0...v0.10.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/tools` from 0.10.0 to 0.11.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/golang/tools/releases">golang.org/x/tools's releases</a>.</em></p> <blockquote> <h2>gopls/v0.11.0</h2> <p>This is a small release containing new integrations of vulnerability analysis.</p> <p>Vulnerability analysis for go.mod files can be enabled by configuring the <a href="https://github.com/golang/tools/blob/master/gopls/doc/settings.md#vulncheck-enum"><code>&quot;vulncheck&quot;</code></a> setting to <code>&quot;Imports&quot;</code>. For more information on vulnerability management, see the <a href="https://go.dev/blog/vuln">Vulnerability Management for Go</a> blog post.</p> <h2>Support changes</h2> <p>This release removes support for the <code>&quot;experimentalUseInvalidMetadata&quot;</code> setting, as described in the <a href="https://github.com/golang/tools/releases/tag/gopls%2Fv0.10.0">v0.10.0</a> release. Other settings slated for deprecation in that release remain temporarily supported, but will be removed in v0.12.0.</p> <h2>New Features</h2> <h3>Analyzing dependencies for vulnerabilities</h3> <p>This release offers two different options for detecting vulnerabilities in dependencies. Both are backed by the Go vulnerability database (<a href="https://vuln.go.dev">https://vuln.go.dev</a>) and complement each other.</p> <ul> <li>Imports-based scanning, enabled by the <a href="https://github.com/golang/tools/blob/master/gopls/doc/settings.md#vulncheck-enum"><code>&quot;vulncheck&quot;: &quot;Imports&quot;</code></a> setting, reports vulnerabilities by scanning the set of packages imported in the workspace. This is fast, but may report more false positives.</li> <li>Integration of the <a href="https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck">golang.org/x/vuln/cmd/govulncheck</a> command-line tool performs a more precise analysis based on-call graph reachability, with fewer false positives. Because it is slower to compute, it must be manually triggered by using &quot;Run govulncheck to verify&quot; code actions or the <a href="https://github.com/golang/tools/blob/master/gopls/doc/settings.md#run-govulncheck"><code>&quot;codelenses.run_govulncheck&quot;</code></a> code lens on <code>go.mod</code> files.</li> </ul> <p><a href="https://user-images.githubusercontent.com/4999471/206977512-a821107d-9ffb-4456-9b27-6a6a4f900ba6.mp4">https://user-images.githubusercontent.com/4999471/206977512-a821107d-9ffb-4456-9b27-6a6a4f900ba6.mp4</a></p> <!-- raw HTML omitted --> <h3>Additional checks for the <code>loopclosure</code> analyzer</h3> <p>The <a href="https://github.com/golang/tools/blob/master/gopls/doc/analyzers.md#loopclosure"><code>loopclosure</code></a> analyzer, which reports problematic references from a nested function to a variable of an enclosing loop, has been improved to catch more cases. In particular, it now reports when subtests <a href="https://pkg.go.dev/testing#T.Parallel">run in parallel</a> with the loop, a mistake that often results in all but the final test case being skipped.</p> <p><img src="https://user-images.githubusercontent.com/57144380/206764370-7fc3c464-af04-4e4e-bb10-a6a0a89a99e3.png" alt="image" /></p> <h2>Configuration changes</h2> <ul> <li>The <a href="https://github.com/golang/tools/blob/master/gopls/doc/settings.md#vulncheck-enum"><code>&quot;vulncheck&quot;</code></a> setting controls vulnerability analysis based on the Go vulnerability database. If set to <code>&quot;Imports&quot;</code>, gopls will compute diagnostics related to vulnerabilities in dependencies, and will present them in go.mod files.</li> <li>The <a href="https://github.com/golang/tools/blob/master/gopls/doc/settings.md#run-govulncheck"><code>&quot;codelenses.run_govulncheck&quot;</code></a> setting controls the presence of code lenses that run the <a href="https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck">govulncheck</a> command, which takes longer but produces more accurate vulnerability reporting based on call-graph reachability.</li> </ul> <h2>Bug fixes</h2> <p>This version of gopls includes fixes to several bugs, notably:</p> <ul> <li><code>golang/go#57053</code></li> <li><code>golang/go#55837</code><a href="https://redirect.github.com/golang/go/issues/56450">golang/go#56450</a>).</li> <li><code>golang/go#54816</code></li> </ul> <p>A full list of all issues fixed can be found in the <a href="https://github.com/golang/go/milestone/293?closed=1">gopls/v0.11.0</a> milestone. To report a new problem, please file a new issue at <a href="https://go.dev/issues/new">https://go.dev/issues/new</a>.</p> <h2>Thank you to our contributors</h2> <p><a href="https://github.com/Arsen6331"><code>@​Arsen6331</code></a>, <a href="https://github.com/SN9NV"><code>@​SN9NV</code></a>, <a href="https://github.com/adonovan"><code>@​adonovan</code></a>, <a href="https://github.com/bcmills"><code>@​bcmills</code></a>, <a href="https://github.com/dle8"><code>@​dle8</code></a>, <a href="https://github.com/findleyr"><code>@​findleyr</code></a>, <a href="https://github.com/hyangah"><code>@​hyangah</code></a>, <a href="https://github.com/pjweinbgo"><code>@​pjweinbgo</code></a>, <a href="https://github.com/suzmue"><code>@​suzmue</code></a></p> <h2>gopls/v0.10.1</h2> <p>This release contains a fix for <a href="https://redirect.github.com/golang/go/issues/56505">golang/go#56505</a>: a new crash during method completion on variables of type <code>*error</code>.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/tools/commit/675bf3c243d60cbba429fad9924e520e8a86074f"><code>675bf3c</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/tools/commit/ad52c1ca35fb661c53eedbdee5f3b0e3c33e54e1"><code>ad52c1c</code></a> go/ssa/interp: support conversions to slices of named bytes</li> <li><a href="https://github.com/golang/tools/commit/14ec3c023fa0003b489ce1abe0484924ea5276f8"><code>14ec3c0</code></a> gopls/doc/contributing.md: document error handling strategies</li> <li><a href="https://github.com/golang/tools/commit/c4953641676aa4639fcbd2ca825c43cedeaa9e8c"><code>c495364</code></a> go/packages/gopackages: document -mode flag</li> <li><a href="https://github.com/golang/tools/commit/87ad891fe35467be3d692a3f37fef9fb5cb08dcd"><code>87ad891</code></a> gopls/internal/lsp/source/typerefs: move test into _test.go</li> <li><a href="https://github.com/golang/tools/commit/27fd94e099b2bbd4c660f0b140af121af9a943c8"><code>27fd94e</code></a> internal/fastwalk: doc formatting fixes (including godoc links)</li> <li><a href="https://github.com/golang/tools/commit/d362be0cdb73ca5215ecaaf1514120c6b8b955e9"><code>d362be0</code></a> gopls/internal/lsp/filecache: reduce GC frequency</li> <li><a href="https://github.com/golang/tools/commit/969078be460fb5efe195a1d4c69e3701298e9a21"><code>969078b</code></a> Revert &quot;go/analysis: add Sizes that matches gc size computations&quot;</li> <li><a href="https://github.com/golang/tools/commit/5aa6acb96f843a0257c5c1c0e52753bcd18b77b3"><code>5aa6acb</code></a> go/analysis: add Sizes that matches gc size computations</li> <li><a href="https://github.com/golang/tools/commit/5a89a3bf267ef12790327b8692c88654845bc78d"><code>5a89a3b</code></a> go/vcs: delete</li> <li>Additional commits viewable in <a href="https://github.com/golang/tools/compare/v0.10.0...v0.11.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-07-12 14:53:29 +02:00
google.golang.org/protobuf v1.31.0 // indirect
feat(schema): add command that generates jsonschema (#2589) * feat(schema): Add command that generates the jsonschema for .goreleaser.yml files This commit adds the jsonschema/schema subcommand that generates a jsonschema doc based on the Project go struct. For the config types that alternatively allow you to specify a string via custom UnmarshalYAML function, this commit adds the JSONSchemaType function, so the type gets documented with an oneOf with string or itself. Add yaml key names for properties that are currently missing them, so alecthomas/jsonschema generates the keys with correct casing. Signed-off-by: Patrick Hahn <patricksilashahn@gmx.net> * fix: Add linguist-generated attribute to generated schema json to exclude this file from pull request size validation Signed-off-by: Patrick Hahn <patricksilashahn@gmx.net> * fix: run gofumpt Signed-off-by: Patrick Hahn <patricksilashahn@gmx.net> * chore(schema): update alecthomas/jsonschema and regenerate schema.json Signed-off-by: Patrick Hahn <patricksilashahn@gmx.net>
2021-10-26 20:02:03 +02:00
gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
feat: add ko support (#3653) continuing the PR by @developer-guy - [x] should be a publisher, as it does publish the images it builds every time - [x] `Default` method does not work - [x] the `fromConfig` thing should probably be on the defaults, too - [x] wire `--skip-ko` - [x] documentation - [x] more tests - [x] use same registry as docker tests does - [ ] see if we can make the log output match goreleaser's - [ ] ?? closes #2556 closes #3490 Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com> Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> Co-authored-by: actions-user <actions@github.com> Co-authored-by: Jason Hall <jason@chainguard.dev> Co-authored-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
2023-01-17 03:34:49 +02:00
gopkg.in/ini.v1 v1.67.0 // indirect
feat: use go 1.17 (#2408) * feat: use go 1.17 Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * fix: go mod tidy Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * test: fix failing test Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * ci: increase lint timeout Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * ci: increase lint timeout Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com>
2021-08-25 01:49:11 +02:00
gopkg.in/warnings.v0 v0.1.2 // indirect
refactor: improving minio and docker tests (#3642) using ory/dockertest to simplify integration tests Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com>
2022-12-15 15:25:52 +02:00
gopkg.in/yaml.v2 v2.4.0 // indirect
feat(deps): bump github.com/google/ko from 0.13.0 to 0.14.1 (#4132) Bumps [github.com/google/ko](https://github.com/google/ko) from 0.13.0 to 0.14.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/ko/releases">github.com/google/ko's releases</a>.</em></p> <blockquote> <h2>v0.14.1</h2> <h2>What's Changed</h2> <ul> <li>fix: Use attestation-name output by <a href="https://github.com/ianlewis"><code>@​ianlewis</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/980">ko-build/ko#980</a></li> <li>Upgrade to go120 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/984">ko-build/ko#984</a></li> <li>fix release workflow by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/977">ko-build/ko#977</a></li> <li>fix deprecated attestation name by <a href="https://github.com/developer-guy"><code>@​developer-guy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/983">ko-build/ko#983</a></li> <li>refactor release job by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/986">ko-build/ko#986</a></li> <li>use git hash instead of git tag by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/988">ko-build/ko#988</a></li> <li>Correct a typo in resolver.go by <a href="https://github.com/felixonmars"><code>@​felixonmars</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/989">ko-build/ko#989</a></li> <li>feat: add riscv64 to goreleaser goarch by <a href="https://github.com/ernado"><code>@​ernado</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/990">ko-build/ko#990</a></li> <li>try to fix codeql workflow by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/994">ko-build/ko#994</a></li> <li>Push images faster by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1005">ko-build/ko#1005</a></li> <li>Don't publish tags twice by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1010">ko-build/ko#1010</a></li> <li>Add context to many gobuild errors by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1016">ko-build/ko#1016</a></li> <li>Fix --local with KO_DOCKER_REPO by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1017">ko-build/ko#1017</a></li> <li>Fix: Incorporate platform architecture by <a href="https://github.com/mattmoor"><code>@​mattmoor</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1029">ko-build/ko#1029</a></li> <li>Update community.md by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1035">ko-build/ko#1035</a></li> <li>mention ko tekton task by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1039">ko-build/ko#1039</a></li> <li>Update community.md by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1037">ko-build/ko#1037</a></li> <li>Fix kind image loading for MacOS by <a href="https://github.com/aidy"><code>@​aidy</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1026">ko-build/ko#1026</a></li> <li>Revert &quot;Fix kind image loading for MacOS&quot; by <a href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1054">ko-build/ko#1054</a></li> <li>update boilerplate file to be KO Build Authors by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1056">ko-build/ko#1056</a></li> <li>Pin setup-ko to previous release by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/ko-build/ko/pull/1082">ko-build/ko#1082</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/felixonmars"><code>@​felixonmars</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/989">ko-build/ko#989</a></li> <li><a href="https://github.com/ernado"><code>@​ernado</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/990">ko-build/ko#990</a></li> <li><a href="https://github.com/aidy"><code>@​aidy</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1026">ko-build/ko#1026</a></li> <li><a href="https://github.com/luhring"><code>@​luhring</code></a> made their first contribution in <a href="https://redirect.github.com/ko-build/ko/pull/1073">ko-build/ko#1073</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ko-build/ko/compare/v0.13.0...v0.14.1">https://github.com/ko-build/ko/compare/v0.13.0...v0.14.1</a></p> <h2>v0.14.0</h2> <p>No release notes provided.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ko-build/ko/commit/200db7243f02b5c0303e21d8ab8e3b4ad3a229d0"><code>200db72</code></a> Pin setup-ko to previous release (<a href="https://redirect.github.com/google/ko/issues/1082">#1082</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/4366ded82cdda05ef85bc5483d19daa241d08f38"><code>4366ded</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1079">#1079</a> from ko-build/dependabot/github_actions/slsa-framewo...</li> <li><a href="https://github.com/ko-build/ko/commit/adbea950c10e2c69c7bf0589a6bf0b4e7ceafbfa"><code>adbea95</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1078">#1078</a> from ko-build/dependabot/github_actions/goreleaser/g...</li> <li><a href="https://github.com/ko-build/ko/commit/6175237fe6539a48206da87c239ad98b4f7d7312"><code>6175237</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1077">#1077</a> from ko-build/dependabot/go_modules/github.com/spf13...</li> <li><a href="https://github.com/ko-build/ko/commit/5e5fe2e703c1f0c9186975b06090ae563283f48d"><code>5e5fe2e</code></a> Merge pull request <a href="https://redirect.github.com/google/ko/issues/1076">#1076</a> from ko-build/dependabot/github_actions/aws-actions/...</li> <li><a href="https://github.com/ko-build/ko/commit/dc9b3eebef9818e2efab17cec8dd3eebff72e074"><code>dc9b3ee</code></a> Bump github.com/spf13/viper from 1.15.0 to 1.16.0</li> <li><a href="https://github.com/ko-build/ko/commit/ed445128e25c7bd0b6643b58ac44383a583d84f5"><code>ed44512</code></a> Bump golang.org/x/tools from 0.9.3 to 0.10.0 (<a href="https://redirect.github.com/google/ko/issues/1080">#1080</a>)</li> <li><a href="https://github.com/ko-build/ko/commit/fcd95ec958cad910b4746245662506b1f974f40e"><code>fcd95ec</code></a> Bump slsa-framework/slsa-github-generator from 1.6.0 to 1.7.0</li> <li><a href="https://github.com/ko-build/ko/commit/974f09cdeacd7042c3db573366768ecbb32246a5"><code>974f09c</code></a> Bump goreleaser/goreleaser-action from 4.2.0 to 4.3.0</li> <li><a href="https://github.com/ko-build/ko/commit/893f6e877f7c352261c13e078bb8fc9709bb285c"><code>893f6e8</code></a> Bump aws-actions/configure-aws-credentials from 2.1.0 to 2.2.0</li> <li>Additional commits viewable in <a href="https://github.com/google/ko/compare/v0.13.0...v0.14.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/ko&package-manager=go_modules&previous-version=0.13.0&new-version=0.14.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-26 18:56:50 +02:00
sigs.k8s.io/kind v0.20.0 // indirect
feat(deps): bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.1 (#4419) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <h2>v2.2.1</h2> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v2.2.1</h1> <p><strong>Note: This release comes with a fix for CVE-2023-46737 described in this <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github Security Advisory</a>. Please upgrade to this release ASAP</strong></p> <h2>Enhancements</h2> <ul> <li>feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li>add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li>Support ReplaceOp in Signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li> <li>feat: added ability to get image digest back via triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li> <li>feat: add <code>--only</code> flag in <code>cosign copy</code> to copy sign, att &amp; sbom (<a href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li> <li>feat: add support attaching a Rekor bundle to a container (<a href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li> <li>feat: add support outputting rekor response on signing (<a href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li> <li>feat: improve dockerfile verify subcommand (<a href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li> <li>Add guard flag for experimental OCI 1.1 verify. (<a href="https://redirect.github.com/sigstore/cosign/issues/3272">#3272</a>)</li> <li>Deprecate SBOM attachments (<a href="https://redirect.github.com/sigstore/cosign/issues/3256">#3256</a>)</li> <li>feat: dedent line in cosign copy doc (<a href="https://redirect.github.com/sigstore/cosign/issues/3244">#3244</a>)</li> <li>feat: add platform flag to cosign copy command (<a href="https://redirect.github.com/sigstore/cosign/issues/3234">#3234</a>)</li> <li>Add SLSA 1.0 attestation support to cosign. Closes <a href="https://redirect.github.com/sigstore/cosign/issues/2860">#2860</a> (<a href="https://redirect.github.com/sigstore/cosign/issues/3219">#3219</a>)</li> <li>attest: pass OCI remote opts to att resolver. (<a href="https://redirect.github.com/sigstore/cosign/issues/3225">#3225</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li>fix: allow cosign download sbom when image is absent (<a href="https://redirect.github.com/sigstore/cosign/issues/3245">#3245</a>)</li> <li>ci: add a OCI registry test for referrers support (<a href="https://redirect.github.com/sigstore/cosign/issues/3253">#3253</a>)</li> <li>Fix