Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): bump the common group with 4 updates #293

Merged
merged 1 commit into from
Nov 27, 2024

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Nov 25, 2024

Bumps the common group with 4 updates: github.com/aws-cloudformation/rain, github.com/hashicorp/hcl/v2, github.com/owenrumney/squealer and github.com/stretchr/testify.

Updates github.com/aws-cloudformation/rain from 1.16.1 to 1.19.0

Release notes

Sourced from github.com/aws-cloudformation/rain's releases.

v1.19.0

What's Changed

Full Changelog: aws-cloudformation/rain@v1.18.0...v1.19.0

v1.18.0

This release addresses a security issue that would allow an attacker to predict the name of the rain asset bucket and create it before a user issues a rain pkg command, which uploads assets such as Lambda function code to the bucket. This would give the attacker full access to the contents uploaded by Rain, since they own the bucket. This release adds the ExpectedBucketOwner argument to S3 calls, which causes an Access Denied error if the bucket does not belong to the same account. Additionally, this release adds the s3-bucket argument to the rain bootstrap command, which allows users to create an asset bucket with a user-supplied name, which will be stored in SSM Parameter Store with the key rain-bucket for reference by future Rain commands. We recommend that users upgrade to v1.18.0, and verify that the expected rain asset bucket exists within their own account. Users who do not use the pkg or deploy commands are not affected by this issue. Users who supply the optional s3-bucket argument to those commands are not affected if the bucket they specify is in their account.

What's Changed

Full Changelog: aws-cloudformation/rain@v1.17.0...v1.18.0

v1.17.0

What's Changed

Full Changelog: aws-cloudformation/rain@v1.16.1...v1.17.0

Commits
  • efb944c Merge pull request #579 from ericzbeard/v-1-19-0
  • de297fa Version bump
  • 7cbaaab Merge pull request #577 from ericzbeard/fix-572
  • d6fcc5d Merge pull request #578 from ericzbeard/fix-528
  • 6fd9379 Add s3 bucket params to stackset command
  • 3c3912c Merge pull request #576 from ericzbeard/fix-573
  • baf9606 Remove debug from test
  • 2a3eeec Fix bugs in Constants an Sub processing
  • ec89c77 Allow overriding the expected bucket owner
  • f7b0612 Merge pull request #574 from ericzbeard/fixmerge
  • Additional commits viewable in compare view

Updates github.com/hashicorp/hcl/v2 from 2.22.0 to 2.23.0

Release notes

Sourced from github.com/hashicorp/hcl/v2's releases.

v2.23.0

What's Changed

Full Changelog: hashicorp/hcl@v2.22.0...v2.23.0

Changelog

Sourced from github.com/hashicorp/hcl/v2's changelog.

v2.23.0 (November 15, 2024)

Bugs Fixed

  • Preserve marks when traversing through unknown values. (#699)
  • Retain marks through conditional and for expressions. (#710)
Commits
  • 56a9aee Merge pull request #710 from hashicorp/jbardin/marked-conditions
  • b48ba6e pass marks through unknown ForExpr values
  • bbfec2d pass all marks through conditional expressions
  • d20d07f github: Pin action refs to latest trusted by TSCCR (#700)
  • 3883feb docs(ext/dynblock): recursive function call typo in detecting variables (#686)
  • 2eb163f Merge pull request #701 from hashicorp/d/fix-typo
  • 65971e8 docs: use 'by' instead of 'prior to'
  • 1dfc778 docs: fix typo
  • 78fe993 Merge pull request #699 from hashicorp/jbardin/marked-traversals
  • e2f43f4 Preserve marks when traversing unknown values
  • See full diff in compare view

Updates github.com/owenrumney/squealer from 1.2.4 to 1.2.5

Release notes

Sourced from github.com/owenrumney/squealer's releases.

v1.2.5

What's Changed

New Contributors

Full Changelog: owenrumney/squealer@v1.2.4...v1.2.5

Commits
  • 07378a3 chore: use os.MkdirTemp instead of ioutil.TempDir (#123)
  • d542ff9 chore(deps): bump alpine from 3.20.2 to 3.20.3 (#121)
  • 8e508d2 chore(deps): bump github.com/go-git/go-billy/v5 from 5.5.0 to 5.6.0 (#122)
  • See full diff in compare view

Updates github.com/stretchr/testify from 1.9.0 to 1.10.0

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.10.0

What's Changed

Functional Changes

Fixes

Documantation, Build & CI

New Contributors

... (truncated)

Commits
  • 89cbdd9 Merge pull request #1626 from arjun-1/fix-functional-options-diff-indirect-calls
  • 07bac60 Merge pull request #1667 from sikehish/flaky
  • 716de8d Increase timeouts in Test_Mock_Called_blocks to reduce flakiness in CI
  • 118fb83 NotSame should fail if args are not pointers #1661 (#1664)
  • 7d99b2b attempt 2
  • 05f87c0 more similar
  • ea7129e better fmt
  • a1b9c9e Merge pull request #1663 from ybrustin/master
  • 8302de9 Merge branch 'master' into master
  • 89352f7 Merge pull request #1518 from hendrywiranto/adjust-readme-remove-v2
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the common group with 4 updates: [github.com/aws-cloudformation/rain](https://github.com/aws-cloudformation/rain), [github.com/hashicorp/hcl/v2](https://github.com/hashicorp/hcl), [github.com/owenrumney/squealer](https://github.com/owenrumney/squealer) and [github.com/stretchr/testify](https://github.com/stretchr/testify).


Updates `github.com/aws-cloudformation/rain` from 1.16.1 to 1.19.0
- [Release notes](https://github.com/aws-cloudformation/rain/releases)
- [Commits](aws-cloudformation/rain@v1.16.1...v1.19.0)

Updates `github.com/hashicorp/hcl/v2` from 2.22.0 to 2.23.0
- [Release notes](https://github.com/hashicorp/hcl/releases)
- [Changelog](https://github.com/hashicorp/hcl/blob/main/CHANGELOG.md)
- [Commits](hashicorp/hcl@v2.22.0...v2.23.0)

Updates `github.com/owenrumney/squealer` from 1.2.4 to 1.2.5
- [Release notes](https://github.com/owenrumney/squealer/releases)
- [Changelog](https://github.com/owenrumney/squealer/blob/main/.goreleaser.yml)
- [Commits](owenrumney/squealer@v1.2.4...v1.2.5)

Updates `github.com/stretchr/testify` from 1.9.0 to 1.10.0
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](stretchr/testify@v1.9.0...v1.10.0)

---
updated-dependencies:
- dependency-name: github.com/aws-cloudformation/rain
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: common
- dependency-name: github.com/hashicorp/hcl/v2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: common
- dependency-name: github.com/owenrumney/squealer
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: common
- dependency-name: github.com/stretchr/testify
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: common
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot requested a review from simar7 as a code owner November 25, 2024 15:53
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Nov 25, 2024
@simar7 simar7 added this pull request to the merge queue Nov 27, 2024
Merged via the queue into main with commit 291efa8 Nov 27, 2024
5 checks passed
@dependabot dependabot bot deleted the dependabot/go_modules/common-84d30e5f22 branch November 27, 2024 02:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file go Pull requests that update Go code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants