Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

build(deps): bump the all-go-mod-patch-and-minor group across 1 directory with 10 updates #3186

Merged
merged 1 commit into from
Aug 12, 2024
Merged

build(deps): bump the all-go-mod-patch-and-minor group across 1 directory with 10 updates #3186

merged 1 commit into from
Aug 12, 2024

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Aug 12, 2024

Bumps the all-go-mod-patch-and-minor group with 8 updates in the / directory:

Package From To
github.com/open-policy-agent/opa 0.66.0 0.67.1
github.com/open-policy-agent/opa-envoy-plugin 0.66.0-envoy-2 0.67.1-envoy
github.com/redis/go-redis/v9 9.6.0 9.6.1
github.com/tidwall/gjson 1.17.1 1.17.3
golang.org/x/crypto 0.25.0 0.26.0
golang.org/x/net 0.27.0 0.28.0
golang.org/x/oauth2 0.21.0 0.22.0
golang.org/x/time 0.5.0 0.6.0

Updates github.com/open-policy-agent/opa from 0.66.0 to 0.67.1

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v0.67.1

This is a bug fix release addressing the following issue:

  • util+server: Fix bug around chunked request handling (#6906) authored by @​philipaconrad, reported by @​David-Wobrock. A request handling bug was introduced in (#6868), which caused OPA to treat all incoming chunked requests as if they had zero-length request bodies.

v0.67.0

This release contains a mix of features, a new builtin function (strings.count), performance improvements, and bugfixes.

Breaking Change

Request Body Size Limits

OPA now automatically rejects very large requests (#6868) authored by @​philipaconrad. Requests with a Content-Length larger than 128 MB uncompressed, and gzipped requests with payloads that decompress to larger than 256 MB will be rejected, as part of hardening OPA against denial-of-service attacks. Previously, a large enough request could cause an OPA instance to run out of memory in low-memory sidecar deployment scenarios, just from attempting to read the request body into memory.

These changes allow improvements in memory usage for the OPA HTTP server, and help OPA deployments avoid some accidental out-of-memory situations.

For most users, no changes will be needed to continue using OPA. However, to control this behavior, two new configuration keys are available: server.decoding.max_length and server.decoding.gzip.max_length. These control the max size in bytes to allow for an incoming request payload, and the maximum size in bytes to allow for a decompressed gzip request payload, respectively.

Here's an example OPA configuration using the new keys:

# Set max request size to 64 MB and max gzip size (decompressed) to be 128 MB.
server:
  decoding:
    max_length: 67108864
    gzip:
      max_length: 134217728

Topdown and Rego

  • topdown: New strings.count builtin which returns the number of non-overlapping instances of a substring in a string (#6827) authored by @​Manish-Giri
  • format: Produce error when --rego-v1 formatted module has rule name conflicting with keyword (#6833) authored by @​johanfylling
  • topdown: Add cap to caches for regex and glob built-in functions (#6828) authored by @​johanfylling. This fixes possible memory leaks where caches grow uncontrollably when large amounts of regexes or globs are generated or originate from the input document.

Runtime, Tooling, SDK

  • repl: Add support for correctly loading bundle modules (#6872) authored by @​ashutosh-narkar
  • plugins/discovery: Allow un-registration of discovery listener (#6851) authored by @​mjungsbluth. The discovery plugin allows OPA to register a bundle download status listener but previously did not offer a method to unregister that listener
  • plugins/logs: Reduce amount of work performed inside global lock in decision log plugin (#6859) authored by @​johanfylling
  • plugins/rest: Add a new client credential attribute to support Azure Workload Identity. This would allow workloads deployed on an Azure Kubernetes Services (AKS) cluster to authenticate and access Azure cloud resources (#6802) authored by @​ledbutter
  • cmd/inspect: Add ability for opa inspect to inspect a single file outside of any bundle (#6873) authored by @​tjons
  • cmd+bundle: Add --follow-symlinks flag to the opa build command to allow users to build directories with symlinked files, and have the contents of those symlinked files included in the built bundle (#6800) authored by @​tjons
  • server: Add missing handling in the server for the explain=fails query value (#6886) authored by @​acamatcisco

... (truncated)

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

0.67.1

This is a bug fix release addressing the following issue:

  • util+server: Fix bug around chunked request handling (#6906) authored by @​philipaconrad, reported by @​David-Wobrock. A request handling bug was introduced in (#6868), which caused OPA to treat all incoming chunked requests as if they had zero-length request bodies.

0.67.0

This release contains a mix of features, a new builtin function (strings.count), performance improvements, and bugfixes.

Breaking Change

Request Body Size Limits

OPA now automatically rejects very large requests (#6868) authored by @​philipaconrad. Requests with a Content-Length larger than 128 MB uncompressed, and gzipped requests with payloads that decompress to larger than 256 MB will be rejected, as part of hardening OPA against denial-of-service attacks. Previously, a large enough request could cause an OPA instance to run out of memory in low-memory sidecar deployment scenarios, just from attempting to read the request body into memory.

These changes allow improvements in memory usage for the OPA HTTP server, and help OPA deployments avoid some accidental out-of-memory situations.

For most users, no changes will be needed to continue using OPA. However, to control this behavior, two new configuration keys are available: server.decoding.max_length and server.decoding.gzip.max_length. These control the max size in bytes to allow for an incoming request payload, and the maximum size in bytes to allow for a decompressed gzip request payload, respectively.

Here's an example OPA configuration using the new keys:

# Set max request size to 64 MB and max gzip size (decompressed) to be 128 MB.
server:
  decoding:
    max_length: 67108864
    gzip:
      max_length: 134217728

Topdown and Rego

  • topdown: New strings.count builtin which returns the number of non-overlapping instances of a substring in a string (#6827) authored by @​Manish-Giri
  • format: Produce error when --rego-v1 formatted module has rule name conflicting with keyword (#6833) authored by @​johanfylling
  • topdown: Add cap to caches for regex and glob built-in functions (#6828) authored by @​johanfylling. This fixes possible memory leaks where caches grow uncontrollably when large amounts of regexes or globs are generated or originate from the input document.

Runtime, Tooling, SDK

  • repl: Add support for correctly loading bundle modules (#6872) authored by @​ashutosh-narkar
  • plugins/discovery: Allow un-registration of discovery listener (#6851) authored by @​mjungsbluth. The discovery plugin allows OPA to register a bundle download status listener but previously did not offer a method to unregister that listener
  • plugins/logs: Reduce amount of work performed inside global lock in decision log plugin (#6859) authored by @​johanfylling
  • plugins/rest: Add a new client credential attribute to support Azure Workload Identity. This would allow workloads deployed on an Azure Kubernetes Services (AKS) cluster to authenticate and access Azure cloud resources (#6802) authored by @​ledbutter
  • cmd/inspect: Add ability for opa inspect to inspect a single file outside of any bundle (#6873) authored by @​tjons
  • cmd+bundle: Add --follow-symlinks flag to the opa build command to allow users to build directories with symlinked files, and have the contents of those symlinked files included in the built bundle (#6800) authored by @​tjons

... (truncated)

Commits
  • b88c09e Prepare v0.67.1 release
  • 11e91b0 util+server: Fix bug around chunked request handling. (#6906)
  • b62ae6b Prepare v0.67.0 release
  • bec8e1a build(deps): bump github/codeql-action from 3.25.13 to 3.25.14 (#6888)
  • d48fdd9 server: Add missing handling for explain=fails to the REST API.
  • 959f9e5 docs: Add an example of a manifest with attribute
  • a793f27 repl: Add support for correctly loading bundle modules
  • c5706ee server+util: Limit max request sizes, prealloc request buffers (#6868)
  • 0ca35e2 build(deps): bump docker/setup-buildx-action from 3.4.0 to 3.5.0 (#6880)
  • f9ccb66 build(deps): bump github/codeql-action from 3.25.12 to 3.25.13 (#6881)
  • Additional commits viewable in compare view

Updates github.com/open-policy-agent/opa-envoy-plugin from 0.66.0-envoy-2 to 0.67.1-envoy

Release notes

Sourced from github.com/open-policy-agent/opa-envoy-plugin's releases.

v0.67.1-envoy

What's Changed

v0.67.0-envoy

What's Changed

Commits
  • 584c64b build(deps): bump github.com/open-policy-agent/opa from 0.67.0 to 0.67.1
  • c7e7307 Update quick_start.yaml
  • a43e4ad examples/grpc: Move to Docker Compose v2
  • be102d7 Upgrade Istio test version to supported 1.22.x and bump kind
  • d0ecbdb build(deps): bump go.opentelemetry.io/contrib/instrumentation/google.golang.o...
  • 1d562bd build(deps): bump go.opentelemetry.io/contrib/propagators/b3
  • a596d30 build(deps): bump github.com/open-policy-agent/opa from 0.66.0 to 0.67.0
  • c111c33 build(deps): bump golang.org/x/tools from 0.22.0 to 0.23.0
  • 5b63a68 build(deps): bump google.golang.org/grpc from 1.64.0 to 1.65.0
  • 10d8375 build(go): bump 1.22.4 -> 1.22.5
  • See full diff in compare view

Updates github.com/redis/go-redis/v9 from 9.6.0 to 9.6.1

Release notes

Sourced from github.com/redis/go-redis/v9's releases.

9.6.1

Changes

9.6

This release contains all new features from version 9.6.

🚀 New Features

  • Support Hash-field expiration commands (#2991)
  • Support Hash-field expiration commands in Pipeline & Fix HExpire HExpireWithArgs expiration (#3038)
  • Support NOVALUES parameter for HSCAN (#2925)
  • Added test case for CLIENT KILL with MAXAGE option (#2971)
  • Add support for XREAD last entry (#3005)
  • Reduce the type assertion of CheckConn (#3066)

9.6.1

In addition minor changes were performed to retract version 9.5.3 and 9.5.4 that were released accidentally.

🧰 Maintenance

  • Change CI to 7.4.0-RC2 (#3070)

🎁 Package Distribution

  • Retract versions 9.5.3 and 9.5.4 (#3069)

Contributors

We'd like to thank all the contributors who worked on this release!

@​LINKIWI, @​b1ron, @​gerzse, @​haines, @​immersedin, @​naiqianz, @​ofekshenawa, @​srikar-jilugu, @​tzongw, @​vladvildanov, @​vmihailenco and @​monkey92t

Commits

Updates github.com/tidwall/gjson from 1.17.1 to 1.17.3

Commits

Updates golang.org/x/crypto from 0.25.0 to 0.26.0

Commits
  • 5bcd010 go.mod: update golang.org/x dependencies
  • 3375612 ssh: add support for unpadded RSA signatures
  • bb80217 ssh: don't use dsa keys in integration tests
  • 6879722 ssh: remove go 1.21+ dependency on slices
  • e983fa2 sha3: Avo port of keccakf_amd64.s
  • 80fd972 LICENSE: update per Google Legal
  • f2bc3a6 x509roots/fallback/internal/goissue52287: delete
  • d66d9c3 x509roots/fallback: update bundle
  • See full diff in compare view

Updates golang.org/x/net from 0.27.0 to 0.28.0

Commits
  • 4542a42 go.mod: update golang.org/x dependencies
  • 765c7e8 xsrftoken: create no padding base64 string by RawURLEncoding
  • 032e4e4 LICENSE: update per Google Legal
  • See full diff in compare view

Updates golang.org/x/oauth2 from 0.21.0 to 0.22.0

Commits

Updates golang.org/x/sync from 0.7.0 to 0.8.0

Commits

Updates golang.org/x/term from 0.22.0 to 0.23.0

Commits

Updates golang.org/x/time from 0.5.0 to 0.6.0

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the all-go-mod-patch-and-minor group across 1 direc…
6f81934 
…tory with 10 updates

Bumps the all-go-mod-patch-and-minor group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) | `0.66.0` | `0.67.1` |
| [github.com/open-policy-agent/opa-envoy-plugin](https://github.com/open-policy-agent/opa-envoy-plugin) | `0.66.0-envoy-2` | `0.67.1-envoy` |
| [github.com/redis/go-redis/v9](https://github.com/redis/go-redis) | `9.6.0` | `9.6.1` |
| [github.com/tidwall/gjson](https://github.com/tidwall/gjson) | `1.17.1` | `1.17.3` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.25.0` | `0.26.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.27.0` | `0.28.0` |
| [golang.org/x/oauth2](https://github.com/golang/oauth2) | `0.21.0` | `0.22.0` |
| [golang.org/x/time](https://github.com/golang/time) | `0.5.0` | `0.6.0` |



Updates `github.com/open-policy-agent/opa` from 0.66.0 to 0.67.1
- [Release notes](https://github.com/open-policy-agent/opa/releases)
- [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md)
- [Commits](open-policy-agent/opa@v0.66.0...v0.67.1)

Updates `github.com/open-policy-agent/opa-envoy-plugin` from 0.66.0-envoy-2 to 0.67.1-envoy
- [Release notes](https://github.com/open-policy-agent/opa-envoy-plugin/releases)
- [Changelog](https://github.com/open-policy-agent/opa-envoy-plugin/blob/main/CHANGELOG.md)
- [Commits](open-policy-agent/opa-envoy-plugin@v0.66.0-envoy-2...v0.67.1-envoy)

Updates `github.com/redis/go-redis/v9` from 9.6.0 to 9.6.1
- [Release notes](https://github.com/redis/go-redis/releases)
- [Changelog](https://github.com/redis/go-redis/blob/master/CHANGELOG.md)
- [Commits](redis/go-redis@v9.6.0...v9.6.1)

Updates `github.com/tidwall/gjson` from 1.17.1 to 1.17.3
- [Commits](tidwall/gjson@v1.17.1...v1.17.3)