ReplaceSignatures (<a href="https://redirect.github.com/sigstore/cosign/issues/3292">#3292</a>)</li> <li>Stop using deprecated in_toto.ProvenanceStatement (<a href="https://redirect.github.com/sigstore/cosign/issues/3243">#3243</a>)</li> <li>Fixes <a href="https://redirect.github.com/sigstore/cosign/issues/3236">#3236</a>, disable SCT checking for a cosign verification when usin… (<a href="https://redirect.github.com/sigstore/cosign/issues/3237">#3237</a>)</li> <li>fix: update error in <code>SignedEntity</code> to be more descriptive (<a href="https://redirect.github.com/sigstore/cosign/issues/3233">#3233</a>)</li> <li>Fail timestamp verification if no root is provided (<a href="https://redirect.github.com/sigstore/cosign/issues/3224">#3224</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Add some docs about verifying in an air-gapped environment (<a href="https://redirect.github.com/sigstore/cosign/issues/3321">#3321</a>)</li> <li>Update CONTRIBUTING.md (<a href="https://redirect.github.com/sigstore/cosign/issues/3268">#3268</a>)</li> <li>docs: improves the Contribution guidelines (<a href="https://redirect.github.com/sigstore/cosign/issues/3257">#3257</a>)</li> <li>Remove security policy (<a href="https://redirect.github.com/sigstore/cosign/issues/3230">#3230</a>)</li> </ul> <h2>Others</h2> <ul> <li>Set go to min 1.21 and update dependencies (<a href="https://redirect.github.com/sigstore/cosign/issues/3327">#3327</a>)</li> <li>Update contact for code of conduct (<a href="https://redirect.github.com/sigstore/cosign/issues/3266">#3266</a>)</li> <li>Update .ko.yaml (<a href="https://redirect.github.com/sigstore/cosign/issues/3240">#3240</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>AdamKorcz</li> <li>Andres Galante</li> <li>Appu</li> <li>Billy Lynch</li> <li>Bob Callaway</li> <li>Caleb Woodbine</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/12cbf9ea177d22bbf5cf028bcb4712b5f174ebc6"><code>12cbf9e</code></a> add changelog for v2.2.1 release (<a href="https://redirect.github.com/sigstore/cosign/issues/3344">#3344</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/827f24e9d4a1f8e845cb1597d02053410f5bbe2a"><code>827f24e</code></a> feat: Support basic auth and bearer auth login to registry (<a href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f"><code>8ac891f</code></a> Merge pull request from GHSA-vfp6-jrw2-99g9</li> <li><a href="https://github.com/sigstore/cosign/commit/8b366c497bd22b9be7742d057b8f59083dcadee0"><code>8b366c4</code></a> add support for ignoring certificates with pkcs11 (<a href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/23920de5623a505921ba4e62fa97e2553eff4699"><code>23920de</code></a> chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3342">#3342</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e022e1c13240d1ae5b3c408bc53e389154331713"><code>e022e1c</code></a> chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3341">#3341</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/28c59c5eca6386924cc8f381afe94efe1e957679"><code>28c59c5</code></a> add missing groups key (<a href="https://redirect.github.com/sigstore/cosign/issues/3339">#3339</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/8e5bdcc0ff39b8dc1b477251fef521601df76ec0"><code>8e5bdcc</code></a> chore(deps): bump github.com/google/certificate-transparency-go (<a href="https://redirect.github.com/sigstore/cosign/issues/3338">#3338</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/510cac4ef54274823599082e3a57a556ccd5c9e5"><code>510cac4</code></a> chore(deps): bump github.com/sigstore/rekor from 1.3.2 to 1.3.3 (<a href="https://redirect.github.com/sigstore/cosign/issues/3336">#3336</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/063902b1d78fed7c12c9d9ce06248d36963e8169"><code>063902b</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.57.0 to 3.58.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3337">#3337</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.1.1...v2.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.1.1&new-version=2.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/goreleaser/goreleaser/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-18 18:39:49 +02:00
sigs.k8s.io/yaml v1.4.0 // indirect
feat: use go 1.17 (#2408) * feat: use go 1.17 Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * fix: go mod tidy Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * test: fix failing test Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * ci: increase lint timeout Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com> * ci: increase lint timeout Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com>
2021-08-25 01:49:11 +02:00
)
Reference in New Issue Copy Permalink