Updates `golang.org/x/crypto` from 0.25.0 to 0.26.0
- [Commits](golang/crypto@v0.25.0...v0.26.0)

Updates `golang.org/x/net` from 0.27.0 to 0.28.0
- [Commits](golang/net@v0.27.0...v0.28.0)

Updates `golang.org/x/oauth2` from 0.21.0 to 0.22.0
- [Commits](golang/oauth2@v0.21.0...v0.22.0)

Updates `golang.org/x/sync` from 0.7.0 to 0.8.0
- [Commits](golang/sync@v0.7.0...v0.8.0)

Updates `golang.org/x/term` from 0.22.0 to 0.23.0
- [Commits](golang/term@v0.22.0...v0.23.0)

Updates `golang.org/x/time` from 0.5.0 to 0.6.0
- [Commits](golang/time@v0.5.0...v0.6.0)

---
updated-dependencies:
- dependency-name: github.com/open-policy-agent/opa
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-mod-patch-and-minor
- dependency-name: github.com/open-policy-agent/opa-envoy-plugin
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-mod-patch-and-minor
- dependency-name: github.com/redis/go-redis/v9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-go-mod-patch-and-minor
- dependency-name: github.com/tidwall/gjson
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-go-mod-patch-and-minor
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-mod-patch-and-minor
- dependency-name: golang.org/x/net
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-mod-patch-and-minor
- dependency-name: golang.org/x/oauth2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-mod-patch-and-minor
- dependency-name: golang.org/x/sync
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-mod-patch-and-minor
- dependency-name: golang.org/x/term
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-mod-patch-and-minor
- dependency-name: golang.org/x/time
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-mod-patch-and-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Aug 12, 2024
@MustafaSaber
Copy link
Member

MustafaSaber commented Aug 12, 2024 •
edited
Loading

This has the bug fix, should be good to merge, right @Pushpalanka?

@MustafaSaber
Copy link
Member

👍

@MustafaSaber MustafaSaber mentioned this pull request Aug 12, 2024
Closed
@AlexanderYastrebov
Copy link
Member

👍

@AlexanderYastrebov AlexanderYastrebov merged commit 4e989ac into master Aug 12, 2024
12 checks passed
@AlexanderYastrebov AlexanderYastrebov deleted the dependabot/go_modules/all-go-mod-patch-and-minor-c673437875 branch August 12, 2024 09:08
RomanZavodskikh pushed a commit to zalando-incubator/kubernetes-on-aws that referenced this pull request Aug 12, 2024
Update skipper version, step 1/2
9a71079 
+ zalando/skipper#3175
+ zalando/skipper#3174
+ zalando/skipper#3173
+ zalando/skipper#3172
+ zalando/skipper#3170
+ zalando/skipper#3176
+ zalando/skipper#3160
+ zalando/skipper#3184
+ zalando/skipper#3185
+ zalando/skipper#3186
+ zalando/skipper#3181
+ zalando/skipper#3183
+ zalando/skipper#3187

Signed-off-by: Roman Zavodskikh <[email protected]>
@RomanZavodskikh RomanZavodskikh mentioned this pull request Aug 12, 2024
Merged
RomanZavodskikh pushed a commit to zalando-incubator/kubernetes-on-aws that referenced this pull request Aug 12, 2024
Update skipper version, step 1/2
07640a4 
+ zalando/skipper#3175
+ zalando/skipper#3174
+ zalando/skipper#3173
+ zalando/skipper#3172
+ zalando/skipper#3170
+ zalando/skipper#3176
+ zalando/skipper#3160
+ zalando/skipper#3184
+ zalando/skipper#3185
+ zalando/skipper#3186
+ zalando/skipper#3181
+ zalando/skipper#3183
+ zalando/skipper#3187

Signed-off-by: Roman Zavodskikh <[email protected]>
RomanZavodskikh pushed a commit to zalando-incubator/kubernetes-on-aws that referenced this pull request Aug 14, 2024
Update skipper version, step 2/2
6007643 
+ zalando/skipper#3175
+ zalando/skipper#3174
+ zalando/skipper#3173
+ zalando/skipper#3172
+ zalando/skipper#3170
+ zalando/skipper#3176
+ zalando/skipper#3160
+ zalando/skipper#3184
+ zalando/skipper#3185
+ zalando/skipper#3186
+ zalando/skipper#3181
+ zalando/skipper#3183
+ zalando/skipper#3187

Signed-off-by: Roman Zavodskikh <[email protected]>
@RomanZavodskikh RomanZavodskikh mentioned this pull request Aug 14, 2024
Merged
@zalando-teapot-robot zalando-teapot-robot mentioned this pull request Sep 23, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file go Pull requests that update Go code
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@MustafaSaber @AlexanderYastrebov